|
Re: كل عام بخير .......واحذروا هذا العنوان ورسائله وفائلاته (Re: yasiko)
|
I received four of these viruses, with different addresses and different subjects, also the text is variable, the result is always the same: Never open a mail from someone you dont know Never open an attachment, specially if you dont know the sender, with the following extensions: .exe, .bat, .com, .scr, etc, even if they pretended to be a photo, e.g. xxxxxxx.jpg.exe this is an exe file and not a photo Never reply to such a mail, just delete and forget..
Happy new year..
| |
|
|
|
|
|
|
Re: كل عام بخير .......واحذروا هذا العنوان ورسائله وفائلاته (Re: yasiko)
|
والله ياجماعة الشئ دا ضربنا كلنا .. المرة دي جاء باسلوب مختلف ..وطبعا زي ما عارفين الفايروس دا من سلسة فايروسات الدودة الحمراء .. غايتو شركة مايكافي بتقديم حلول بس بقرووش ودي الرسالة حقتهم Mcafee give you the special W32.Klez.E removal tools W32.Klez.E is a special dangerous virus that spread through email.
For more information,please visit http://www.Mcafee.com المهم الناس الما ضربهم الفايروس مفروض يعملوا الاتي :- 1- ما يفتحوا اي رسالة تحتوي على ملفين مرفقين .. ومن شخص ما متعود او متوقع استلام رسالة منه 2- اي رساله بحجم 45-46-47-48 لالالالالالاتفتحها ا ودي بعض مواصفات الفايروس دا .. وياريت الشباب المتخصصين يلقوا لينا حل المواصفات الفنية للفيروس
عند تشغيل فيروس ياماها اول شي يقوم بنسخ نفسه في في ملفات مخفية بهذه الاسماء والامكان C:\%System%\WinServices.exe. C:\%System%\Nav32_loader.exe C:\%System%\Tcpsvs32.exe
يقوم بتحديد مكان مجلد الوندوز وينسخ نفسه في هذه الموقع بصفة ثابته وذلك حسب اصدار الوندوز NOTE: %System% is a variable. The worm locates the Windows system folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows 2000/NT/), or C:\Windows\System32 (Windows XP).
يقوم بعمل صيغة وقانون في الرجستري بالقيمة التالية WinServices.exe C:\%System%\WinServices.exe
وفي الرجستري في هذه المواقع
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
وبذلك يقوم الفيروس بتشغيل نفسه كل مرة تقوم بتشغيل الجهاز فيها
يقوم الفيروس باعداد نفسه ليقوم بتشغيل نفسه كل مرة على اساس انه ملف تطبيقي وذلك بتغير قيمته الخاصة في الرجستري HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command to C:\%System%\WinServices.exe"%1 %*
وقد يقوم الفيروس بنسخ نفسه في مجلد \Windows\System بهذه الاسماء Hotmail_hack.exe Friendship.scr World_of_friendship.scr Shake.scr Sweet.scr Be_happy.scr Friend_finder.exe I_like_you.scr Love.scr Dance.scr Gc_messenger.exe True_love.scr Friend_happy.scr Best_friend.scr Life.scr Colour_of_life.scr Friendship_funny.scr Funny.scr
يقوم الفيروس باغلاق ملفات مكافحة الفيروسات والحماية وذلك بعمل قانون لها يمنعها من ايقاف اي ملف يحمل اي من الاسماء التالية REGEDIT ACKWIN32 F-AGNT95 SWEEP95 VET95 N32SCANW _AVPM LOCKDOWNADVANCED NSPLUGIN NSCHEDNT NRESQ32 NPSSVC NOD32 _AVPCC _AVP32 NORTON NVC95 FP-WIN IOMON98 PCCWIN98 F-PROT95 F-STOPW PVIEW95 NAVWNT NAVRUNR NAVLU32 NAVAPSVC NISUM SYMPROXYSVC RESCUE32 NISSERV VSECOMR VETTRAY TDS2-NT TDS2-98 SCAN32 PCFWALLICON NSCHED32 IAMSERV.EXE FRW.EXE MCAFEE ATRACK IAMAPP LUCOMSERVER LUALL NMAIN NAVW32 NAVAPW32 VSSTAT VSHWIN32 AVSYNMGR AVCONSOL WEBTRAP POP3TRAP PCCMAIN PCCIOMON ESAFE.EXE AVPM.EXE AVPCC.EXE AMON.EXE ALERTSVC ZONEALARM AVP32 LOCKDOWN2000 AVP.EXE CFINET32 CFINET ICMON RMVTRJANSAFEWEB WEBSCANX PVIEW ANTIVIR
المواصفات الخاصة بالايميل يقوم الفيروس باستخدام ملقمات البريد الوارد والصادر الخاصة به وذلك ليقوم بارسال نفسه لكل ايميل موجود في ملف الايميلات بنظام التشغيل وندوز او في المسنجر هوت ميل والياهو بيجر وكل الملفات التي تحمل في الاكستنشن الحرفين اتش وتي ويحمل الفيروس اكثر من ملقم بريد وارد وصادر يمكنه استخدامها وذلك ببرمجة عبقرية تم بها صنع هذا الفيروس
عنوان رسالة الفيروس عادة تكون Are you the BEST Free Win32 API source Learn SQL 4 Free I Love You.. Wanna be like a stone ? Are you a Soccer Fan ? Sexy Screensavers 4 U Check it out Sample Playboy Hardcore Screensavers 4 U XXX Screensavers 4 U We want peace Wanna be a HE-MAN Visit us One Virus Writer's Story One Hacker's Love World Tour Whats up Wanna be my sweetheart ?? Screensavers from Club Jenna Jenna 4 U Free rAVs Screensavers Feel the fragrance of Love Wanna Hack ?? Sample KOF 2002 The King of KOF Wanna Brawl ?? Wanna Rumble ?? Play KOF 2002 4 Free Demo KOF 2002 Free Demo Game Wanna be friends ?? Need money ?? Are you beautiful Who is your Valentine Free Screenavers of Love Free XXX Free Screensavers WWE Screensavers Freak Out Wanna be friends ? Things to note Lovers Corner Patch for Elkern.gen Patch for Klez.H Free Screensavers 4 U Project Sample Screensavers Are you in Love I am in Love I Love You You are so sweet The Hotmail Hack U realy Want this to ur lovers to ur friends Find a good friend Learn How To Love Are you looking for Love Wowwwwwwwwwww check it Check ur friends Circle The world of Friendship Shake it baby How sweet this Screen saver war Againest Loneliness Need a friend? Say 'I Like You' To ur friend love speaks from the heart Let's Dance and forget pains Looking for Friendship True Love make ur friend happy Who is ur Best Friend hey check it yaar Check this #### Hello Hi
وتحتوي الرسالة عادة على هذه المواضيع hey, did u always dreamnt of hacking ur friends hotmail account.. finally i got a hotmail hack from the internet that really works.. ur my best friend thats why sending to u.. check it..just run it..enter victim's address and u will get the pass. hi, check the attached love screensaver and feel the fragrance of true love.. Hi, check the attached screensaver.. its really wonderfool.. i got it from freescreensavers.com
Hi, check ur friends circle using the attached friendship screensaver.. check the attached screensaver and if u like it send it to all those you consider to be true friends... if it comes back to you then you will know that you have a circle of friends..
Hi, check the attached screensaver and enjoy the world of friendship.. Hi, are u in a rocking mood... check the attached scrennsaver and start shaking..
Hi, Check the attached screensaver..
Hi, Are you lonely ??.. check the attached screensaver and forget the pain of loneliness
Hi, Looking for online pals.. check the attached friend finder software..
Hi, sending you a screensaver.. check it and let me know how it is...
Hi, Check the attached screensaver and feel the fragrance of true love...
Hey, I just got this wonderfull screensaver from freescreensaver.com.. Just check it out and let me know how it is.. I just came across it.. check out.. ===================================================================== Are you one of those unfortunate human beings who are desperately looking for friends.. but still not getting true friends with whom you can share your everything..
anyway you wont feel down any more cause GC Chat Network has brought up a global chat and online match making system using its own GC Messenger. Attached is the fully functional free version of GC Instant Messenger and Match Making client.. Just install, register an account with us and find thousands of online pals all over the world.. You can also search for friends by specific country,city,region etc.
Regards Admin, GC Global Chat Network System..
Hi, So you think you are in love.. is it true love ? you may think right now that you are in true love but it is certainly possible that it is nothing but a mere infatuation to you..
anyway to know yourself better than you have ever known check the attached screensaver and feel the fragrance of true love..
Hey pal, you know friendship is like a business... to get something you need to give something.. though its not that harsh as business but to get love and care from your friends you need to give love,care and respect to your friends.. right {BR> check the attached screensaver and you will learn how to make your friends happy..
Hi, Its quite obvious that in our life we have numerous friends but.. BUT Best Friend can only be ONE.. right {BR>so can you decide who is your best friend {BR>i guess not.. cause mostly you will find that your best friend wont care about u like somebody else..
anyway i found one way to find who is my best friend.. check it.. just check the attached screensaver.. answer some questions in it and also ask your best friend to answer the questions..
..then you will know more about him.. Hey pal, wanna have some fun in life... {BR>feel like life is too boring and monotonous.. check the attached screensaver and bring colours to your black & white life.. Hi, I just came across this funny screensaver.. sending it to u.. hope u like it.. check out and die laughing.. <>>>>><>>>>><>>>>><>>>>><>>>>><>>>>>
This E-Mail is never sent unsolicited. If you receive this E-Mail then it is because you have subscribed to the official newsletter at the KOF ONLINE website.
King Of Fighters is one of the greatest action game ever made. Now after the mind boggling sucess of KOF 2001 SNK proudly presents to you KOF 2002 with 4 new charecters. Even though we need no publicity for our product but this time we have decided to give away a fully functional trial version of KOF 2002. So check out the attached trial version of KOF 2002 and register at our official website to get a free copy of KOF2002 original version
Best Regards, Admin,KOF ONLINE..
<>>>>><>>>>><>>>>><>>>>><>>>>><>>>>> Hello, I just came across your email ID while searching in the Yahoo profiles. Actually I want a true friend 4 life with whom I can share my everything. So if you are interested in being my friend 4 life then mail me.
If you wanna know about me, attached is my profile along with some of my pics. You can check and if you like it then do mail me. I will be waiting for your mail.
Best Wishes, Your Friend.. Hello, Looking for some Hardcore mind boggling action ? Install the attached browser software and browse across millions of paid hardcore ####### sites for free. Using the software you can safely and easily browse across most of the hardcore XXX paid sites across the internet for free. Using it you can also clean all traces of your web browsing from your computer.
Note:The attached browser software is made exclusivley for demo only. You can use the software for a limited time of 35 days after which you have to register it at our official website for its furthur use.
Regards, Admin. Klez.H is the most common world-wide spreading worm.It's very dangerous by corrupting your files. Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it. We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once,and then Klez will never come into your PC Hello, The attached product is send as a part of our official campaign for the popularity of our product. You have been chosen to try a free fully functional sample of our product.If you are satified then you can send it to your friends. All you have to do is to install the software and register an account with us using the links provided in the software. Then send this software to your friends using your account ID and for each person who registers with us through your account, we will pay you $1.5.Once your account reaches the limit of $50, your payment will be send to your registration address by check or draft. Please note that the registration process is completely free which means by participating in this program you will only gain without loosing anything.
Best Regards, Admin
والملفات المرفقة لهذا الفيروس عادة تكون بهذه المسميات والامتدادات The_Best.scr Codeproject.scr SQL_4_Free.scr I_Love_You.scr Stone.scr #######.scrSoccer.scr Real.scr Plus6.scr Plus2.scr Playboy.scr Hardcore4Free.scr xxx4Free.scr Screensavers.scr Peace.scr Body_Building.scr Services.scr VXer_The_LoveStory.scr Hacker_The_LoveStory.scr World_Tour.scr up_life.scr Sweetheart.scr Sexy_Jenna.scr Jenna_Jemson.scr zDenka.scr Ravs.scr Free_Love_Screensavers.scr Romeo_Juliet.scr Hacker.scr KOF_Fighting.exe KOF_Sample.exe KOF_Demo.exe KOF_The_Game.exe KOF2002.exe King_of_Figthers.exe KOF.exe My_Sexy_Pic.scr MyProfile.scr Ways_To_Earn_Money.exe Beautifull.scr Valentines_Day.scr zXXX_BROWSER.exe Britney_Sample.scr THEROCK.scr FreakOut.exe MyPic.scr Notes.exe Cupid.scr FixElkern.com FixKlez.com Romantic.scr Project.exe Love.scr friendship_funny.scr Colour_of_life.scr Life.scr Best_friend.scr Friend_happy.scr True_love.scr Gc_messenger_exe Dance.scr I_like_you.scr Friend_finder_exe Be_happy.scr Sweet.scr Shake.scr World_of_friendship.scr Friendship.scr Funny.scr Hotmail_hack_exe.scr
وعادة يكون اسم المرسل بهذه المسميات Klein Anderson Codeproject SQL Library me2K Rocking Stone Super Soccer Sexy Screensavers Real Inc. Plus 6 Plus 2 Playboy Inc. Hardcore Screensavers XXX Screensavers Nomadic Screensavers Keanu Stevenson Nicolas Schwarzeneggar [email protected]
| |
|
|
|
|
|
|
Re: كل عام بخير .......واحذروا هذا العنوان ورسائله وفائلاته (Re: yasiko)
|
To obtain and run the tool
NOTE: You must have administrative rights to run this tool on Windows NT 4.0, Windows 2000, or Windows XP.
1. Download the FixYaha.com file from:
http://securityresponse.symantec.com/avcenter/FixYaha.com
2. Save the file to a convenient location, such as your downloads folder or the Windows desktop (or removable media that is known to be uninfected, if possible). 3. To check the authenticity of the digital signature, refer to the section The digital signature. 4. Close all running programs before running the tool. 5. If you are on a network or you have a full-time connection to the Internet, disconnect the computer from the network and the Internet. 6. If you are running Windows Me or XP, then disable System Restore. Please refer to the section System Restore option in Windows Me/XP for additional details.
CAUTION: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.
7. Double-click the FixYaha.com file to start the removal tool. 8. Click Start to begin the process, and then allow the tool to run. 9. Restart the computer. 10. Run the removal tool again to ensure that the system is clean. 11. If you are running Windows Me/XP, then re-enable System Restore. 12. Run LiveUpdate to make sure that you are using the most current virus definitions.
NOTE: The removal procedure might be unsuccessful if Windows Me/XP System Restore is not disabled as previously directed because Windows prevents System Restore from being modified by outside programs. Because of this, the removal tool might fail.
When the tool has finished running, you will see a message indicating whether the computer was infected by W32.Yaha.E@mm/W32.Yaha.F@mm/W32.Yaha.K@mm. In the case of a removal of the worm, the program displays the following results: The total number of the scanned files. The number of deleted files. The number of repaired files. The number of viral processes terminated. The number of registry entries fixed.
The digital signature FixYaha.com is digitally signed. Symantec recommends that you only use copies of FixYaha.com that have been downloaded directly from the Symantec Security Response download site. To check the authenticity of the digital signature, follow these steps: 1. Go to http://www.wmsoftware.com/free.htm 2. Download and save the chktrust.exe file to the same folder where you saved FixYaha.com (for example, C:\Downloads). 3. Depending on your operating system, do one of the following: Click Start, point to Programs, and click MS-DOS Prompt. Click Start, point to Programs, click Accessories, and then click Command Prompt. 4. Change to the folder where FixYaha.com and Chktrust.exe are stored, and then type:
chktrust -i FixYaha.com
For example, if you saved the file to the C:\Downloads folder, you would enter the following commands:
cd\ cd downloads chktrust -i FixYaha.com
Press Enter after typing each command. If the digital signature is valid, you will see the following:
Do you want to install and run "W32.Yaha Fix Tool" signed on 12/31/2002 10:46 AM and distributed by Symantec Corporation.
NOTES: The date and time that are displayed in this dialog box will be adjusted to your time zone if your computer is not set to the Pacific time zone. If you are using Daylight Saving time, the time that is displayed will be exactly one hour earlier. If this dialog box does not appear, there are two possible reasons: The tool is not from Symantec. Unless you are sure that the tool is legitimate, and that you downloaded it from the legitimate Symantec Web site, you should not run it. The tool is from Symantec, and is legitimate. However, your operating system was previously instructed to always trust content from Symantec. For information on this, and how to view the confirmation dialog again, read the document How to restore the Publisher Authenticity confirmation dialog box. 5. Click Yes to close the dialog box. 6. Type exit and then press Enter. This will close the MS-DOS session.
System Restore option in Windows Me/XP Windows Me and Windows XP users should temporarily turn off System Restore. This feature, which is enabled by default, is used by Windows Me/XP to restore files on your computer in case they become damaged. When a computer is infected with a virus, worm, or Trojan, it is possible that the virus, worm, or Trojan could be backed up by System Restore. By default, Windows prevents System Restore from being modified by outside programs. As a result, there is the possibility that you could accidentally restore an infected file, or that on-line scanners would detect the threat in that location. For instructions on how to turn off System Restore, read your Windows documentation or one of the following articles: How to disable or enable Windows Me System Restore. How to disable or enable Windows XP System Restore.
For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article Anti-Virus Tools Cannot Clean Infected Files in the _Restore Folder, Article ID: Q263455.
How to run the tool from a floppy disk 1. Insert the floppy disk that contains the FixYaha.com file in the floppy disk drive. 2. Click Start and then click Run. 3. Type the following and then click OK:
a:\fixyaha.com
NOTES: There are no spaces in the command a:\fixyaha.com. If you are using Windows Me, and the System Restore remains enabled, you will see a warning message. You can choose to run the removal tool with the System Restore option enabled or exit the removal tool. 4. Click Start to begin the process, and then allow the tool to run. 5. If you are using Windows Me, then reenable System Restore.
| |
|
|
|
|
|
|
Re: كل عام بخير .......واحذروا هذا العنوان ورسائله وفائلاته (Re: madani)
|
شكرا الاخ ياسيكو للتنبيه وشكرا الاخ ودمدنى للشرح والتوضيح
وحقيقة يا جماعة انا لا ادرى ماذا يستفيد اولئك من تدمير اجهزة الغير ؟؟؟ هل هنالك مصلحة ما يود هؤلاء الوصول اليها ام انه عبث ليس الا ؟؟
عموما كل الرسائل التى معها مرفقات بطلنا نفتحها خالص
لكم التحايا وكل عام وانتو بالف خير
| |
|
|
|
|
|
|
|