لقد تم اكتشاف فايروس جديد والذي إلى الآن لا يعرف مكان مصدره , وهو مايسمى ب W32/Netsky.s@MM , ويتوقع من هذا الفايروس حسب المصدر بأنه متوسط الفعاليه .

اسم الفايروس : W32/Netsky.s@MM
فعاليته : Medium
تاريخ توقع انتشاره : 4/5/2004م
المصدر : Unknown
نوعه : Internet Worm
بالاضافه إلى انه E-mail worm

الامتدادات التي سوف تصل عبر الايميل حامله هذا الفيروس هي :
.adb
.asp
.cfg
.cgi
.dbx
.dhtm
.doc
.eml
.htm
.html
.jsp
.mbx
.mdx
.mht
.mmf
.msg
.nch
.ods
.oft
.php
.pl
.ppt
.rtf
.sht
.shtm
.stm
.tbb
.txt
.uin
.vbs
.wsh
.wab
.xls
.xml

والميميل يأتي بعنوان:
Hello!
Hi!
Re: Important
Important
Re: My details
My details
Re: Your information
Your information
Re: Your details
Your details
Re: Your
Your
Re: Request
Request
Re: Thanks you!
Thank you!
Re: Approved
Approved
Re: Hello
Re: Hi
Hello
Hi

والمرفقات تأتي بأسم :
account
postcard
sample
developement
concept
story
report
icq_number
e-mail
phone_number
personal_message
photo_
order
important_
diggest
final_version
release
answer
bill
notice
requested_
deion
summary
picture_
movie_
approved_
old_

mail
letter
homepage
detailed_
powerpoint_
excel_
word_
info
information

new_
file
user_list
improved_file
secound_
file
number_list
contact_list
message
note
improved_
details
instructions
presentation_
abuse_list
archive
corrected_
list
approved_file

مثل هذي الصوره الموضحه :

واذا زرع الفيروس نفسه يأتي بالامتدادات التالية:
في الوندوز : %WinDir%\EASYAV.EXE
في الرجستري : HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion
\Run "EasyAV" = %WinDir%\EASYAV.EXE

وتحذير اخر : احد هذي الآيبيات يتوقع ان يصدر من اجهزتها وهي :
212.44.160.8
195.185.185.195
151.189.13.35
213.191.74.19
193.189.244.205
145.253.2.171
193.141.40.42
194.25.2.134
194.25.2.133
194.25.2.132
194.25.2.131
193.193.158.10
212.7.128.165
212.7.128.162
193.193.144.12
217.5.97.137
195.20.224.234
194.25.2.130
194.25.2.129
212.185.252.136
212.185.253.70
212.185.252.73

Worm.Bagle.y

04/27/2004 12:49, GMT +03:00, Moscow

Danger: moderate risk
Kaspersky Labs has detected I-Worm.Bagle.y, a new version of the Internet worm Bagle. The worm spreads as an attachment to emails, and also via local and file-sharing networks.

لقد تم اكتشاف فايروس جديد بأسم I-Worm.Bagle.y , ويعتمد على الانترنت في انشاره كالعاده , والفايروس في اغلب الاوقات يأتي كمرفقات في الايميل او يدخل عبر الشبكات العنكبوتية .

وهنا المقال كاملا :


I-Worm.Bagle.y
[ 04/27/2004 12:49, GMT +03:00, Moscow ]
Danger : moderate risk

Kaspersky Labs has detected I-Worm.Bagle.y, a new version of the Internet worm Bagle. The worm spreads as an attachment to emails, and also via local and file-sharing networks.


The message header, message and name and extension of the attached file varies. The body of the worm may be in unpacked form, or in a password protected archive. In the second case, the password will be shown in an image attached to the message. The message attachment may not contain the worm itself, but a dropper written in Visual Basic (a file with the extension .vbs). This dropper component will install the worm onto the victim system.

When the file containing the worm is launched, a fake dialogue box, "Can't find a viewer associated with this file", is displayed on screen. The program then writes itself to the system registry in order to autorun, and starts replicating.

The body of the worm contains the following message from the worm's author:

UNIQUE PEOPLE MAKE UNIQUE THINGS
THAT THINGS STAY BEYOND THE NORMAL LIFE AND COMMON UNDERSTANDING
THE PROBLEM IS THAT PEOPLE DON'T UNDERSTAND SUCH WILD THINGS,
LIKE A MAN DID NEVER UNDERSTAND THE WILD LIFE
-- Author of Bagle
I-Worm.Bagle.y is currently being analysed, and a full deion will be available in the Virus Encyclopaedia in the near future.

***ملاحظه: يجب تحديث برامج الحماية update it now !!! النورتون + المكافي + البيسي سلين ... الخ