[TRLog] Last update

[Tom Hammond NØSS]

Folks:

Tree wrote:
> >I sent out 6.56 about 36 hours ago - and some people have reported
> >it had a  v i r u s.
> >Tree

Then W6CT asked:

 >Was this a separate file that got attached to the message
 >in addition to the zip file, or is it actually embedded
 >in the zip file?

IN the ZIP file... see below.

Since I may have been to source of the virus (actually a TROJAN virus, 
TROJ_HYBRIS.B), I'll tell you what I've found so far...

I've found NUMEROUS instances of this virus on my machine...! See below.

To see IF you are CURRENTLY infected, do a whole-drive search for ANY files 
with a .EX$ file extension. If you DO find any instances of this file 
extension. LOOK IN THE SAME FOLDER to see if you find a similarly-named 
file, BUT with a .EXE file extension. If you do, the file with the .EXE 
file extension IS the trojan!!!  DO NOT EXECUTE IT!!!!!

DELETE the .EXE file and RENAME the .EX$ file to the same filename but with 
a .EXE extension. This will fix THAT problem, but ONLY in THAT folder. 
There may be more...!

ADDITIONALLY... if you find our than one instance of a file with a .EX$ 
extension, this probably indicates that your PC has been INFECTED, rather 
than just merely having received a single infected file.

Note that the trojan file will normally be 23,040 bytes in length, although 
I found one instance where it was clearly present and NOT of this length.

In the case of the TRLOG v6.56 file, it contained a file named TR.EX$ _and_ 
a file (23,040 bytes in length) named TR.EXE.

If you attempt to RUN the TR.EXE (trojan) file, you will have 'installed' 
the virus onto your PC.

Once run, the trojan sends itself to others, using the addresses you use 
when you send out your e-mails. It does NOT accesses your address book, 
rather it looks at the addresses actually in the messages being sent and 
uses them. The address of the 'sending' party will usually show as having 
come from "Hahaha" <Hahaha@sexyfun.net> and will contain an attachment 
named midgets.SCR or midgets.EXE, either of which, ONCE THEY ARE RUN, will 
infect the recipient's PC.

Once infected, not only will the trojan effect your normal .EXE files, but 
it will also infect .EXE files WITHIN ZIP FILES as well. Usually only one 
.EXE file in each ZIP file, but EACH and EVERY ZIP file will have to be 
checked to confirm the presence of a file with the .EX$ extension. Fixing 
these files is not all that difficult, but it time-consuming.

Another possible way you may detect presence of this virus is to monitor 
significant MODEM activity during times when you are connected, but not 
expecting to have any... for instance, while you're reading your mail, all 
of a sudden there's a flurry of modem activity and your not supposed to be 
SENDIND _or_ RECEIVING data. THis may be a clue that somethine else is 
going on that you're not aware of. Although this is NOT necessarily an 
indication of infection, it may be worth checking out anyway.

Finally, IF you have been infected, you WILL have to REMOVE and REPLACE 
your (infected) WSOCK32.DLL with a new one. ALL of the WSOCK32.DLL files 
I've found around here were about 40kB to 45kB in size, and my infected 
WSOCK32.DLL file was about 65kB in size, however at least one correspondent 
tells me that HIS WSOCK32.DLL file seems to NOT be infected, but IS around 
65kB in size. Although I'm still a bit skeptical of this report, you should 
be aware of the possibility of the possible difference in sizes 
of  UNinfected files.

For more info about this virus, I direct your attention to:

     http://www.datafellows.fi/v-descs/hybris.htm

and for other viruses, try:  htp://www.datafellows.fi/v-descs/

There are other very good sources as well, I just happen to like the info 
this group provides.

73 - Tom Hammond   N0SS


--
FAQ on WWW:               http://www.contesting.com/FAQ/trlog
Submissions:              trlog@contesting.com
Administrative requests:  trlog-REQUEST@contesting.com
Problems:                 owner-trlog@contesting.com
Feature Wishlist:	  http://web.jzap.com/n6tr/trwish.html