D**n those f***ing China! *joke* :P

This is new varian for Microsoft.vbs virus which I write formula how to clean it around a month ago when it hit my cybercafe until totally broken he he… Now most people know this virus as ARP virus.  Why? Because after learning it more deeply this virus categorized as HIGH RISK and should removed as soon as possible before it infected total your network.

First.. To know this virus is active on your computer is  you will get most error pages  message when browsing, or error when using messenger, PLUS you will find this file Microsoft.vbs Microsoft.bat Microsoft.pif on your hard drive where you install your OS PLUS *again* your computer gonna be slow PLUS *oh not again* Your internet connectivity will going slow than usually PLUS *OMG* It will flooding your network until some billing(via TCP/IP) will stop responding.

It’s hard to know when your computer infected because it’s only showing a little error when you browsing and sometimes it’s not active (like clean computer) until you idle for some minutes/hour.

arp-spoofing-1.jpg

When you browsing you don’t feel something goes wrong… but when you look on the page source the evil is waiting on there :D

arp-spoofing-3.jpg

Clean page source from google.com not injected with any code.. but wait when virus active you will look something like this..

arp-spoofing-2.jpg

Holy s**t what is that!!! :P

So the answer is virus going active when you’re using internet by browsing or chat on messenger. Basically all internet explorer activity can bring this virus active! Enough let’s remove this virus permanently and stop it from coming back.

You can use Colasoft MAC Scanner (shareware) to scan your network, If you found there is mac address same with your gateway then you have to unplug that computer from network and clean it before you put it back on network. Why? In condition when you clean infected one virus will going to spread on other computer in your network once you clean it, it will calling back file from other infected one in your network so don’t waste your time for this stupid thing UNPLUG IT to stop it spreading in network!

arp-spoofing-4.jpg

Now.. Get Security Task Manager and delete/remove strange process on your computer background (usually with IE icon and dll files) delete/remove Desktopwin.dll/Jview.dll and ThunderAdvise.dll delete/remove AppInit_DLLs.

Done.. Now get hijackthis and restore your hosts file by Open the Misc Tools section, on System tools choose Open hosts file manager and deleted all line after 127.0.0.1 localhost or you can done this using notepad hosts file is on %systemroot%/system32/drivers/etc

Now get ATF Cleaner  and deleted all cookies, history and java cache.

Repair your registry to back in normal by using this code:

 [Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, AppInit_DLLs,0, “”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Object

[del]
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, ThunderAdvise
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, DesktopWin

Or download repair.inf

To stop virus coming back from other computer disable default share  by using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, SYSTEM\CurrentControlSet\Services\lanmanserver\parameters, AutoShareWks,0×00010001,0
HKLM, SYSTEM\CurrentControlSet\Services\lanmanserver\parameters, AutoShareServer,0×00010001,0

Or download disable-default-share.inf and activate it restart-net-service.bat

Disable autorun to stop virus coming back from USB flashdisk/removable mediaby using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255

Or download disable-autoplay.inf

To stop virus from coming back by replacing old files let’s make dummy files download dummy.bat!

Last scan with your BEST antivirus/antimalware to make sure your system clean! Another trick to stop virus from infected back your computer you can add static entry on ARP by write in command prompt “arp –s *gatewayipaddress* *gatewaymacaddress*” or another trick say we can blocked those d**n virus site by change it in hosts file here is some website list detected as virus update:

972.aksjd11.com
w3og.cn
qazc.fourtw.cn
www.aujoy.cn
www.hao601.cn
www.psp476.cn
222.1212l112.net
444.1212l112.net
555.1212l112.net
111.1212l112.net
root.51113.com
hk.www404.cn
err.www404.cn
(Still there a lot out there.. BLOCKING ALL .cn domain might resolve this problem ha ha ha :P)

Anyway this method is not really can stop virus updated as long the creator change website again we have to update block it manually.

Done (finally)… now using your computer like usually for 1-2 hours and see if the virus coming back.. :D

Similar Posts:

    Digg Del.icio.us StumbleUpon Reddit Twitter RSS

PENGERTIAN SPOOFING, setting anti arp spoofing mikrotik, cara mengatasi does name exist, Tutorial membuat plood web via hp, blok sality di mikrotik, Cara mengatur jaringan hdsp pada laptop, antiarp bat, serang ip dengan cmd, time scheduler in winbox, kegunaan arp, mikrotik arp flooding, Cara flood web pakai hp, free download anti spoofing windows xp, cara blok ip dengan anti arp, setting mikrotik anti spoofing, cara drop virus arp spoofing di mikrotik, arti arp spoofing, arp spoofing mikrotik, cara mengatasi virus arp, CARA MENYEMBUNYIKAN IP, pengertian mikrotik, mikrotik arp spoofing, carainjectvirus, mengatasi-ip-spoofing-pada-mikrotik, anti arp di mikrotik, kode flood, Anti ARP VER 6 O2, cara mengatasi arp spoorfing, pengertian arp, menyembunyikan ip address dengan cmd, pengertian arp spoofing, tips pembersihan virus arp spoofing, mikrotik sality, mikrotik anti arp spoofing, fungsi arp poisoning, mikrotik anti fix ip, MIKROTIK anti mac spoofing, mikrotik anti spoofing, microtek protect from spoof, mikrotik boot scripts, mikrotik stop virus flooding, mikrotik prevent arp spoofing, mikrotik port virus sality, mikrotik disable arp, mikrotik blocking cn, mikrotik blocking arp poisoning, mikrotik block china domain, mikrotik block arping, mikrotik block arp broadcast, mikrotik block arp attac, mikrotik arp virus removal tool, merakit jaringan warlles dengan manual mengunakan windows 7, membuat virus trojan vbscript, membuat trojan dengan vbscript, membuat ip flooding, membuat aplikasi penangkal arp poison, memblokir virus arp, membersihkan arpvirus di mikrotik, melihat trafik virus pada mikrotik, melepaskan jaringan dari mikrotik, manual mikrotik anti spoofing, mac spoofing mikrotik, kegunaan spoofing di ubuntu, kegunaan spofing di ubuntu, kegunaan antiARP, jaringan microsoft window xp 2011, mencegah arp spoofing di mikrotik, mencegah flood di mikrotik, menyembunyikan scan winbox, menyembunyikan hostname ipscan, mengilangkan flood mikrotik, menghilangkan geniu di windos xp sp3, menghapus ip di mikrotik, menghapus host otomatis mikrotik, mengatur jaringan dalam cmd, mengatasi virus code block, mengatasi virus arp spoofing di mikrotik, mengatasi nge-fload mikrotik, mengatasi billing error terkena firus, mengatasi arp position, mencegah virus yang menduplikasi mac address, mencegah flooding di mikrotik, ip scanner vbs bat, winbox sharing internet dengan mac address, spoof ip in winbox, spofing mikrotik, source code java program anti arp, source code html code injection dengan vbscript, source code for Spoofing in vb net, software penangkal arp poisoning, setting sharing jaringan menggunakan windows 7, setting arp poisoning mikrotik dengan winbox, sembunyikan mac address windows 7, sembunyikan IP Adress, script mikrotik anti spoof, script anti flood mikrotik, script anti arp mikrotik, Spoofing, spoofing dan flooding pengertian, what is arp list winbox, virus XP Duplicate name in network, virus sality mikrotik, virus jaringan dengan nembak ip address, virus cara mengatasi ip address conflict, virus arp windows 7, virus arp spoofing mikrotik, vb6 source code arp spoof -freelancer -softwaretopic, vb net arp posion, trik sms sembunyikan nomor, tips mengetahui flood mikrotik, stop mac spoofing in mikrotik, spoofing mikrotik, scheduler static arp di mikrotik, sality dengan mikrotik, put virus o mikrotik, pengertian interface pada java, pengertian Idle, pengertian host name, pengertian flooding, pengertian floodiing, pengertian clearing ARP, pengertian cara membuat jaringan wireles, pengertian blok, pengertian blocking, pengertian block, pengertian anti arp, pengerian arp wifi, penangkal ARP dengan notepad, Pengertian jaringan nirkabel spoofing took online download dan upload, pengertian sality virus, proteksi virus mikrotik, protect mikrotik from arp spoof, program penangkal spoof, program bank pake vb, prevent arp spoof by mikrotik, port 38768, pengertian winbox, pengertian virus spoofing, pengertian virus sality, pengertian spoofing jaringan wireless, Pengertian spoofing dan flooding dalam jaringan, pengertian spoofing dan flooding, Pengertian sofhwer, mikrotik tr content uploads 2008 winbox firewall log drop 7, cara menangani arp spoofing di mikrotik, blokir web facebook pakek mikrotik, blokir port virus sality di mikrotik, bloking arp poisioning/spoffing di jaringan wifi, blok virus sality lewat mikrotik, blok ip spoofing di mikrotik, block trojan dengan miktoik, block arp poisoning mikrotik, block arp flooding mikrotik, best antivirus for anti arp spoofing, arti logo mikrotik, arti dan pengertian spoofing, arti ARP pada tcp/ip, arpspoof mikrotik, cara benerin idm time out, cara bikin link flood web pakai vbs, cara bikin web flood, cara membuat bingkai di cmd, cara memblokir win32 worm downadup gen di mikrotik, cara memblock internet positif, cara memakai arp-scan di ubuntu, cara masuk jaringan bank BCA, cara flood komputer lain pada jarigan wireles, cara disble arp pada mikrotik, cara blokir client instal idm melalui cmd, cara blok worm di mikrotik, cara blok trafik virus di mikrotik via winbox, cara blok jaringan kantor, cara blok internet kantor, cara blocking via cmd, arp spoofing with vb net, ARP Spoofing virus download, arp spoofing using vb net, anti spoofing mikrotik, anti poisoning mikrotik, anti flooding mikrotik, anti flood untuk mikrotik, anti flood mikrotik, anti conficker mikrotik, anti change macaddress mikrotik, anti arp spoofing mikrotik, anti arp spoofing, anti arp spoof mikrotik, anti arp source code java, anti arp server java, anti arp mikrotik, antispoofing for mikrotik, apa kegunaan program file sharing manager, aplikasi anti arp wifi di ubuntu, arp spoofing code implementation in batch, ARP Spoofing cmd, arp spoofing 소스 vb, arp spoofer in vb, ARP scan vbs, arp poisoning vbs, arp poisoning vb

If you're new here, you may want to subscribe to my RSS feed. You may copy or publish this article to your blog or other site as long you give credit link back to this site article. Thanks for visiting my blog!