D**n those f***ing China! *joke* :P

This is new varian for Microsoft.vbs virus which I write formula how to clean it around a month ago when it hit my cybercafe until totally broken he he… Now most people know this virus as ARP virus.  Why? Because after learning it more deeply this virus categorized as HIGH RISK and should removed as soon as possible before it infected total your network.

First.. To know this virus is active on your computer is  you will get most error pages  message when browsing, or error when using messenger, PLUS you will find this file Microsoft.vbs Microsoft.bat Microsoft.pif on your hard drive where you install your OS PLUS *again* your computer gonna be slow PLUS *oh not again* Your internet connectivity will going slow than usually PLUS *OMG* It will flooding your network until some billing(via TCP/IP) will stop responding.

It’s hard to know when your computer infected because it’s only showing a little error when you browsing and sometimes it’s not active (like clean computer) until you idle for some minutes/hour.

arp-spoofing-1.jpg

When you browsing you don’t feel something goes wrong… but when you look on the page source the evil is waiting on there :D

arp-spoofing-3.jpg

Clean page source from google.com not injected with any code.. but wait when virus active you will look something like this..

arp-spoofing-2.jpg

Holy s**t what is that!!! :P

So the answer is virus going active when you’re using internet by browsing or chat on messenger. Basically all internet explorer activity can bring this virus active! Enough let’s remove this virus permanently and stop it from coming back.

You can use Colasoft MAC Scanner (shareware) to scan your network, If you found there is mac address same with your gateway then you have to unplug that computer from network and clean it before you put it back on network. Why? In condition when you clean infected one virus will going to spread on other computer in your network once you clean it, it will calling back file from other infected one in your network so don’t waste your time for this stupid thing UNPLUG IT to stop it spreading in network!

arp-spoofing-4.jpg

Now.. Get Security Task Manager and delete/remove strange process on your computer background (usually with IE icon and dll files) delete/remove Desktopwin.dll/Jview.dll and ThunderAdvise.dll delete/remove AppInit_DLLs.

Done.. Now get hijackthis and restore your hosts file by Open the Misc Tools section, on System tools choose Open hosts file manager and deleted all line after 127.0.0.1 localhost or you can done this using notepad hosts file is on %systemroot%/system32/drivers/etc

Now get ATF Cleaner  and deleted all cookies, history and java cache.

Repair your registry to back in normal by using this code:

 [Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, AppInit_DLLs,0, “”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Object

[del]
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, ThunderAdvise
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, DesktopWin

Or download repair.inf

To stop virus coming back from other computer disable default share  by using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, SYSTEM\CurrentControlSet\Services\lanmanserver\parameters, AutoShareWks,0×00010001,0
HKLM, SYSTEM\CurrentControlSet\Services\lanmanserver\parameters, AutoShareServer,0×00010001,0

Or download disable-default-share.inf and activate it restart-net-service.bat

Disable autorun to stop virus coming back from USB flashdisk/removable mediaby using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255

Or download disable-autoplay.inf

To stop virus from coming back by replacing old files let’s make dummy files download dummy.bat!

Last scan with your BEST antivirus/antimalware to make sure your system clean! Another trick to stop virus from infected back your computer you can add static entry on ARP by write in command prompt “arp –s *gatewayipaddress* *gatewaymacaddress*” or another trick say we can blocked those d**n virus site by change it in hosts file here is some website list detected as virus update:

972.aksjd11.com
w3og.cn
qazc.fourtw.cn
www.aujoy.cn
www.hao601.cn
www.psp476.cn
222.1212l112.net
444.1212l112.net
555.1212l112.net
111.1212l112.net
root.51113.com
hk.www404.cn
err.www404.cn
(Still there a lot out there.. BLOCKING ALL .cn domain might resolve this problem ha ha ha :P)

Anyway this method is not really can stop virus updated as long the creator change website again we have to update block it manually.

Done (finally)… now using your computer like usually for 1-2 hours and see if the virus coming back.. :D

Similar Posts:

    Digg Del.icio.us StumbleUpon Reddit Twitter RSS

PENGERTIAN SPOOFING, setting anti arp spoofing mikrotik, cara mengatasi does name exist, blok sality di mikrotik, Tutorial membuat plood web via hp, serang ip dengan cmd, antiarp bat, time scheduler in winbox, Cara mengatur jaringan hdsp pada laptop, cara drop virus arp spoofing di mikrotik, mikrotik sality, arp spoofing mikrotik, mengatasi-ip-spoofing-pada-mikrotik, arti arp spoofing, mikrotik anti arp spoofing, carainjectvirus, menyembunyikan ip address dengan cmd, cara mengatasi arp spoorfing, pengertian arp, mikrotik arp flooding, cara blok ip dengan anti arp, pengertian arp spoofing, Cara flood web pakai hp, mikrotik arp spoofing, pengertian mikrotik, CARA MENYEMBUNYIKAN IP, setting mikrotik anti spoofing, tips pembersihan virus arp spoofing, anti arp di mikrotik, cara mengatasi virus arp, fungsi arp poisoning, Anti ARP VER 6 O2, kode flood, kegunaan arp, free download anti spoofing windows xp, menyembunyikan scan winbox, mikrotik block arp broadcast, mac spoofing mikrotik, membersihkan arpvirus di mikrotik, mikrotik block arp attac, melihat trafik virus pada mikrotik, mikrotik arp virus removal tool, manual mikrotik anti spoofing, mikrotik block arping, mikrotik block china domain, mikrotik stop virus flooding, jaringan microsoft window xp 2011, kegunaan antiARP, kegunaan spofing di ubuntu, kegunaan spoofing di ubuntu, mikrotik prevent arp spoofing, mikrotik port virus sality, melepaskan jaringan dari mikrotik, mikrotik boot scripts, mikrotik blocking cn, mikrotik blocking arp poisoning, mikrotik disable arp, memblokir virus arp, membuat virus trojan vbscript, mengatur jaringan dalam cmd, mengatasi virus code block, mengatasi virus arp spoofing di mikrotik, mengatasi nge-fload mikrotik, mencegah arp spoofing di mikrotik, mencegah flood di mikrotik, mencegah flooding di mikrotik, mengatasi billing error terkena firus, mengatasi arp position, menghapus host otomatis mikrotik, membuat trojan dengan vbscript, membuat ip flooding, mikrotik anti spoofing, MIKROTIK anti mac spoofing, mikrotik anti fix ip, menghapus ip di mikrotik, microtek protect from spoof, merakit jaringan warlles dengan manual mengunakan windows 7, membuat aplikasi penangkal arp poison, menyembunyikan hostname ipscan, mengilangkan flood mikrotik, menghilangkan geniu di windos xp sp3, mencegah virus yang menduplikasi mac address, mikrotik tr content uploads 2008 winbox firewall log drop 7, winbox sharing internet dengan mac address, spoof ip in winbox, spofing mikrotik, source code java program anti arp, source code html code injection dengan vbscript, source code for Spoofing in vb net, software penangkal arp poisoning, setting sharing jaringan menggunakan windows 7, setting arp poisoning mikrotik dengan winbox, sembunyikan mac address windows 7, sembunyikan IP Adress, script mikrotik anti spoof, script anti flood mikrotik, script anti arp mikrotik, Spoofing, spoofing dan flooding pengertian, what is arp list winbox, virus XP Duplicate name in network, virus sality mikrotik, virus jaringan dengan nembak ip address, virus cara mengatasi ip address conflict, virus arp windows 7, virus arp spoofing mikrotik, vb6 source code arp spoof -freelancer -softwaretopic, vb net arp posion, trik sms sembunyikan nomor, tips mengetahui flood mikrotik, stop mac spoofing in mikrotik, spoofing mikrotik, scheduler static arp di mikrotik, sality dengan mikrotik, Pengertian jaringan nirkabel spoofing took online download dan upload, pengertian interface pada java, pengertian Idle, pengertian host name, pengertian flooding, pengertian floodiing, pengertian clearing ARP, pengertian cara membuat jaringan wireles, pengertian blok, pengertian blocking, pengertian block, pengertian anti arp, pengerian arp wifi, pengertian sality virus, Pengertian sofhwer, put virus o mikrotik, proteksi virus mikrotik, protect mikrotik from arp spoof, program penangkal spoof, program bank pake vb, prevent arp spoof by mikrotik, port 38768, pengertian winbox, pengertian virus spoofing, pengertian virus sality, pengertian spoofing jaringan wireless, Pengertian spoofing dan flooding dalam jaringan, pengertian spoofing dan flooding, penangkal ARP dengan notepad, ip scanner vbs bat, cara menangani spoofing, blokir web facebook pakek mikrotik, blokir port virus sality di mikrotik, bloking arp poisioning/spoffing di jaringan wifi, blok virus sality lewat mikrotik, blok ip spoofing di mikrotik, block trojan dengan miktoik, block arp poisoning mikrotik, block arp flooding mikrotik, best antivirus for anti arp spoofing, arti logo mikrotik, arti dan pengertian spoofing, arti ARP pada tcp/ip, arpspoof mikrotik, cara bikin link flood web pakai vbs, cara bikin web flood, cara blocking via cmd, cara menangani arp spoofing di mikrotik, cara membuat bingkai di cmd, cara memblokir win32 worm downadup gen di mikrotik, cara memblock internet positif, cara memakai arp-scan di ubuntu, cara masuk jaringan bank BCA, cara flood komputer lain pada jarigan wireles, cara disble arp pada mikrotik, cara blokir client instal idm melalui cmd, cara blok worm di mikrotik, cara blok trafik virus di mikrotik via winbox, cara blok jaringan kantor, cara blok internet kantor, arp spoofing with vb net, ARP Spoofing virus download, arp spoofing using vb net, anti spoofing mikrotik, anti poisoning mikrotik, anti flooding mikrotik, anti flood untuk mikrotik, anti flood mikrotik, anti conficker mikrotik, anti change macaddress mikrotik, anti arp spoofing mikrotik, anti arp spoofing, anti arp spoof mikrotik, anti arp source code java, anti arp server java, anti arp mikrotik, antispoofing for mikrotik, apa kegunaan program file sharing manager, aplikasi anti arp wifi di ubuntu, arp spoofing code implementation in batch, ARP Spoofing cmd, arp spoofing 소스 vb, arp spoofer in vb, ARP scan vbs, arp poisoning vbs, arp poisoning vb

If you're new here, you may want to subscribe to my RSS feed. You may copy or publish this article to your blog or other site as long you give credit link back to this site article. Thanks for visiting my blog!