Sandra Dewi Bugil….? This is not porn! this is an computer virus! but surely this is a noob virus creator *again*

Virus characteristic:

• Virus size 132kb
• Virus file type “application”
• Virus extension .exe
• Using images icon

Sandra Dewi Bugil Virus has been created using visual basic, If virus success on infected your system he will created some files:

• \Sandra Dewi Bugil.exe (In all root drive)
• \Documents and Settings\%user%\Start Menu\Programs\Startup\Sandra Dewi Bugil.exe
• \WINDOWS\Sandra Dewi Bugil.exe
• \WINDOWS\system32\ Sandra Dewi Bugil.exe
• Creating duplicate virus on all folder in removable drive/usb.

This virus will show message when your computer active, the easiest way to know is you’re system infected by this virus.

This virus will blocking some windows function to make him hard to removed.

• Disable Folder Options
• Disable Registry Editor
• Disable Search/Find
• Disable Command Prompt
• Disable Task Manager
• Disable Control Panel
• Disable Msconfig/System Configuration Utility
• Disable Right Click on Desktop
• Disable “All Programs” on Start Menu
• Disable Log Off/Turn Off

Virus will change your name and organization on your System Properties.

Virus will change your Internet Explorer Header.

When your computer starts it will showing message (look at the the top article) then splash with picture:

What do you think about this? virus maker team? I think so.. They try to act become popular *LOL* I can created this virus within 10 minutes surely they all noob *LOL* When you click “keluar” (out) button virus will shown confirmation box asking to sending email to virus creator

This option actually has nothing to do, each button will bring you into the auto shutdown box.

Spreading Method:

This virus spreading from removable media/USB flash disk,virus will created a copy into any removable media/USB flash disk plugin into infected system.

How to Remove Sandra Dewi Bugil Virus W32/Sadra.A:

1. Disconnected your computer from network.

2. Disable System Restore when in cleaning process.

3. Kill active virus process in your computer background, use this 3rd party tools process explorer kill all sandra dewi bugil process.

4. Repair your registry using code below or download repair.inf

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del
[UnhookRegKey]
HKCR, batfile\shell\open\command,,,”"”%1″” %*”
HKCR, comfile\shell\open\command,,,”"”%1″” %*”
HKCR, exefile\shell\open\command,,,”"”%1″” %*”
HKCR, piffile\shell\open\command,,,”"”%1″” %*”
HKCR, lnkfile\shell\open\command,,,”"”%1″” %*”
HKCR, scrfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion, RegisteredOrganization,0, “Organization”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion, RegisteredOwner,0, “Owner”
HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, CheckedValue, 0×00010001,1
HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, DefaultValue, 0×00010001,2

[del]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableMsConfig
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr
HKCU, Software\Policies\Microsoft\Windows\system, DisableCMD
HKCU, Software\Microsoft\Internet Explorer\Main, Window Title
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFolderOptions
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoClose
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoControlPanel
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoRun
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoStartMenuMorePrograms
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoViewContextMenu
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoViewOnDrive
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, StartMenuLogoff

5. Search and Destroy all virus in your system, before doing this as usually show all hiden files back and carefull when you deleted files, make sure it virus… find files with this specification:

• Icon Images (JPEG)
• File Extension .exe
• File Size 132kb

6. Last, scan with your best antivirus. Norman user download in here for free.

Have a nice day

Discount Candles Shop designer candles today at discount pricing.

SIMILAR POST :

• Remove MaHaDeWa VBS.Autorun.AM
• Remove W32/VBWorm.QXE (bulubebek)
• Remove virus AMBURADUL (all varian)
• 6 Step to: Remove Jengkol Virus
• Remove K0pL4xZ Virus VBWorm.QTT

If you're new here, you may want to subscribe to my RSS feed. You may copy or publish this article to your blog or other site as long you give credit link back to this site article. Thanks for visiting my blog!

This entry was posted on Wednesday, June 17th, 2009 at 2:35 PM and is filed under Computer And Internet, Miscellaneous, Tips & Trick. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.