Worm

Remove Worm VBS/Cryf.A, Shemale by CRY

9 Comments
Istanto
Computer And Internet, Miscellaneous, Tips & Trick
July 19, 2009June 26, 2012

VBS/Cryf.A was created using visual basic scripting (not visual basic), first case happen on my cyber cafe on date 18 July 2009 it spreading from user flash disk and try to infected all PC in my network.

I’m not sure why so much Indonesian virus maker using lot of thisÂ� VBS technique (maybe they know without msvbvm.dll VBS can executed on a lot target), Since I write about VBS article long long time ago (I forget maybe around year 2003-2005) in jasakom website with title “VBS sederhana yang berbahaya” many people has try to manipulate that simple code to become advanced code. Now I’m fell really stupid by share that Article to public…

How to know if you’re infected by this worm VBS/Cryf.A:

1.First time your computer turned on it will open web browser and show this pictures.

2. VBS/Cryf.A will change your web browser start page become:

3. There is folder “album bokep” (in Indonesian language this mean p**n) in all folder.

4. VBS/Cryf.A will change your system properties become like this:

5. Change file type .lnk become “movie clip”

6. It will control your DVD/CD-rom by make it open and close to make you panic.

RELATED SEARCH TERMS:

Remove Worm Kido

13 Comments
Istanto
Computer And Internet, Miscellaneous, Tips & Trick
April 4, 2009

Worm kido also known as Conficker or Downadup, on 1st April 2009 there is some rumors out there said this worm will generated new varian. I Personally not hear big problem on that date. Many computers has been infected by this worm because it’s spreading through network. Kaspersky AntiVirus has free removal tools for this worm. First before we remove this worm, to prevent it’s spreading in networks and infected many computers please follow this step. Install Patch from Microsoft for MS08-067, MS08-068, and MS09-001. Make sure Administrator password not easy to guess. Turn off autoplay on removable devices. Follow… Read More »Remove Worm Kido

Microsoft.lnk Shortcut Virus? Worm:PIF/Starter.A

Hello everyone sorry for late update this blog, I have been really very busy analyze forex market and grown my another business, busy IRL also… 😀

Now my story…….

Last week my cousins tell me in his office he got strange virus. He said there is lot shortcut in desktop an computers running slow. How actually some newbie out there know exactly which one real programs/folders and which one shortcut? Don’t say you’re not noob! almost many people not take to much attention on this simple different, that’s why with simple social technique virus maker can win beating yourself! 😛

LOOOOOOOOOOOOKKKKKKKK!!!!!!

To know when your computer infected by this virus there is 4 important point:

In your “My Documents” folder there is file named “database.mdb“.
There is clone folder with extension .lnk maximum 5 first folder arranged by name, rules until second sub folders.
There is files Autorun.inf, Thumb.db, Microsoft.lnk in each root drive and folders, rules until second sub folders. (You might not see them because it’s set hidden)
Your Registry Editor is disabled.

This virus master actually in “My Document” folder named “database.mdb” Wait… you will know why this is called as virus master. Actually virus will created clone for folder using “wscript.exe” execution. wscript.exe is microsoft windows based script host programs.

RELATED SEARCH TERMS:

YM and Skype Virus:YouTube Lady_Eats_Her_Shit Worm:Coutsonif.A

2 Comments
Istanto
Computer And Internet, Miscellaneous, Personal
February 14, 2009

Last week I got IRC bot virus in my server. I don’t know the virus name but I cleaned it manually. We’re not talking about this IRC bot virus cause it really simple cleaned manually using ANSAV UPX tools and Hidden Revealer I cleaned it in within short 1 minutes 😛 In this article we will write to clean YM and Skype bot virus Worm:Coutsonif.A

This virus spreading using social technique and autorun.inf, since it using social technique this virus can spreading easy. Did you ever received message from your TRUSTED friend like this sample?

Listen to me, don’t so easy clicked any link in email or anything! even it come from trusted source. In this case social technique can make you in danger position, Think if virus collecting your financial information :p

When you download this virus it will making 2 random file in %systemroot%\Documents and Settings\%user%\Local Settings\Temp with extension .tmp and .exe then created vshost.exe with size 122kb, file will available on every drive root.

Virus will also make another files:

%systemroot%\autorun.inf [all drive]
%systemroot%\RECYCLER\S-1-5-21-9949614401-9544371273-983011715-7040\winservices.exe
%systemroot%\WINDOWS\system32\sysmgr.exe
%systemroot%\WINDOWS\TEMP\5755.tmp
%systemroot%\windows\system32\crypts.dll
%systemroot%\windows\system32\msvcrt2.dll

It wil also change your registry to automatically started when your computers booting. Beside that, old autorun.inf technique also adopted in this virus spreading:

Virus will change your registry to allowed only 11 maximum active application, it also blocking your maximum port to only port 8000.

Automatic Update:

This virus will try to automatically update himself to this address list:

66.90.103.169:99/a.exe
66.90.103.169:6666/lsass .exe
66.90.103.169:443/crss .exe
TCP:72.249.94.146:7008 Port:27
TCP:127.0.0.1:1092 Port:30
TCP:66.90.103.169:99 Port:29
TCP:66.90.103.169:6666 Port:30
TCP:66.90.103.169:443 Port:30
Port 80 IP:83.133.127.5
Port 80 IP:68.180.151.74
Port 25 IP:127.0.0.1
Port 80 IP:65.55.21.250
TCP:83.133.127.5:443 Port:17
TCP:65.54.186.47:443 Port:17
Port 80 IP:87.248.208.54
TCP:89.149.254.14:443 Port:21
Port 80 IP:64.4.33.7
Port 80 IP:207.46.11.121
Port 80 IP:65.54.186.47
Port 80 IP:88.221.26.64
TCP:65.55.16.123:443 Port:28
TCP:92.122.112.124:443 Port:28
TCP:92.122.112.124:443 Port:28
TCP:88.221.165.186:443 Port:29
TCP:88.221.165.186:443 Port:29
TCP:83.133.127.5:443 Port:18
TCP:89.149.254.14:443 Port:2
TCP:65.55.16.123:443 Port:27
TCP:65.54.186.47:443 Port:27
TCP:92.122.112.124:443 Port:27
TCP:92.122.112.124:443 Port:28
TCP:88.221.165.186:443 Port:28
TCP:89.149.254.14:443 Port:21

Simple steps to cleaning Coutsonif.A:

1. Disable “System Restore” when in cleaning process.

2. Disable “autoplay/autorun” function by: