Kalo di directory C:\WINDOWS kalian backgroundnya berubah menjadi Samurai X bisa jadi windowsnya udah kena virus ini :D Virus ini mengeksekusi beberapa program/file pemicu pada saat start-up, diantaranya Restoration.msd, Vel.exe, explore.exe, AdobeGama.pif, Desktop.ini. FIle-file tersebut adalah file milik virus. Pada task manager akan terlihat beberapa program dengan status running tapi task terkesan kosong, mungkin inilah salah satu trik penyamaran si virus.
Indikasi terkena MySamurai :
File milik virus ini tersebar di :
C:\WINDOWS\Temp\Vel.exe
C:\WINDOWS\Temp\runer.exe
C:\WINDOWS\Temp\system31.exe
C:\WINDOWS\Temp\windxp.exe
C:\WINDOWS\Temp\Ngsys.exe
C:\WINDOWS\Temp\rvshost.exe
C:\WINDOWS\Temp\userint.exe
C:\WINDOWS\Temp\winzipt.exe
C:\WINDOWS\explore.exe
C:\windows\system32\Restoration.msd
C:\windows\Explore.exe
C:\WINDOWS\system32\WindXP.ini
C:\WINDOWS\system32\Windows 3D.scr
C:\WINDOWS\system32\shareNet.msd
C:\WINDOWS\system32\CommandPrompt.sysm
C:\WINDOWS\system32\NvMedia.sysm
C:\WINDOWS\system32\odbcad32.dll
C:\WINDOWS\system32\command.PIF
C:\WINDOWS\Desktop.ini
C:\WINDOWs\pss\AdobeGama.pifCommonStartup
C:\Documents and Settings\User\Start Menu\Programs\Startup\AdobeGama.pif
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AdobeGama.pif
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
data registry yang ditulis :
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AdobeGama.pif
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\User\Start Menu\Programs\Startup\AdobeGama.pif
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\User\LOCALS~1\Temp\Ngsys.exe
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\User\LOCALS~1\Temp\runer.exe
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\User\LOCALS~1\Temp\rvshost.exe
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\User\LOCALS~1\Temp\userint.exe
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\User\LOCALS~1\Temp\Vel.exe
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\windows\system32\Restoration.msd
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\Temp\Vel.exe
HKEY_USERS\S-1-5-21-1614895754-2139871995-839522115-1003\sOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache\G:\Copy of Desktop.ini
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-\SysRestore
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-\def
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell /t REG_SZ /d Explorer.exe
Untuk menghapusnya sangat mudah, tinggal matikan proses virus kemudia hapus file & registry yang dibuatnya. Atau kalo gak mau cape pake aja 'jamu' yang gw buat untuk menghapus virus ini. Download 'jamu'nya di sini, diminum cukup 1 kali aja :D
0 comments:
:f
:D
:x
B-)
b-(
:@
x(
:?
;;)
:-B
:|
:))
:((
=((
:s
:-j
:-p
Post a Comment