Messenger – nhattruongquang.0catch.com

Beberapa hari ini, pada chat menggunakan Yahoo Messenger, aku sering dapat pesan :

• Biet tin gi chua, vao day coi di http://nhattruongquang.0catch.com
• E may, vao day coi co con nho nay ngon lam http://nhattruongquang.0catch.com
• Vao day nghe bai nay di ban http://nhattruongquang.0catch.com
• Vao day nghe bai nay di ban http://nhattruongquang.0catch.com
• Biet tin gi chua, vao day coi di http://nhattruongquang.0catch.com
• Trang Web nay coi cung hay, vao coi thu di http://nhattruongquang.0catch.com
• Toi di lang thang lan trong bong toi buot gia, ve dau khi da mat em roi? Ve dau khi bao nhieu mo mong gio da vo tan… Ve dau toi biet di ve dau? http://nhattruongquang.0catch.com
• Khoc cho nho thuong voi trong long, khoc cho noi sau nhe nhu khong. Bao nhieu yeu thuong nhung ngay qua da tan theo khoi may bay that xa…http://nhattruongquang.0catch.com
  Tha nguoi dung noi se yeu minh toi mai thoi thi gio day toi se vui hon.
• Gio nguoi lac loi buoc chan ve noi xa xoi, cay dang chi rieng minh toi…http://nhattruongquang.0catch.com
• Loi em noi cho tinh chung ta, nhu doan cuoi trong cuon phim buon. Nguoi da den nhu la giac mo roi ra di cho anh bat ngo… http://nhattruongquang.0catch.com
• Tra lai em niem vui khi duoc gan ben em, tra lai em loi yeu thuong em dem, tra lai em niem tin thang nam qua ta dap xay. Gio day chi la nhung ky niem buon http://nhattruongquang.0catch.com

Pesan tersebut pemakai YM tidak menyadari kalau mengirim pesan seperti itu. Apakah itu ?

Ini termasuk worm yang mulai muncul akhir 2006 dan mungkin sekarang muncul lagi dengan varian barunya…..

Virus / worm ini dikenal dengan berbagai nama antara lain :

• Symantec : W32.Imaut.U
• Avira : Worm/Sohanad.bm
• Kaspersky: IM-Worm.Win32.Sohanad.bm
• F-Secure: IM-Worm.Win32.Sohanad.bm
• Sophos: W32/SillyFDC-G atau W32/Sohana-R
• Panda: W32/Hakaglan.A.worm
• Grisoft: I-Worm/Sohanad.J
• Eset: Win32/Hakaglan.AH
• Bitdefender: Trojan.AutoIt.TD
• McAfee : w32/Yahlover.worm.gen.c

Platforms / OS :

• Windows 95
• Windows 98
• Windows 98 SE
• Windows NT
• Windows ME
• Windows 2000
• Windows XP
• Windows 2003

Imaut / sohanad / Hakaglan / AutoIt / Yahlover ini, menginfeksi lewat Yahoo! Instant Messenger, Microsoft Windows Live Messenger, dan AOL Instant Messenger. Worm akan download remote files di compromised computer dan disable Windows Task Manager dan Registry tools.

INFECTED

File

Copy di :

• %SYSDIR%RVHOST.exe
• %WINDIR%RVHOST.exe

Menulis schedule :

• %WINDIR%TasksAt1.job File schedule task untuk run malware.

Dan melakukan download di lokasi http://nhatquanglan2.0catch.com/**********
Dan saved ke local hard drive di : %SYSDIR%setting.ini

Registry

Registry keys yg akan ditambahkan pada run the processes setelah reboot :

• [HKCUSoftwareMicrosoftWindowsCurrentVersionRun]
  •  Yahoo Messengger=”%SYSDIR%RVHOST.exe”
• [HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]
  •  Shell=”Explorer.exe RVHOST.exe”

..

Registry keys yang di add :

• [HKLMSYSTEMControlSet001ServicesSchedule]
  •  AtTaskMaxHours=dword:00000000
• [HKCUSoftwareMicrosoftWindowsCurrentVersionExplorer
  WorkgroupCrawlerShares]
  •  shared=”%all shared folders%New Folder.exe”

Registry keys yang berubah :

Various Explorer settings :

[HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]

Old value :
•  NofolderOptions=%user defined settings%

New value :
•  NofolderOptions=dword:00000001

Disable Regedit dan Task Manager :

[HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]

Old value :
•  DisableTaskMgr=%user defined settings%
•  DisableRegistryTools=%user defined settings%

New value :
•  DisableTaskMgr=dword:00000001
•  DisableRegistryTools=dword:00000001

Network

Propaganda malware connect pada PC lain dengan cara :

copy sendiri pada network share :
•  %all shared folders%New Folder.exe

Penyembuhan

• Disable System Restore
• Update antivirus
• Scan dengan anti virus yang ter update.
• Buat file UnHookExec.inf
• [Version]
  Signature=”$Chicago$”
  Provider=Symantec
  [DefaultInstall]
  AddReg=UnhookRegKey
  [UnhookRegKey]
  HKLM, SoftwareCLASSESbatfileshellopencommand,,,”””%1?” %*”
  HKLM, SoftwareCLASSEScomfileshellopencommand,,,”””%1?” %*”
  HKLM, SoftwareCLASSESexefileshellopencommand,,,”””%1?” %*”
  HKLM, SoftwareCLASSESpiffileshellopencommand,,,”””%1?” %*”
  HKLM, SoftwareCLASSESregfileshellopencommand,,,”regedit.exe “”%1?””
  HKLM, SoftwareCLASSESscrfileshellopencommand,,,”””%1?” %*”
  HKCU, SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem,DisableRegistryTools,0×00000020,0

  Save file tersebut dan right click – install untuk mengembalikan fungsi regedit

• Change dan Delete registry Windows yang telah diubah oleh worm.
• Nilai registry yang dihapus :
  1. HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon”Shell” = “Explorer.exe ” RVHOST.exe”
  2. HKCUSoftwareMicrosoftWindowsCurrentVersionRun”Yahoo Messengger” = “%System%RVHOST.exe”
  3. HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerWorkgroupCrawlerShares”shared” = “[SHARED DRIVE]New Folder.exe”
• Ubah Registry ke nilai semula :
  1. HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem”DisableTaskMgr” = “1?
  2. HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem”DisableRegistryTools” = “1?
  3. HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer”NofolderOptions” = “1?
  4. HKLMSYSTEMCurrentControlSetServicesSchedule”AtTaskMaxHours” = “0?
  5. HKLMSOFTWAREMicrosoftWindowsCurrentVersion”Run” = “BkavFw”
  6. HKCUSoftwareMicrosoftWindowsCurrentVersion”Run” = “IEProtection”

Exit registry editor / regedit.

Similiar Post

• Remove Virus Downadup.C , Conficker , Kido
• Remove Downadup , Kido dan Conficker di Network
• Varian Virus Downadup.C , Conficker , Kido
• Worm Windows Server Service RPC
• Sality Virus Terkenal di Indonesia
• Remove Malware LCASS.EXE
• Top 10 Virus Indonesia, Juli 2009
• Remove Virus / worm W32.Downadup.B
• Top 10 Virus di Indonesia, Juni 2009
• Alert Conficker / Downadup / Kido on 1 April ?

Popular Post

• HP Modem Smart Haier C700 dan ZTE C261, Internet Gratis 90 hari
• Mempercepat Akses Internet Smart Telecom
• Internet Gratis Indosat dan IM3
• Internet Unlimited Smart Jump dari Smart Telecom
• Mempercepat Akses Internet dengan cFosSpeed
• Internet Gratis PRO-XL, Your-Freedom & cFosSpeed
• Uji Coba Fitur BREW HP Haier C700 dan ZTE C261
• HP 3G Modem & Internet Akses CDMA dari Smart Telecom
• Install dan Setting Your Freedom
• Opera Mini Mod v.3.10

Random Post

• Update Portable Antivirus
• SEO antara Wordpress dan Joomla
• Selamat Idul Fitri 1430 H, Kapan 1 Syawal 1430 H ?
• Retina Network Security Scanner – Pendeteksi Conficker / Downadup / Kido di Network
• UPDATE PAGERANK
• Dasar Grab Kurs Bank Indonesia (BI)
• Top 10 Virus di Indonesia, Juni 2009
• Packet Injection Software for Wifi in Windows
• Messenger – nhattruongquang.0catch.com
• Upgrade Wordpress Version 2.6.2 dengan Wordpress Automatic Upgrade

Save Children

Ad by AdsMedia.cc

All about FaceBook

Comments