HOT NEWS

Virus VBS/Repulik.A injection MS.Word and MS.Excel

Selasa, 06 Mei 2008

if yesterday ever appear virus that inspired by song ari lasso, today we want to introduce you in one new virus menyinyalir fan group music repvblik and remind in famous brand branded bvlgari.

we are sure still to remember with virus case kespo (kspoold) sempat booming with file principal target ms office especially ms. word and ms. excel with several database programs. this virus copes to menginjeksi file permanently use original icon from file at hypodermic so that enough effective to mengelabui user, although antivirus success “clean” virus but unfortunately not yet can to return icon and file extension (file at clean still berekstensi exe and icon application) so that user of opinion that file broken, eventually appear lah several tools alternative to split file that virus infection like chanal splitter (yayat_dhn), doc/xls recovery (husni), pcmedia antivirus “mengaku” as antivirus best at world. besides kespo gultung/stubble kawung also come along to enliven illusion world with principal target wipes off contents from file at infection and replaced it with country test exercise, so that although virus success at clean but contents from file at change with file contents other.

not want to lose with the pioneer, recently appear virus of a kind kespo where does this virus also will cope to menginjeksi file office (ms word and excel). even though this virus will still to belong to “baik” because he only menginjeksi file office exist in flash menyk.

actually is not too difficult to detect file that this virus infection, that is “hanya” with see icon and file extension tesebut. usually file that this virus infection has icon vbs with extension. doc. vbs, like seen in picture 1 hereunder.


Picture 1, File induk VBS/Repulik.A

with newest update norman can detect this virus by the name of vbs/repulik. A (see picture 2)

Picture 2, result scan norman virus control detect worm: VBS/Repulik.A

Feature VBS/Repulik.A

Next several features from VBS/Repulik.A

  • Icon VBS

  • Ekstensi VBS

  • Size 5 KB

  • Type file “VBScript script file”

  • File hypodermic exe/doc with add file size as big as 5 kb and have extension. doc. vbs. file at this hypodermic has icon vb

At the (time) of this virus is mobile, he will make mother file that be run each time computer booting. differ from another local virus, he will not make string in registry editor so that not too suspicious looking, this virus also will not windows function block and software security so that easier to cleaned.

Next mother file that at will deliver by vbs/republik. A
  • C:\Documents and Settings\%user%\Start Menu\Programs\Startup\Repvblik.vbs

besides make mother file, vbs/repulik. a also will keep hypodermic file that run by user and file repvblik. txt to folder c: \repvblik, like seen in picture 3 under this:

Picture 3, File drop VBS/Repulik.A


Message from the VM

Akan muncul di akhir umatku, wanita-wanita yang berpakaian namun pada hakikatnya bertelanjang.

Diatas mereka terdapat suatu penaka punuk unta.

Mereka tidak akan memasuki surga dan tidak juga akan mencium aroma surga.

Padahal bau surga itu dapat dicium dari jarak sekian dan sekian (H.R. Muslim)

By Repvblik

if you open file repvblik. txt that reside in directory c: \repvblik, so will appear latent message that is made by the vm. (see picture 4)

Picture 4, latent message the VM

Change volume (name) flash disk

vbs/repulik. a also will try to will change volume (name) flash menyk will be repvblik. (see picture 5)

Picture 5, VBS/Repulik.A Change volume (name) flash disk

injection ms. word and ms. excel

principal target vbs/repulik. a bone other than data especially ms. word and ms. excel by menginjeksi with add code virus in header file. file that at hypodermic will increase 5 kb from size at first. file that at this hypodermic actually not too difficult to been identified because he permanent will use icon vbs with extension. doc. vbs other the things of if icon use icon ms. word or ms. excel with file extension hidden, so that for certain user easy will be deceived to run file.

this virus the good news only aims data exist in removable disk (flash disk).

next file feature that at hypodermic by vbs/repulik. a (see picture 6)
  • Icon VBS

  • size “berbeda-beda” (happen file size increasing sebensar 5 kb from size at first)

  • Extension .DOC.VBS

Picture 6, file at hypodermic by VBS/Repulik.A

if file that injeksi at run so in folder same will make file temporary of the size 6 kb and use icon vbs, look at picture 7 under this:

Picture 7, temporary file that made by Repulik.A

scattered to pass flash disk

to simplify menyebara, he will use diskette / flash disk by will deliver virus file with hypodermic all files ms. word and ms. excel existing, next several files that at will make by vbs/repulik. a
  • I am So Sorry.txt.vbs

  • Indonesian and their corruption!!.txt.vbs

  • Make U lofty.txt.vbs

  • NenekSihir and her Secrets.txt.vbs

  • Never be touched!!.txt.vbs

  • SMS Gratis via GPRS.txt.vbs

  • Thank U Ly.txt.vbs

way to overcome VBS/Repulik.A

  1. Deactivate “sytem restore” during cleaning process (if use windows me/xp)

  2. kill virus process that has file name wscript. exe. for lethal this process is your can use tools currproses.

  3. file erase that made by virus

    • C:\Documents and Settings\%user%\Start Menu\Programs\Startup\Repvblik.vbs

    • C:\Repvblik

also file that deliverred at flash disk

    • I am So Sorry.txt.vbs

    • Indonesian and their corruption!!.txt.vbs

    • Make U lofty.txt.vbs

    • NenekSihir and her Secrets.txt.vbs

    • Never be touched!!.txt.vbs

    • SMS Gratis via GPRS.txt.vbs

    • Thank U Ly.txt.vbs

  1. change volume/name flash disk according to manual by:

    1. click right flash disk

    2. click rename

    3. change name “repvblik” by the name of you want

  1. for anticipation and prevent infection repeats, please install and scan with antivirus that can detect this virus well.

  1. if antivirus you are install not success “repair” file that at hypodermic by vbs/repulik. a. you can use tools “spliter vbs2doc/xls”. please download tools at address next

http://www.4shared.com/file/43727532/dda23d77/_2__Splitter_VBS2DOC_XLS.html?dirPwdVerified=3c4e3b82


Note:

spliter vbs2doc/xls this be development from tools chanal splitter yav (yayat_dhn). chanal spliter yav tools that used to repair file that at hypodermic by kespo (kspoold), please download tools chanal spitter yav at address next: http: /chanal. biz/blog/? p=17

(sumber: vaksin.com)

11 komentar:

Anonim mengatakan...

[url=http://community.bsu.edu/members/buy+online+Viagra.aspx]Viagra overnight delivery no rx[/url]

[url=http://ceklansi.ru/zhurnal-znakomstv-v-spb.php]журнал знакомств в спб[/url]
[url=http://ceklansi.ru/pesnya-buduschie-blyadi.php]песня будущие бляди[/url]
[url=http://ceklansi.ru/seks-znakomstva-novokuzneck-chat.php]секс знакомства новокузнецк чат[/url]
[url=http://ceklansi.ru/dosug-nnov.php]dosug nnov[/url]
[url=http://ceklansi.ru/znakomstva-org.php]знакомства org[/url]
[url=http://celuyou.ru/dosug-nn-ru.php]досуг нн ру[/url]
[url=http://celuyou.ru/sayt-seks-znakomstva.php]сайт секс знакомства[/url]
[url=http://celuyou.ru/poznakomtes-s-uolli-sparksom-onlayn.php]познакомьтесь с уолли спарксом онлайн[/url]
[url=http://celuyou.ru/iskusstvo-znakomstva-s-muzhchinami.php]искусство знакомства с мужчинами[/url]
[url=http://celuyou.ru/znakomstva-bez-registracii-v-novosibirske.php]знакомства без регистрации в новосибирске[/url]
[url=http://deperovero.ru/poznakomlus-s-armyankoy.php]познакомлюсь с армянкой[/url]
[url=http://deperovero.ru/botanicheskiy-sad-intim.php]ботанический сад интим[/url]
[url=http://mx.deperovero.ru/blyadi-v-kino.php]бляди в кино[/url]
[url=http://mx.deperovero.ru/prostitutki-kutuzovskiy.php]проститутки кутузовский[/url]
[url=http://rp.deperovero.ru/deshevye-shluhi-moskvy-vyezd.php]дешевые шлюхи москвы выезд[/url]
[url=http://rp.deperovero.ru/intim-internet-znakomstva.php]интим интернет знакомства[/url][url=http://ss.deperovero.ru/index.php]секс чаты знакомств москвы[/url]
[url=http://ss.deperovero.ru/serpuhovsko-timiryazevskaya-intim.php]серпуховско-тимирязевская интим[/url]
[url=http://tt.deperovero.ru/sluzhba-znakomstv-muzhchina-i-zhenschina.php]служба знакомств мужчина и женщина[/url]
[url=http://tt.deperovero.ru/intim-belorussii.php]интим белоруссии[/url]

Anonim mengatakan...

Your blog keeps getting better and better! Your older articles are not as good as newer ones you have a lot more creativity and originality now keep it up!

Anonim mengatakan...

I want not agree on it. I over precise post. Specially the appellation attracted me to read the intact story.

Anonim mengatakan...

Amiable post and this mail helped me alot in my college assignement. Say thank you you as your information.

Anonim mengatakan...

My friend and I were recently discussing about the ubiquitousness of technology in our daily lives. Reading this post makes me think back to that discussion we had, and just how inseparable from electronics we have all become.


I don't mean this in a bad way, of course! Ethical concerns aside... I just hope that as technology further advances, the possibility of transferring our memories onto a digital medium becomes a true reality. It's one of the things I really wish I could see in my lifetime.


(Posted on Nintendo DS running [url=http://kwstar88.insanejournal.com/397.html]R4i SDHC[/url] DS Fling)

Anonim mengatakan...

[B]NZBsRus.com[/B]
Escape Slow Downloads With NZB Downloads You Can Rapidly Find High Quality Movies, PC Games, MP3 Singles, Software and Download Them at Accelerated Speeds

[URL=http://www.nzbsrus.com][B]Newsgroup[/B][/URL]

Anonim mengatakan...

Predilection casinos? harm this advanced [url=http://www.realcazinoz.com]casino[/url] exemplar and wing it naval disrate online casino games like slots, blackjack, roulette, baccarat and more at www.realcazinoz.com .
you can also examine our untrained [url=http://freecasinogames2010.webs.com]casino[/url] be comprised of c hatch something at http://freecasinogames2010.webs.com and glean mastery impressive folding shin-plasters !
another inexperienced [url=http://www.ttittancasino.com]casino spiele[/url] draw up is www.ttittancasino.com , in pick to of german gamblers, inspect beneficent online casino bonus.

Anonim mengatakan...

Good dispatch and this fill someone in on helped me alot in my college assignement. Gratefulness you seeking your information.

Anonim mengatakan...

Making money on the internet is easy in the undercover world of [URL=http://www.www.blackhatmoneymaker.com]blackhat methods[/URL], It's not a big surprise if you don't know what blackhat is. Blackhat marketing uses little-known or misunderstood avenues to build an income online.

Anonim mengatakan...

Hi
Very nice and intrestingss story.

Anonim mengatakan...

Just popping in to say nice site.

Posting Komentar

 
 
 
eXTReMe Tracker
Powered By Blogger