Conficker still came out on top, followed by a re-Recycler in the chart and immediately soared to the top three, followed by Autoit. More information, please refer to the following list:
1. Conficker
Virus beyond tech is indeed remarkable spread. The shape
which is a DLL (Dynamic Link Library) distinguishes
most other viruses in the form of EXE. Abilities as well
can be equated with a rootkit. As well, its air-polymorphic
make a body's changing. On infected computers,
user will not be able to open the site "smell" antivirius or
Microsoft update. The virus is also actively spread in Indonesia
using removable disk media for example flash disks. On flash disk
infected, you will find the file autorun.inf and RECYCLER directory
in which there is a sub-directory named eg
S-5-3-42-2819952290-8240758988-879315005-3665, and this is the directory
there is a file with the name of the Conficker virus that usually jwgkvsq.vmx
is actually a DLL file.
which is a DLL (Dynamic Link Library) distinguishes
most other viruses in the form of EXE. Abilities as well
can be equated with a rootkit. As well, its air-polymorphic
make a body's changing. On infected computers,
user will not be able to open the site "smell" antivirius or
Microsoft update. The virus is also actively spread in Indonesia
using removable disk media for example flash disks. On flash disk
infected, you will find the file autorun.inf and RECYCLER directory
in which there is a sub-directory named eg
S-5-3-42-2819952290-8240758988-879315005-3665, and this is the directory
there is a file with the name of the Conficker virus that usually jwgkvsq.vmx
is actually a DLL file.
2. Recycler
Like its predecessor, which is characteristic of this virus is a technique
how it spreads. That is "hiding" in the directory
Recycler / Recycler / Recycle Bin. He is also known to apply the technique code
injection so that the virus code can be "stuck" on explorer.exe. This
done to complicate the user or antivirus program though
to kill him. In Build3 this time, have included engine cleaner
specific variants that can eradicate the Recycler completely.
Please scan your computer thoroughly, destroy any virus
found, and do not forget to restart your computer.
how it spreads. That is "hiding" in the directory
Recycler / Recycler / Recycle Bin. He is also known to apply the technique code
injection so that the virus code can be "stuck" on explorer.exe. This
done to complicate the user or antivirus program though
to kill him. In Build3 this time, have included engine cleaner
specific variants that can eradicate the Recycler completely.
Please scan your computer thoroughly, destroy any virus
found, and do not forget to restart your computer.
3. Autoit
Most common variant of the virus-based import script uses
looks like a folder icon. This virus has the ability to perform
auto updates to multiple sites. He can also take advantage of Yahoo!
Messenger as its medium spread by sending messages
contains a link to each contact person is in Y! M victim.
looks like a folder icon. This virus has the ability to perform
auto updates to multiple sites. He can also take advantage of Yahoo!
Messenger as its medium spread by sending messages
contains a link to each contact person is in Y! M victim.
4. Smansa
Viruses are created with this VB when viewed in Explorer mode
Details view, it would seem like standard applications without
icon, but apablia seen with Icons mode, it will appear as
a folder. Viruses that use UPX pack, when infected
will create a file named Autorun.inf Paket.exe and in every
he found the root drive. These files were hidden attributes in order
not seen with standard settings Explorer. In addition, the drive
infected flash disk will also find a message file with the name
Kenangan.html memories that contain a message from the creator of the virus.
Details view, it would seem like standard applications without
icon, but apablia seen with Icons mode, it will appear as
a folder. Viruses that use UPX pack, when infected
will create a file named Autorun.inf Paket.exe and in every
he found the root drive. These files were hidden attributes in order
not seen with standard settings Explorer. In addition, the drive
infected flash disk will also find a message file with the name
Kenangan.html memories that contain a message from the creator of the virus.
5. GhostyNet
The virus is believed to be not a local product at run time will appear
false messages or "fake error" that reads "Memory access violation
at 0 × 000000EF base address 0 × 000000F0. "as if the program
The crash when the virus has been residing in memory. He created
Run two new items in the registry with the name avpupdt and ctfmon. File
parent virus resides in the directory C: \ WINDOWS \ system32 \ 1920622684.
At the root of drive system is operating, there will be a file with the name
index.html which is a viral message.
false messages or "fake error" that reads "Memory access violation
at 0 × 000000EF base address 0 × 000000F0. "as if the program
The crash when the virus has been residing in memory. He created
Run two new items in the registry with the name avpupdt and ctfmon. File
parent virus resides in the directory C: \ WINDOWS \ system32 \ 1920622684.
At the root of drive system is operating, there will be a file with the name
index.html which is a viral message.
6. Viettel
Virus this one will drain the victim's computer resources so that was
very slow. It uses the folder icon similar in its distribution.
It is alleged he was from Vietnam. He will create a master file in
userinit.exe Windows directory with the name and in the name System32
system.exe. At the infected computer will have a file with the name
kdcoms.dll in the Windows directory.
very slow. It uses the folder icon similar in its distribution.
It is alleged he was from Vietnam. He will create a master file in
userinit.exe Windows directory with the name and in the name System32
system.exe. At the infected computer will have a file with the name
kdcoms.dll in the Windows directory.
7. HellSpawn
Virus bericon folder is created with the C + + language. Filename parent
following the name of the process / services of Windows such as service.exe,
winlogon.exe, lsass.exe, and smss.exe. There is also another name
random thought. In the body there is a database application is prohibited
to run. If the application is in the list of blacklist
is run, it will immediately be kill.
following the name of the process / services of Windows such as service.exe,
winlogon.exe, lsass.exe, and smss.exe. There is also another name
random thought. In the body there is a database application is prohibited
to run. If the application is in the list of blacklist
is run, it will immediately be kill.
8. MoneyMy
This virus uses the icon that looks like an installation file from
Game House, a manufacturer of gaming. When the file is virus-click
will display a fake error message or a fake error. This virus will
creating a parent file in the System32 directory with the name
debuger.exe.
Game House, a manufacturer of gaming. When the file is virus-click
will display a fake error message or a fake error. This virus will
creating a parent file in the System32 directory with the name
debuger.exe.
9. Autoit-Hubbun
Local virus Autoit want to follow, because it uses the application
Autoit scripting in the making. It uses the folder icon in
spread. Parent file located in the directory
\ Windows \ System32 \ WBEM \ services.exe. The virus also creates the file
hubbun.txt containing a message from the maker. He still has many
bug, seen in action several times displaying an error in the script.
Autoit scripting in the making. It uses the folder icon in
spread. Parent file located in the directory
\ Windows \ System32 \ WBEM \ services.exe. The virus also creates the file
hubbun.txt containing a message from the maker. He still has many
bug, seen in action several times displaying an error in the script.
10. Merlin.bat
One example of a simple virus that just made using a batch file (BAT)
He will mengkopikan himself in System32 with the name
dirsystem.cmd. Then try to create a new task on the Schedule Tasks
Windows with the name of the file that will run VTTimer virus
at a vulnerable time specified. During the action he will try
spread itself to every drive by creating autorun.inf file and
dirsystem.cmd on the drive that he found. The easiest way to
determine whether a computer is infected with this virus is to look
Registered Information Windows, because this virus is known to
change it to "Merlin" and "GINGO"
He will mengkopikan himself in System32 with the name
dirsystem.cmd. Then try to create a new task on the Schedule Tasks
Windows with the name of the file that will run VTTimer virus
at a vulnerable time specified. During the action he will try
spread itself to every drive by creating autorun.inf file and
dirsystem.cmd on the drive that he found. The easiest way to
determine whether a computer is infected with this virus is to look
Registered Information Windows, because this virus is known to
change it to "Merlin" and "GINGO"
No comments:
Post a Comment