ANIA DAYTOY BACA BRO!!!

[Cycle_Mind]

Di kay la makatulong iti panangpasardeng iti daytoy raira a spyware apo?

[Cycle_Mind]

Other Names

Other names for this worm include: W32/Rontokbro.gen@MM, W32.Rontokbro@mm, BackDoor.Generic.1138, W32/Korbo-B, Worm/Brontok.a, Win32.Brontok.A@mm, Worm.Mytob.GH, W32/Brontok.C.worm, and Win32/Brontok.E.

[edit] Description

Brontok Virus came from Indonesia. When Brontok is first run, it copies itself to the user's application data directory. It then sets itself to start up with Windows, by creating a registry entry in the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key. It disables the Windows Registry Editor and modifies Windows Explorer settings. It removes the option of "Folder Options" in the Tools menu so that the hidden files, where it is concealed, are not easily accessible to the user. It also turns off Windows firewall. In some variants, when a window is found containing certain strings in the window title, the computer reboots. Using its own mailing engine, it sends itself to email addresses it finds on the computer, even faking the own user's email address as the sender. The computer also restarts when trying to open MS Dos in Windows and Downloading Files from the Internet. It also pop ups an Internet browser which is located in the my pictures folder.

[edit] Origin

The virus/email itself contains a message in Indonesian (and some broken English). When translated, this reads:

[By: H [REMOVED] Community] -- stop the collapse in this country --

1. Try the Hoodlums, the Smugglers, the Bribers, the gamblers, & drugs
Port (Send to "Nusakambangan") --

2.Stop Free Sex, Abortion, & Prostitution

3.Stop (sea and river pollution), forest burning, & wild hunting.

4.SAY NO TO DRUGS!!! - THE END IS NEAR -

Inspired by: (Spizaetus Cirrhatus) that is almost extinct [By: H [REMOVED] unity --

It also contains a JavaScript pop-up.

The worm also carried out a ping flood attack on two websites: israel.gov.il and playboy.com. This virus may be an example of Hacktivism.

[Cycle_Mind]

Back again, have been reading the google info & there is quite a bit available. Your AV program should be able to remove it.

A disk format would only be a short term solution, you need better prevention, here is some info.

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

* Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
* If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
* Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
* Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
* Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
* Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
* Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

removal instructions

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan and delete all the files detected.
4. Use the Security Response "Tool to reset shell\open\command registry subkeys."
5. Delete any values added to the registry.
6. Delete the scheduled task.

For specific details on each of these steps, read the following instructions.

1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:

* How to turn off or turn on Windows XP System Restore

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam

[Cycle_Mind]

This antivirus software is beginning to notice the remnants of the spyware by detecting, cleaning and deleting the cloned file in directories/ sub directories thus preventing it from accidentally opening it through windows explorer.

That it after a clean installation, so a hard disk format in that case is not that long term solution.

Try this software it will help!

[daguerrson]

THANX CYCLE FOR THAT VERY USEFUL INFO. THIS WILL COME IN HANDY, JUST IN CASE.

WE NEED THIS AND SIMILAR DO-IT-YOURSELVES KITS DOWN THE ROAD.

[Myrna]

Hello kumpadre...komusta dita Chicago?...hope youre OK after the storm....


thanks CYCLE....now I know what to do just in case...