pmerxnkr on Momaroo

purelocke: Brontok e-mail worm

I recently had an encounter with an infected Windows XP Pro with SP2 machine which annoyingly restarted whenever a download was initiated and opened on the default browser the link about Brontok.A. The page that was appearing had the following text:

BRONTOK.A [ By: H[REMOVED]Community ]
-- Hentikan kebobrokan di negeri ini --
1. Adili Koruptor, Penyelundup, Tukang Suap, Penjudi, & Bandar NARKOBA
( Send to "NUSAKAMBANGAN")
2. Stop Free Sex, Absorsi, & Prostitusi
3. Stop (pencemaran laut & sungai), pembakaran hutan & perburuan liar.
4. SAY NO TO DRUGS !!!
-- KIAMAT SUDAH DEKAT --

This was my clue, so I searched for the brontok.a reference, and came up with the following aliases for the e-mail worm that had infected the system when the user opened a certain e-mail attachment.

A.K.A. : Email-Worm.Win32.Brontok.a (Kaspersky Lab) is also known as: W32/Rontokbro.gen@MM (McAfee), W32.Rontokbro@mm (Symantec), BackDoor.Generic.1138 (Doctor Web), W32/Korbo-B (Sophos), Worm/Brontok.a (H+BEDV), Win32.Brontok.A@mm (SOFTWIN), Worm.Mytob.GH (ClamAV), W32/Brontok.C.worm (Panda), Win32/Brontok.E (Eset)

An Anti-virus was present on the system, but was not updated (lesson no. 1 !!!), and scanning the system did not find anything. Apparently, upon infection the virus creates registry keys that enable it to run at startup, and edits and sets registry entries that disable the use of regedit, msconfig, folder options, etc. (More info from Sophos.)

On the Sophos website, there is an available removal tool, but running it did not remove the worm variant. Badly enough, there was no anti-spyware software on the system, and downloading was not an option as the system would restart at every attempt to download one. The Anti-virus software was also unable to do auto-update. I downloaded Spybot from a different machine, and was able to install it on the infected one. It found and reverted changes made to the registry by the virus. Now this allowed the Anti-virus software to update itself and on restart was able to clean the machine after scan.

AlanWarez.TK: Nikky Case - Lidi

size = 'small';

Nikky Case - Lidi
152 JPG | 2000x3000 | 161 MB | Rapidshare

http://rapidshare.com/files/277552961/NC-_Ld-MA.part1.rar
http://rapidshare.com/files/277559935/NC-_Ld-MA.part2.rar

digg_url="http://alanwarez.blogspot.com/2009/09/nikky-case-lidi.html";

If you enjoyed this post, make sure you subscribe as an Reader!

Night Walker: Location is not available: C:\windows\system32 ...

If you have anti-virus softwares installed and are simply looking for a solution, go to http://nw360.blogspot.com/2009/08/location-is-not-available.html.

This desktop issue has happened twice.

When I turned on my laptop, Vista takes an extended period of time to show you it is "preparing your desktop".

After the desktop appears, a message window pops up with the title ""Location is not available". The content is

C:\windows\system32\config\systemprofile\desktop refers to a location that is unavailable. It could be on a hard drive on this computer.or on a network. Check to make sure that the disk is properly inserted, or that you are connected to the Internet or your network and then try again. If it still cannot be located the information might have been moved to a different location.
Moreover, the desktop theme is changed to windows classic.

The solution is quite simple, reboot the PC. If this doesn't work, go to Last Known Good Configuration (advanced) when you start Vista. This option enables you to start Windows Vista with the last registry and driver configuration that worked successfully. How to access this startup option, please visit Windows Vista Advanced Boot Options.

If both approaches provided above are not working, try to restore/ recover your vista system. If you have Windows Recovery Environment (Windows RE) installed, start it and do the system restore or system recovery. Alternatively, you can access the System Recovery Options menu via the Windows installation disc. Refer to http://windowshelp.microsoft.com/windows/en-US/help/2b3724d1-f4ad-5b26-16dc-3e9e66f4be5e1033.mspx for details.

As I pointed out, the cause may be the Norton anti-virus software. If all the approaches don't work, try to uninstall the software even under the circumstance that the desktop location is not available. Using Norton removal tool to make sure you have uninstalled Norton products completely. The Norton removal tool is available at http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039.

However, what caused this problem?

It may be a software conflict.
The software is associating with the system tightly.
It may be an anti-virus software.
The biggest suspect is Symantec/Norton security softwares.

OK, the cause of this issue still remains unknown, but I do think it is Symantec/Norton softwares. Suppose you have Symantec/Norton anti-virus softwares installed. Start your PC, when see the desktop, shut down the computer immediately. What will happen on next startup? Before using Norton anti-virus software, I didn't have this problem at all with McAfee total protection. Refer to the section above to get the information on how to uninstall Norton products.

Update: 25/08/2009

Some people left their comments here and it seemed their problems were not caused by Norton. However, the common point is that they are caused by the anti-virus softwares. Therefore, if you have this problem, uninstall your anti-virus software completely. Use the official uninstall tool if it is necessary. Then reboot your system. Now the problem should be solved. So far, I haven't met this problem using McAfee and Avira. If you would like to stick to your original anti-virus software, try to use different versions.

Where there is a major version of the anti-virus software released, especially Norton, I recommend uninstall the old version first then install the new one. DO NOT over install the new version on the old one.

Understanding windows

What Slows Down Your Windows

Results and Conclusions

Most people won't find anything too shocking here. One of the most surprising things to be

gleamed from here is the blatant time and effort Symantec have gone to improve their product from the 2006 version. This won't help you if you own that version, but it should give you a good idea what to expect from Symantec in the future if you're determined to stick with their product line.

Overall

Here's the table of results for all three sections ranked by their overall performance degradation. The control times where:

Boot Time: 70 seconds
Prime: 26 seconds
FileIO: 25seconds

Boot Delay

The boot delays were quite a lot smaller than last time, likely to be attributable to VMWare having a better grasp on its file system than Virtual PC, but the same names were at the top of this test.

Prime Delay

I wasn't expecting too much of a result from here. The prime delays would have come on systems where there were applications hogging resources.

FileIO Delay

The only applications this was going to affect were the system-monitors; those applications that require 100% attention on the file system, namely the security products.

Conclusions

Well it's clear to see what sort of application has most effect on Windows. Antivirus programs tether the performance of your computer alongside that of one three years its elder. If you really need an antivirus system, make sure you follow these benchmarks but also make sure you check how good the one you're looking at really is. Nod32 gets good security reviews and seems to leave the system fairly nippy

The new version of Norton has shocked me a little. Every year since their Norton AntiVirus 2002, they've added more and more "bloat". They call them features, and looking at the box, you'd agree. Features have traditionally come at a price though. If you're scanning more things, it's going to take it more time. NIS2007 seems to do all the work of 2006 but with significantly less load on the FileIO. I'm not shouting "go out and buy it" because of the massive boot delay and there are still better products.

If you're looking for the best of the best antivirus products you should look at their detection rates. There's no point in having something, no matter how expensive, if it cannot keep you protected.

Hack to learn , not learn to h4ck: Creating Universal Ghost Usb ...

If you want to use Norton Ghost 2003 to create an image of a PC's primary partition you will find it has 2 serious limitations:

1- The USB support driver they use (from Iomega) can only be installed in USB1 or USB2 mode (not both), and it is not universal - it didn't recognize my external USB IBM mobile HD .

2- You can't create a Ghost bootable CD - only a floppy. How can you clone a newly bought laptop, most of which don't have a floppy anymore?
Here's How to:

1- create a Ghost floppy with USB support (1 or 2 - it won't matter later)
2- download 2 files kxlrw40an.exe and mhairu.zip
CODE

http://panasonic.co.jp/pcc/products/drive/cdrrw/kxlrw40an/driver/kxlrw40an.exe

CODE

http://www.stefan2000.com/darkehorse/PC/DOS/Drivers/USB/mhairu.zip

From the first file (Panasonic driver for a USB CDRW) you will need the file usbaspi.sys found under "F2H" sub directory after extraction of the downloaded archive. From the second archive you need di1000dd.sys
3- Copy these 2 files to the USB folder on the Ghost floppy, and delete any other files in that folder. Also delete the file guest.exe from the floppy's root.
4- And finaly:
edit the AUTOEXEC.BAT file - delete the line: guest.exe
and edit CONFIG.SYS - delete all entries and enter:
device=usb\USBASPI.SYS /v /e /o /u
device=usb\Di1000dd.SYS
LASTDRIVE = Z

That's it. You can now boot with this floppy and have full USB support so you can create the image on an external USB drive.

If you want to create a bootable CD you can use Nero:
Choose to create a "CD-ROM (boot)" from the wizard, under Boot tab leave the default "bootable logical drive: as A:\ . Insert your Ghost floppy to the drive, drag all the files from the floppy to "New compilation" and burn. You now have a bootable Ghost CD that even Symantec doesn't have..

PS if you need Norton Ghost 2003 get the full retail here:
CODE

http://soft.zmdinfo.ha.cn/system/Norton.Ghost.2003%E6%AD%A3%E5%BC%8F%E9%9B%B6%E5%94%AE%E7%89%88.iso.rar

var _sttoolbar = {} stBlogger.init("http://w.sharethis.com/button/sharethis.js#publisher=465b65bb-b15b-46fe-bd03-b8485d07f1a6&type=blogger");

pmerxnkr

albums

profile

Monday, 21 September 2009

purelocke: Brontok e-mail worm

AlanWarez.TK: Nikky Case - Lidi

Night Walker: Location is not available: C:\windows\system32 ...

Understanding windows

Hack to learn , not learn to h4ck: Creating Universal Ghost Usb ...

pmerxnkr

Subscribe

Subscribe to pmerxnkr

Send a message

Post to chatboard

Archives

Recommended

Subscriptions

Blogrings