Daily Internet Activity

Original posting from: http://forums.sureshkumar.net/showthread.php?t=7790
Here the posting:

It is one of the most powerful Trojan /virus I have ever seen.. If your computer is infected with this virus ” It will sends the nsl-school.org url to all of your friend list in yahoo messenger using your ID . So with in few hours many of your friends will get infected with it.

I don’t know the actual target of the idiot who created it. May be to advertise his site or to steal very imp data from your computer. I resolved the problem manually from 2 infected PC’s. Just go through the below steps carefully.

What are those links ?:

Nsl-school.org or other (Do not open this url in your browser).

If you are infected with it what is going to happen ?

1: It sets your default IE page to nsl-school.org, you can’t even change it back to other page. If you open IE from your comp some malicious code will automatically executed into your computer.

2: It will disables the Task manager / reg edit. So you can’t kill the Trojan process anymore.

3: Files that are gonaa installed by this virus are svhost.exe , svhost32.exe , internat.exe.

you can find these files in windows/ & temp/ directories.

4: It will sends the secured & protected information to attacker

How to remove this manually from your computer ?

1: Close the IE browser. Log out messenger / Remove Internet Cable.

2: To enable Regedit

Click Start, Run and type this command exactly as given below: (better – Copy and paste)

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

3: To enable task manager : (To kill the process we need to enable task manager)

Click Start, Run and type this command exactly as given below: (better – Copy and paste)

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

4: Now we need to change the default page of IE though regedit.

Start>Run>Regedit

From the below locations in Regedit chage your default home page to google.com or other.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main

Just replace the attacker site with google.com or set it to blank page.

5: Now we need to kill the process from back end. Press Ctrl + Alt + Del

Kill the process svhost32.exe . ( may be more than one process is running.. check properly)

6: Delete svhost32.exe , svhost.exe files from Windows/ & temp/ directories. Or just search for svhost in your comp.. delete those files.

7: Go to regedit search for svhost and delete all the results you get.

Start menu > Run > Regedit >

8: Restart the computer. That’s it now you are virus free.

I don’t know whether any removal patch that works for this Trojan/virus. But we can easily delete it manually.

** Send this URL to all of your friends through messenger so that they can get rid off this virus. **

Digg it

Conclution : Better not to open any unknown url from your Computer.. There are lot of black hat hackers who are waiting to steal your credit card numbers, passwords or what not…. Use a better firewall & updated anti virus. However an Antivirus can do nothing if the virus is very latest…

Let me know if you need any more help…

To know more about protecting your passwords.. read my other article here..
http://forums.sureshkumar.net/showthread.php?t=94

Cheers,
Sureshkumar CH,
Information Security Specialist.
www.sureshkumar.net.

do you want to archive your yahoogroups? Try this script:

http://www.tt-solutions.com/en/products/yahoo2mbox/

What is it?

yahoo2mbox is a small Perl script which retrieves all messages from a mailing list archive at Yahoo! Groups (there is a missing copyright sign somewhere here probably) and stores them into a local file in MBOX which is recognized by all Unix mail readers and good many of other ones.

Again, i got this links from Onoy*** (much thank to him).

manage ponsel anda dg program berikut
fitur send/recieve/edit ringtone, logo,sms, game ponsel dari PC. syncronin
phonebook ponsel dg outlook (PC)

Manage your handset using this application.
Features:

• Send/Recieve/Edit Ringtone, Logo, SMS, Game
• Syncronize With outlook.

http://rapidshare.de/files/34947491/Nokia.PC.Suite.6.81.13.0._EnG_.ra
MD5: 6FAA429D42D65CB523E5FD9A4CEB4942 15.99 MB

http://rapidshare.de/files/34947481/NokiaSoftwareUpdaterSetup_en.exe
MD5: B29D7054DFA29DB730C3F1295B471BBF 14.82 MB

http://rapidshare.de/files/34947475/MOBILedit.1.99.0.5.rar
MD5: B43A30C3145F5269F3336C03AD88702E 15.06 MB

http://rapidshare.de/files/34947459/Oxygen.Phone.Manager.II.2.8.5.2.rar
MD5: 6275CFDF1CB20AC1313A653449EC4EB6 13.11 MB

http://rapidshare.de/files/34947427/MobTime.Cell.Phone.Manager.5.3.1.rar
MD5: C55DAEF92BF9F31FE66C5A0144985377 8.72 MB

enjoy it…

If you got some difficulty to download that links, try download using this application:
http://rapidshare.de/files/34469411/RapGET111_SSLono.zip
MD5: 91287C15055B8E26C2A6F3634B15D899 1.34 MB
You must read the tutorial.