Devirusare Show la webcam gratis http://webcamsex.lx.ro asteapta sa se incarce java si dai run – NU da click pe link

Daca primiti pe Yahoo Messenger un mesaj ca cel de mai jos, NU DATI CLICK !

Show la webcam gratis http://webcamsex.lx.ro asteapta sa se incarce java si dai run

Infectia se produce prin rularea automata a unui JAR, direct in browser (deci orice browser e vulnerabil).

Acel JAR ceeaza si executa un fisier VBS, si de asemenea descarca si executa un fisier EXE.


Detectie actuala:

File Info

Report date: 2010-05-04 05:50:21 (GMT 1)
File name: server.exe
File size: 51809 bytes
MD5 Hash: e4eeaf3cdf492139b7686ac721d9cbdf
SHA1 Hash: 1ac7a023747d56c30e1d48c92b24a3c47acc7bb4
Detection rate: 17 on 20 (85% )
Status: INFECTED

Detections

a-squared – Virus.Win32.Bifrose!IK
Avast – Win32:Bifrose-DPA [Trj]
AVG – BackDoor.Generic_c.PZ
Avira AntiVir – BDS/Agent.BKY
BitDefender – Backdoor.Bifrose.AAGY
ClamAV – Trojan.Bifrose-693
Comodo – Backdoor.Win32.Bifrost.~AEC
Dr.Web – BackDoor.Bifrost.515
F-PROT6 – W32/Backdoor.ACFX
G-Data – Trojan.Win32.Agent.bcn A
Ikarus T3 – Virus.Win32.Bifrose
Kaspersky – Trojan.Win32.Agent.bcn
McAfee – BackDoor-CEP.svr trojan
NOD32 – Win32/Bifrose.ADR
Panda – Bck/Bifrose.BHL
Solo – -
TrendMicro – BKDR_BIFROSE.MIC
VBA32 – Trojan.Win32.Agent.bcn
VirusBuster – -
Zoner – -

Scan report generated by
NoVirusThanks.org


Devirusare automata:

Cine are instalat Kaspersky Antivirus 2010 sau Kaspersky Internet Security 2010, sa faca update la definitii si sa ruleze o scanare completa a sistemului.

Atentie ! Cine are alt antivirus instalat, urmati pasii de mai jos(instalarea Kaspersky Virus Removal Tool 2010 9.0.0.722 NU implica dezinstalarea antivirus-ului vostru de pe sistem).

Descarcati

Kaspersky Virus Removal Tool 2010 9.0.0.722

Instalati-l, scoateti cablul de Internet/modem/etc, opriti protectia real-time(scutul) antivirus-ului instalat pe PC si scanati complet sistemul acest utilitar.

La terminarea scanarii stergeti toate fisierele detectate.


Devirusare manuala:

Stergeti urmatoarele fisiere si foldere:

%AppData%\addon.dat
%System%\Bifrost\servver.exe
%System%\Bifrost
C:\Documents and Settings\Administrator\Local Settings\Temp\update.exe
C:\Documents and Settings\<USER>\Local Settings\Temp\update.exe

*unde <USER> este profilul actual din Windows.

Stergeti urmatoarele chei de registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_CURRENT_USER\Software\Bifrost