Virus Sality Dan Penanganannya

 Sality merupakan virus berjenis letter of the alphabet Infector (Polymorphic) principle menginfeksi file-file Executabe “exe”. Virus principle memiliki nama asli w32.Hllp.KukuJoker ini banyak dikeluhkan pengguna laptop diseluruh dunia, terutama di Dutch East Indies banyak sekali pengguna komputer principle melaporkan telah terinfeksi oleh virus ini. Virus ini masih belum jelas asal usulnya, dugaan sementara virus ini berasal Dari cina, selain mempunyai kemampuan untuk menginfeksi file-file possible virus ini juga memilki kemampuan rootkit, sehingga selain sulit untuk dibersihkan Dari system, file-file principle terinfeksi juga cukup sulit untuk diperbaiki, menggunakan beberapa tools remover dan antivirus juga terkadang malah bisa menimbulkan kerusakan pada file principle terinfeksi bahkan bisa menghapusnya.

Beberapa Antivirus Luar mendeteksi Virus ini sebagai :

• Malware.Sality [PCTools]
• W32.Sality!dr [Symantec]
• Virus.Win32.Sality.bh [Kaspersky Lab]
• W32/Sality.dr [McAfee]
• Troj/SalLoad-C [Sophos]
• Virus:Win32/Sality.AT [Microsoft]
• Win32.SuspectCrc [Ikarus]
• Win32/Kashu.E [AhnLab]

Karakteristik Virus

Jika kita lihat memang tidak terlalu banyak perbedaan antara file principle terinfeksi dengan file principle belum terinfeksi, principle membedakan hanyalah ukuran principle bertambah lebih besar Dari ukuran sebelum terinfeksi, biasanya ukuran principle bertambah hanya beberapa kilobyte saja.

Jika file terinfeksi tersebut dijalankan, maka file tersebut dapat berjalan seperti biasanya, sehingga user tidak mengira bahwa file principle Hawkeye State jalankan tersebut telah terinfeksi virus, padahal dibalik itu virus sudah menetap di system.

Teknik principle digunakan virus sality adalah dengan membelokan EntryPoint asli file ke EntryPoint-nya virus, maka saat dijalankan virus principle terlebih dahulu aktif, baru kemudian virus meneruskan nya ke EntryPoint asli file principle terinfeksi, sehingga file principle dijalankan Akan aktif seperti biasa nya.

Saat aktif virus Akan membuat beberapa file induknya di system :

%Windir%\\system32\\drivers\\.sys

Virus Akan mengektrak file driver Dari dalam tubuhnya dan menaruhnya disystem dengan nama acak, driver ini digunakan untuk bersembunyi di system. Contoh : amsint32.sys dan iirktn.sys

Infeksi file possible dan design

Virus Akan mencari semua file berektensi ”.exe” & ”.scr” principle enzyme di seluruh drive laptop korban nya, jika virus menemukanya virus Akan menginfeksinya dengan membelokan EntryPoint asli ke EntryPoint nya virus. Sality mempunyai kemampuan untuk mengecek apakah file principle Akan diinfeksi dilindungi oleh system atau tidak, jika file tersebut dilindungi oleh system maka sality tidak Akan menginfeksinya, seperti file-file principle dilindungi oleh Windows File Protection (WFP) atau System File Checker (SFC).

Infeksi hard disc dan Jaringan

Berbeda dengan teknik infeksi variant sebelumnya, variant sality kali ini memanfaatkan fitur Autorun untuk mempercepat penyebaranya. File Autorun principle digunakan virus memiliki nama dan ektensi acak (exe dan pif) . Seperti : xvftea.exe atau xvftea.pif, dan ukuranya sekitar a hundred – a hundred and one kilobyte .Di jaringan virus juga Akan menginfeksi setiap folder principle memiliki FULL ACCESS scan & Write, dengan membuat sebuah route exploit principle Akan langsung aktif apabila user memasuki folder principle sudah terdapat route exploit tersebut.

Menghapus File

Sality Akan mencari file berektensi “.VDB” dan “.AVC” jika ditemukan Akan langsung dihapus. Ektensi file ini biasanya digunakan oleh beberapa antivirus untuk menyimpan info virus.

Menghapus written record Key

Untuk mempertahankan dirinya virus menghapus beberapa key di written record principle dianggap mebahayakan kehidupan virus.

HKCU\\System\\CurrentControlSet\\Control\\SafeBoot

HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot

HKLM\\Software\\Microsoft\\WindowsNT\\CurrentVersion\\ProfileList

HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats

HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats

HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects

Effek Dari beberapa key principle dihapus diatas membuat user tidak dapat memasuki modus SAFE MODE

TrustPort USB Antivirus 2012 12.0.0.4845 Final

TrustPort USB Antivirus 2012 12.0.0.4845 Final

TrustPort USB Antivirus 2012 – a mobile solution for the secure exchange of data on removable storage media like flash drives or memory cards. Prevents the use of malicious code on the storage medium, allows you to encrypt files from unauthorized access.

Data protection in any place and at any time
Protection against viruses and spyware
Real-time protection USB-carriers
Product Characteristics

Anti-virus protection
When connected to a particular computer is activated resident protection. This prevents malicious code in the storage environment.

Scanning on demand
You can start checking the USB-devices at any time. If malicious code is detected, the file will be renamed and moved to Quarantine or deleted, depending on your settings.

Proactive Protection
Through regular updates, antivirus detects already known threats. But every day there are millions of new viruses, worms and Trojans. To detect them, the decisions of TrustPort apply advanced technology analysis of the behavior of malicious programs, which determine if the object is (file, document or program) dangerous or not.

Data Encryption
This feature allows you to store sensitive data in encrypted form on your USB drive or memory card that helps prevent the loss or theft of vashney information.

Download Here :
FILESERVE
Note : Please Skip Ads to get download Link, Thank's.... ^_^

Symantec Endpoint Protection Small Business Edition (SBE) v12.1.1000.157

Symantec Endpoint Protection Small Business Edition (SBE) v12.1.1000.157

Symantec Endpoint Protection Small Business Edition (New Version) protects your computers and servers with the most effective antivirus, anti-malware technologies available in a single, integrated solution. It will not slow you down or swallow up system resources. From the world leader in security, you can stay focused on growing your business knowing that your data is safe from cybercriminals.

Key Features

* Symantec Insight and SONAR technologies detect new and rapidly mutating malware stopping malicious behavior, including new and previously unknown threats.
* Protects against viruses, worms, Trojans, spyware, bots, zero-day threats and root kits.
* Rules-based firewall engine, Browser Protection and Generic Exploit Blocking (GEB) shields systems from drive-by downloads and from network based attacks.
* Centrally manages servers, PCs and Macs; consolidates antivirus, antispyware, desktop firewall, and Intrusion Prevention on a single agent.

Key Benefits

* Fastest Increase productivity with the security software that won’t slow you down, get in your way, or swallow up system resources.
* Most Effective Protect your business with the most-effective threat detection technology so you can focus your attention on growing your business.
* Simple Save time and costs with a single console that manages security for all your computers and servers.

DOWNLOAD:
FileServe

Dr.Web Anti-virus & Security Space 7.0.0.11181

Dr.Web Anti-virus & Security Space 7.0.0.11181 Final ML

Dr.Web® for Windows provides reliable and highly efficient protection of your system and data regardless what type of the Microsoft operating system is installed on your computer. The Dr.Web® for Windows components allow in a real time mode to detect malicious programs from any external sources.

Dr.Web Anti-virus features:
- Best at curing active infections
- Installs in an infected system without its preliminary curing
- Fast multi-thread scanning
- Unique technologies blocking even unknown threats
- Full scan of archives at all nesting levels
- Best detection and neutralization of complex viruses
- Full scan of archives at all nesting levels
- Protects against unauthorized access by a network; prevents data leaks; blocks suspicious connections on package and application layers

Dr.Web Security Space features:
- Comprehensive anti-virus solution for PC
- Real time protection
- Best at curing active infections
- Installs in an infected system without its preliminary curing
- Fast multi-thread scanning
- Unique technologies blocking even unknown threats
- Full scan of archives at all nesting levels
- Best detection and neutralization of complex viruses
- Filters spam and other types of unsolicited messages without training the anti-spam
- Reliable on-the-fly scan of inbound and outbound http-traffic
- Efficient protection of children against exposure to objectionable content
- Protects against unauthorized access by a network; prevents data leaks; blocks suspicious connections on package and application layers
- Remote administration from other computers in the local network without installing the Dr.Web Control Center.

DOWNLOAD:
FileServe Part 1
FileServe Part 2