ကၽြန္ေတာ္ စိုးမိုးသူ ၏ မွတ္တမ္းမ်ား: December 2010

loikaw virus ရွင္းပစ္ခ်င္သူေတြအတြက္ ပါဗ်ာ

ကၽြန္ေတာ့္ memory stick ထဲမွာ လြဳိင္ေကာ္ ေရာက္ေနျပီတဲ့ သူငယ္ခ်င္းက ေျပာလာတယ္
ငွားသုံးတဲ႕သူငယ္ခ်င္းကေျပာလာတယ္ ဒါနဲ႕ ဘယ္လိုရွင္းပစ္ရမလည္း ရွာရင္း ထိုင္း ဘေလာ့ဂ္တစ္ခုမွာ ေတြ႕လိုက္ရတဲ့ software ေလးတစ္ခုကို စမ္းသုံးၾကည့္တာအဆင္ေျပသြားပါတယ္

Loikaw ကို
Update 05/06/2010
Loikaw.exe
Filesize: 244,675 bytes
MD5: EABB037DF4126080B26D2ABFEA51CE9B
SHA-1: F6C1A824B27FCB81976088308900426265DADED4
===================================================
Virus loikaw ၀င္ျပီ ဆိုတာနဲ႕ message box မွာဒီလိုျမင္ရမယ္

Welcome to loikaw in kayah
chi thu loikaw kola par nor
write by comput5r3razygirl@gmail.com
"loikaw hacking day" 3D virus for jan

Virus Information.txt အထဲမွာ ဖတ္ၾကည့္ရင္

Hi fri “Administrator”
It is nice to meet you . . . .
I ko thi lar, see yin kaw kin mar lar, i ka talk khin tat tal nor . . . .
I ka girl nor, chit mar lar . . . . .
I ka u computer ko bar ma, ma loat par buu khin lo Virus write pi talk sa tar ko , he` he` . . .
Sate so ya buu nor i ka di lo pae` . . . . ya tal ma hote lar I name ko thi chin lar? pyaw pya par buu; bar lo pyaw pya ya mar lae` u ka boy lar, age ka kaw?
i ka 18age girl i gamil ka comput5r3razygirl@gmail.com bye bye . . . luu soe . . . fly kiss . .

------------------------------------------------------------------------
Files created
C:\autorun.inf
C:\Temp.pif
C:\Documents and Settings\[UserName]\Application Data\control.exe
C:\Documents and Settings\[UserName]\Application Data\Microsoft\CD Burning\Mp3.exe
C:\Windows\Loikaw.exe
C:\Windows\Jan.exe
C:\Windows\System32\extramain.exe
C:\Windows\System32\Iexplorer.exe
C:\Windows\%UserName%.exe
MD5: EABB037DF4126080B26D2ABFEA51CE9B
SHA-1: F6C1A824B27FCB81976088308900426265DADED4
------------------------------------------------------------------------
C:\Documents and Settings\[UserName]\Desktop\Virus Information.txt
C:\Documents and Settings\[UserName]\Application Data\Microsoft\CD Burning\autorun.inf

Registry Modifications
Keys Added
HKLM\SOFTWARE\Classes\soesoe
HKLM\SOFTWARE\Classes\soesoe\DefaultIcon
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system

Values Added:
HKUM\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
\DefaultIcon :(Default) = "%System%\winlogon.exe,0"
HKLM\SOFTWARE\Classes\soesoe\DefaultIcon
Default = "%System%\mshearts.exe,0"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
load = "%Windir%\Loikaw.exe"
* = "%AppData%\control.exe"

Values Midified
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFind = 0x00000001
NoFolderOptions = 0x00000001
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableTaskMgr = 0x00000001
DisableRegistryTools = 0x00000001

Value deleted:
HKLM\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon:(Default) = "%SystemRoot%\Explorer.exe,0"
(C:\WINDOWS\System32\shell32.dll,15)
------------------------------------------------------------------------
Virus : Loikaw.exe (update 05/06/2010) ကို ေအာက္မွာျပထားတာေလးနဲ႕ ရွင္းထုတ္ရေအာင္
ခ်ၾကည့္ဗ်ာ ကၽြန္ေတာ္ကေတာ့ ဒါေလးနဲ႕ အဆင္ေျပသြားတယ္
------------------------------------------------------------------------

စမ္းၾကည့္လိုသူေတြအတြက္ပါ
ဒီမွာေဒါင္ူးႏိုင္ပါတယ္