Annie, 'Beautiful Women' Deadly

Who is not fascinated by beautiful women . When used as bait , they are often successful in reaching the victims . Including current used to run a cyber crime .

It is also the source of inspiration for local malware makers are being raged in Indonesia in recent months .

G Data detect this virus as Annie.sys , Beautiful Girl or as Trojan.JS.Autorun.A . With the lure of a file called ' Beautiful Girl ' aka beautiful woman , this malware successfully attract potential victims to malware managed to become one of the most talked about online communities in Indonesia.

This malware has the action of the ' magic' because it has the ability to html injection and infection victims through html files as malware Ramnit .

In addition , he also has a payload that is quite troublesome as did blocking of many administrative functions such as Windows Registry Editor , Task Manager , Microsoft Management Console , File Association , System Restore , hide file extensions and can not show hidden files ( hidden ) .

Not enough action on top , he also blocking the supporting applications that are commonly used to clean up malware like Kill Process , attrib , SysInternals Autostart , SysInternals Process Explorer , RegAnalyzer , blocking computers to run inf file and registry cleaning with the aim of preventing the virus .

Vaksincom feel the need to discuss this malware because the malware threat is indeed great many casualties and several files derivatives is still hard to detect by antivirus famous though .

This malware can be said to be a notch above other local viruses because in addition to doing the activities mentioned above also have injection capability MS Office and HTML files .

Unfortunately , if the html file is run on another computer , similar to the way a beautiful woman Ramnit infection this one will be able to infect victim computers .

Be careful if you encounter a file with a name that is quite tempting , especially with the video icon because the virus usually uses file names are ' exotic ' curiosity to invite the user to the file.

As performed by one of the viruses will disguise himself Trojan.JA.Autorun.A by making 5 shortcut files in each drive with the name Beautiful_girl_part_1.lnk s / d Beautiful_girl_part_5.lnk .

Same as that of the Ramnit Virus , the virus will also inject file HTM / HTML to spread itself by inserting code in the footer file HTM / HTML . G Data Antivirus with Active Hybryd technology and Close Gap technology detects this malware as Trojan.JS.Autorun.A ( see figure 1 )

Malware is created using Java Script language program with a file size of approximately 9 kb . By the time the file is activated it will run the file wmplayer.exe or windows media player ( see figure 3 ) with the goal of deceiving victims who expect beautiful women videos .

The main purpose of this action is to run a script contained in the file , and then will make a master file that will be stored in multiple locations .

To trick the user , the virus will make five (5) pieces of the file shortcut ( lnk ) to be stored in all root drives including removable media / USB Flash .

The shortcut file contains a script to run annie.ani existing file on the same drive ( Script annie.ani file C: \ Windows \ system32 \ wscript.exe / / e : jscript.encode annie.ani / q : 1 ) , so that if the user runs the file it will automatically activate the virus by first going to run the program Windows Media Player ( wmplayer ) .

Posted in: Internet