Continuing the previous article Close Up with Stuxnet, in this article I will try to write about how to clean and repair Stuxnet virus.

If  Stuxnet already succeeded to infiltrate your computer, Stuxnet will make some files as follows :

1. C:\WINDOWS\system32\winsta.exe
Winsta.exe files created by this Stuxnet, will enlarge to the remaining disk space, and will causing
your hard drive becomes full (usually will attack the C drive or OS system).
2. C:\WINDOWS\system32\drivers\mrxcls.sys, and
3. C:\WINDOWS\system32\drivers\mrxnet.sys

File mrxcls.sys and mrxnet.sys an active file used by Stuxnet to infect computers and other devices connected (such as USB flash / removable disk).

In addition to making files above, Stuxnet also will infect some the following important file system :

1. Svchost: this files related to network connections, with infected this file Stuxnet will be make the network disconnected.
2. LSASS: when this file is infected will make the computer slowly, hangs and restarts.
3. Spoolsv: If the file is infected will be that the computer cannot print.

When the third file system above it has infected by Stuxnet, computer will automatically run slow or hangs, and if your computer have connected to the network, your connection will be disconnected.

Stuxnet also will make modifications to your computer registry, some register changed are:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCls
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxNet
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxNet
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxCls
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET

Obtained from several sources that I have read and from some case that has ever addressed the following steps is effective enough to clean or remove the virus Stuxnet :

1. Clean and Remove Stuxnet virus with removal tools from Dr Web CureIT. Download and run removal tools from Dr Web CureIt, you can download this tool at http://www.freedrweb.com/download+cureit/

2. Fix computer registry
Fix the windows registry that has been modified by a virus Suxnet, with copy the script below, use WordPad or Notepad and save it with name repair.inf

[Version]
Signature=”$Chicago$”
Provider=Project-880
[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, SuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt,0×00010001,0
HKLM, SOFTWARE\CLASSES\batfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\comfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\exefile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\piffile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”

[del]
HKLM, SYSTEM\CurrentControlSet\Services\MRxCls
HKLM, SYSTEM\CurrentControlSet\Services\MRxNet
HKLM, SYSTEM\ControlSet001\Services\MRxCls
HKLM, SYSTEM\ControlSet002\Services\MRxNet
HKLM, SYSTEM\CurrentControlSet\Services\Enum\Root\LEGACY_MRXClS
HKLM, SYSTEM\CurrentControlSet\Services\Enum\Root\LEGACY_MRXNET
HKLM, SYSTEM\ControlSet001\Services\Enum\Root\LEGACY_MRXClS
HKLM, SYSTEM\ControlSet002\Services\Enum\Root\LEGACY_MRXNET

Run repair.inf file by right clicking this file name on file explorer then select install and restart your computer.

To prevent the rest of the trojan tries to be active again, clear the temporary files using software such as ATF Cleaner or using Microsoft Windows program application Disk Clean-Up.

3. Prevention of virus attack again

To prevent a virus infects a computer again, you can use the following script:

@echo off
del /f c:\windows\system32\winsta.exe
rem rd c:\windows\system32\winsta.exe
md c:\windows\system32\winsta.exe
del /f c:\windows\system32\drivers\mrxnet.sys
rem rd c:\windows\system32\drivers\mrxnet.sys
md c:\windows\system32\drivers\mrxnet.sys
del /f c:\windows\system32\drivers\mrxcls.sys
rem rd c:\windows\system32\drivers\mrxcls.sys
md c:\windows\system32\drivers\mrxcls.sys
attrib +r +h +s c:\windows\system32\winsta.exe
attrib +r +h +s c:\windows\system32\drivers\mrxnet.sys
attrib +r +h +s c:\windows\system32\drivers\mrxnet.sys

Save this file with the name “winsta.bat”, then run this file by double click on this file name.
For optimal cleaning and prevent the virus infects a computer, scan your computer again using the antivirus that has been updated and can recognize this virus very well.

Security experts said Stuxnet is cyber weapons, which was created as a tool of terrorism

in cyberspace, which until now still not known who was behind the attack Stuxnet. There are rumors, saying that the virus is designed to attack large industrial systems, and nuclear sites in Iran is one of the objectives of this virus attacks. If the rumor is true, then it is possibility that a virus has been created with an intervention by a country or institutions that have substantial funds which has the intended  to infiltrate another country’s national security system.

How to Stuxnet can infected a computer ?
- This virus spreads via USB thumb drive storage device that has been infected, by exploiting vulnerabilities in Microsoft Windows operating system.
- This virus will spread in share network that has a acces level full.

How about widespread Stuxnet ?
From the research that has been done by a computer security firm Symantec, shows that countries affected by this virus attack on August 6 is, Iran with a number of computers infected 62.867 computers, Indonesia 13.336 computers, India’s computer 6.552, the United States 2.913 computer, Australia  2.436 computers, England 1.038 computers, Malaysia 1.013 computers , and Pakistan 993 computers.

Who was first identified this virus attack ?
Belarus Companies Virusblokada is the first was identified this virus in mid-June.

How much harm could be caused by this virus?
These viruses will steal the victim’s computer information, it was reported that when a virus attacks the SCADA system, the virus can take over the machine control system. In a modified variant of this virus were reported, in the Vista operating system will causes the hard disk becomes full.

Therefore some information about Stuxnet. In the next article I will try to write how to prevent and eliminate this virus from your computer.

Here are the signs that usually occur when viruses attack your computer:
-          You will feel your computer runs slower than usual.
-          Computer suddenly stopped or not responding, and often occurs.
-          Computer suddenly restart or crash, and this happened within a few minutes.
-          Computer suddenly restart and can not run normally again.
-          Computer applications can not run normally.
-          Hard drive or disk drive can not be accessed.
-          Printing activity does not work correctly.
-          Often appears strange and unusual error message.
-          Frequently appear damage dialog box.
-          Function ctrl alt del on microsoft windows has been disable.
-          Same as the previous on command Regedit and MSConfig can not be done.
-          Original folders on your computer has been hidden and replaced with virus files.
-          On Tools Menu, folder options in windows explorer has been missing.
-          Appears files with folder icon but it’s has type file exe.

The things above are common symptoms that occur when a computer infected by computer viruses, but could have some of the above happened because of interference on your computer hardware or software. It is recommended to prevent virus attacks to the computer, you should always make your data definition AntiVirus keep to up-date and do not forget to make backups regularly all your important data.

As you know now we are living in the a world of technology with almost every job are being performed by computers. It can you imagine what if when you are working in the deadline project suddenly your computer system displays a blank screen?  “The data which appears to be lost and inaccessible, don’t panic actually your data is not will lost forever. The lost data can be recovered with data recovery software and services.”

Data Recovery is defined as a scientific approach followed to get back the lost and inaccessible data. This can be made possible through data recovery software utilities and services.

1. Data Recovery software effectively recovers and repair files, databases, storage media, corrupt partitions and brings back your data safely. The recovery software are helpful and effectively recovers back your lost, deleted data, which can be easily purchased through on-line sale transactions.

2. Data Recovery Services are usually performed when the software to recover data is unable to recover your data or the complexity of the damage to data is to such an extent that specialized attention of the data recovery technician is required. This generally happens in cases when your hard drive or storage media indicates the following symptoms:

- Clicking noise from the hard disk drive

- Drive not recognized by the BIOS

- Fire and water damage

- Hard disk component failure

- Computer is not bootable and many other undefined reasons.

The specialist data recovery service providers offer services to recover data from hard disks of desktops and laptops, RAIDs, Tape media, Pen drives, Zip drives, Compact disks, DVDs, Digital Cards, Memory Cards etc where data gets lost due to Logical and Physical crashes.

Data recovery services are the most efficient and economical way to recover your data and files. If you choose for data recovery services you can be assured that you will get back your data.

Some steps to make your computer safe from Viruses

As you all has know computer today have become a central to our lives. But unfortunately computer are also has vulnerable to attack from a variety of sources, with viruses being one of the most malicious and troublesome. Even though  the virus written with simply code, but must still vigilant  because the virus has probability to make damage the files on your computer, or it may act as a way for a hacker to access your personal data on your computer.

Clearly, if you want to keep your computer and the information safe from these kinds or threat, you’ll must take steps to keep your computer safe from viruses. This means getting security and utilities software, such as an antivirus program, firewall etc.
here below is some simple steps to make your computer safe form virus :

1. Understand viruses. One saving grace of viruses is that, like the programs you install on your computer, they generally can’t do anything until they are run by you. Unfortunately, some of the more clever viruses are designed to trick the user into running them without realizing that is a threat exists. For example, in the earlier days of email, it was fairly common for people’s email programs to automatically save and run attachments in emails; if that attachment was a virus, then that virus was basically allowed to infect the user’s computer as soon as they checked their email.
Sometimes a virus may be hidden inside another program that appears entirely benign. In this case, it’s important to have antivirus software that can spot the hidden threat and neutralize it before it does any damage.
2. Get yourself high-quality virus protection software. Without any antivirus software, the user is saddled with the responsibility for detecting viruses and preventing them from damaging their computer. Even the most savvy computer user would find this a time-consuming and formidable task. (It may not be able to undo everything, particularly if files were deleted or if the virus transmitted personal information to identity thieves or other malicious characters.)
3. Keep your antivirus software up to date. Although the latest antivirus software can protect your computer from an enormous inventory of existing viruses, it won’t necessarily be able to safeguard your computer from any new viruses that are developed. For this reason, companies that produce antivirus software often include a one-year subscription to keep your antivirus up-to-date so that it can recognize any new viruses that may manifest.

Some of us may already use (OS) from Microsoft’s latest operating system, but carefully Have we realized this one was different OS versions of Microsoft’s previous output. Failure of Microsoft in Vista seems to be a lesson for the latest output is not experiencing similar things and more successful than the record of spectacular success of Windows XP.
Let us dismantle surplus from the previous version of  Microsoft Windows 7

Microsoft has claimed that Windows is an operating system that is designed to suit the tastes of users who want a computer that is simple and convenient, but can work with a fast, lightweight, no fuss, a little click, easy to use and not complicated.
Comparison of Windows XP, Vista and Windows 7

Here are the benefits of Windows 7 which is claimed by new boss Bill Gates, Microsoft’s successor, Steve Ballmer:

1. Finding files fast
To find the file is not too difficult and time consuming. Do I just click on the Start menu and type in the search box what will be searched. Once open, select what you want and quickly be realized.

2. Seeing all the windows with ease
At a time when many windows open, sometimes we confused the name or contents. Windows 7 to help you see him easily with just a peek of the taskbar. The trick with flying-Lift cursor over an icon from an open window will appear the name of the icon and the program.

3. Secretly peeked your desktop
Many times we have to close the window one by one to see the desktop. This feature helps you peek Peek Aero desktop without touching the window. How to cast your cursor over a square box on the bottom right corner. Click above to minimize all open windows. When the desktop screen opens, click Nagi to show again.

4. Finding what you want very easily
Jump List in Windows 7 helps you search for files, songs, pictures, or other documents in the desktop quickly. This reduces the wasted time you find a document that operated yesterday. This feature is no start menu and taskbar. With 1 click, you can view websites that are often used in Internet Explorer 8. You can attract and remove a file from the Jump List.

5. Compare 2 windows
Snap Feature to help us look back at the window with better and easier to compare two documents to each other. How to draw a window to one side of the screen. When the mouse pointer to the other side, the window will snap half of the screen. To extend it vertically, drag the border to the edge of the screen. When the mouse pointer on the edge, the window will snap to the vertical penuh.Satu Click D

6. One Click Can All
With the pin feature, you can access the taskbar with one click. Hover the cursor over your favorite program and drag it to the taskbar. Or right click on it and select “pin” in the Taskbar. Your program will be a pin. To open, click on the Taskbar icon. You can open the pin with another program at the time.

7. Set-up Wireless Easy
With Windows 7 wireless set-up much easier. You can add others, including network printers and digital media players. You do this by launching the wizard “Add a Device” and then type the pin location on mobile devices.

8. Surf the Internet with Fast, Safe and Easy
Internet Explorer 8 makes use of the Internet so more quickly, safely and easily. Through the web slices, you can keep track of specific information. It’s easier to follow than an auction on eBay or the latest news from ESPN. With instant contact search on the internet explorer, the results can be followed in real time. The search results are also equipped with the SmartScreen, the filter that protects you from spam, viruses and other. While InPrivate help you explore the virtual world of privacy after closing the browser.

9. Personalise Your Computer
With Windows 7, you’re not too hard to make the computer more personal. You do this by right click on desktop then click personalize to choose from many themes of interest or turn the desktop back into the slide show your favorite photos. Click on Gadgets to add information that is often needed on the desktop.

Virus Stuxnet a dangerous virus turned out to have the potential to replace Conficker, because there are more dangerous than Conficker Stuxnet.

“Virus Stuxnet actually has emerged since some time ago and the newly emerging again in recent days,” said Regional Manager of Symantec’s Consumer Product Marketing Asia Pacific David Hall.

“Nevertheless,” Hall added, “Stuxnet could replace Conficker because it is much more dangerous.”

if  we see from the dangerous level of the virus, virus Stuxnet  have possibility to replace Conficker  who has make horrendous many computer users in a few years ago.

“However, today the computer users need not worry because many antivirus companies,  has try to always make update they technology so that the antivirus can be overcome Stuxnet virus. That’s  included Norton Internet Security 2011, that had just launched,” Hall said.

As reported earlier, Stuxnet has be suspected to sabotage the cripple nuclear industris systems that exist in Iran. This is after 60 percent Stuxnet successful attack computer systems in the state, Symantec predicted 18 percent of computers in Indonesia have been infected Stuxnet.

Currently, malware is predicted to have infected approximately 45,000 computers in the worldwide. Siemens AG, a company that designs systems to target the virus, said if Stuxnet has infected 15 power plant control systems, including water filtration systems, oil drilling, electricity and nuclear power.

For those of you who use internet, you should be careful if you try to visit a website address which is indicated as have pornographic content, or for you who always visiting cracking site for download software crack, because without you realize when you try to use the crack code,  it will be could cause turned out the file that actually contains a trojan script “Stuxnet or Winsta“.

If you’ve already run the file, the “Stuxnet” will managed to infect a computer, and will make some files as follows:
-    C: \ WINDOWS \ system32 \ winsta.exe
-    C: \ WINDOWS \ system32 \ drivers \ mrxcls.sys
-    C: \ WINDOWS \ system32 \ drivers \ mrxnet.sys

File “winsta.exe” made will swell for the rest of the existing hard disk space, it will be causing the hard drive becomes full (usually the C drive or system of the OS).  While the file is a file mrxnet.sys and  mrxcls.sys actively used to infect other computers and devices that are connected ( like USB flash or removable drive ).

Actually Winssta.exe is the original files of Windows that is useful for WinStation Monitor, which is one of the tools from Microsoft that is used in Windows 2000 to monitor Terminal Services client session. Location of these files should also be located at C: \ ProgramFiles \ Resources \ winsta.exe. For further information on the following article you can see at http://support.microsoft.com/kb/320190

Some of the symptoms and effects that occur if you are infected with a trojan “Stuxnet” is as follows:

- Hard-disk computers in the network suddenly fully and your will get a warning “Low Disk Space”. Winsta.exe will growing and make adjust the remaining disk space you have (the C drive or system OS).

- The notification from windows system which informs that the rest of your disk space is empty will appears.

- Because of your disk space is empty, so you can not store data again or you can run certain programs that require hard drive space / use the cache.

- The computer will seem to hang or slow, if you are connected to network, you will be disconnected from the network, because some windows system files that become victims of infections are:

1. Svchost: files relating to network connections, with this file to infect the network will be disconnected.
2. Lsass: making slow and the computer hangs and restarts itself, this was done by infecting files.
3. Spoolsv: can not print data via a printer, this is done with this file to infect.

Trojan Virus “Stuxnet” It spreads by exploiting usb storage or full access network. Trojan infected computer will do automatically, because by creating execution files which name,
~ WTR [random_numbers]. Tmp
The steps that must be done to make cleaning a virus is as follows:

-          Clean the virus removal tools using Dr.Web CureIt. You can download the following link:
http://www.freedrweb.com/download+cureit/

-          Fix the windows registry is already in the modification of the virus with the following steps:

Copy this script to use WordPad or Notepad :

[Version]
Signature=”$Chicago$”
Provider=Project-880.com
[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del
[UnhookRegKey]
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, SuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt,0×00010001,0
HKLM, SOFTWARE\CLASSES\batfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\comfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\exefile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\piffile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
[del]
HKLM, SYSTEM\CurrentControlSet\Services\MRxCls
HKLM, SYSTEM\CurrentControlSet\Services\MRxNet
HKLM, SYSTEM\ControlSet001\Services\MRxCls
HKLM, SYSTEM\ControlSet002\Services\MRxNet
HKLM, SYSTEM\CurrentControlSet\Services\Enum\Root\LEGACY_MRXClS
HKLM, SYSTEM\CurrentControlSet\Services\Enum\Root\LEGACY_MRXNET
HKLM, SYSTEM\ControlSet001\Services\Enum\Root\LEGACY_MRXClS
HKLM, SYSTEM\ControlSet002\Services\Enum\Root\LEGACY_MRXNET

Save the file with the name “repair.inf”. Use the Save as type option to Text Document in order to avoid mistakes. Right-click the file “repair.inf” then select “Install”, then restart your computer. Clean temporary files, this in order to prevent the rest of the trojan is trying to become active again. Use tools like “ATF Cleaner” or use the windows feature is “Disk Clean-Up.”

Next step use the following script to prevent the virus infected your computer again :

@echo off
del /f c:\windows\system32\winsta.exe
rem rd c:\windows\system32\winsta.exe
md c:\windows\system32\winsta.exe
del /f c:\windows\system32\drivers\mrxnet.sys
rem rd c:\windows\system32\drivers\mrxnet.sys
md c:\windows\system32\drivers\mrxnet.sys
del /f c:\windows\system32\drivers\mrxcls.sys
rem rd c:\windows\system32\drivers\mrxcls.sys
md c:\windows\system32\drivers\mrxcls.sys
attrib +r +h +s c:\windows\system32\winsta.exe
attrib +r +h +s c:\windows\system32\drivers\mrxnet.sys
attrib +r +h +s c:\windows\system32\drivers\mrxnet.sys

Save the file with the name “winsta.bat”. Use the Save as type option to Text Document in order to avoid mistakes. then run the file by double clicking on it.

– reference : vaksin.com

2. Leap-A/Oompa- A
Mac that has a concept of security through obscurity, Mac believe thea system can’t be infected by a virus of cause of  the OS system is a closed. But in the year 2006, Leap-A virus or commonly known as Oompa-A appears and spreads via iChat on the Mac. Having a Mac attack, the virus will search for contacts via iChat and send messages to each contact. The message will contain a form of corrupt JPEG file. It’s not dangerous, but this proved that the Mac OS systems are not immune to the virus.

3. Sasser and Netsky
Creator by German children aged 17 years, Sven Jaschan. Sasser attack Microsoft Windows. Sasser does not spread via email. The virus is usually spread through the network. This will create a computer virus could not be shutdown without unplug the power. Netsky spread via email with a 22 Kb file attachments and Windows network. Sven Jaschan Finally caught but he’s not jail, was only given probation 1 year 9 months, because at that time still under the age of 18.

4. MyDome (Novarg)
This virus is making a backdoor on the OS. Computer was first known attack on first February by doing DDoS. Then reported back to attack on the 12th of Feb, after that the virus stopped spreading and start creating backdoors. MyDoom spreads via email.

5.SQL Slammer / Sapphire
Appeared in January in the year 2003, spread quickly via the Internet. This virus has also been a U.S. Bank ATMs crash, the collapse of Seattle’s 911 service, and Continental Airlines.

6.Nimda
Reported attacks in 2001, call Nimda taken from opposite the word “admin”. These viruses spread very quickly, according to TruSecure CTO Peter Tippett, Nimda only takes 22 minutes to make the Top Ten Virus at the time. The main target of this virus is Internet servers, Nimda spread through Internet network by creating a backdoor into the OS.

7.Code Red & Code Red II
Appear summer 2001, attacks Windows 2000 & NT OS. This virus will create a buffer becomes full so make the memory becomes full.

8.The Klez
This virus was first known infected on 2001, this virus spreads via email by conducting continuous replication, and sent to all email addresses in the victim’s address book. This virus makes the victim computer becomes very slow and can also turn off the antivirus application

9.ILOVEYOU
This virus started spreading in the Philippines, these virus classified as worm virus, which has the ability to do her own replication. ILOVEYOU spread via email, with the title “love letters” from a secret admirer. His original file LOVE-LETTER-FOR-YOU.TXT. vbs. VBS stands for Visual Basic Scripting. Creator Onel de Guzman was from the Philippines.

10.Melissa
This virus was made in 1999 by David L. Smith, created with Basic program, exactly with Microsoft Word macros. This virus spreads via email with the document “Here is That document you asked for, do not show it to anybodey else.”. When this file will be opened or clicked it will automatically run the virus replication and automatically send a pass up to the top 50 in the address book of an email. Smith was jailed 20 months and fined $ 5,000 and prohibited from accessing the computer without supervision.

Microsoft recommends that users of Windows XP SP2, Server 2000 or 2000 client to upgrade to the latest OS such as Windows 7, Windows Server 2003 and Windows Server 2008. Is this a sign that our favorite Windows XP will soon be a memory?

For personal users may be only the cost and installation techniques, which will serve as a consideration in deciding to do this, but not so for corporate users.

To do this on the Company is not as easy as you imagine, the companies need to think and prepare about :

1. 1. License purchase costs, whether it is to purchase a new license or upgrade license fees for
2. For the server should also note his license call
3. Human resources or IT staff who will perform the system upgrade
4. Compatibility hardware drivers and system applications that previously used.
5. Time to upgrade, keep in mind as well as to upgrade the system to do backups of all documents as well and email users.

For companies that have large funds may be this is not be a problem, but what about for small companies, I hope Microsoft can provide a good solution for this.