envio land » life

YET Another Gumblar

envio — Fri, 27 Aug 2010 14:47:48 +0000

Today I have deal with my client to clean all chaos caused by Gumblar virus, It’s seem his root password was stolen and all web data infected with code. The virus code snippet is like this:

var D;if(D!='' && D!='X'){D=''};var U=new Array();var p="";function u(){var aY=new Date();

The condition , all index file , index.html or index.php was injected. The virus code injected on last line of file. After couple hour browse I didn’t find any solution to this problem and this make me confused, it will horrible if I have to remove the virus code one by one.

After two hour doing experiment finally I found the way how to remove the virus, just use bash script , using “grep” , “find” , “cut” , “grep” , “xargs” and “sed”.

Silly SmartDav Autorun.inf Folder

envio — Thu, 15 Jul 2010 03:16:18 +0000

When I plug my USB pen drive to my friend computer that SmartDav antivirus installed there, it will automatically create a autorun.inf folder and make some special directory there called “con” and on that directory it also create another directory called “Locked by SmartDav … bla … bla … bla”

The annoying problem when I plug my USB pen drive to my own computer with Avira antivirus installed, the Avira Active Guard seem scan the “autorun.inf” folder then Lock It.

When I want to eject my USB pen drive it can’t be done, It said my USB pen drive being used . I think the the “special” folder created by SmartDav must be removed.

The special folder created by SmartDav can not delete using normal way, it will say “Can not find specific File” or “Invalid Parameter”. After googling I found some trick how to remove it. Here the trick :

1. Open Command Promt

2. J:\>rd /S \\.\j:\autorun\con\

“J” is my USB pen drive and It will ask confirmation, hit “Y” to confirm then The autorun.inf folder and it sub folder will automatically deleted

Repeat as Header on MS Word not working

envio — Mon, 24 May 2010 02:31:36 +0000

Some time when you format some row as table header it didn’t work correctly, the solution is very easy,

1. select all your table , and right click, it will show table properties, click it !

2. then it will show table properties, click “table” tab on top of it.

3. change “text wrapping” in to “none”

4. that’s it, you can select some row as your table header

Conficker Removal

envio — Fri, 19 Mar 2010 03:55:50 +0000

Last day I have successfully remove all conficker on from serveral Windows XP computer. Those conficker must be the latest one because the computer has internet computer so it will update it self.

Method that I use is :

1. Unplug / terminate the local area connection.

2. Use rootkit detector to disable some svchost service infected by conficker

You can download the rootkit detector at http://www.gmer.net/ Run the rootkit detector software, if your computer has conficker on it it will detect some svchost service in red colour. You not need do full scan, just right click on red svchost service found by the rootkitdetector, and click disable service.

3. Use conficker removal software

Use this removal software from http://www.enigmasoftware.com/products/conficker-removal-tool/ it very small tool, less than 200Kb software. Download and run the software. Follow the instruction. It need reboot few time.

4. Patch Your Windows with latest hotfix from microsoft to avoid conficker come again. Get the patch on

http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx . Download accourding you operating system.

That’s it

Video Instruction for 7D user

envio — Wed, 10 Mar 2010 01:42:06 +0000

For Canon 7D user, canon has been released some video instruction. Check the video at :

http://www.usa.canon.com/dlc/controller?act=GetArticleAct&articleID=3167

/LGPL virus again (Gumblar Family)

envio — Mon, 25 Jan 2010 00:34:41 +0000

After last virus attack , some my FTP account was stolen, my terrible mistake, I forgot change some of FTP password and the second attack come again after I clean it with virus removal from justcoded.com.

The second attact, the Java script code injected is not same as first one, it have some code variant , The code I was found on my PHP and Javascript code is :

So I need to modify the cure file for this code variation, and it work fine. Recently I browse on justcode.com and see the new version on cure file it has have ability to cure variant Java Script code that injected to web file. So just try to download it here

Malware : /LGPL/ try{ window.onload

envio — Sun, 17 Jan 2010 05:12:21 +0000

This story happen when I visit a website, http://pa-malangkab.go.id, when I visit it , nothing happen actually, a weird thing happen tomorrow.

In the morning, I turn on my notebook and suddenly a message appear, “Security Tools” already installed on my computer, I didn’t feel install that software recently, but I know it was a spy ware or malware software, then I use Malwarebytes (http://www.malwarebytes.org/mbam.php) to clean my notebook, and it work great, the malware was successfully cleaned.

Accidentally I open my website work, and something bad happen, the website show nothing, I check the code and found some java script code injected to my PHP file. Then I think where the code came from ??

The java script code :