"WA MAU JADI APA" virus aka "Apa punya Malaysia"

Luminax — Wed, 28 Oct 2009 20:53:45 +0800

Greetings, my brother's laptop got attacked by this stupid virus, and I said stupid, because it IS damn stupid.

I googled and found not much help from the references which leads me to believe it's a small-spread harmless virus which affects very small circle of people.

It displays a centered always-on-top flashing texts in red/black alternating background which displays...well...stupid text.

I take the Laptop for a run through the usual shindigs, task manager, command prompt, msconfig, the works... not much luck there.

Then something dawns upon me, I have seen this manifestation of virus before(the difference being, back then, the virus was SMART, and it took me almost a full computer wipe to clear it, this one... well... just a dumb copy made by stupid virus maker)... Holding my breath, I researched the file in question and found, that, indeed, my suspicion hit the marks.

Directory of C:\WINDOWS\system32

04/08/2004 00:56 13,312 lsass.exe
1 File(s) 13,312 bytes

Directory of C:\WINDOWS\system32\oobe

04/08/2004 00:56 49,532 lsass.exe
1 File(s) 49,532 bytes

odd ? why, yes...
Terminating the little stupid bugger leads to no dice, so after a restart and a safe-mode (still no dice on the ctrl+alt+del end task btw) I went digging into registry editor, found the entry in question, and swaps it with the REAL lsass.exe

Oh, by the way, you might want to peek at your friends' WindowsXP's registry for this particular entry, just in case, you know

now, onward to deletion :

Command Prompt:
>tasklist

--- Long List Of Tasks Appears ---
pay attention to the number that starts the little fake bugger, that's the PID
>taskkill -PID <enter bugger number here>
and say goodbye to the flashing little stupid window!
a little note: on some PC, taskkill might not work as expected, but it works with more power and priviledges than your average CAD end task.
also don't forget to wipe the fake exe.
and we're done

Lowyat.NET: Latest topics by Luminax

"WA MAU JADI APA" virus aka "Apa punya Malaysia"