Mencegah Facebook yang disisipi jebakan Phising dengan metode Cross Site Scripting

Baru –baru ini saya mendapatkan kiriman pesan dari sahabat saya yang di batam  yang mengirimkan pesan agar saya mengklik link yang dilampirkan di chat fb ataupun di message fb.

Sekali dua kali saya abaikan saja pesan sahabat tersebut yang tadinya saya berpikir mungkin sahabat sedang iseng atau memang sedang beriklan.Namun alangkah mengejutkannya ketika saya membuka beranda sahabat tersebut yang menginformasikan bahwa pesan yang ada di account facebooknya tersebut bukanlah merupakan hasil buah karyanya namun hasil kerjaan pihak yang tak bertanggung jawab. Gambarnya seperti ini :

 

 

Memang kalau dilihat link ini “ short url “ sehingga kita tidak tahu mau dibawa kemana kita seandainya belum mengklik link tersebut. Ya metode ini memang JEBAKAN dan gampang menyebar bila kita mengklik link short url tersebut,

Walaupun belum tahu sampai sejauh mana kebocoran data pribadi kita di account facebook tersebut ada baiknya kita melakukan tindakan sebagai berikut ini dengan harapan tidak menyebar ke teman-teman kita yang lainnya, yaitu :

1. Gantilah password Facebook kita secara berkala dan usahakan dengan menyatukan abjad dan angka ( alfanumerik ) ,buat minimal 8 digit dan jangan tanggal kelahiran atau nama keluarga kita.

2. Hapuslah pesan jebakan di message kita yang biasanya ada disebelah kanan dari nama pengirim atau lakukan tindakan hapus pesan atau hapus percakapan

3. Ingatlah selalu agar selalu LogOut dan membersihkan data kita di browser dengan menekan tombol Ctrl Shift Del.

4. Semoga dengan semua usaha kita ini tidak menyebar jebakan betmen tersebut.Amiin

 

nb: maaf kalau kurang atau salah infonya, mohon dilengkapi.Tks

Salam

Tag Technorati: {grup-tag}jebakan,jebakan betmen,short url yang mengganggu,facebook dihack

»»  READMORE...Mencegah Facebook yang disisipi jebakan Phising dengan metode Cross Site Scripting

Remove xlavra(trojan)

remove xlavra (Trojan-Downloader.Win32.Agent) and Wintools adware

WinTools is an adware that adds a toolbar to your browser and generating annoying popups and balloon dialogs.

Go to Start > Control Panel > Add or Remove Programs and remove the following programs, if found: WinTools, WhenU, SearchUpgrader

Download HijackThis and save the file to your desktop. Double click on the file for install.
Download CCleaner. Double click on the file for install.
Download Avenger and unzip to your desktop.
Download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your Desktop.

Reboot your computer in Safe Mode by doing the following:

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode.

Start HijackThis. Click “Do a system scan only.” and put a checkmark next to the following items:

R3 – URLSearchHook: (no name) – {1C78AB3F-A857-482E-80C0-3A1E5238A565} – (no file)
O2 – BHO: (no name) – {87766247-311C-43B4-8499-3D5FEC94A183} – C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O3 – Toolbar: (no name) – {8B224779-3B0E-4FEA-8AE1-B66C20DD840F} – (no file)
O4 – HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
O4 – HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 – HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O9 – Extra button: (no name) – {AFC3FA82-AD07-45cd-8B57-983435B9899E} – (no file)
O16 – DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O20 – AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat
O23 – Service: WinTools for IE service (WinToolsSvc) – Unknown owner – C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)

Now close all browser and other windows except for HijackThis, and click “Fix Checked” to have HijackThis fix the entries you checked.

Open notepad and then copy and paste the lines below into it.

@echo off
sc stop WinToolsSvc
sc delete WinToolsSvc

Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop.
Double-click on fixes.bat file to execute it.

Run Avenger.
Check the ‘Input script manually’ option. Click the Magnifying Glass icon. In the box that opens, copy,then paste the following text:

Files to delete:
C:\WINDOWS\xlavba3.exe
C:\WINDOWS\system32\sulimo.dat

Folders to delete:
C:\Program Files\Common files\SearchUpgrader\
C:\Program FilesVVSN\
C:\PROGRA~1\COMMON~1\WinTools\

Then click on ‘Done’.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.

Boot your PC in Safe Mode.

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode

Open the SmitfraudFix folder and double-click smitfraudfix.cmd. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).

You will be prompted : “Registry cleaning – Do you want to clean the registry ?“; answer “Yes” by typing Y and press “Enter” in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer “Yes” by typing Y and press “Enter”.

The tool may need to restart your computer to finish the cleaning process; if it doesn’t, please restart it into Normal Windows.

Run CCleaner.

Click Analyze button. After scan your system, click Run Cleaner.

Reboot your PC.

Disable system restore to flush out infected restore points. Reboot your computer again. Turn on Windows System Restore. After that click START > ALL PROGRAMS > ACCESSORIES > SYSTEM TOOLS > SYSTEM RESTORE. click on “create new restore point” > click on NEXT and follow the prompts.

source:http://www.myantispyware.com

Tag Technorati: {grup-tag}spyware,remove spyware,Trojan XLAVRA

»»  READMORE...Remove xlavra(trojan)

How to Remove “vistamessage.exe” spyware

Vistamessage.exe is a rare kind of spyware/walware.

Much information is not available on the Internet about vistamessage. And most spyware/virus scanners do not detect it. However, it is definitely some kind of spyware or malware. If you get infected with vistamessage.exe, you may experience the following problems:
1. System slowdown: You computer may become very slow. If you hit Ctrl-Alt-Delete, you can observe vistamessage.exe comsuming memory and CPU, thus causing the computer to slow down.
2. Popups: Some users have also reported unwanted popups.

how to remove vistamessage.exe

1) Go to Start -> Run and type "MSCONFIG". The MSCONFIG dialog box with open up.
2) Go to "Startup" and uncheck "VistaMessage". (You can also do this using CCleaner.)
3) Restart your computer.
4) Locate "vistamessage.exe" on your hardrive using Windows search and delete it.
5) Run a registry scan to remove references to this file in the registry.

 

how about now..is it your PC clean now from spyware ???

goodluck

Tag Technorati: {grup-tag}spyware,remove spyware,vistamessage

»»  READMORE...How to Remove “vistamessage.exe” spyware