The Demo Site

Membersihkan akar virus amvo manual

cd c:\windows\system32
attrib -s -h -r amvo.exe
attrib -s -h -r amvo0.dll
del amvo.exe
del amvo0.dll
explorer

---------------------------------------
Bersihkan Registri virus Surabaya

copy tag dibawah ke notepad, disimpan ke file antisurabaya.reg
---------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
----------------
Penggunaanya dengan mengklik dua kali OK

Kemudian copy tag dibawah ini ke notaped dengan nama file anti-surabaya.inf

---------------
[Version]

Signature=”$Chicago$”

Provider=Vaksincom Oye - Blue Fantasy

[DefaultInstall]

AddReg=UnhookRegKey

DelReg=del

[UnhookRegKey]

HKLM, Software\CLASSES\batfile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\comfile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\exefile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\piffile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1?”

HKLM, Software\CLASSES\scrfile\shell\open\command,,,”"”%1?” %*”

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”

HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”

HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, “cmd.exe”

HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”

HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, UncheckedValue,0×00010001,0

HKLM, SOFTWARE\Classes\scrfile,,,”Screen Saver”

[del]

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, LegalNoticeCaptio

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, LegalNoticeText

HKLM, SOFTWARE\Classes\scrfile, InfoTip

HKLM, SOFTWARE\Classes\scrfile, NeverShowExt

HKLM, SOFTWARE\Classes\scrfile, TileInfo

HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools

HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoFolderOptions

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Msconfig.exe

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

------------------------------------------------------------

Repair Registry Virus Palma.exe

Copy tag dibawah ini, simpan dalam ektensen inf (anti palma.inf)

[Version]

Signature=”$Chicago$”

Provider=Vaksincom Oye - Blue Fantasy

[DefaultInstall]

AddReg=UnhookRegKey

DelReg=del

[UnhookRegKey]

HKLM, Software\CLASSES\batfile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\comfile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\exefile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\piffile\shell\open\command,,,”"”%1?” %*”

HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1?”

HKLM, Software\CLASSES\scrfile\shell\open\command,,,”"”%1?” %*”

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”

HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”

HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, “cmd.exe”

HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”

HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, UncheckedValue,0×00010001,0

HKLM, SOFTWARE\Classes\scrfile,,,”Screen Saver”

[del]

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, LegalNoticeCaptio

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, LegalNoticeText

HKLM, SOFTWARE\Classes\scrfile, InfoTip

HKLM, SOFTWARE\Classes\scrfile, NeverShowExt

HKLM, SOFTWARE\Classes\scrfile, TileInfo

HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools

HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoFolderOptions

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Msconfig.exe

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

----------------------------------

Penggunaan file berekstensen inf dengan klik kanan mouse dilanjutkan pilihan install.


Semoga bermanfaat
Dari berbagai sumber