How to remove virus shortcuts without an AntiVirus?

Yesterday I tried to access Google Analytics blog, almost 90% of visitors from more than 30 countries found this blog with a keyword shortcut around the virus, the virus was present this shortcut is rampant throughout the world. For that I will try to discuss the return of the virus.

PIF Virus / Starter or better known as the virus shortcut upset victim with a lot of shortcuts that are created by the virus. Fuss, if ways of handling this virus is not right then he actually will come back again, again and again

Here are some ways of a virus analyst at MG Vaksincom Lat shortcut to stop the flood caused this virus:

1. Previously turning off system restore process.

2. Turn off the process of Wscript file located in C: \ Windows \ System32, by using tools such as CProcess, HijackThis or can also use the Task Manager of Windows.
3. Once off the process of Wscript, we need to delete or rename the file so as not to be used temporarily by the virus.

For the record, if we are to rename the file wscript.exe it automatically, it will be copied again in the folder. Therefore, we must find where the file wscript.exe others, usually in C: \ Windows \ $ NtServicePackUninstall $, C: \ Windows \ ServicePackFiles \ i386.

Unlike other VBS viruses, we can change the Open With from the vbs file into Notepad, the virus that matters is berextensi MDB Microsoft Access file. So Wscript DATABASE.MDB will run the file as if he is VBS file.

4. Delete an existing parent file in C:\Documents and Settings\\My Documents\database.mdb, for every time the computer boots will not load the file. And do not forget we also open MSCONFIG, disable the run command.

5. Now we are going to delete the files autorun.inf. Microsoft.INF and Thumb.db. Way, click the START button, type CMD, and moved to the drive to be cleaned, for example, drive C:\, then we have to do is:


Type C:\del Microsoft.inf/s, this command will be to delete all files microsoft.inf the whole folder on drive C:. Meanwhile, if you want to move the drive to stay just renamed drive example: D:\del Microsoft.inf/s.

For the autorun.inf file, type C:\del autorun.inf /s/ah/f, the command would be to delete the autorun.inf file (syntax /ah/ f) is used because the file is taking attrib RSHA, as well as to file Thumb . db also do the same thing.

6. To delete files older than 4 files, we must find a way search files with extensions. Lnk size 1 kb. In the 'More advanced options' make sure the option 'Search system folders' and 'Search hidden files and folders' are both checked.

Please be careful, not all files shortcut / LNK file size of 1 kb is a virus, we can distinguish it from an icon, size and type. For a shortcut icon is created virus always uses icons 'folder', size 1 kb and type 'shortcut'. While the correct folder should not have 'size' and its type is 'File Folder'.

7. Fix the registry has been changed by the virus. To speed up the process of repair registry copy the script below on the program 'notepad' and save with the name 'repair.inf'. Run the file in the following manner:

- Right-click repair.inf
- Click Install

[Version]
Signature = "$ Chicago $"
Provider = Vaksincom Oyee

[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del

[UnhookRegKey]
HKLM, Software \ CLASSES \ batfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ comfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ exefile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ piffile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ regfile \ shell \ open \ command,,, "regedit.exe"% 1 ""
HKLM, Software \ CLASSES \ scrfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, Shell, 0, "Explorer.exe"
HKLM, SYSTEM \ ControlSet001 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"
HKLM, SYSTEM \ ControlSet002 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"

[Del]
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, Winupdate
HKCU, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, explorer

Please leave comments, suggestions or constructive criticism, may be useful to readers.

Read More …

Top 4 Best free Antivirus

 













Actually, today I will try to discuss about the Hiren's Boot CD 11.0 is remarkable, but I delayed till tomorrow.

Now I will try to show some good performers Free Antivirus according to my experience:

The purpose here is the best in terms of security, and memory consumption that influence the performance of our computer.

Here I include four antivirus which became a recommendation from me:

1 Comodo Internet Security
Comodo prioritize the security of Internet attacks with a very strong firewall defenses, all activities will be monitored very well, so if there is any suspicious activity can be directly prevented.
In terms of antivirusnya, Comodo is very sensitive. Comodo Internet Security suited for those of you who are always online to the Internet. visit www.comodo.com
Comodo Internet Security please download here

2. Avira Antivir Personal
This is an alternative antivirus for those of you who do not always online, because it has the ability Offline antivirus update, in terms of this antivirus defense has a pretty good detection capability, as well as self defense from a virus attack.
Download Avira Antivir Personal here

3. AVG Free
AVG is the antivirus product with the user very much, more than 80 million users worldwide, the ability of detection is good enough but when the scan would take a lot of memory so make the computer becomes feels slow. This could be an alternative for your free Antivirus
Download AVG Free here

4. SmadAV
Antivirus made in Indonesia, this performance is very light and capable of removing viruses made in Indonesia, in terms of defense capabilities are not adequate, but there is a feature to open some important tools of Windows which is disabled by viruses, such as regedit, task manager, run command and so forth, one click we can all be opened without manually changing the registry.
SmadAV very good when combined with one of the top three antivirus
Download SmadAV Free here

Read More …

How do I delete the autorun.inf file created by SmadAV Antivirus?

Before that, I apologize for the last few days I do not post because it is too busy with work.

to atone for it all this time I will discuss about how menhapus autorun.inf in flash is created by antivirus SmadAV.

For those of you who use artificial SmadAV antivirus Indonesia may find Autorun.inf folder that is created automatically to protect your drive. Perhaps you are one of those who ask how to delete a folder as where Autorun.inf SmadAV it from your computer

Here's how you can use to remove these folders SmadAV Autorun.inf.

First: You can use the setting of SmadAV itself.



* Open SmadAV and click on the Settings tab
o Remove the Checklis in writing: "Aktifkan Smad-Lock pada saat flashdisk dicolok."

You can also delete the folder by typing a few commands in notepad and save with the extension *. bat samples: removeautorun.bat.

rd/s/q D:\con\aux\nul. Autorun.inf This is locked by Smad? V to protect your Flash-Disk from virus infection.
rd/s/q D:\con\aux
rd/s/q D:\con

Note: D in the code represents the location of your flash, replace and adjust with the existing drive letter on your computer. If you've completed typed and saved, removeautorun.bat Double-click the file.

Second: Using Smad Lock Remover or Unlocker
so hopefully can help you delete the file

Read More …