tag:blogger.com,1999:blog-90062391026848490692011-10-20T23:39:55.933-07:00romeo_echo - - Bloghttp://www.blogger.com/profile/13062033063944631024noreply@blogger.comBlogger21100tag:blogger.com,1999:blog-9006239102684849069.post-53396725776534508202009-09-12T07:13:00.001-07:002009-09-12T07:17:46.935-07:00>HP Mini 110-1013TU CNU9234CQL with Windows XP Home Edition SP3<br />>IBM ThinkPad R40 2681-CEA with Windows XP Professional SP3<br />>NexianBerry NX-G922 with Dual SIMcard<br />>Sierra 881u HSDPA Modem - GPS Enabled<br />>SONY DSC W-120 7.2MP<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/9006239102684849069-5339672577653450820?l=isokom.blogspot.com' alt='' /></div>romeo_echo - - Bloghttp://www.blogger.com/profile/13062033063944631024noreply@blogger.com0tag:blogger.com,1999:blog-9006239102684849069.post-12524631313896857712008-02-24T19:02:00.000-08:002008-02-24T19:12:36.429-08:00<div class="plc_tit"><table class="plc_tit" style="width: 81px; height: 1px;" cellpadding="0" cellspacing="0"> <tbody><tr> <td class="plc_tit_tl"><img src="http://www.jasakom.com/skins/Graphite_Pro/css/themes/theme_images/spacer.gif" /></td> <td class="plc_tit_t" style="width: 100%;"> <div class="plc_tit_t"> <!--// //--> </div> <br /></td> <td class="plc_tit_tr"><img src="http://www.jasakom.com/skins/Graphite_Pro/css/themes/theme_images/spacer.gif" /></td> </tr> <tr> <td class="plc_tit_l"><img src="http://www.jasakom.com/skins/Graphite_Pro/css/themes/theme_images/spacer.gif" /></td> <td class="plc_tit_m"> <br /></td> <td class="plc_tit_r"><br /></td> </tr> <tr> <td class="plc_tit_b"> <div class="plc_tit_b"> <!--// //--> </div> <br /></td> </tr> </tbody></table></div><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Sebelumnya salam kenal dari black_spider. </span>. <span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Berawal dari keluhan teman ku yang kompienya kena virus. Katanya, aku dah scan pake avast tapi ga kedetek, gimana nech...!?!?! </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Artikel ini bukan dimaksudkan untuk menggurui tetapi hanya sebatas berbagi pengalaman yang aku alami dan juga ditujukan buat temen-temen newbie ( seperti aku juga ) yang haus akan ilmu dan bagi yang udah expert mohon pencerahannya atas kesalahan dan kekurangan. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Nama W32.SillyDC dideteksi sama Yahoo Virus Scan.</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" > <p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >OK. Mulai... ( banyak omong lo ah... : p )</span></p></span><b><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><u>Ciri-cirinya kayak gini:<br /></u></span></b><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Ga bisa klik kanan pada taskbar n desktop, mematikan process explorer, hijackfree dimatiin juga, disable taskmanager, run, regedit, control panel, cmd, search, folder option. Membuat file di tiap folder dengan nama folder tersebut tapi ejaannya dibalik</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="sv" >( misalnya folder “SYSTEM” jadi “METSYS”)</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >. Pada directory c:\windows virus tersebut membuat folder prcsys, prcsys2, prcsys3, pusat2, pusat, menggunakan icon folder dan ukuran filenya 354 KB. Apabila kita mo ngapus file dengan menekan tombol del pada keyboard, otomatis virus akan mematikan konfirmasi hapus.</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" > <p><b><u><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Persiapan sebelum kita mulai merontokkan virus ini.</span></u></b></p></span><ol style="margin-top: 0in;" type="1"><li style="line-height: 150%; text-align: justify;" class="MsoNormal"><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Process Explorer </span><span style="line-height: 150%;font-size:10;" lang="en" >(<a href="http://www.sysinternals.com/">http://www.sysinternals.com/</a>) (</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="en" >Lo… Katanya bisa dimatiin sama virus, kok di pake juga? </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="sv" >Ya mo gimana lagi, aku ga tau mo pake apa lagi.)</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" > </span></li><li style="line-height: 150%; text-align: justify;" class="MsoNormal"><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Virus Fighter (Cari aja pake bantuan om google) </span></li><li style="line-height: 150%; text-align: justify;" class="MsoNormal"><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Kesabaran secukupnya. </span></li></ol><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><b><u><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Langkah-langkah </span></u></b></p></span><b><u><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ></span></u></b><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>1.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Restart komputer, tekan f8 kemudian pilih safe mode. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>2.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Jalankan virus fighter, pada menu windows pilih rename msvbvm60.dll. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >(kali aja virusnya dibuat pake VB, seperti tutorial yang pernah aku baca ) </span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>3.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Jalankan processexp.<br /></span><span style="line-height: 150%;font-family:Symbol;font-size:10;" lang="IN" ><span>·<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Waktu pertama menjalankan processxp, otomatis akan ditutup oleh virus. Coba jalankan lagi, tapi kalo masih ditutup juga dicoba aja ampe bisa. Kalo tetap ga bisa juga, hanya Tuhan yang tau <img src="http://www.jasakom.com/images/smilies/happy.gif" alt="" border="0" /> </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>4.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Kalo aku sih saat menjalankan ProcessXP yang kedua kalinya langsung bisa.(selama beberapa kali percobaan berhasil dan ada juga yang gagal menjalankan processXP trus aku coba restart untuk mencobanya lagi langkah 1 dan 2 ternyata bisa jalan) OK Lanjut... </span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>5.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Proses yang sedang berjalan terlihat pada processxp</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="sv" > (virus yang menggunakan icon folder)</span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><img src="http://www.jasakom.com/images/Artikel2008/PRCSYS1.jpg" /></p></span><shapetype id="_x0000_t75"></shapetype><stroke></stroke><formulas></formulas><f></f><f></f><f></f><f></f><f></f><f></f><f></f><f></f><f></f><f></f><f></f><f></f><path></path><lock ext="edit" aspectratio="t"></lock><shape style="width: 6in; height: 287.25pt;" id="_x0000_i1025"></shape><imagedata title="pe 1"></imagedata><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>6.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Klik kanan program yang iconnya folder, tapi jangan di KILL dulu, coz virus tersebut otomatis akan menjalankan file virus yang lainnya. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>7.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Sekarang pilih suspend semua virus yang aktif setelah itu KILL TREE dech semuanya...! <p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><img src="http://www.jasakom.com/images/Artikel2008/PRCSYS2.jpg" /></span></p></span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>8.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Ok, sekarang virusnya dah gak aktif. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>9.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Kembali lagi ke Program Virus fighter. pilih semua checkbox pada menu windows untuk mengaktifkan fitur windows yang dinonaktifkan oleh virus. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><img src="http://www.jasakom.com/images/Artikel2008/PRCSYS3.jpg" /></span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span>10.<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Hapus file virus pada directory : </span><span style="line-height: 150%;font-family:Symbol;font-size:10;" lang="IN" ><span>·<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >c:\prcs </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Symbol;font-size:10;" lang="IN" ><span>·<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >C:\windows<br /></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >( prcsys, prcsys2, prcsys3, pusat, pusat2 )<span> </span></span></p></span><span style="line-height: 150%;font-family:Symbol;font-size:10;" lang="IN" ><span>·<span style="font-style: normal; font-variant: normal; font-weight: normal; line-height: normal; font-size-adjust: none; font-stretch: normal;font-family:'Times New Roman';font-size:7;" > </span></span></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Cari semua file aplikasi yang menggunakan icon folder (jangan mengunakan fungsii SEARCH atau SCAN FOR VIRUS Pada menu klik kanan DRIVE coz akan menjalankan viruz). </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><b><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><br /><u>Perhatiaaaaaaaaaaaaaaaaaannnn...........!!!!!!!!!!!!!!! </u></span></b></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Cari dan hapus semua string yang valuenya mengakses program-program yang namanya prcs, prcsys, prcsys2, prcsys3, pusat, pusat2. </span><span style="line-height: 150%;font-family:Arial;font-size:10;" >Yang ada </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >pada registry editor </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Registry yang di rubah oleh virus ini : </span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >HKCR\folder\*\shell\scan for virus\command dan HKCR\folder\shell\scan for virus\command </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><span> </span>>> Mengelabui user dengan menambahkan pilihan SCAN FOR VIRUS dan pilihan SEARCH pada menu klik kanan drive dan klik kanan folder </span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >HKLM\software\microsoft\windows\currentversion\run </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><img src="http://www.jasakom.com/images/Artikel2008/PRCSYS4.jpg" /></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><shape style="width: 336.75pt; height: 82.5pt;" id="_x0000_i1028"></shape><imagedata title="run 1"></imagedata><p> </p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >HKLM\system\controlset001\control\safeboot <p><img src="http://www.jasakom.com/images/Artikel2008/PRCSYS5.jpg" /></p></span><shape style="width: 347.25pt; height: 17.25pt;" id="_x0000_i1029"></shape><imagedata title="alternateshell"></imagedata><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >HKLM\system\controlset002\control\safeboot </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><img src="http://www.jasakom.com/images/Artikel2008/PRCSYS5.jpg" /></p></span><shape style="width: 347.25pt; height: 17.25pt;" id="_x0000_i1030"></shape><imagedata title="alternateshell"></imagedata><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >HKCU\sofware\microsoft\windows\currentversion\policies\explorer </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >rubah Noviewcontextmenu jadi 0, notraycontextmenu "0", kamu bisa cari sendiri yang pengen kamu rubah, sesuai kebutuhan. </span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >HKLM\software\microsoft\windowsNT\currentversion\winlogon ganti value pada string shell menjadi explorer.exe </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><p><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" ><img src="http://www.jasakom.com/images/Artikel2008/PRCSYS6.jpg" /></span></p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Sebenarnya masih banyak yang dapat dilakuin, mohon untuk cari sendiri. <p> </p></span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="IN" >Segitu aja dulu, dah malem ni.... </span><span style="line-height: 150%;font-family:Arial;font-size:10;" lang="sv" >Sebenarnya sampel virus mau disertakan, karena kedetek sama yahoo jadinya ga bisa.<br /><br />Sumber : http://www.jaskom.com<br /></span><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/9006239102684849069-1252463131389685771?l=isokom.blogspot.com' alt='' /></div>romeo_echo - - Bloghttp://www.blogger.com/profile/13062033063944631024noreply@blogger.com1