Showing posts with label VIRUS. Show all posts
Showing posts with label VIRUS. Show all posts

Sunday, October 14, 2012

BLOKIR FLASH DISK TERHADAP VIRUS BANDEL

Seiring berkembangnya teknology maka flash disk yang dijadikan target utama dari virus...
Untuk mencegahnya, kita harus mengingat format-format yang sering digunakan oleh virus contohnya EXE, VBS, JS, dan INF.
Format file ini akan kita ubah agar virus yang berada di dalam flash disk tidak bisa masuk..
Begini nich caranya:

  • Buka program Notepad dari Start--All Program--Accessories--Notepad.

  • Tuliskan teks berikut :
echo off
cls
echo ****************************************
echo ***************Backup assoc***************
echo Tekan Enter untuk mulai atau tekan ctrl +c untuk Cancel
echo
********************************************
assoc .exe=exefile
assoc .vbs=vbsfile
assoc .inf=inffile
assoc .js=jsfile
echo.
pause > nul
cls
  •  Simpan file pada drive dan beri nama file itu dengan menambahkan .bat dibelakangnya...Oke, sekarang anda telah membuat backup-nya. Sekarang lanjut langkah berikutnya...
  • Klik start---Run---CMD---lalu anda ketikkan kode berikut ini.

assoc .exe=txtfile
assoc .vbs=txtfile
assoc .inf=txtfile
assoc .js=txtfile
  • Setelah itu, anda pilih lokasi dimana flash disk anda berada, contoh G:---ketikkan attrib -s-h*.*
  • Coba anda lihat hasilnya. file yang berformat tadi telah berubah menjadi TXT. cari file yang tidak anda kenal lalu hapuslah file tersebut.
  • Untuk mengembalikan format file tersebut, anda tinggal membuka file backup yang telah kita buat yaitu assoc.bat. Perintah ini sering digunakan oleh virus agar dapat membutakan anti virus.

Tuesday, October 9, 2012

MENGHAPUS VIRUS MELALUI COMMAND PROMPT

Marilah kita mulai menghapus virus-virus tersebut. Kita akan menghapusnya dengan tool standar bawaan Windows dengan sedikit modifikasi yaitu Command Prompt.
Sebelumnya telah dijelaskan beberapa file yang berpotensi atau digunakan oleh virus, diantaranya adalah autorun.inf, *.exe, *.pif, *.scr, *.vbs, *. _desktop.ini, desktop_.ini, Thumbs .db dan thumbs.com. File-file dengan ekstensi tersebutlah yang akan kita hapus manual dengan command prompt.

Bukalah command prompt yang tidak perlu aku jelaskan caranya. Setelah muncul jendelanya, ketikkan drive mana yang akan dituju lalu ditambah tanda titik dua “:” misalnya “D:” kemudian tekan enter. Kalau sudah masuk, kita tinggal masukkan perintahnya. Misalnya ingin menghapus file *.exe yang biasanya ekstensi ini yang paling banyak virus gunakan, ketikkan del *.exe /s kemudian tekan enter. Maka semua file yang berekstensi exe yang ada drive itu akan terhapus. Penambahan perintah”/s” artinya akan melaksanakan perintah hingga ke sub folder yang paling dalam. Tanpa perintah tersebut maka hanya akan berlaku pada folder/darive yang sedang aktif saja.

Sekarang satu jenis file pemicu sudah terhapus. Artinya satu kekhawatiran terhadap virus sudah berkurang. Selanjutnya lakukan penghapusan untuk jenis file yang lain yang sudah disebutkan di atas sehingga semuanya menjadi tuntas.

Biasanya virus sudah memproteksi diri dengan mengatur attributnya sendiri baik itu menjadi readonly, hidden biasa atau hidden secara system. File yang punya attribut readonly tidak bisa dihapus dengan cara di atas. Oleh karena itu perlu dilakukan reset attribut dengan command prompt. Perintahnya yaitu attrib –r –h –s –a /s. Attribut r artinya readonly, h artinya hidden, s artinya system atau orang-orang sering menyebuatnya super hidden sedangkan a artinya file archive atau arsip. Penambahan tanda minus (-) artinya untuk tidak mengaktifkan attibut setelahnya. Begitu pula kalau ingin mengaktifkannya tinggal tambahkan tanda plus (+).

Tentunya tidak efisien kalau setiap komputer terserang virus maka harus mengetikkan satu per satu perintah perintah di atas di command prompt. Jadi, semua perintah tadi sudah aku rangkum dalam sebuah file batch. Namanya ba.bat yang bisa didownload di sini.

Dari namanya, file ini fungsinya membabat seluruh file yang tentunya telah ditentukan sebelumnya. Cara menggunakannya sangat mudah tinggal dieksekusi langsung atau dipanggil lewat command prompt atau menu Run. Tampilannya pun sangat sederhana hanya sebuah jendela kecil dengan beberapa pilihan perintah di dalamnya. Terdapat tiga pilihan utama yaitu babat tuntas, babat cepat dan pilihan keluar. Untuk memilih perintah yang akan dilaksanakan tinggal masukkan angka 1, 2 atau 3 sesuai dengan pilihan lalu tekan enter.

Pilihan babat tuntas digunakan kalau file yang berpotensi terhadap virus banyak terdapat di setiap folder. Sedangkan babat cepat sangat efisien kalau menghadapi virus yang memanfaatkan autorun dan kita yakin benar kalau virus tidak terdapat di dalam folder sehingga tidak perlu lama-lama menunggu.

File ba.bat bukan digunakan hanya untuk drive hardisk tapi ditujukan terutama untuk FD. Setelah FD dicolok jangan dulu membuka Windows Explorer tapi eksekusilah dulu file ba.bat yang sudah disimpan di FD baik menggunkan Command Prompt atau menu Run. Jika ada file yang ada dalam daftar tidak mau terhapus maka patut dicurigai kalau komputer sudah terinfeksi virus.

Inilah tadi cara mengapus atau tepatnya membabat file yang berpotensi terhadap virus. Memang sangat beresiko. Seri berikutnya kita akan membahas bagaimana mencegah virus terus berkembang termasuk mengurangi resiko di atas.

Sunday, September 23, 2012

REMOVE THE WIN HDD VIRUS A WINDOWS7 PC

Remove the Win HDD Virus from a Windows 7 PC Everyone knows that it is smart to have a good anti-virus program installed and running on every PC, but that doesn’t mean your computer is going to be 100% safe. The virus maker’s are constantly thinking of ways around the anti-virus programs, and sometimes people don’t update the virus lists frequently enough. With that in mind it is always important to know how to remove the most common virus’s once they get on your PC.
REMOVE THE WIN HDD VIRUS A WINDOWS7 PC
The Win HDD virus is one of the more common viruses, and while it is often blocked by anti-virus programs it is still good to have a way to get rid of it. This particular virus works by affecting the computer through a Trojan horse. In most cases the Trojan horse will act like a security application which is scanning your computer and alerts you to a ‘critical error’. If you follow the instructions it provides it will ask you to enter your credit card information in order to purchase the fix to this virus. Of course, this won’t actually work and you’ll have given your information to a scammer.
There are a few ways to remove the Win HDD virus from a Windows 7 PC. For most people the easiest option is to simply restore your PC to a date before the virus affected your computer. This is a fairly simple process which most people are able to follow. Follow these simple steps to restore your PC.
  1. Power off your computer and turn it back on.
  2. While the computer is booting up, press and hold the F8 key to bring up the system restore screen.
  3. Go to the ‘advanced boot options’ and select ‘repair your computer’ and press enter.
  4. Select US for the keyboard layout.
  5. Choose your username and enter your password. This will bring up a list of recovery options.
  6. Choose “System Restore”
  7. At this point you will most likely have several different dates to choose from. Select the most recent option that you know is clean.
  8. The computer will restore to that date without the virus. It will take several minutes to complete.
The whole process should only take about 15-20 minutes in most cases. This is the ideal solution for most people, and is especially good for when you are walking someone through getting rid of this (or most any) virus over the phone because the instructions are so simple to follow. If, however, you don’t want to lose any data and you’d rather manually remove the virus there are some things you can try.
The Win Hdd virus is extremely persistent and won’t let you run programs or access the internet so you’ll need to have another uninfected computer as well as a thumb drive (flash drive). Once you’ve got your other computer ready simply follow these instructions:
  1. From the clean computer download the simple program called “RKill” (can be found here).
  2. Move the RKill programs to the thumb drive and then plug that thumb drive into the infected computer.
  3. You can either move the RKill program onto the infected computer’s desktop or run it from the thumb drive itself. The program takes just seconds to run. Once it is run attempt to connect to the internet, if it doesn’t work you’re still infected
    1. If you’re still infected that means the particular virus you have is likely attempting to stop the RKill program from running. To get around this you can ‘overload’ the virus by running the RKill program repeatedly. Simply click on the RKill program as quickly as possible for about a minute. This will cause your computer to attempt to launch dozens of copies of the program, and once one of them is able to run successfully it will disable the virus. This actually works better on slower computers than faster ones.
  4. Once the virus has been disabled you’ll need to download the latest copy of a free program called “Malwarebytes Anti-Malware”. This is one of the best programs for removing maleware (viruses) available today and does an excellent job with the Win HDD virus.
  5. Once the program has been installed run it and follow the simple instructions. It may ask you to update the virus definitions, if it does, say yes.
  6. Instruct the program to check all your drives and hit ‘start’.
  7. Allow the program to run all the way through. This may take quite a while depending on the size of your hard drive and how many files you have.
Once Malwarebytes has finished running you can restart your computer and you should be virus free! At this point it would be smart to update the virus definitions of whatever your main anti-virus program is to attempt to prevent yourself from getting infected again.
The Win HDD virus’s is one that is extremely difficult to remove if you don’t have the right tools so make sure to keep the RKill program around even after you’ve successfully removed it. One last tip is that some versions of this virus recognize the name ‘rkill’ and won’t allow the program to run at all. If you find you can’t get it to run simply rename the program to anything you’d like and see if that allows it to run. As with all virus’s, the best way to fix them is to avoid them all together and always have an updated anti-virus program on your windows 7 PC.