Menetralisir Perbuatan Virus

Biasanya permasalahan yang di timbulkan oleh virus bermacam-macam. Kita pun selaku pengguna computer terkadang sering bertemu dengan berbagai macam aksi virus dikomputer yang kita gunakan. Memang sangat bingung dan terkadang pusing mengatasi virus-virus yang tingkah lakunya aneh-anek.

Dibawah ini sebagian kecil tinggah yang dilakukan oleh virus :
Merubah setingan File hidden/system menjadi tak terlihat
Fasilitas Find diblokir, FolderOptions, Run, Regedit, Task Manager, System Restore, perubahan Wallpaper, Hotkey, Control Panel, Log Off
Memblokir file-file exe milik Windows dan AntiVirus
Dll
Untuk itu bagai mana cara mengatasi masalah tersebut? untuk mempermudah pengerjaan kita gunakan VB Script, ikuti langkah berikut untuk membuatnya :
1.Buka notepad (Start > run > notepad)
2.copy-paste script dibawah ini :
on error resume next
Dim fso, WshShell, FlashDisk, Drives, winpath
Dim autoruninf, dekstopini
Set fso = CreateObject("Scripting.FileSystemObject")
Set WshShell = Wscript.CreateObject("Wscript.Shell")
Set Drives = fso.drives
Set winpath = fso.GetSpecialFolder(0)

Smwc = "\Software\Microsoft\Windows\CurrentVersion\"
Smwnc = "\Software\Microsoft\Windows NT\CurrentVersion\"
Spmn = "\Software\Policies\Microsoft\Windows NT\"
Smie = "\Software\Microsoft\Internet Explorer\"
Hsmwci = "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\"
WshShell.RegWrite "HKCR\.lnk\", "lnkfile"
WshShell.RegWrite "HKCR\.vbs\", "VBSFile"
WshShell.RegWrite "HKCR\vbsfile\", "VBScript Script File"
WshShell.RegWrite "HKCR\vbsfile\DefaultIcon", "%SystemRoot%\System32\WScript.exe,2"
WshShell.RegWrite "HKCR\vbsfile\FriendlyTypeName", "@%SystemRoot%\System32\wshext.dll,-4802", "REG_EXPAND_SZ"
WshShell.RegDelete "HKCR\vbsfile\NeverShowExt"
WshShell.RegWrite "HKCR\inffile\shell\Install\command\", "%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1"
WshShell.RegWrite "HKLM\Software\CLASSES\batfile\shell\open\command\ ", """%1"" %*"
WshShell.RegWrite "HKLM\Software\CLASSES\comfile\shell\open\command\ ", """%1"" %*"
WshShell.RegWrite "HKLM\Software\CLASSES\exefile\shell\open\command\ ", """%1"" %*"
WshShell.RegWrite "HKLM\Software\CLASSES\piffile\shell\open\command\ ", """%1"" %*"
WshShell.RegWrite "HKLM\Software\CLASSES\scrfile\shell\open\command\ ", """%1"" %*"
WshShell.RegWrite "HKCR\regfile\shell\open\command\", "regedit.exe ""%1"""
WshShell.RegWrite "HKCR\VBSFile\shell\edit\command\", "notepad.exe ""%1"""
WshShell.RegWrite "HKLM"&Smwc&"Policies\Explorer\RestrictRun", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\Explorer\RestrictRun", "0", "REG_DWORD"
WshShell.RegWrite "HKLM"&Smwc&"Policies\Explorer\DisallowRun", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\Explorer\DisallowRun", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Policies\Explorer\NoFileAssociate ", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\Hidden", "1", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\HideFileExt", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\SuperHidden", "1", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\ShowSuperHidden ", "1", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\Start_ShowRun", "1", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\Start_ShowSearc h", "1", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\Start_ShowHelp" , "1", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smwc&"Explorer\Advanced\HideIcons", "0", "REG_DWORD"
WshShell.RegWrite "HKCU"&Smie&"Main\Start Page", "about:blank"
WshShell.RegWrite "HKLM"&Smwnc&"Winlogon\Shell", "Explorer.exe"
WshShell.RegWrite "HKLM"&Smwnc&"Winlogon\Userinit", winpath & "\system32\userinit.exe,"
WshShell.RegWrite "HKLM"&Smwnc&"Winlogon\Shell", "Explorer.exe"
WshShell.RegWrite "HKLM"&Smwc&"App Paths\HELPCTR.EXE\", winpath & "\PCHealth\HelpCtr\Binaries\helpctr.exe"
WshShell.RegWrite "HKLM"&Smwc&"App Paths\HELPCTR.EXE\Path", winpath & "\PCHealth\HelpCtr\Binaries\"
WshShell.RegWrite "HKLM"&Smwc&"App Paths\MSCONFIG.EXE\", winpath & "\PCHealth\HelpCtr\Binaries\msconfig.exe"
WshShell.RegWrite "HKLM"&Smwc&"App Paths\MSCONFIG.EXE\Path", winpath & "\PCHealth\HelpCtr\Binaries\"
WshShell.RegWrite "HKLM"&Smwnc&"SystemRestore\DisableSR", "0", "REG_DWORD"
WshShell.RegDelete "HKLM"&Spmn&"SystemRestore\DisableSR"
WshShell.RegDelete "HKLM"&Smwc&"Policies\Explorer\NoLogOff"
WshShell.RegDelete "HKLM"&Smwc&"Policies\Explorer\NoControlPanel"
WshShell.RegDelete "HKLM"&Smwc&"Winlogon\LegalNoticeCaption"
WshShell.RegDelete "HKLM"&Smwc&"Winlogon\LegalNoticeText"
WshShell.RegDelete "HKLM"&Smwnc&"Winlogon\LegalNoticeCaption"
WshShell.RegDelete "HKLM"&Smwnc&"Winlogon\LegalNoticeText"
WshShell.RegDelete "HKLM"&Smwc&"Run\Ageia"
WshShell.RegDelete "HKCU"&Smie&"Main\Window Title"
WshShell.RegDelete "HKCU"&Smwc&"Policies\Explorer\NoFind"
WshShell.RegDelete "HKCU"&Smwc&"Policies\Explorer\NoFolderOptions "
WshShell.RegDelete "HKCU"&Smwc&"Policies\Explorer\NoRun"
WshShell.RegDelete "HKCU"&Smwc&"Policies\Explorer\NoViewContextMe nu"
WshShell.RegDelete "HKCU"&Smwc&"Policies\Explorer\NoTrayContextMe nu"
WshShell.RegDelete "HKCU"&Smwc&"Policies\Explorer\NoWinKeys"
WshShell.RegDelete "HKCU"&Smwc&"Policies\System\DisableRegistryTo ols"
WshShell.RegDelete "HKCU"&Smwc&"Policies\System\DisableTaskMgr"
WshShell.RegDelete "HKCU"&Smwc&"Policies\System\DisableRegedit"
WshShell.RegDelete "HKCU"&Smwc&"Policies\System\DisableCMD"
WshShell.RegDelete "HKCU"&Smwc&"Policies\ActiveDesktop\NoChangingWall paper"
WshShell.RegDelete "HKCU"&Smwc&"Explorer\RunMRU\"
WshShell.RegDelete Hsmwci&"cmd.exe\"
WshShell.RegDelete Hsmwci&"helpctr.exe\"
WshShell.RegDelete Hsmwci&"msconfig.exe\"
WshShell.RegDelete Hsmwci&"regedit.exe\"
WshShell.RegDelete Hsmwci&"regedt32.exe\"
WshShell.RegDelete Hsmwci&"TaskMgr.exe\"
WshShell.RegDelete Hsmwci&"attrib.exe\"
WshShell.RegDelete Hsmwci&"install.exe\"
WshShell.RegDelete Hsmwci&"setup.exe\"
WshShell.RegDelete Hsmwci&"PCMAV.exe\"
WshShell.RegDelete Hsmwci&"PCMAV-CLN.exe\"
WshShell.RegDelete Hsmwci&"PCMAV-RTP.exe\"
WshShell.RegDelete Hsmwci&"PCMAV-SE.exe\"
WshShell.RegDelete Hsmwci&"VB6.exe\"
WshShell.RegDelete Hsmwci&"autorun.exe\"
WshShell.RegDelete Hsmwci&"ansav.exe\"
WshShell.RegDelete Hsmwci&"ansavgd.exe\"
WshShell.RegDelete Hsmwci&"avscan.exe\"
WshShell.RegDelete Hsmwci&"avgnt.exe\"
WshShell.RegDelete Hsmwci&"gav.exe\"
WshShell.RegDelete Hsmwci&"iexplore.exe\"
WshShell.RegDelete Hsmwci&"firefox.exe\"
WshShell.RegDelete Hsmwci&"procexp.exe\"
WshShell.RegDelete Hsmwci&"procexpNT.exe\"
WshShell.RegDelete Hsmwci&"AppSvc32.exe\"
WshShell.RegDelete Hsmwci&"ccApp.exe\"
WshShell.RegDelete Hsmwci&"ccSvcHst.exe\"
WshShell.RegDelete Hsmwci&"Rtvscan.exe\"
WshShell.RegDelete Hsmwci&"Smc.exe\"
WshShell.RegDelete Hsmwci&"SmcGui.exe\"
WshShell.RegDelete Hsmwci&"egui.exe\"
WshShell.RegDelete Hsmwci&"ekrn.exe\"
WshShell.RegDelete Hsmwci&"RegistryEditor.exe\"
WshShell.RegDelete Hsmwci&"wordpad.exe\"
WshShell.RegDelete Hsmwci&"viremoval.exe\"
WshShell.RegDelete Hsmwci&"viremover.exe\"

For Each FlashDisk In fso.drives
If (FlashDisk.drivetype = 1 Or FlashDisk.drivetype = 2) And FlashDisk.Path <> "A:" Then
set autoruninf = fso.GetFile(FlashDisk.Path & "\autorun.inf")
autoruninf.Delete true
set dekstopini = fso.GetFile(FlashDisk.Path & "\dekstop.ini")
dekstopini.Delete true
End If
Next

3.Simpan dengan Save As Type : All File, dan File Name : PerbaikanRegistry.vbs silahkan letakan di drive mana saja. Untuk contoh taruh saja di desktop, kemudian double klik file yang baru dibuat tersebut.
4.Mudah-mudahan membantu meringankan beban anda masalah virus.

Sumber : http://indoforum.org/showthread.php?t=43007