Maggo Mag Theme

/*
Brontok Remover
Copyright (C) 2006 - Teddy Baykard
teddy_baykard@yahoo.com

This tools is free; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This tools is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/


ASSUME :
=======
Antivirus was installed-uptodate in you'r system

How to remove Brontok?

Simply, follow the instruction below:
1. Turn off system restore (just find in WIN-HELP or Press F1 on Desktop if you don't now how to do it)
2. extract 'BrontokRemover.zip' to My Documents, than move RegFixer-shortcut to desktop
3. Recommended - Delete Start Menu\Programs\Startup\Empty.pif
4. restart > safe-mode
5. right click RegFixer-shortcut > install - do it at least 3 times
6. open command-shell immediately, repeat step-3 while restart
7. if system doesn't restart, run Remover.bat
8. restart > normal-mode
9. Full-Scan your system
10.Turn on system restore

Help :
Help ini Saya buat se-awam mungkin. Maaf bagi Anda yang muak dengan langkah yang panjang dan bertele-tele :)

1. Sebelum memulai, pastikan Komputer Anda sudah terinstal antivirus apapun. Siapkan juga virus_definition terbaru yang telah mengenali W32/Brontok.Hal pertama yang harus Anda lakukan untuk membasmi Brontok adalah dengan menonaktifkan System Restore Windows. Caranya?

Untuk Win XP:
> Klik Kanan My_Computer > Properties > Pilih Tab System Restore > CheckList pilihan Turn off System Restore > OK

Untuk Win ME:
> Start > Settings > Control Panel
> Double-click the System icon
> If the System icon is not visible, click View all Control Panel options to display it
> On the Performance tab, click File System
> On the Troubleshooting tab check Disable System Restore > OK
> When you are asked to restart Windows, click Yes

atau Klik Start > Help and Support > Ketikkan "Turn off System Restore" > ikuti langkah-langkah yang diberikan

2. Extract BrrontokRemover.zip ke My Documents, lalu cut-paste Regfixer-Shortcut ke desktop
3. Saran Saya, delete file "Empty.pif" yang ada di Start Menu\Programs\Startup
4. Restart > SAFE-MODE
5. Klik kanan Regfixer-shortcut > install. Lakukan minimal tiga kali.
6. Buka Command-Shell segera (Start > Run > ketikkan "cmd"), jika komputer Restart ulangi langkah ke-3
7. Jika Komputer Anda tidak Restart, eksekusi "Remover.bat" yang ada pada My Documents\BrontokRemover\Registry Fixer
8. Restart > NORMAL-MODE
9. Sekarang Anda bisa mengupdate Antivirus Anda dengan Virus Definition terbaru, lalu Full-Scan Komputer Anda.
10.Turn off System Restore

Jika langkah ke-6 bisa dilakukan tanpa restart, berarti file-file inti W32/Brontok sudah terhapus dari Komputer Anda.
Saat langkah ke-7 Anda lakukan, Remover.bat akan membuka Explorer dengan path "%UserProfile%\Local Settings\Application Data" dan "AUTOEXEC.BAT"-notepad. Anda bisa menghapus Empty-Folder pada path tersebut dan menghapus String "PAUSE" yang ada pada "AUTOEXEC.BAT". Anda bisa memodifikasi File RegFixer.inf dan Remover.bat sesuai dengan kebutuhan.

Sangat tidak Saya sarankan Anda menghapus file-file buatan W32/Brontok secara manual, Full-Scan akan memudahkan Anda menghapus file-file tersebut.

Catatan:
Bila Anda menggunakan OS Win 9x, NT, dan ME buka Comment yang ada di RegFixer.inf lalu ulangi langkah ke-5 sekali saja.



Salam,


:: baykard ::

//File Copy an buat file RegFixer.inf
; Created : 4/01/2006
; ===================== w!Z4rD
; please backup you'r registry first!

; How to Use:
; Turn off System Restore > right click RegFixer.inf > install
; This script will unhook Win Registry tools and shell that critical

[Version]
Signature="$Chicago$"
Provider=Baykard

[DefaultInstall]
AddReg=RegFixer
DelReg=Del
;DelReg=Del2 ; for 9x - Me - NT hilangkan tanda titik-koma di depan DelReg=Del2

[RegFixer]
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced,Hidden,%REG_DWORD%,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced,HideFileExt,%REG_DWORD%,0
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced,ShowSuperHidden,%REG_DWORD%,0
HKLM, Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe "%1""
HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, "Explorer.exe"

[Del]
HKCU, Software\Microsoft\Windows\CurrentVersion\Run,Tok-Cirrhatus
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Bron-Spizaetus
HKLM, SYSTEM\CurrentContolSet\Control\SafeBoot,AlternateShell
HKLM, SYSTEM\ContolSet001\Control\SafeBoot,AlternateShell
HKLM, SYSTEM\ContolSet002\Control\SafeBoot,AlternateShell
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCMD
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoFolderOptions

[Del2]
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run,msconfig
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Pirus Males
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Buat Anda

[Strings]
REG_DWORD = 0x00010001

; for 98 - Me - NT uncomment key below
;HKCU, .DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run,Tok-Cirrhatus
;HKCU, .DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCMD
;HKCU, .DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools