pertama kali saya dapatkan si doi”tukul arwana.doc.exe”ini, saat salah seorang user meminta tolong cara menghapus virus ini.saya malah kewalahan dan akhirnya hanya mengambil file induk virus tersebut. Saya meminta maaf pada user tersebut dan berjanji mencari caranya,dan meminta bantuan pada teman.selama 3 minggu lamanya menjadi pekerjaan rumah untuk mencari cara membasmi si doi “virus tukul arwana.doc.exe”.dan akhirnya ketemu juga caranya berkat bantuan teman yang ada di Solo.silahkan ikuti langkah-langkahnya:

Pertama:

kenali terlebih dahulu kapasitas virus tersebut,yakni kapasitas virus tersebut adalah 56 kb.
Virus ini berexkstensi doc.exe
jenis file aplication.

Yang Kedua:

kalau komputernya berjaringan matikan terlebih dahulu jaringannya.
seperti biasanya,menghapus secara manual dengan cara-
search dengan key “*.exe”
matikan proses kerja virus tersebut,
gunakan tool ini http://www.nirsoft.net/utils/cprocess.html,
yang anda harus matikan :
-spool32.exe
-winword.exe

yang terakhir :

Hapus string registry yang dibuat oleh virus, untuk mempercepat proses penghapusan registry tersebut salin script dibawah ini pada notepad kemudian simpan dengan nama "repair.vbs" setelah itu jalankan file tersebut kemudian logoff komputer.

Dim oWSH: Set oWSH = CreateObject("WScript.Shell")
on error resume Next
oWSH.Regwrite "HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command\","""%1"" %*"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command\","""%1"" %*"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command\","""%1"" %*"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command\"
,"""%1"" %*"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\Software\CLASSES\scrfile\shell\open\command\","""%1"" /S"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\Software\CLASSES\regfile\shell\open\command\","regedit.exe %1"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\AlternateShell","cmd.exe"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\AlternateShell","cmd.exe"
oWSH.Regwrite "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\AlternateShell","cmd.exe"
oWSH.Regwrite

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShell","
cmd.exe"oWSH.Regwrite
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell","Explorer.exe"
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\Windows
\CurrentVersion\Run\Microsoft Word")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run\Printer Cpl")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
Windows\Installer\DisableMSI")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
Windows\Installer\LimitSystemRestoreCheckpointing")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoWinLeys")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoControlPanel")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoFolderOptions")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoCLose")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\Nofind")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoRun")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\DisableMSI")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoClose")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoFolderOptions")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoWinLeys")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft
\Windows\CurrentVersion\Policies\Explorer\NoDesktop")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NOLogoff")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoWinKeys")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\Explorer\Run\")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\System\DisableTaskMgr")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\WinOldApp\")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\System\DisableTaskMgr")
oWSH.RegDelete("HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\Explorer\Run\")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\System\DisableCMD")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoWinKeys")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoDesktop")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoLogoff")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\System\DisableRegistryTools")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\System\NoDispApprearancePage")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft
\Windows\CurrentVersion\Policies\System\NoDispCpl")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\System\NoDispBackgroundPage")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\System\NoDispSettingsPage")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\System\NoScrSavPage")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\Microsoft
\Windows\CurrentVersion\Policies\WinOldApp\")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\SOFTWARE\
Classes\exefile\NeverShowExt")
oWSH.RegDelete("HKEY_CLASSES_ROOT\exefile\NeverShowExt")
oWSH.RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\Explorer\NoFolderOptions")
oWSH.RegDelete("HKEY_CURRENT_USER\Software\policies\
Microsoft\system\DisableCMD")

Jika menggunakan Windows ME/XP, disable "System Restore" untuk sementara
selama proses pembersihan berlangsung.

 
mungkin hanya itu saja yang saya dapat bagi pada rekan-rekan sekalian ataupun
yang membuka web ini.saya cuman sekedar membagi informasi,tidak ada mak-
sud lain.terima kasih kalau anda memanfaatkan informasi ini.

cintaku datang dan bersemi
membawa kebahagian sementara
serasa aku di atas awan
senang rasanya….

***************

Ntah kenapa…
Ingin rasa berjumpa
tapi,terpisah jarak dan waktu