واضح آرشیو وب فارسی:سایت ریسک: View Full Version : كرم brontok.g bbc_sh15th April 2008, 12:28 AMسلام.اين كرم (brontok.g) باnod 32 پيدا ميشه ولي نمي تونه پاكش كنه.سيمنتك رو هم امتحان كردم جواب نداد.فولدر اوپشن هم كار نميكنه .وارد رجيستري و برنامه هاي clean up هم كه ميشم restart ميشه.هر كه ميدونه چه طوري پاك ميشه لطف كنه كمكم كنه چون نمي خوتم ويندوز نصب كنم.ممنون.:-< alfredo15th April 2008, 10:05 AMسلام.اين كرم (brontok.g) باnod 32 پيدا ميشه ولي نمي تونه پاكش كنه.سيمنتك رو هم امتحان كردم جواب نداد.فولدر اوپشن هم كار نميكنه .وارد رجيستري و برنامه هاي clean up هم كه ميشم restart ميشه.هر كه ميدونه چه طوري پاك ميشه لطف كنه كمكم كنه چون نمي خوتم ويندوز نصب كنم.ممنون.:-< اينجا فارسيش گفته شده : کاربران ثبت نام کرده قادر به مشاهده لینک می باشند اين هم راهكار اينگليسيش : Solution: Deleting Malware Files on Windows 2000, XP, and Server 2003 using Recovery Console This malware uses a complex memory-residency technique that makes it particularly difficult to terminate and remove from the system. To successfully remove this malware, boot the system using the Recovery Console. To boot with into Recovery Console, please do the following: Start your computer with a Windows 2000 or XP installation CD. Insert the CD into the CD drive and restart your system. At the Welcome to Setup screen, press R to repair. For users using Windows 2000 CD, press C to start the Windows Recovery Console. Select the appropriate number which corresponds to the Windows installation that you want to repair. Usually, this is represented by the number 1. Type the administrator password. If an administrator password does not exist, press ENTER. On the command prompt, locate the folder %UserProfile%Local SettingsApplication Data. (Note: %UserProfile% is the user profile folder, which is usually C:Documents and Settings{User name}.) In the folder where the malware files are, type the following command, then press ENTER: DEL br5931on.exe. Repeat the step above with the following commands: DEL csrss.exe DEL inetinfo.exe DEL lsass.exe DEL services.exe DEL smss.exe DEL svchost.exe On the command prompt, locate the folder %Windows%. In the folder where the malware files are, type the following command, then press ENTER: DEL KesenjanganSosial.exe. (Note: %Windows% is the Windows folder, which is usually C:Windows or C:WINNT.) On the command prompt, locate the folder %Windows%ShellNew. In the folder where the malware files are, type the following command, then press ENTER:DEL RakyatKelaparan.exe. On the command prompt, locate the folder %System%. In the folder where the malware files are, type the following command, then press ENTER: DEL cmd-brontok.exe. (Note: %System% is the Windows system folder, which is usually C:WINNTSystem32 on Windows NT and 2000, or C:WindowsSystem32 on Windows XP and Server 2003.) Restart the system normally.Restarting in Safe Mode on Windows ME and NT This malware has characteristics that require the computer to be restarted in safe mode. Removing Autostart Entries from the Registry on Windows 2000, XP, and Server 2003 Removing autostart entries from the registry prevents the malware from executing at startup. If the registry entries below are not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter. In the left panel, double-click the following: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> Windows>CurrentVersion>Run In the right panel, locate and delete the entry: Bron-Spizaetus = "%Windows%ShellNewRakyatKelaparan.exe" In the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft> Windows>CurrentVersion>Run In the right panel, locate and delete the entry: Tok-Cirrhatus-2454 = "%UserProfile%Local SettingsApplication Datar5931on.exe" In the left panel, double-click on the following: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> Windows NT>CurrentVersion>Winlogon In the right panel, locate the entry: Shell = "Explorer.exe "%Windows%KesenjanganSosial.exe"" Right-click on the said entry and choose Modify. Change the value to: Shell = "Explorer.exe" Close Registry Editor.Removing Autostart Entries from the Registry on Windows ME Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter. In the left panel, double-click the following: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> Windows>CurrentVersion>Run In the right panel, locate and delete the entry: Bron-Spizaetus = "%Windows%ShellNewRakyatKelaparan.exe" In the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft> Windows>CurrentVersion>Run In the right panel, locate and delete the entry: Tok-Cirrhatus-1464 = "%Windows%Application Datar3951on.exe" Close Registry Editor.Removing Autostart Entries from the Registry on Windows NT Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter. In the left panel, double-click the following: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> Windows>CurrentVersion>Run In the right panel, locate and delete the entry: Bron-Spizaetus = "ShellNewRakyatKelaparan.exe" In the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft> Windows>CurrentVersion>Run In the right panel, locate and delete the entry: Tok-Cirrhatus-1464 = "Mediar3951on.exe" In the left panel, double-click on the following: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> Windows NT>CurrentVersion>Winlogon In the right panel, locate the entry: Shell = "Explorer.exe "KesenjanganSosial.exe"" Right-click on the said entry and choose Modify. Change the value to: Shell = "Explorer.exe" Close Registry Editor.Removing Other Malware Entries from the Registry Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter. In the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft> Windows>CurrentVersion>Policies>Explorer In the right panel, locate and delete the entry: NoFolderOptions = "dword:00000001" In the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft> Windows>CurrentVersion>Policies>System In the right panel, locate and delete the entry: DisableCMD = "dword:00000000"Addressing Safe Mode Autostart Registry Entry for Windows 2000, XP, and Server 2003 Still in Registry Editor, in the left panel, double-click the following: HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Control>SafeBoot In the right panel, locate the entry: AlternateShell = "cmd-brontok.exe" Right-click on the said entry and choose Modify. Change the value to: AlternateShell = "cmd.exe" Close Registry Editor.Restoring AUTOEXEC.BAT on Windows ME Open AUTOEXEC.BAT in Notepad using command prompt. In the command prompt, type this text string in the Open input box then press Enter: notepad c:autoexec.bat Delete the following entry created by the malware: pause Close AUTOEXEC.BAT and click Yes when prompted to save.Important Windows ME/XP Cleaning Instructions Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers. Users running other Windows versions can proceed with the succeeding solution set(s). Running Antivirus If you are currently running in safe mode, please restart your computer normally before performing the following solution. سایت ما را در گوگل محبوب کنید با کلیک روی دکمه ای که در سمت چپ این منو با عنوان +1 قرار داده شده شما به این سایت مهر تأیید میزنید و به دوستانتان در صفحه جستجوی گوگل دیدن این سایت را پیشنهاد میکنید که این امر خود باعث افزایش رتبه سایت در گوگل میشود
این صفحه را در گوگل محبوب کنید
[ارسال شده از: سایت ریسک]
[مشاهده در: www.ri3k.eu]
[تعداد بازديد از اين مطلب: 359]