Cara Remove W32.IMAUT.J (Virus YM yang ngirim thecoolpics.net)

1. download ini dulu (IE “save target as” atau Firefox “save link as”):
http://securityresponse.symantec.com/avcenter/UnHookExec.inf

2. klik kanan di file yang barusan di donlot, pilih install (untuk kita bisa jalanin Regedit)

3. kemudian jalankan regedit32 dari folder system32 di windows, biasanya ada di C:\WINDOWS\SYSTEM32\ untuk XP

4. buka

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

atau

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

atau

HKey_Current_User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

hapus yang (antara ini) DisableLocalMachineRun atau DisableLocalMachineRunOnce atau DisableCurrentUserRun atau DisableCurrentUserRunOnce atau noRun. dia bisa pake apa aja untuk disable RUN, kalo gak ada key nya dan run masih di disable, search for “noRun”

5. hapus juga

“DisableTaskMgr”
“DisableRegistryTools”

6. buka

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Hapus

“Task Manager” = “%Windir\system\svchost32.exe”
“SVCHOST” = “%Windir\system\svhost.exe”

7. buka

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

hapus

“Start Page” =”[http://]thecoolpics.com/[REMOVED]“

8. buka

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel

hapus

“Homepage” = “1?

9. buka

HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_buzz dan HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_Launchcast

hapus

“content url” = “[http://]thecoolpics.com/[REMOVED]“

10. Restart, masuk ke safe mode

11. hapus file berikut

C:\WINDOWS\system32\svchost32.exe
C:\WINDOWS\system32\svhost.exe

(ini bukan file system, file system adalah svchost.exe dia niru)

12. selametan karna komputer uda bersih

Posted by Bang Juntak on Jun 5th, 2007 and filed under Tutorial. You can follow any responses to this entry through the RSS 2.0. You can leave a response by filling following comment form or trackback to this entry from your site

3 Responses for “Cara Remove W32.IMAUT.J (Virus YM yang ngirim thecoolpics.net)”

roby says:

June 22, 2008 at 10:32 am

thhanks ya
rohman says:

August 26, 2008 at 2:01 pm

suwun mas n kalo ada info lagi mau donk n ajarin donk mas supaya q dapat berkarya kayak sampeyan
kyuby says:

April 4, 2009 at 10:57 am

virus ym ya anehh,,ym jadi lemot gerknya!!