0 Virus Alman / Almanahe Remover & Cleaner

Virus Alman / Almanahe yang mempunyai nama lain

• Avira : W32.Almanahe.B
• Symantec : W32.Almanahe.B
• Mcafee : W32/Almanahe.c virus
• Kaspersky : Virus.Win32.Alman.b
• TrendMicro : PE_CORELINK.C-1
• F-Secure : Virus.Win32.Alman.b
• Sophos : W32/Alman-C
• Panda : W32/Almanahe.C
• AVG : Win32/Alman
• VirusBuster : Win32.Alman.B
• Eset: Win32/Alman.NAB virus
• Bitdefender: Win32.Almanahe.D

akhir-akhir ini kembali mengganas di Indonesia. Virus Alman / Almanahe ini, menyebar melalui jaringan dengan melalui share folder [C$/D$/ADMIN$] dan flashdisk. Virus Alman / Almanahe, menginjeksi file EXE dan membuat file boot.exe dan autorun.inf.

Remove Manual Virus Alman / Almanahe

1. Disconnect network / internet
2. Disable system Restore
3. Boot safe mode
4. Stop service yang mempunyai nama “NVIDIA Compatible Windows Miniport Driver” atau “ RioDrvs Usb Driver”
5. Stop file di LINKINFO.DLL memory
6. Buat file inf untuk hapus registry windows yang dibuat oleh virus, running

[Version]

Signature="$Chicago$"

[DefaultInstall]

AddReg=UnhookRegKey

DelReg=del

[UnhookRegKey]

HKLM,Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*"

HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*"

HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*"

HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*"

HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe "%1""

HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, "Explorer.exe"

HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, "cmd.exe"

HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, "cmd.exe"

HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe"

HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0x00010001,1

[del]

HKLM, Software\Microsoft\Internet Explorer\Main, Window Title

HKLM, SYSTEM\ControlSet001\Services\RioDrvs

HKLM, SYSTEM\ControlSet001\Services\cdralw

HKLM, SYSTEM\ControlSet001\Services\nvmini

HKLM, SYSTEM\CurrentControlSet\Services\RioDrvs

HKLM, SYSTEM\CurrentControlSet\Services\nvmini

HKLM, SYSTEM\CurrentControlSet\Services\cdralw

HKLM, SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RIODRVS

HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_RIODRVS

HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_nvmini

HKLM, SYSTEM\CurrentControlSet\Enum\Root\LEGACY_cdralw

HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_cdralw

HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_nvmini

7. Checked Show hidden files and folders dan unceck Hide protected operating system files (recommended)
8. Delete file yang dibuat oleh virus

C:\Windows\linkinfo.dll

C:\Windows\System32\drivers\lsDrv118.sys

C:\Windows\system32\\drivers\nvmini.sys

C:\Windows\System32\\drivers\cdralw.sys

C:\Windows\System32\drivers\riodrvs.sys

C:\Windows\System32\drivers\DKIs6.sys

Hapus juga file Boot.exe dan autorun.inf yang dibuat di FlashDisk....