Virus Alman / Almanahe yang mempunyai nama lain
- Avira : W32.Almanahe.B
- Symantec : W32.Almanahe.B
- Mcafee : W32/Almanahe.c virus
- Kaspersky : Virus.Win32.Alman.b
- TrendMicro : PE_CORELINK.C-1
- F-Secure : Virus.Win32.Alman.b
- Sophos : W32/Alman-C
- Panda : W32/Almanahe.C
- AVG : Win32/Alman
- VirusBuster : Win32.Alman.B
- Eset: Win32/Alman.NAB virus
- Bitdefender: Win32.Almanahe.D
akhir-akhir ini kembali mengganas di Indonesia. Virus Alman / Almanahe ini, menyebar melalui jaringan dengan melalui share folder [C$/D$/ADMIN$] dan flashdisk. Virus Alman / Almanahe, menginjeksi file EXE dan membuat file boot.exe dan autorun.inf.
Remove Manual Virus Alman / Almanahe
- Disconnect network / internet
- Disable system Restore
- Boot safe mode
- Stop service yang mempunyai nama “NVIDIA Compatible Windows Miniport Driver” atau “ RioDrvs Usb Driver”
- Stop file di LINKINFO.DLL memory
- Buat file inf untuk hapus registry windows yang dibuat oleh virus, running
- Checked Show hidden files and folders dan unceck Hide protected operating system files (recommended)
- Delete file yang dibuat oleh virus
[Version]
Signature="$Chicago$"
[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del
[UnhookRegKey]
HKLM,Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe "%1""
HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, "Explorer.exe"
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0x00010001,1
[del]
HKLM, Software\Microsoft\Internet Explorer\Main, Window Title
HKLM, SYSTEM\ControlSet001\Services\RioDrvs
HKLM, SYSTEM\ControlSet001\Services\cdralw
HKLM, SYSTEM\ControlSet001\Services\nvmini
HKLM, SYSTEM\CurrentControlSet\Services\RioDrvs
HKLM, SYSTEM\CurrentControlSet\Services\nvmini
HKLM, SYSTEM\CurrentControlSet\Services\cdralw
HKLM, SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RIODRVS
HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_RIODRVS
HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_nvmini
HKLM, SYSTEM\CurrentControlSet\Enum\Root\LEGACY_cdralw
HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_cdralw
HKLM, SYSTEM\CurrentControlSet001\Enum\Root\LEGACY_nvmini
C:\Windows\linkinfo.dll
C:\Windows\System32\drivers\lsDrv118.sys
C:\Windows\system32\\drivers\nvmini.sys
C:\Windows\System32\\drivers\cdralw.sys
C:\Windows\System32\drivers\riodrvs.sys
C:\Windows\System32\drivers\DKIs6.sysHapus juga file Boot.exe dan autorun.inf yang dibuat di FlashDisk....




