-elangbiru-

frah deh…itu bukan bantu ..tp ngerusak kali ya..

neh copiin scrip ini di scrip virus nya ::on error resume next
‘Disable System Restore
strComputer = “.”
Set objWMIService = GetObject(”winmgmts:” _
& “{impersonationLevel=impersonate}!\\” & strComputer & “\root\default”)

Set objItem = objWMIService.Get(”SystemRestore”)
errResults = objItem.Disable(”")
‘WScript.Echo “System Restore disabled”

dim x, windowpath, syspath, desades
set x = CreateObject (”Scripting.FileSystemObject”)
Set windowpath = x.getspecialfolder(0)
Set syspath = x.getspecialfolder(1)
x.DeleteFile(syspath & “\WinXp.vbs”),True
x.DeleteFile(windowpath & “\MaHaDeWa.dll.vbs”),True

for each desades in x.drives
If (desades.drivetype = 1 or desades.drivetype = 2) and desades.path “A:” then
x.DeleteFile(desades.path &”\MaHaDeWa.dll.vbs”),True
x.DeleteFile(desades.path &”\autorun.inf”),True
end if
next

Set Shell = CreateObject( “WScript.Shell” )
Shell.RegWrite “HKCU\Software\Microsoft\Internet Explorer\Main\StartPage”, “about:blank”, “REG_SZ”
Shell.RegDelete “HKCU\Software\Microsoft\Internet Explorer\Main\Window Title”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced\”
Shell.RegDelete “HKCU\Software\Policies\Microsoft\Windows\system\DisableCMD”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind”
Shell.RegWrite “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun”,”255″, “REG_DWORD”
Shell.RegWrite “HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun”,”255″, “REG_DWORD”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableMsConfig”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys”
Shell.RegDelete “HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore\DisableSR”
Shell.RegDelete “HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff”
Shell.RegDelete “HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel”
Shell.RegDelete “HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\”
Shell.RegDelete “HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Systemdir”
Shell.RegDelete “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu”
Shell.RegWrite “HKLM\Software\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization”, “windows”
Shell.RegWrite “HKLM\Software\Microsoft\Windows NT\CurrentVersion\RegisteredOwner”, “Bilgate”
Shell.RegWrite “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\a”,”awas kena virus lagi”
Shell.RegWrite “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\MRUList”,”a”
Shell.RegDelete “HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption”
Shell.RegDelete “HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText”
Shell.RegDelete “HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Ageia”

‘Enable System Restore
strComputer = “.”
Set objWMIService = GetObject(”winmgmts:” _
& “{impersonationLevel=impersonate}!\\” & strComputer & “\root\default”)

Set objItem = objWMIService.Get(”SystemRestore”)
errResults = objItem.Enable(”")
‘WScript.Echo “System Restore enabled”

WScript.Echo “Perbaikan MaHaDeWa memerlukan restart.” & chr(13) & “Simpan/tutup semua program dan dokumen anda by IT flegt” & chr(13) & “sebelum tekan OK”
set objShell = CreateObject(”WScript.Shell”)
objShell.Run “shutdown -r -t 0 -f”

coba ajah gw berhasil

terima kasih