Windows

Saya menulis artikel ini kerana terjadi satu permasalahan ditempat kerja lama saya. Apa yang terjadi ialah komputer ditempat kerja lama saya itu mengalami serangan virus yang akan mengakibatkan file dan folder akan dihiddenkan oleh virus tersebut dan diganti dengan file yang menyerupai file asal dan mempunyai extention .exe. Seperti contoh file asal ialah text.doc yang dihiddenkan dan virus tersebut membina file text.doc.exe yang bertujuan mengelirukan pengguna komputer dan membuka file tersebut. Akibat daripada membuka file tersebut, virus tersebut akan terus aktif dan merebak di dalam komputer. Yang menghairankan saya ialah antivirus yang digunakan tidak dapat mengesan virus tersebut sedangkan antivirus yang dibekalkan oleh Kem. Pelajaran merupakan antivirus berbayar. Tidak perlu saya nyatakan nama antivirus tersebut. Apa yang pasti saya menggunakan antivirus Avast Home Free Edition dan virus tersebut dapat dihalang daripada menjangkiti komputer saya.

Cerita ini berlaku apabila salah seorang staff menghadapi masalah tersebut dan meminta juruteknik menyelesaikan masalahnya tetapi jawapan juruteknik: “boleh buka file tersebut tetapi tidak dapat unhidden file tersebut”. Inilah masalah apabila orang yang dilantik tidak mempunyai ilmu yang secukupnya sedangkan apa sahaja masalah pada komputer termasuk masalah yang disebabkan oleh virus ada jalan penyelesaiannya.

Di sini saya berikan cara untuk membolehkan file yang dihidden untuk unhidden (mengaktifkan semula fungsi checkbox pada properties file tersebut).

1. Pertama sekali, pastikan drive yang dijangkiti virus tersebut dan pastikan virus tersebut dah dipadamkan daripada drive tersebut menggunakan antivirus.
2. Pastikan drive path bagi drive tersebut. Sebagai contoh, pen drive menggunakan drive path H:
3. Klik butang start -> klik Run…
4. Taip command di dalan text area open:
5. Anda akan mendapati Window DOS berwarna hitam.
6. Taip drive path pen drive anda. Contoh taipkan H:\
7. Selepas itu taipkan arahan attrib -h -s *
8. File anda akan kelihatan semula di dalam pen drive anda.

Sebenarnya pada masa zaman IT, tiada istilah I don’t know how to do that kerana sekiranya anda tidak tahu cara menyelesaikan masalah, google sahaja di internet. Bak kata pepatah, hendak seribu daya, tak hendak pelbagai dalih.

Beberapa hari yang lalu seorang sahabat saya meminta saya menyelesaikan masalah beliau iaitu laptop beliau dijangkiti dengan virus HBKiller.js. Di sini ingin saya kongsikan bersama langkah – langkah bagi memadam masalah virus ini secara manual.

1. Finding potential processes running- Press CTRL, ALT and DELETE key together. You will open the Windows Task Manager.- Click the Processes tab, and comb through the list and see whether there is a program called wscript.exe is running. If you find it, click on it and click End Process.- After that you can close the Task Manager window.

2. Finding the virus (for those who were not detected by the antivirus – for Microsoft Windows)- Go to My Computer- Click Tools at the top bar –> Folder Options- When you come to the Folder Options window, click on the View tab- Look for Hidden files and folders- Tick Show hidden files and folders- Tick Show system files- Press OK- Once the window is closed, click on your C drive once.- Go to C:\WINDOWS\system32. Once you are in there, look for whether there is a filename called HBKiller.js- If you can’t find it in C (like I did), look in C:\Windows- If you still can’t find it, don’t worry, press F3 at the top row of your keyboard (in case you don’t know) and the search bar will be on your left. Click on All files and folders, and type in the file name HBKiller.jsIf you don’t find any file in there, congratulations, you are one step out of it.You can jump to step (4)

3. You found the virus- Click on the file you found and press SHIFT key and DELETE key- It will ask you “Are you sure you want to delete (the file name)”. Click Yes- If you find more than one location that has HBKiller.js, then you need to repeat the steps in (3)

4. Editing the Windows Register (do it with full of caution!)- Click Start –> Run- Type regedit and press ENTER- You will come to the Registry Editor window- On your left there will be the registry directories. Look for:HKEY_LOCAL_MACHINE –> Software –> Microsoft –> Windows –> Current Version –> Run- If there is a HBKiller.js in there, delete the entry.- Then you need to look for:HKEY_CURRENT_USER –> Software –> Microsoft –> Internet Explorer –> Main- If you see the Window Title has “HBKiller In The House!!!” you should delete that entry.- You can now close the Registry Editor window.

5. Stop all auto runs in future (recommended move)- Click on Start –> Run- Type gpedit.msc and press ENTER- You will come to the Group Policy window- Go to User Configuration –> Administrative Templates –> System- Look for Turn off Autoplay and double click it. You will come to Turn Off Autoplay Properties window.- Click Enable and select All drives from the drop-down combo box.(It is suggested to turn it off to avoid further potential virus infections in future)- You can now close the Group Policy window.

6. Stopping auto run virus programs (if have)- Click on Start –> Run – Type msconfig and press ENTER. You will come to the System Configuration Utility window- Click on the Startup tab, and look for any programs that runs under HBKiller.js- If you find then, uncheck the checkbox on the left of the file- Click Apply- Click Close- When you close the window it will ask you whether to restart or not. Click on Exit without Restart.

7. Start > Run > RegeditThen go toHKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Explorer > MountPoints2 >Then you will see a list of random numbers and jargon looking a little like “{07852ef4-9baf-11db-a10c-806d6172696f}” – This refers to your hard drives. The more you have the more random things you will have in this list. A partition counts as a seperate drive.Now go in these “drives” toShell > AutoRun > commandYou will see a file called “default” with some code next to it saying ”C:\\WINDOWS\\system32\\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe .HBKiller.js”. or similar. Open the file and delete all the “wscript.exe .HBKiller.js” part. I dunno if you need the rest but this will kill it anyway.Do this for every drive you have within the “Mountpoints2″ subtree. Also go into:Shell > AutoPlay > commandShell > Explore > commandShell > Open > commandShell > Scan for Biros > commandShell > Scan with Manok > commandShell > Scan with Rempit > commandAnd open the default file and delete “wscript.exe HBKiller.js”

8. Restarting your PC- Before restart, make sure that you empty your recycle bin.

Restart your PC- You will see a windows prompt that you have changed your system configurations. Check on the checkbox not to remind you anymore and press ok.