Memunculkan File Hidden Dengan VBS

Memuculkan File Hidden Dan Membongkar Virus Dengan VBS atau Visual Basic Sript.

Ini adalah script dasar untuk memunculkan kembali file yang telah dihidden oleh virus dan mengembalikan kembali registry yang telah dirusak oleh virus. Anda juga bisa mengubah script dibawah ini dengan keinginan anda. Yang anda lalakukan adalah copy paste script yang ada dibawah ini ke notepad lalu save file tersebut dengan file nama terserah anda misal script.vbs . Ingat file tersebut harus berekstention file vbs. Setelah di save klik 2x file tersebut, setelah itu restart explorer anda dengan memunculkan task manager CTRL + Alt + Del. lalu cari proses explorer lalu end procces, kemudia klik file pada Task Manager lalu pilih New Task ( Run...) lalu ketikan explorer dan ketik OK.


on error resume next

dim infreg, almreg

rem -- dapat memilih beberapa baris script saja sesuai kebutuhan

set infreg = createobject("WScript.Shell")

rem -- membongkar beberapa fasilitas yang di blokir
almreg ="HKCU\Software\Policies\Microsoft\Windows\System\"
infreg.RegWrite almreg & "DisableCMD","0","REG_DWORD"

almreg ="HKCU\Software\Microsoft\Windows\CurrentVersion\"
infreg.RegWrite almreg & "Policies\System\DisableTaskMgr","0","REG_DWORD"
infreg.RegWrite almreg & "Policies\System\DisableMsConfig","0","REG_DWORD"
infreg.RegWrite almreg & "Policies\System\DisableRegistryTools","0","REG_DWOrD"


rem -- membongkar beberapa fasilitas yang dihiden
infreg.RegWrite almreg & "Explorer\Advance\Hidden","0","REG_DWORD"
infreg.RegWrite almreg & "Explorer\Advance\HideFileExt","0","REG_DWORD"
infreg.RegWrite almreg & "Explorer\Advance\ShowSuperHidden","0","0x00000000"

almreg ="HKLM\Software\Microsoft\Windows NT\SystemRestore\"
infreg.RegWrite almreg & "DisableSR","0","REG_DWORD"

almreg ="HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"
infreg.RegWrite almreg & "Folder\SupperHiden\type","Checkbox"
infreg.Regwrite almreg & "Folder\HideFileExt\Type","Checkbox"

rem -- membongkar kembali fasilitas beberapa fasilitas yang disembunyikan untuk dimunculkan
almreg ="HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"
infreg.RegWrite almreg & "NoRun","0","REG_DWORD"
infreg.RegWrite almreg & "NoFind","0","REG_DWORD"
infreg.RegWrite almreg & "NoClose","0","REG_DWORD"
infreg.RegWrite almreg & "NoViewOnDrive","0","REG_DWORD"
infreg.RegWrite almreg & "NoControlPanel","0","REG_DWORD"
infreg.RegWrite almreg & "NoFolderOptions","0","REG_DWORD"
infreg.RegWrite almreg & "NoViewContextMenu","0","REG_DWORD"
infreg.RegWrite almreg & "NostartMenuMorePrograms","0","REG_DWORD"

rem -- mengembalikan beberapa inisial yang dirubah untuk memplubikasikan virus
almreg = "HKCU\SoftWare\Microsoft\Internet Explorer\Main\"
infreg.RegWrite almreg & "Start page","About:blank"

almreg = "HKLM\Software\Microsoft\Windows NT\CurrentVersion\"
infreg.RegWrite almreg & "ProductId","Your ID"
infreg.RegWrite almreg & "RegisteredOwner","Owner"
infreg.RegWrite almreg & "RegisteredOrganization","Organization"