Giai phap khac phuc tac hai cua virus lay qua USB

Anh: Geekologie.

Cac huong dan sau day se giup ban loai bo tinh trang khong truy cap duoc registry, mat Folder Options, khong cho hien thi file an va file he thong, dong thoi lam an mot so tap tin du lieu khac... ke ca khi da dung phan mem diet virus.
> Cach "cuu chua" don gian cho truc trac cua o USB

Truoc het, ban phai dam bao may tinh da sach virus, neu khong, moi hanh dong se la vo nghia. Virus se nhanh chong nhan biet cac thay doi cua ban va tiep tuc dieu chinh lai he thong theo y cua chung, con nhanh hon ban rat nhieu lan.

1. Bi khoa Registry

Trieu chung: Khi bam Start > Run > go regedit chi nhan duoc mot thong bao "Registry editor has been disabled by your administrator".

Khac phuc: Mo Notepad ra, copy va dan doan ma nay vao va save no lai thanh file UnHookExec.inf

[Version]
Signature="$Chicago$"
Provider=Symantec

[DefaultInstall]
AddReg=UnhookRegKey

[UnhookRegKey]
HKLM, SoftwareCLASSESatfileshellopencommand,,,"""%1"" %*"
HKLM, SoftwareCLASSEScomfileshellopencommand,,,"""%1"" %*"
HKLM, SoftwareCLASSESexefileshellopencommand,,,"""%1"" %*"
HKLM, SoftwareCLASSESpiffileshellopencommand,,,"""%1"" %*"
HKLM, SoftwareCLASSES egfileshellopencommand,,,"regedit.exe ""%1"""
HKLM, SoftwareCLASSESscrfileshellopencommand,,,"""%1"" %*"
HKCU, SoftwareMicrosoftWindowsCurrentVersionPolicies
System,DisableRegistryTools,0x00000020,0

Hoac tai file nay http://securityresponse.symantec.com/avcenter/UnHookExec.inf ve su dung luon.

Sau khi luu, nhan chuot phai vao no roi chon "Install". Neu can restart lai may.

2. Mat Folder Option

Trieu chung: Mo Explorer, tai Menu Tools, thay bien mat menu Folder Option.

Khac phuc: Co 2 cach sau day:

Cach 1

Bam Start > Run go vao Regedit:

Neu Registry bi khoa thi thuc hien theo phan 1.
Neu muc Run bi khoa thi thuc hien theo phan 6 o ben duoi.

Tim den khoa sau:

User Key: HKEY_CURRENT_USER Software Microsoft Windows CurrentVersion Policies Explorer
System Key: HKEY_LOCAL_MACHINE Software Microsoft Windows CurrentVersion Policies Explorer

Ben cua so ben phai ban se thay mot gia tri REG-DWORD co ten la "NoFolderOptions"
Ban click double de chinh sua gia tri cua no nhu sau:
Value: 0 - hien menu , 1 - an menu.

Cach 2

Bay gio vao Start > Run.

Neu muc Run bi khoa thi thuc hien theo phan 6 cua bai viet nay.

Go vao GPEdit.msc roi chon OK.
Sau do vao tiep User Configuration/Administrative Template/Windows Component/Windows Explorer

Nhan dup chuot vao muc REMOVE THE FOLDER OPTIONS...va chon Disable. Xong dong lai, ra Run go GPUPDATE /FORCE roi bam OK.

3. Khong hien thi duoc file an

Trieu chung: Ban thay bien mat du lieu, khong nhin thay no mac du biet chac chan la no van o do. Mo Explorer, bam Menu Tools, chon Folder Options (neu khong nhin thay Folder Options thi thuc hien muc 2 cua bai viet nay). Vao tab View/Advanced Settings, muc "Hidden files and folders". Cho du ban co bam xuong "Show Hidden Files and Folders" roi bam Apply hay OK thi file an van cu an. Mo lai Setting do thi no lai nhu cu.

Khac phuc: Mo Notepad ra, copy va dan doan ma nay vao va save no lai thanh file ShowHiddenFile.reg

REGEDIT4

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindows
CurrentVersionexplorerAdvancedFolderHiddenSHOWALL]
"RegPath"="Software\Microsoft\Windows\CurrentVersion\
Explorer\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000000
"HKeyRoot"=dword:80000001
"HelpID"="update.hlp#51105"

Hoac tai file nay http://files.myopera.com/trandungkts/blog/
ShowHiddenFileandFolder.reg ve su dung luon, neu code tren do loi hien thi tren mang chay khong dung.

Sau khi save, ban nhan dup chuot vao no de import vao registry. Neu can restart lai may. Roi vao Folder Options de hieu chinh Show Hidden Files and Folder.

4. Bi an (hidden) file va folder du lieu

Trieu chung: Thay bien mat du lieu. Mo Folder Options, chon show all files len thi nhin thay du lieu tu dong bi an (bi dat thuoc tinh Hidden hoac System). Bo check Hidden di thi khong bo duoc. Thuoc tinh System thi Windows da bo khong cho su dung, mac du thuoc tinh nay cua file van ton tai.

Khac phuc: Mo cua so Explorer ra, chuyen den cho co chua cac file an, bam chuot phai vao dau do tren vung trong cua cua so Explorer. Tai menu bat ra, chon New/Shortcut.

Mot cua so Creat Shortcut se xuat hien. Tai o Type the location of the item, ban copy va dan dong sau day vao do:

attrib.exe -s -r -h

Bam Next. Tai o Type a name for this shortcut, ban dat ten cho Shortcut, vi du nhu showfile chang han. Ban se co mot file shortcut co ten la Showfile.lnk.

Sau do, bat cu file hay folder nao bi dat thuoc tinh "khong binh thuong" (bi Read Only, bi Hidden, bi System) ban cu keo file hoac folder do tha vao bieu tuong cua Shortcut Showfile (drag and drop).

5. Bi khoa Task Manager

Trieu chung: Bam Ctrl-Alt-Del, chi thay nhan duoc thong bao "Task Manager has been disabled by your administrator".

Khac phuc: Chon mot trong hai cach sau:

Cach 1. Thay doi Registry

Bam Start > Run go vao Regedit:

Neu registry bi khoa thi thuc hien theo phan 1 cua bai viet nay.
Neu muc Run bi khoa thi thuc hien theo phan 6 cua bai viet nay.

Tim den khoa sau:
HKEY_CURRENT_USERSoftwareMicrosoftWindows
CurrentVersionPolicies System

Tai cua so ben phai, ban se thay mot gia tri REG-DWORD co ten "DisableTaskMgr"

Ban click double de chinh sua gia tri cua no nhu sau:
Value: 1= Cam Task manager.
Value: 0= Mo khoa TaskManager.

Hoac don gian la xoa di, ban se mo duoc Task Manager.

Cach 2. Dung Administrative Tool

Bay gio hay vao START --> RUN

Neu muc Run bi khoa thi thuc hien theo muc 6 cua bai viet nay.

Go vao GPEdit.msc roi chon OK

O cua so Group Policy settings, chon User ConfigurationAdministrative TemplatesSystem

Chon Options Ctrl+Alt+Delete

Chon Remove Task Manager

Nhan dup chuot vao vao muc Remove Task Manager va chon Disable.

Xong dong lai, ra Run go GPUPDATE /FORCE roi bam OK.

6. Mat muc Run

Trieu chung: Dang nhe o menu Start, phai co muc Run de chung ta chay cac phan mem khong nam trong Start Menu. Nhung gio no da bien mat.

Khac phuc: Bam Start/All Programs/Accessories. Mo Command Prompt.

Cua so Command Prompt se xuat hien. Gio thi go thang "Regedit.exe" vao dong lenh cua Command Prompt. Ban se mo duoc Registry Editor.

Ban tim den khoa sau:

HKEY_CURRENT_USER Software Microsoft Windows CurrentVersion Explorer Advanced.

O cua so ben phai, Ban se thay mot gia tri REG-DWORD voi ten "StartMenuRun".

Sua gia tri thanh 0 neu muon tat, 1 neu muon khoa.

Hoac don gian la xoa no di. Khoi dong lai may.

Tran Ngoc Dung