Quote:Illegal System DLL Relocation
The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occured because the DLL C:\WINDOWS\system32\SHELL32.dll occupied and address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.
1.Menimpa dengan mngcopy file shell32.dll dari komputer lain, file ini terletak pada C:\WINDOWS\system32\ (OS komputer harus sama,. misalx komp1 dan komp2 menggunakan windows XP SP2)
hal ini disebabkan rusakx file trsebut yg disebabkan oleh false alarm atau cleaning system.
2.Menscan dengan menggunakan antiSpyware terbaru.(coba dengan Ansav, gunakan plugin RegistryFx) hal ini biasax disebabkan karena komputer pernah terserang trojan.
ciri2x: beberapa file instalasi tidak dapat djalankan dikarenakan hook yg tidak valid.
coba repair registry dengan mnyalin kode dibawah ke dalam notepad,.
Code:
[Version]
Signature="$Windows NT$"
Provider=WardanaPro
[DefaultInstall]
AddReg=Write
DelReg=Delete
[Write]
HKCR, .bat,,,"batfile"
HKCR, .cmd,,,"cmdfile"
HKCR, .js,,,"jsfile"
HKCR, .vbs,,,"VBSfile"
HKCR, .reg,,,"regfile"
HKCR, .exe,,,"exefile"
HKCR, .scr,,,"scrfile"
HKCR, .com,,,"comfile"
HKCR, .pif,,,"piffile"
HKCR, batfile\shell\open\command,,,"""%1"" %*"
HKCR, cmdfile\shell\open\command,,,"""%1"" %*"
HKCR, JSFile\shell\open\command,,,"%SystemRoot%\System32\WScript.exe ""%1"" %*"
HKCR, VBSFile\Shell\open\command,,,"%SystemRoot%\System32\WScript.exe ""%1"" %*"
HKCR, regfile\shell\open\command,,,"regedit.exe "%1""
HKCR, exefile\shell\open\command,,,"""%1"" %*"
HKCR, comfile\shell\open\command,,,"""%1"" %*"
HKCR, piffile\shell\open\command,,,"""%1"" %*"
HKCR, batFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, cmdFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, JSFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, VBSFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, regFile\Shell\Edit\Command,,,"%SystemRoot%\System32\Notepad.exe %1"
HKCR, batfile\DefaultIcon,,,"%SystemRoot%\System32\shell32.dll,-153"
HKCR, cmdfile\DefaultIcon,,,"%SystemRoot%\System32\shell32.dll,-153"
HKCR, JSFile\DefaultIcon,,,"%SystemRoot%\System32\WScript.exe,3"
HKCR, VBSfile\DefaultIcon,,,"%SystemRoot%\System32\WScript.exe,2"
HKCR, exefile\DefaultIcon,,,"%1"
HKCR, comfile\DefaultIcon,,,"%SystemRoot%\System32\shell32.dll,2"
HKCR, batfile, FriendlyTypeName,0, "MS-DOS Batch File"
HKCR, cmdfile, FriendlyTypeName,0, "Windows NT Command Script"
HKCR, JSFile, FriendlyTypeName,0, "@%SystemRoot%\System32\wshext.dll,-4804"
HKCR, VBSFile, FriendlyTypeName,0, "@%SystemRoot%\System32\wshext.dll,-4802"
HKCR, ScrFile, FriendlyTypeName,0, "Screen Saver"
HKCR, comfile, FriendlyTypeName,0, "MS-DOS Application"
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, "Explorer.exe"
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Userinit,0, "@%SystemRoot%\system32\userinit.exe"
HKLM, SYSTEM\CurrentControlSet\Control\Session Manager, BootExecute,0, "autocheck autochk *"
HKLM, SYSTEM\CurrentControlSet\Control\Session Manager\Environment, ComSpec,0, "%SystemRoot%\system32\cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Services\PugPlay, ImagePath,0, "%SystemRoot%\system32\services.exe"
HKLM, SYSTEM\CurrentControlSet\Services\srservice, ImagePath,0, "%SystemRoot%\system32\svchost.exe -k netsvcs"
HKLM, SYSTEM\CurrentControlSet\Services\MSIServer, ImagePath,0, "%SystemRoot%\system32\msiexec.exe /V"
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, Software\Microsoft\Windows\CurrentVersion\Policies\System, legalnoticetext,0, ""
HKLM, Software\Microsoft\Windows\CurrentVersion\Policies\System, legalnoticecaption,0, ""
[Delete]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoRun
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDesktop
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFileAssociate
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFolderoptions
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFileMenu
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDrives
HKCU, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoTrayContextMenu
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableCMD
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system, DisableTaskmgr
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system, NoFolderoptions
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoTrayContextMenu
HKLM, Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp, Disabled
HKCR, batfile, NeverShowExt
HKCR, cmdfile, NeverShowExt
HKCR, VBSFile, NeverShowExt
HKCR, JSFile, NeverShowExt
HKCR, exefile, NeverShowExt
HKCR, comfile, NeverShowExt
HKCR, pifile, NeverShowExt
HKCR, scrfile, NeverShowExt
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskMgr.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskkill.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskList.exesimpan dengan nama apa saja tp berekstensikan *.inf
klik kanan dan pilih instal
jika masih belum selesai, mngkin cara lain yang dapat dilakukan yaitu dengan mengupgrade service Pack windows. misalx anda menggunakan Service Pack 2, maka anda dapat mngupgrade ke Service Pack 3.
0 Comments
