| Cara membersihkan W32/Kang.A - I |
| | | | | |
| Keterangan | Varian W32.Kang |
| Kang.A | Kang.B-D, F-H | Kang.E | Kang.I |
| Terminate proses virus | Ccapps.exe | Winword.exe | Bervariasi | Tskmgr.exe |
| Gunakan perintah "taskkill " |
| dari MS DOS Prompt |
| C:\Taskkill /f /im nama proses |
| File yang dihapus | C:\Windows\system32 | C:\windows\system32 | C:\Windows\system32 | C:\Windows\Fonts |
| Ccapps.exe | Winword.exe | Bervariasi | Tskmgr.exe |
| Winlog.dat | Winlog.dat | | |
| Kangen.doc | Kangen.doc |
| Root C:\ | Root C:\ | Root C:\ | C:\Windows\System32 |
| Folder !Submit | Folder !Submit | Selamat ulang tahun meyer.exe | syslove.exe |
| Kangen.exe | Kangen.exe | | readme123.exe |
| | | C:\Windows | C:\Windows |
| passMe.txt | rundll32.exe |
| | Root C:\ |
| untukmu.exe |
| Folder !Submit |
| C:\My Documents and settings |
| love.dot dan love1.dot |
| Ukuran file virus | 64 kb, untuk kangen.doc 2kb | 72 kb | Bervariasi (105 atau 81 kb) | 48 kb, 1-2 Kb untuk file love.dot dan love1.dot |
| Hapus option pada [Msconfig] | Rest In peace | Rest In peace | | Witta I Love You |
| Ccapps | Ccapps | Bervariasi (dengan lokasi C:\Windows\system32) | Tskmgr.exe |
| | winword | | |
| Hapus Registry Key | | Ccapps | FSysApp | |
| HKLM\Software\Microsoft\Windows\ | Ccapps | LoadService | Local Service |
| Current_version\Run | LoadService | OSA | Security |
| | | Symrun | |
| HKCU\Software\Microsoft\ | - | - | about:tumero | - |
| internet Explorer\main, start page |
| HKCU\Software\Microsoft\Windows\ | - | - | NoDispCPL | - |
| CurrentVersion\Policies\System |
| HKCU\Software\Microsoft\Windows | - | - | NoFolderOptions | - |
| \CurrentVersion\Policies\Explorer |
| HKLM\Software\Microsoft\ | - | - | • RegisteredOrganization = Your Organization Name | - |
| WindowsNT\CurrentVersion | • RegisteredOwner = Your User Name |
| HKLM\SOFTWARE\Microsoft\ | - | - | OrgOwner = ToMErO yOu toMErO mE | - |
| Windows\CurrentVersion |
| HKCU\Control Panel\International | - | - | o s1159 = ToNgam Meyer menjadi AM | - |
| o s2359 = RogaTMan TaMPubOLon menjadi PM |
| HKLM\SOFTWARE\Classes\CLSID\ | - | - | Untuk merubah info tip pada menu My Computers | - |
| {20D04FE0-3AEA-1069- | Ubah pada value INFO TIP menjadi = |
| A2D8-08002B30309D}, | Show the disk drives and hardware connected to this computer |
| HKLM\SOFTWARE\Classes\CLSID\ | - | - | Untuk merubah info tip pada menu My Documents | - |
| {450D8FBA-AD25-11D0- | Ubah pada value INFO TIP menjadi = |
| 98A8-0800361B1103}, | Contains letters, reports and other documents and files |
| HKLM\SOFTWARE\Classes\CLSID\ | - | - | Untuk merubah info tip pada menu Recycle Bin | - |
| {645FF040-5081-101B- | Ubah pada value INFO TIP menjadi = |
| 9F08-00AA002F954E}, | Contains the files and foders that you have deleted |
| Mengembalikan MS.Word | Attrib –s –h %Drive%:\*.doc /s | Attrib –s –h %Drive%:\*.doc /s | - | Attrib –s –h %Drive%:\*.doc /s |
| yang disembunyikan |
| Hapus File Duplikat MS.Word | - Icon MS.Word | - Icon MS.Word | - | - Icon MS.Word |
| yang dibuat oleh virus | - Ukuran file 64 kb | - Ukuran file 72 kb | - Ukuran 48 kb |
| Dengan ciri-ciri : | - Type file Aplikasi | - Type file Aplikasi | - Type file Aplikasi |