Basically meta used for robot/crawler to get information from your web/blog, But be careful when you write irrelevant meta tag your site might will crawled in wrong way and result  might will false.

1. Meta Description:

Used to describe about your website, this words will also will be placed on search engine result. Example on one of my site meta description is about “Server project of nexustk the kingdom of the wind emulator and atlantia development free flash games” (yea I know this meta description s*ck LOL)  see the result in google search engine.

What will happen if most search engine not found meta description on your site? not sure about all crawler but one I know google crawler bot will crawl the top words to be put in  search result.

2.  Meta Keyword:

Used to describe your site keyword in search result on search engine this is sorted from first keyword to be the first priority . Again sample on one of my site meta keyword is “nexmutk,nexustk,baram,nexia,nexustk map editor,emulator,ps1,ps2,bios,scph,games,development,install shield,earn money,game server,server games,mmorpg,nexustk packet,nexustk emulator,gunbound,darkages,lunentia,ts online,ran online,maplestory,donation,project,developer,visual basic,vb6,utility,zlib compression,paypal,egold,kingdom of the winds” see the result when I search something using keyword “nexmutk”

So the answer is when you need to fill your meta keyword this keyword MUST included at least 1-3 words in your site content. This also the way for some people try to targeting HPK (high paying keyword) from google adsense to get HPK ads showing on their site.. that s*ck is it?!?! YES MONEY RULES! *LOL*

Alright we focused on this 2 meta first, other meta and their function will be written on next article. Usually meta tag should written on header files, the problem is lot and ALMOST header files is static.

How we can make dynamic meta on static header?!

Simple and easy as 1-2-3 :p if you’re advanced in php/database programming this should can be done in only 5 minutes he he he.. how we can done with this one.. listen to me carefully I will not tell you the code but only my vision *LOL* when you programing your site you can describe your meta to follow your pages words content, remember meta description no more than 150 character this way is for medium level programing. for some people who advanced on database you can write your meta from your database by calling it out, there is other way also using rewrite rules to play with your meta and many many ways to do this. Maybe next time I will write some sample code for this.

Have good day everyone

If you downloaded and run this files it will making virus master and downloaded files from internet automatically then run it.

C:\WINDOWS\system32\CbEvtSvc.exe
C:\Documents and Settings\Your User Name\Local Settings\Temp\lfq0kzgs.exe
C:\Documents and Settings\Your User Name\Local Settings\Temp\.xx1.tmp.vbs
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\smss.exe
C:\WINDOWS\system32\lphc7nvj0e52e.exe
C:\WINDOWS\system32\phc7nvj0e52e.bmp
C:\WINDOWS\system32\phc7nvj0e52e.bmp
C:\WINDOWS\system32\blphc7nvj0e52e.scr
C:\WINDOWS\system32\phc7nvj0e52e.bmp
C:\windows\system32\drivers\xxx.sys
C:\Documents and Settings\LocalService\Application Data\584289103.exe
C:\Program Files\rhc3nvj0e52e
C:\Windows\system32\pphc7nvj0e52e.exe
C:\Documents and Settings\LocalService\Application Data\rhc3nvj0e52e
C:\Documents and Settings\Your User Name\Application Data\rhc3nvj0e52e.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008
C:\Documents and Settings\Your User Name\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk

This virus will also make your registry changes:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbEvtSvc
DisplayName = CbEvtSvc
ImagePath = %SystemRoot%\System32\CbEvtSvc.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CbEvtSvc
DisplayName = CbEvtSvc
ImagePath = %SystemRoot%\System32\CbEvtSvc.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\CbEvtSvc
DisplayName = CbEvtSvc
ImagePath = %SystemRoot%\System32\CbEvtSvc.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6127a5e3
ImagePath = \SystemRoot\System32\drivers\6127a5e3.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6127a5e3
ImagePath = \SystemRoot\System32\drivers\6127a5e3.sys

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\6127a5e3
ImagePath = \SystemRoot\System32\drivers\6127a5e3.sys

KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
lphc7nvj0e52e = C:\WINDOWS\system32\lphc7nvj0e52e.exe

SMrhc3nvj0e52e = C:\Program Files\rhc3nvj0e52e\rhc3nvj0e52e.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\software notifier

HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\rhc3nvj0e52e
DisplayName = AntivirXP08
UninstallString = “C:\Program Files\rhc3nvj0e52e\uninstall.exe”

HKEY_LOCAL_MACHINE\software\rhc3nvj0e52e
HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion
rhc3nvj0e52e = 8b 6e 99 48 (bynary)

HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
AntivirXP08 = AntiVirXP08
SV1

This virus will try to spreading using your internet connection, it will spam every email address founded on your computers, type netstat -a on your command prompt and you will found lot of activity without your action.

This virus also will remove your “screen saver” and “desktop” tab on display properties and change your desktop with file %systemroot%\system32\phc7nvj0e52e.bmp and change your screensaver with executed file %systemroot%\\system32\blphc7nvj0e52e.scr to make you panic by showing fake blue screen of death (BSOD) on your screen

Enough, now time to remove this stupid things!

1. Run your computer from “safe mode” and disable your “system restore“

2. Stop active virus services by type in run/command prompt services.msc

3. Find  services with name CbEvtSvc or something similar with that name then click properties on that services. Stop it and on startup column choose Disable then click OK.

4. Repair your registry already changed by virus using this code:

 [Version]
Signature=”$Chicago$”
Provider=nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\comfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\exefile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\piffile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, Software\CLASSES\scrfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
HKCU, Control Panel\Desktop, ConvertedWallpaper,0, “”
HKCU, Control Panel\Desktop, OriginalWallpaper,0, “”
HKCU, Control Panel\Desktop, SCRNSAVE.EXE,0, “”
HKCU, Control Panel\Desktop, Wallpaper,0, “”
HKCU, Software\Microsoft\Internet Explorer\Desktop\General, BackupWallpaper,0, “”
HKCU, Software\Microsoft\Internet Explorer\Desktop\General, Wallpaper,0, “”

[del]
HKLM, Software\Microsoft\Windows\CurrentVersion\Run, lphc7nvj0e52e
HKLM, Software\Microsoft\Windows\CurrentVersion\Run, services
HKLM, Software\Microsoft\Windows\CurrentVersion\Run, SMrhc3nvj0e52e
HKLM, Software\Microsoft\Windows\CurrentVersion\Run, rhc3nvj0e52e.exe
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, NoDispBackgroundPage
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, NoDispScrSavPage
HKLM, SYSTEM\CurrentControlSet\Services\6127a5e3
HKLM, SYSTEM\ControlSet002\Services\6127a5e3
HKLM, SYSTEM\ControlSet001\Services\6127a5e3
HKLM, SYSTEM\ControlSet001\Services\CbEvtSvc
HKLM, SYSTEM\ControlSet002\Services\CbEvtSvc
HKLM, SYSTEM\CurrentControlSet\Services\CbEvtSvc
HKLM, SYSTEM\ControlSet001\Services\CbEvtSvc
HKLM, SYSTEM\CControlSet002\Services\CbEvtSvc
HKLM, SOFTWARE\Microsoft\software notifier
HKLM, software\Microsoft\Windows\CurrentVersion\Uninstall\rhc3nvj0e52e
HKLM, software\rhc3nvj0e52e
HKLM, software\Microsoft\Windows\CurrentVersion, rhc3nvj0e52e
HKLM, software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
HKLM, SOFTWARE\Microsoft\Software Notifier
HKLM, SYSTEM\ControlSet001\Services\125c1fb5
HKLM, SYSTEM\ControlSet002\Services\125c1fb5
HKLM, SYSTEM\CurrentControlSet\Services\125c1fb5

Save this code as repair.inf and run it by right click and choose install, or you can download it repair.inf

5.  Deleted this file list (if your OS on drive d then c:\ should be d:\ and so on):

C:\WINDOWS\system32\CbEvtSvc.exe
C:\Documents and Settings\Your User Name\Local Settings\Temp\lfq0kzgs.exe
C:\Documents and Settings\Your User Name\Local Settings\Temp\.xx1.tmp.vbs (xx=random).
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\smss.exe
C:\WINDOWS\system32\lphc7nvj0e52e.exe
C:\WINDOWS\system32\phc7nvj0e52e.bmp
C:\WINDOWS\system32\phc7nvj0e52e.bmp
C:\WINDOWS\system32\blphc7nvj0e52e.scr
C:\WINDOWS\system32\phc7nvj0e52e.bmp
C:\windows\system32\drivers\xxx.sys (xxx random with size 108 KB)
C:\Documents and Settings\LocalService\Application Data\584289103.exe
C:\Program Files\rhc3nvj0e52e
C:\Windows\system32\pphc7nvj0e52e.exe
C:\Documents and Settings\LocalService\Application Data\rhc3nvj0e52e
C:\Documents and Settings\Your User Name\Application Data\rhc3nvj0e52e.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008
C:\Documents and Settings\Your User Name\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk

6. Delete your temporary files using ATF Cleaner.

7. Last, scan with your best updated antivirus to make sure system is clean.

Done, now get some coffee and send it to me he he he

This is happen to me in last 2 days ago when I moving all off my website from dreamhost to hostmonster I working in front of my computer around 3-5 hours to complete it *lol* it’s really fast!? I moving looooooooooooooooooooooooooooooot of site from other to another he he he.. I don’t say Dreamhost s*ck in my oppinion their price is to high and they not compete on this day most of my site got timeout error message, advertiser leave me!! Hostmonster offer better hosting plan with cheap price and service. hostmonster review will be written after a month I used they service.

Now let’s back to the business *LOL* the fastest and simple way to move your website is using SSH Access. First it will not take to much of your internet bandwith imagine if your site have total size 100GB and you have to move it quickly in just 10 minutes ha ha ha you might think this is impossible…

No, it’s possible!! to use SSH Access you will need a program called putty first packing all files on your site, if your host have cPanel you can simply backup all your files and move it when ready. How if your host don’t have cPanel? from SSH type:

tar cvf myfiles.tar mysitepath

*Learn it yourself about nix command how to creating tar archive this example will making myfiles.tar file contain everything from mysitepath folder… to learn tar manual command read it from HERE

Good now we have our tar archive, next begin to move it into our new host using wget command or ftp it manualy from SSH host, example:

wget http://www.mysite.com/backup/blabla/myfiles.rar

Attention: sometimes this way is not allowed! don’t know why most of hosting company not allowed we moved BIG files out from their space they want we keep it on it and continue paid to using it :p in case wget not working you can use FTP or NCFTP command, once you connected you can using get or put command depend on situation to move your files.

Alright now the site archive files already moved to new host, time to extract it! type..

tar xzf myfiles.tar

Hurray! we have move all files from other host to new host fast! Optional if your web using MySQL database you should backup it from phpmyadmin there is export button in the top of your screen, use it! now you have database and files already moved into new host. Import this database to your new host database and check your configuration files. Last test open your website to see if there anything goes wrong you have to fix it manually.

I forget but there is a website offer me service to move one of my site for $127.9 completed in 3 days pffffffttttttttt….. using this method I move it just in minutes and always free.

Have fun everyone!

This time I will write tutorial on “how to make random ads” using php and text as database. This idea comes from gmail interface my lovely free mail account! pfffftt yea .. yea.. we all know gmail are better than ymail *lol*

Alright leave them fight alone *not our business* before we start to make random ads we have to understand why we should make random ads? if we can fill those ads space with permanent ads. Most of people are bored about ads and ads on all website. Dilemma! in webmaster side we have to earn some revenue to keep continue, in costumer side sometimes they hate if we push to many ads on web page.

So? why not making random ads on your ads space some paid ads and some free ads you can use to help your costumer for what they looking for.  Simple as 1-2-3  now open your superb text editor NOTEPAD and copy this code:

<?php
$fcontents = join (”", file (”random_ads.txt“));
$s_con = split(”~”,$fcontents);
$banner_no = rand(0,(count($s_con)-1));
echo $s_con[$banner_no];
?>

Save it as random.php or whatever you like (remember to give .php extension) Now creating random_ads.txt files (for database) and put a sample code on there:

<center>I’m center!</center>
~
<b>I’m bold!!! for freeeeeeeeeeeee</b>
~
I’m adsense ads
~
I’m short news!
~
I’m paid ads!!! hooray!

You can write html code or php code on database file if you’re creative you can put images/flash on it. Now put this both files on same directory on your hosting and embed it using include command into your website page.

Refresh your page to see ads rotated or you can use auto refresh meta

<meta http-equiv=”refresh” content=”180“>

180 value are in milliseconds you can change it to fit your need.

See what you have now

I think this advertising type will become popular in next advertising generation, Yes.. I’m talking about programs that will pay you fixed earning monthly by placing banners on your website. Most of them are UK based company which looking for business site, insurance site, legal site, and any other content site they wanted (most genuine content).

In the past article I write about betterthanbanners which not accepted new members again (but they still active and paid also still approved some of my new site) , theadnetwork, matched and the other one I just know from adsense-sby forum is freebies4webmasters.

*breathe* Let’s imagine how much possibilities we can make fixed monthly earnings from this network. Different with CPC, CPM, or CPA network which needed some specification, qualification, and condition.. this network doesn’t really care about your SEO, Traffic, Pagerank, Alexa. All they want is keep their banner on your website which approved in their networks and you will earn money each month.

*For beginner joining this program very recommended by me*

So.. it is possible we make $1.000,00 or more in a single month? my short answer will be yes it is possible and I declare make money from internet has unlimited possibilities as long you learn a new way and learn the trick how to reach it.

Let’s back to the topic.. said you have 100 website and all of them approved into 4  network site like this you will make 4×100x£5 = £2.000,00 Monthly.. it is good? it’s not over yet… the trick is for each network they have different advertiser so if you have 100 site approved into the network cross you will make 4×4x100x£5 = £8.000,00 is it enough? NOT ENOUGH!?!?!? said if you found 10 network like this and all your website accepted you will make 10×10x100x£5 = £50.000,00 well if it done and you can’t find other site will pay you fix monthly earning you can… combine it with CPC, CPM, or CPA network or try to sale your real product and you will make $unlimited monthly

Better for your wealthy and better for your user, most of this banner will not annoyed your users, there is no pop-up or adult ads on it (as far I know) they are clean. Perhaps the hard way is when you try to apply it so… my recommendation… make lot of  genuine content website *lol* No, I joke!! it’s all back to you if you really need to reach your target… if you’re  doesn;t really care about money then don’t make lot of site which will waste your time and your money

The last.. if you fell this article help you please do my favor as usually referral links *lol*

Please write my email ratnanet82@gmail.com on  referral box on this site

Freebies4webmasters.co.uk
Theadnetwork.co.uk

Or joined matched using this link

Matched.co.uk

Thank you

This is new varian for Microsoft.vbs virus which I write formula how to clean it around a month ago when it hit my cybercafe until totally broken he he… Now most people know this virus as ARP virus.  Why? Because after learning it more deeply this virus categorized as HIGH RISK and should removed as soon as possible before it infected total your network.

First.. To know this virus is active on your computer is  you will get most error pages  message when browsing, or error when using messenger, PLUS you will find this file Microsoft.vbs Microsoft.bat Microsoft.pif on your hard drive where you install your OS PLUS *again* your computer gonna be slow PLUS *oh not again* Your internet connectivity will going slow than usually PLUS *OMG* It will flooding your network until some billing(via TCP/IP) will stop responding.

It’s hard to know when your computer infected because it’s only showing a little error when you browsing and sometimes it’s not active (like clean computer) until you idle for some minutes/hour.

When you browsing you don’t feel something goes wrong… but when you look on the page source the evil is waiting on there

Clean page source from google.com not injected with any code.. but wait when virus active you will look something like this..

Holy s**t what is that!!!

So the answer is virus going active when you’re using internet by browsing or chat on messenger. Basically all internet explorer activity can bring this virus active! Enough let’s remove this virus permanently and stop it from coming back.

You can use Colasoft MAC Scanner (shareware) to scan your network, If you found there is mac address same with your gateway then you have to unplug that computer from network and clean it before you put it back on network. Why? In condition when you clean infected one virus will going to spread on other computer in your network once you clean it, it will calling back file from other infected one in your network so don’t waste your time for this stupid thing UNPLUG IT to stop it spreading in network!

Now.. Get Security Task Manager and delete/remove strange process on your computer background (usually with IE icon and dll files) delete/remove Desktopwin.dll/Jview.dll and ThunderAdvise.dll delete/remove AppInit_DLLs.

Done.. Now get hijackthis and restore your hosts file by Open the Misc Tools section, on System tools choose Open hosts file manager and deleted all line after 127.0.0.1 localhost or you can done this using notepad hosts file is on %systemroot%/system32/drivers/etc

Now get ATF Cleaner  and deleted all cookies, history and java cache.

Repair your registry to back in normal by using this code:

 [Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, AppInit_DLLs,0, “”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Object

[del]
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, ThunderAdvise
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, DesktopWin

Or download repair.inf

To stop virus coming back from other computer disable default share  by using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, SYSTEM\CurrentControlSet\Services\lanmanserver\parameters, AutoShareWks,0×00010001,0
HKLM, SYSTEM\CurrentControlSet\Services\lanmanserver\parameters, AutoShareServer,0×00010001,0

Or download disable-default-share.inf and activate it restart-net-service.bat

Disable autorun to stop virus coming back from USB flashdisk/removable mediaby using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDriveTypeAutoRun,0×000000ff,255
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoDriveTypeAutoRun,0×000000ff,255

Or download disable-autoplay.inf

To stop virus from coming back by replacing old files let’s make dummy files download dummy.bat!

Last scan with your BEST antivirus/antimalware to make sure your system clean! Another trick to stop virus from infected back your computer you can add static entry on ARP by write in command prompt “arp –s *gatewayipaddress* *gatewaymacaddress*” or another trick say we can blocked those d**n virus site by change it in hosts file here is some website list detected as virus update:

972.aksjd11.com
w3og.cn
qazc.fourtw.cn
www.aujoy.cn
www.hao601.cn
www.psp476.cn
222.1212l112.net
444.1212l112.net
555.1212l112.net
111.1212l112.net
root.51113.com
hk.www404.cn
err.www404.cn
(Still there a lot out there.. BLOCKING ALL .cn domain might resolve this problem ha ha ha :P)

Anyway this method is not really can stop virus updated as long the creator change website again we have to update block it manually.

Done (finally)… now using your computer like usually for 1-2 hours and see if the virus coming back..

Your site got no Traffic? then try this simple tricks to get it. People around the world using Internet are usually using search engine to get information on what they need. The 2 most powerful Search engine are google and yahoo. There is other search engine but in my opinion this 2 search engine are the champion of search engine so we have to focus on it.

The great news is… google have completed data for trends keyword based on daily search you can see it for free!  We can play with that trends data to create content with keyword from google trends data and get flooded traffic in short time it will also (claimed by some friend and other people) can raised your  site pagerank.

HOW?

Visit google trends website on HERE you will got almost great data information on trends keyword daily. If you have site with almost same keyword with google trends data you can try to make new content using that keyword. In result? of course it will be flooded in short time on next day you can visited google trends website again and looking for new keyword trends today.

The trends keyword hourly, daily is changed. So… using google trends really fit and the best technique for news site or blogging site. Don’t have it? you can still using google trends to analyze your keyword using google trends.. you can searching for keyword match to your site content and try to implement it on your site.

Give it a try you won’t loose anything

LinkWorth is one of the web’s largest and most innovative marketing portals that caters to both Advertisers and Partners. LinkWorth have a multitude of products and services to fill your every online marketing need.

LinkWorth products consist of text link ads, paid blog reviews, in-text links, in-content pay per click ads, rotating text ads, hosted content pages, article submission, directory submission and many more.

Alright Now we got it, LinkWorth basically is ads network which specialize on link sale. Dependent on each their product LinkWorth can sell link on blogs, website, etc. You can set your own link price or your blog review price ( I love this feature).

Better  in result, with lot of link sale media you can optimize your website revenue using LinkWorth, it also will hiding your paid link from your visitor. Example is text link on your site content. Let say you have article and usually on each article you have link to other site say example you write about program blabla and you link their download link to your article. In same way LinkWorth will do that but the different in here is you earn revenue. Almost same with kontera and other inline text ads but better in revenue

Basic share revenue is 70:30 you got 70% and LinkWorth got 30% you can simply upgrade it into premium with share revenue 50:50 anyway I prefer you to stay in basic if you want to earn more revenue for yourself or you might can be premium with 50:50 revenue share but they not guarantee you will get lot of job/order.

Minimum Payment is different on each method Payment at date 10 of each month if day 10 is down on Sunday it will processed on next day. You can get paid by paypal, check, wire transfer.

I recommended this ads network to all of you please take a look on LinkWorth website

The simple way to know if your computer infected by this virus is you will see JPEG files with aplication extension. Now let’s start to remove it!

1. Unplug your infected computer from your network to stop this virus spreading.
2. Disable “System Restore” when in cleaning process.
3. Kill the virus process using power tools “currprocess” kill all process with icon JPG.
4. Repair your registry that already changed by the virus using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\comfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\exefile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\piffile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, Software\CLASSES\scrfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, UncheckedValue,0×00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,CheckedValue,0×00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,DefaultValue,0×00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0×00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, CheckedValue,0×00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, DefaultValue,0×00010001,0
HKCU, Software\Microsoft\Internet Explorer\Main, Start Page,0, “about:blank”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, type,0, “checkbox”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, type,0, “checkbox”
HKCU, Control Panel\International, s1159,0, “AM”
HKCU, Control Panel\International, s2359,0, “PM”
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, SuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt,0×00010001,0

[del]
HKCU, Software\Microsoft\Internet Explorer\Main, Window Title,
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableConfig
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableSR
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-CLN.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-RTP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe, debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, DisableMSI
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, LimitSystemRestoreCheckpointing
HKCR, exefile, NeverShowExt
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, PaRaY_VM
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, ConfigVir
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NviDiaGT
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NarmonVirusAnti
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, AVManager
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, EnableLUA

5. Delete the master virus in %systemroot%\system32\~A~m~B~u~R~a~D~u~L~ before you do this you have to make hiden files become visible.
Then deleted this file list:

csrcc.exe
smss.exe
lsass.exe
services.exe
winlogon.exe
Paraysutki_VM_Community.sys
msvbvm60.dll
Drive:\Autorun.inf
Drive:\FoToKu xx-x-*.exe, where x show the date when virus active
Drive:\Friendster Community.exe
Drive:\J3MbataN K4HaYan.exe
Drive:\MyImages.exe
Drive:\PaLMa.exe
Drive:\Images

To make sure your computer clean you can check scan your computer using your favorite antivirus programs.
Done, have a nice day

Let me introduce to you about TNX (for people already know about it stop reading then :D), TNX is link sale basically. But why I recommended TNX to you? with some reason sometimes google hit our website pagerank down to 0 and we cannot sell link on that website, we lost revenue and time in here. In TNX we can sell link even we have Pagerank 0 all needed is your website already indexed in most search engine (google, yahoo, msn, ask, etc it can easily done by submitting your website sitemap) in other words you build your SEO and TNX will work to sale link on your website without looking on your pagerank.

TNX is good in my history, they never cheating me in the last 6 month since I joined with them so I very recommended you to try them. You can easily earn $ unlimmited each month from TNX! All depend on to how much page you own and how much website you own. For each of that sale link you will get point and point can sold  back to TNX or other TNX member. Point price will grown each month so you can safe it if you like.

Starting 11-07-2008 TNX will buyout your tnx-points at the rate of $0.9 per 1000 pts. Those who meet link placement recommendations (links not in block etc.) will be getting $0.92 per 1000 pts. You can sell that point to TNX or to other member, And you can also use that point back to advertising your website link to TNX to raise your pagerank. TNX Minimum payout is $5 paid using PAYPAL.

* Tips for double your TNX Points.
1. Calculate how much your website page already indexed on search engine.
2. Double, Triple or more (max 4) your link.
3. Make a good communication between you and TNX so they know you’re a good person.

Well.. if you interesting please do my favor.. Joined on TNX using my TNX referral link in HERE Thank you everyone!