Free From Virus

Add Life Time Protection To USB Drives Against Autorun Viruses

2010-04-13T22:50:00.000-07:00

We have many ways to protect drives from viruses including a tool which removes the viruses from infected USB drives and some other tools like Smart Virus Remover, USB Protect and you can also read our guide on how to avoid autorun virus infection and in worst case, how to Copy Data From Virus Infected Pen Drive

Today we came across another useful tool which can add life time protection for any USB Drive or other Removable USB Devices. This application is called USB Defender – It allows you to securely protect your flash drive from different type of autorun viruses which infect you drives and then you computers when your USB Drives are connected to them.
USB Defender was developed to be extremely easy in use. You can see just two buttons on it: "Protect" and "Unprotect". First button you are using to vaccinate your drive, second – to remove protection.

After selecting any drive, program automatically detects, if there is any protection active and only one button will be available for you.

Lets see what this tool does in order to vaccinate your drive against autorun viruses, it actually creates a system hidden folder called AUTORUN.INF as shown in the screen shot taken of the USB drives contents

google_protectAndRun("ads_core.google_render_ad", google_handleError, google_render_ad);
After this autorun.inf folder that has been created no autorun.inf viruses can infect your pen drive which means even if you connect your USB drive to virus infected computer it wont infect your USB removable drive.

Conclusion – This program does allow you to add protection right now, as the time passes hackers will find a new way to make these viruses work, till then this could be real rescue.
NOTE: If you format your pen drive, this protection will be lost and you need to protect the pen drive again using this tool if you want this protection.
Download USB Defender

Block Virus Transfer From USB Flash Drive

2010-04-13T22:40:00.000-07:00

Some times you already know about a USB removable drive you are going to connect to your computer is virus infected, but you may have some crucial data on it. Now, you want to copy data from the virus infected USB drive but you also know that if you connect that drive you computer will also get infected with the virus in the USB drive.

We have written a tutorial on how to back up data from virus infected USB drive and how to remove virus in USB drive and another way to copy data from virus infected removable drive.
In order to block virus spreading or copying on your computer, you can also use the free to use tool called Smart USB Flash Drive blocker – This software easily blocks the USB drives from copying any automated virus files on your computer.

In simple words application allows you to copy data from virus infected drive and block all the virus files to be copied from USB drive. It is very easy to use, and you just need to run the portable application and it will block the USB drive.

Once you have clicked the block button, it will show a message prompt that the USB drives are now blocked.

How to remove downloaded but not yet installed windows update files

2008-05-02T02:30:00.000-07:00

Trouble:

One of our readers Jaime reported a problem regarding the windows update, he says

“How do I delete already downloaded but not yet installed Windows update file?”

As stated in the statement above user has downloaded windows update files through windows update but because of some reason he does not want to install those windows update. But windows automatic update service keeps trying to install the update.

Let’s see how can we delete the downloaded windows update files

Fix:

You can easily delete windows update files. For this you need to stop windows update services running in background.

Follow the procedure given below:

1. Open Start >> Run or press window key + r

2. Type “services.msc” (without quotes) and Click OK , this will open services window.

3. Right click on Automatic Updates Service and select Stop.

4. After the service is stopped, press window key + r

5. Type “%windir%\SoftwareDistribution” (without quotes) and press enter.

6. Open the Download folder and delete all contents of the Download folder.

7. Close the window, press Window Key + r ( or Open Start >> Run )

8. Type “services.msc” (without quotes) and Click OK

9. Right click on Automatic Updates Service and select Start.

10. That’s it Done

How to increase disk space in case of Low Disk space

2008-04-11T20:21:00.000-07:00

Trouble:

Do you feel that the free space on your hard-disk is too little ? Does it seem that something fishy is going on which is eating your hard-disk space? If your answer is yes, read on till end to uncover the secrets of this type of behavior.

Reasons for consumption of free space

Some of the key reasons are:

Temp files on C drive
Temporary Internet files
Backup files created during installation
Windows system restore data
Duplicate copies of large files like movies, songs etc.
Deleting Uninstall files for windows updates.

There are some more reasons as well, but these are most common reasons which can be observed. Now the important question, how to fix it ? Lets read on for the solution.

Fix:

1. Deleting Temp files:

Temp files are the files which are created for some temporary purpose by many softwares. Go to Start > Run type “%temp” (without quotes) and press enter. This will open a Temp folder, at this folder,select and delete all files at this location. After this empty your windows recycle bin.

Note: You may not be able to delete certain files as they might be in use, but delete as many as you can.

2. Deleting Temporary Internet files and backup files:

There are several ways to do it, but we will tell you the most convenient way. Open My computer, right click on the disk drive , go to properties and click on Disk Cleanup as shown below:

This will open a Disk cleanup window as seen below:

Select the temporary Internet files,recycle bin,setup log files, temporary files, office setup files, and any other option which is not very important for you and Click OK. This will start the cleanup process and will delete the un-necessary files thus increasing the disk space.

Note: Above two methods deals with removal of junk and temporary internet files which can also be removed automatically using a software called CCleaner which can be downloaded from here.

What is CCleaner?

CCleaner removes unused and temporary files from your system - allowing it to run faster, more efficiently and giving you more HDD space.

3. Deleting old restoration data:

As a part of system restore utility, windows creates some check-points and saves corresponding data on each disk having restore feature. These files also consume significant space. You can delete all of them except the most recent restore point data if you feel that your computer is running stable for a long time and you may not need very old restore points. To delete it, open disk cleanup window as mentioned in previous step and click on More Options tab as shown below:

Click on System restore clean up button as highlighted in red circle in image above. This will give a warning message, click yes to it. This will delete all old restoration points except the most recent one.

4 .Delete duplicate copies of large files:

Sometimes we have several copies of same documents, songs and even videos which consume lots of space un-necessarily. Finding them manually and deleting them is a real pain. But this work has been made very easy by double-killer. Its an intelligent utility which scans your drives for duplicate copies of files and gives you and option to delete them. You can download it from here for free.

5. Deleting Uninstall files for windows updates:

You can also delete some folders whose name starts with “$NtUninstall.” in the windows directory (for example C:\Windows ) if C drive is the primary partition.

However, They are referring to prior hot fixes, so they should be safe to delete if your system is stable with the fixes applied after windows update, and you have no intention of uninstalling them.

We hope that this article will help you see more free space out of your drives!

How to protect your computer from virus in pen drives

2008-04-11T20:17:00.000-07:00

Trouble:

We have received lot of problems where computers got infected easily by the viruses in the pen drives, pen drives have become one of the most easiest carriers of various types of viruses these days.

We will tell you how pen drives normally infect your computer systems and how can you open pen drive safely and back up your important data.

How a virus in your pen drive infects?

Most of the active viruses infect your windows system as soon as you double click on the Pen Drive icon in your my computer. As virus always creates a autorun.inf file which is a system ,hidden and a read only file on your pen drive. It point to the main virus file which is also located on the pen drive. When user double clicks on the pen drive files pointed by the autorun.inf got executed which copies the virus files on your system.

The image below shows the Autorun file entries in some special characters when you right click on the drive.

Let’s see how can you protect yourself by following certain practices.

Fix:

Let’s discuss these practices one by one:

1. Disable Autorun on Your Pen Drive:

Open to Start >> Run and type “gpedit.msc” (without quotes) and press enter. This will open Group policy editor.
Browse to Administrative templates >> System >> double click on Turn off Autoplay click on Enabled and Under Settings >> Select All Drives in the drop down and click OK

2. Scan Your Pen Drive:

Whenever you insert your pen drive / portable drive into USB port on your system make sure to run a virus scan with your anti virus before opening your pen drive contents in windows explorer.

3. Use FreeCommander:

FreeCommander is again a file explorer like windows explorer, so you just need to download it by clicking here and install it.

After installing open your pen drive through FreeCommander

Check if there are some additional files like autorun.inf , Funny UST Scandal.avi.exe ,Ravmon.exe ,New Folder.exe etc or any other file which you have not copied or created, delete all these suspicious files on your pen drive.

Quick Update: 26th March 2008

4. Use your virus infected pen drive: You can also use your virus infected pen drives to copy your important data in worst circumstances.

How to backup your important data when your pen drive is infected with a virus

a. Insert your pen drive into the usb port, if it detects your drive you will see it in my computer.

b. Now don’t double click on your drive, rather open the pen drive contents by typing the drive letter.

For Example: type g: and press enter if your pen drive is shown as new g drive under my computer.

c. Copy your important files from your pen drive close the window and format your pen drive after then.

If you are still suspicious about the existence virus files on your pen drive, you can remove virus from your pen drive through command prompt by the method suggested by Madhur here in this article

USB pen drive detected but doesn’t show up in My Computer

2008-04-11T20:11:00.001-07:00

Trouble:

You may have faced a problem when you insert your pen drive and it gets detected very easily but it doesn’t show up as a drive icon in My Computer. The computer detects the pen drive but data on pen drive is not visible as the pen drive is not visible in My Computer (Explorer).

This problem occurs mainly when windows XP fails to allocate a drive letter to your portable drive(pen drive). It occurs mostly with new pen drives connected to your computer for the first time. If you face such problem then it may not be the pen drive’s fault, rather it may be windows trouble.

Fix:

You can fix this issue by following some simple steps given below.

1. Click Start, click Run, type compmgmt.msc, and then click OK.

2. In the console tree, click Disk Management. The Disk Management window will appear.

3. On this disk management window, you can see some drives including the portable drive. Right click on your portable drive and click change drive letter and paths.

4. Now a assign a new drive letter which is not being used by any of your drives in My Computer.

5. After assigning the new drive letter your portable drive will show up in my computer with other drives

We hope the above solution will help to fix this trouble.

2008-04-11T20:11:00.000-07:00

Trouble:

Fix:

You can fix this issue by following some simple steps given below.

1. Click Start, click Run, type compmgmt.msc, and then click OK.

2. In the console tree, click Disk Management. The Disk Management window will appear.

3. On this disk management window, you can see some drives including the portable drive. Right click on your portable drive and click change drive letter and paths.

4. Now a assign a new drive letter which is not being used by any of your drives in My Computer.

5. After assigning the new drive letter your portable drive will show up in my computer with other drives

We hope the above solution will help to fix this trouble.

How to avoid chkdsk disk scan at every time booting windows

2008-04-11T20:10:00.000-07:00

Trouble:

Recently we received a problem from one of the readers on system run a chkdsk disk scan again and again at every time on booting windows.

Let’s see how we can solve the problem of disk scan running every time of boot on windows.

Fix:

Disc scan is one of the protective feature of windows which runs to clean any cross-links or bad sectors that may be generated because of the improper shutdown of windows due to some reason. So, when ever you shutdown your system in some improper way ,the next time you boot your windows you will see scan disk running which you can stop by pressing an key on time.

But in some cases as experienced by some of the windows users, disk scan runs every time they reboot, this happens because of the following reasons:

1. Improper shutdown(most common).

2. External hard drive or portable drive attached which causes scan disk to scan them at every reboot.

3. chkdsk was not allowed to be completed at the time of boot.

Above reasons are normally the most common reasons behind this problem, but none of them matches with your case then, you probably have a dirty volume on your hard drive which has some bad sectors which does not get repaired at the time of reboot.

Here is a link to info about understanding of dirty volumes.

So, at every reboot chkdsk tries to repair those dirty bits on those bad sectors on your hard drive in those specific partitions.

But, don’t worry as you can simply fix this problem of disc scanning at every reboot.

Just follow the procedure given below:

You need to do a manual chkdsk on all the partitions or physical hard drives.

1. Open start>>run and type “cmd”(without double quotes)

2. Type “chkntfs /x ”(without double quotes) For example: chkntfs /x d:

3. Run this command for all the partitions of your hard drive.

4. Reboot your computer properly it will not do a disk scan again.

We hope this solves your problem…do lets us know through comments if you have any issues.

How to remove Win32/NSAnti, d.com virus without any anti-virus tool

2008-04-09T19:06:00.000-07:00

Recently we received a mail from one of our readers whose computer was infected by Win32/NSAnti virus, this virus mainly causes drive opening problem by double click in windows XP.

If your system is infected by this virus you can’t see hidden files and folders , even after applying the settings to show hidden folders. This setting is reverted back to Don’t show hidden files and folders by the virus.

This happens because virus protects the two hidden ,system files called d.com and autorun,inf which are created by amvo.exe and amvo0.dll , amvo1.dll which resides in system32 folder on the OS drive (hard disk partition on which windows operating system is installed).

Fix:

In order to fix the problems caused by this virus ,you will need to delete all these files created by the virus.

Follow the set of commands to delete these files

1. Open Start>>Run and type cmd and press enter. This will open windows command prompt window. On this window, type as directed in steps further and press enter at the end of each step.

2. type cd\

3. type cd windows\system32

4. type attrib -r -h -s amvo.exe

5. type del amvo.exe

6. type attrib -r -h -s avmo0.dll ,repeat the steps 5 and 6 again to delete avmo1.dll

7. now type d: and press enter for d: drive partition.

8. type attrib -r -h -s autorun.inf

9. type del autorun.inf

10. type attrib -r -h -s d.com

11. type del d.com

Similarly repeat from steps 8 to 11 for all your hard disk partitions to remove the files created by the virus.

Note: Above procedure may seems cumbersome but proves to be of great help to repair your system, if none of your anti-virus tools is able to solve the problem and remove the infections caused by the virus.

Updated (21 Jan 2008):

We have just received some comments by the users who do not find above method useful as they were not able to remove amvo.exe virus by following the above method.

For all those who are facing issues with the above method, can follow the steps given below to remove the virus.

1. First download Trend Micro HijackThis from here

2. Install and run the scan ,you will see an entry like this :

HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

3. Check the above entry and click on the button which says Fix Checked and click yes on the prompt.

4. Uncheck amvo.exe from msconfig>> startup (type msconfig in run and click on the startup tab) also and restart your system

5. Open my computer and go to folder options >> check the option show hidden files and folders. Also un-check the option Hide protected operating system files (This will give a warning message, confirm by pressing yes button). After this click Ok.

6. Now access all your system drives by typing the drive letters in the address bar (for example c:) and delete the files like autorun.inf and other file with a name ms18us.exe (sorry but I am not sure about the second file name )

7. Also delete the files amvo.dll and amvo1.dll from windows/system32 folder.

Updated ( 28 Jan 2008)

Note: Looks like that for most of the people both of the above methods are little bit confusing in terms of implementation.

So we would like tell another method to remove amvo and ampo virus by using a vbscript which you can download from http://www.en.mygeekside.com/?p=18 by clicking here. You can easily remove the virus by double clikcing the script.

PS: But we dont take any responsibilty if this script causes any damage to your system so use it on your own risk.

We hope the new solution for removal of win32/ns anti virus will help.

Task Manager disabled problem in windows xp

2008-04-08T10:17:00.001-07:00

We have received mails from some readers of Trouble Fixers about task manager is disabled on their system suddenly.

Problem: It is due to some kind of virus/ trojan activity which normally disables the task manager.Now due to this problem when ever the user press alt+ctrl+del to launch windows task manager it gives an error saying “Task Manager is being disabled by your administrator”.

Solution:

To Enable the Disabled Task Manager on your system

1. Press window key+r to show run prompt

2. Follow the following steps

Enter gpedit.msc in the run prompt and click OK
In the Group Policy settings window
Select User Configuration
Select Administrative Templates
Select System
Select Ctrl+Alt+Delete options
Select Remove Task Manager
Double-click the Remove Task Manager option’.
Set the property of this item as disabled.

Updated on 12th FEB 2008

For Those who use Windows XP Home Edition can use the registry to enable Task Manager

1. open start >> run and type regedit

2. Navigate to the following path:

Hive: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
3. You will find a registry key with name DisableTaskMgr of type: REG_DWORD
4. Double click the key with and set the Value to 0

5. Exit the registry and restart to see the effect.

If you still get problems in enabling the disabled task manager on your windows XP system , please let us know through your comments.

Registry editing has been disabled by your administrator

2008-04-08T10:13:00.000-07:00

Trouble:

We have been receiving lots of mails from our readers having problems with the registry editing on their system mostly because of virus activity.

Whenever they open Run and type regedit and press enter a message prompt appears saying “Registry editing has been disabled by your administrator“.

Let’s see how can we fix it.

Fix:

There are two ways through which you can enable registry editing in windows XP

Method 1:

You can use a simple UnHookExec.inf to enable registry editing.

1. Download UnHookExec.inf

2. Right click on the downloaded file and select install.

Method 2:

For enabling you can also use the remove restrictions tool by Sergiwa.com, if the method 1 doesn’t work for you.

1. First Download Remove Restrictions Tool

2. Run and check the registry tools and click apply.

Method 3:

if the above two methods does not work for you , you can also try executing a small vbscript which I found on major geeks.

1. First Download EnableRegEdit.vbs

2. Double click on the downloaded file to enable registry editing.

We hope at least one of the above will help to fix the trouble.

Not able to open drives on hard disk by double click

2008-04-08T10:12:00.000-07:00

Trouble:

Sometimes it happens in windows XP that you are not able to open drives on your hard disk. When you double clicking on the drives icons or right click on the drive>>explore in My computer ,the drive does not open.

This problem is generally caused by most of the viruses which infect windows XP system. They block or restrict your access to any of the drives.

But don’t worry this is not a big trouble it can be fixed easily.

Fix:

Normally when a virus infects a windows system which causes a drive opening problem, it automatically creates a file named autorun.inf in the root directory of each drive.

This autorun.inf file is a read only ,hidden and a system file and the folder option is also disabled by the virus. This is deliberately done by the virus in order to protect itself. autorun.inf initiates all the activities that the virus performs when you try to open any drive.

You have to just delete this file and restart your system to correct this problem.

Follow the set of commands below to show and delete the autorun.inf

1. Open Start>>Run and type cmd and press enter. This will open a command prompt window. On this command prompt window type the following steps.

2. type cd\

3. type attrib -r -h -s autorun.inf

4. type del autorun.inf

5. now type d: and press enter for d: drive partition. Now repeat steps 3 and 4. Similarly repeat step 5 for all your hard disk partition.

Restart your system and your trouble will be fixed.

How to remove: Newfolder.exe Virus (Complete Removal Instructions)

2008-03-28T20:03:00.000-07:00

Newfolder.exe Virus (Complete Removal Instructions)

An ".exe" file is being created with the same name as the folder itself in all drivers and cannot be deleted?
Your task manager, folder option are disabled, you "can not open the registry" because "it has been disabled by your administrator", your pen drive is infected and the system running too slow?
And you do not know how to remove NewFolder.exe because it recreates itself everytime you delete it.
Get rid of it - Security Stronghold security team has developed Newfolder.exe Virus removal.

Here you will find complete description and solution for "newfolder.exe" problem.

his problem can be solved manually by deleting all registry keys and files connected with this software, removing it from starup list and unregistering all corresponding DLLs. Additionally missing DLL's should be restored from distribution in case they are corrupted by Iddono. To fix this threat, you should:

1. Kill the following processes and delete the appropriate files:

• libedit.dll

• newfolder.exe

• shelliddono.dll

• srv0104.ids

• srvidd20.exe

If these files can't be deleted during normal Windows work or recreate themselves, reboot into Safe Mode and repeat deletion. If you do not see all of these files, then they are hiding themselves. You need special software to kill those hidden files.

2. Delete the following malicious registry entries and\or values:

• Key: SOFTWARE\Microsoft\Windows\CurrentVersion\Run for nwiz.exe

Value: @

• Key: software\microsoft\windows\currentversion\run\alchem

Value: @

• Key: software\microsoft\windows\currentversion\run\zzb

Value: @

Or Download Anti Virus To Remove IT-Download Now

SoBig Virus - too Fast, too Furious!

2008-03-24T20:40:00.000-07:00

More than 20 million users opened and passed along the Sobig.F virus, the fastest spreading Web worm ever. It infects computers running Microsoft Windows, told Reuters and FOX news.

The attack seems to have caught out a lot of people in China. About 30% of China's net users have been infected by the virus -- news based on Chinese survey, Said BBC news.

----------------------
SOBIG SUBJECT LINES
----------------------
1)Re: details
2)Re: approved
3)Re: my details
4)Re: Thankyou!
5)Re: That movie
6)Re: wicked screensaver
6)Re: your application
8)Your details
9)Thankyou
----------------------

The virus is programmed to try the download every Friday and Sunday, between 3 pm and 6 pm(eastern time). The "Sobig" virus started appearing last Tuesday.

Prevent Spam Mail In Yahoo!!!!

2008-03-24T20:37:00.000-07:00

-->>> Go to your Yahoo! Mail Plus page and click the Options link in the upper-right corner of the page.
-->>> The Mail Options page appears.
-->>> Under the Spam column on the Mail Options page, click the AddressGuard link.
-->>> If this is the first time that you've used AddressGuard, the AddressGuard introductory page appears. (Otherwise the regular AddressGuard page appears.)
-->>> On the AddressGuard introductory page, click the Get Started Now button.
-->>> The first AddressGuard setup page appears.
-->>> Enter a base name of your choice, then click the Continue button.

NOTE: Your base name must begin with a letter, contain no spaces or symbols and be different from your Yahoo! ID.

-->>> AddressGuard checks whether or not the base name you've entered is available. If it's not available, AddressGuard directs you to choose another base name.

-->>> Confirm that you want to use the available base name, or specify another base name by clicking the Continue button.

-->>> The next page prompts you to create your first disposable address. Enter a keyword to use with your base name, then click the Continue button.

-->>> Specify your preferences for this disposable address, then click the Set Up AddressGuard button to finish the setup process.

Do Not Able To View Hidden Folder - Here The Solution

2008-03-24T20:33:00.000-07:00

1. Go to Start --> Run, then type Regedit
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.
Now you should be able to view all the hidden files..

Get Rid The Funny UST Scandal.avi. exe (Vista and XP)

2008-03-24T20:18:00.000-07:00

Remove Funny UST Scandal.avi. exe (Vista and XP)Details:
1) This will block your Task Manager, Registry Editor and Command Prompt.
2) It hacks in your Yahoo Messenger and sends stupid and senseless messages to them and even a copy of itself. (ask gigacore if you don’t believe me!!!:P)
3) It will log your all key strokes and send them to an unknown email address through IM.
4) It slows down your system badly and reinstalling the OS will do no good.
5) It will disable the search and viewing of hidden files.
It’s built using AutoIt V3 virus programming software.--( source= some blog)

Windows XP:
This virus was made mainly to infect XP and Windows NT systems.
In XP and NT systems, it makes the following files:
a) Killer.exe (4084 kb) in c:\windows\
b) lsass.exe (3920kb) in c:\documents and settings\all users\start menu\programs\ startup
c) xmss.exe (4088kb) in all partitioned drives and in c:\windows
d) autorun.inf (1kb) in all partitioned drives with a script.
e) Funny UST Scandal.avi. exe in all partitions and Funny UST Scandal.exe in c:\Windows.

This Virus makes the following registry entries:
a) HKLM\Software\ Microsoft\ WindowNT\ CurrentVersion\ Wi nlogonshell(killer. exe or xmss.exe)
b) HKCU\Software\ Microsoft\ windows\Currentv ersion\RunRunonce(c:\windows\ xmss.exe)If the virus has completely installed itself, then you can find all these files in your system.
To remove this virus:
a) In order to removes the files, you’ll first have to stop the execution of this virus. To do so, download this file and run it.
b) Now open cmd.exe and go the above mentioned locations and unhide the files by typing: attrib –h –s Funny UST Scandal.exe for C:\windows and so on for all the other files in different locations. You might get an error while unhiding Funny UST Scandal.avi. exe which is placed in all partitions. If you get that error, just leave that file.
c) After unhiding all these files, delete them from your hard disk.
d) Download REPLACER and open it.
e) In the REPLACER type: c:\Funny UST Scandal.avi. exe and press enter. It will now ask you for another file. Create a text file named a.txt in C:\ and then type: c:\ a.txt and press enter. Press Y and press enter. Go to C: drive and there you’ll find 3 files named Funny UST Scandal.backup, Funny UST Scandal.exe and a Temp file. Delete them.
f) Repeat Step e) for all you partitions.

Windows Vista: Files included:
a) xmss.exe (4088kb) in all partitioned drives and in c:\windows
b) autorun.inf (1kb) in all partitioned drives with a script.
c) Funny UST Scandal.avi. exe in all partitions and Funny UST Scandal.exe in c:\Windows.
Registry Entries:
a) HKLM\Software\ Microsoft\ WindowNT\ CurrentVersion\ Wi nlogonshell(killer. exe or xmss.exe)
b) HKCU\Software\ Microsoft\ windows\Currentv ersion\RunRunonce(c:\windows\ xmss.exe)The second key might no be present.

Removing the Virus:
To remove this virus:
a) In order to removes the files, you’ll first have to stop the execution of this virus. To do so, download this file and run it.(File include in Attachment)
b) Now open cmd.exe and go the above mentioned locations and unhide the files by typing: attrib –h –s Funny UST Scandal.exe for C:\windows and so on for all the other files in different locations. You might get an error while unhiding Funny UST Scandal.avi. exe which is placed in all partitions. If you get that error, just leave that file.
c) After unhiding all these files, delete them from your hard disk.
d) Download REPLACER and open it.
e) In the REPLACER type: c:\Funny UST Scandal.avi. exe and press enter. It will now ask you for another file. Create a text file named a.txt in C:\ and then type: c:\ a.txt and press enter. Press Y and press enter. Go to C: drive and there you’ll find 3 files named Funny UST Scandal.backup, Funny UST Scandal.exe and a Temp file. Delete them.
f) Repeat Step e) for all you partitions.
As you can see that the procedure for both the OS is same just the files are different. I have tested the steps myself on Windows XP sp2 (my desktop), Windows Vista Home Basic (my lappy), Windows Vista Home Premium (my friends lappy) and Windows Vista Ultimate (my desktop).Hope this guide is useful. Happy Removing…

Remove microsoftpowerpoint.exe Virus

2008-03-24T20:13:00.001-07:00

Mircosoftpowerpoint .exe is a file that is created by a virus named w32.USBWorm. This virus is an epidemic and spreads very rapidly through USB drives. When a USB drive is connected to a computer which is already affected by this virus, it gets affected. The virus in the computer will transfer all its files into the drive. When this USB drive is connected to another unaffected computer, it will transfer all the required files to the computer's hard drive.
Once the program runs, your computer system is infected. This virus will not destroy any of your system files. It hides all the hidden folders and disables "Show hidden folders" option in folder options menu. It runs its process in the memory. This makes the worm to start with windows start-up and and displays annoying pop-up like "I dont hate mozilla, but use IE or else", Orkut is banned you fool. It will not let you open Orkut using Internet Explorer. It will not let you access even YouTube too.
The virus, after affecting your computer, creates a folder named "heap41a" in your root drive ie; C drive, where it resides. This folder will be hidden and since this virus disables show hidden files and folders option, it is not easy to locate. This folder contains following:

* Offspring - an empty folder.

* 2.mp3 - a laughing sound.

* Icon.ico - a blank icon file.

* reproduce .txt - codes to change registry entries.

* svchost.exe - gives all kinds of pop-ups.

* script1.txt - codes for displaying pop-ups.

* std.txt - codes to change registry entries.
You can find this folder by typing C:\heap41a in Start Menu> Run. If you go through the text files, you will get an idea what the worm does to your computer. It runs the executable file vchost.exe and also changes the following keys in the registry which in turn inactivates the hidden files and folders option.

>> regread,regdata, REG_DWORD, HKEY_LOCAL_ MACHINE,SOFTWARE \ Microsoft\Windows\ CurrentVersion\ Explorer\ Advanced\ Folder\ Hidden\SHOWALL, checkedvalueifno tequal,regdata, 2

>> regwrite,REG_ DWORD,HKEY_ LOCAL_MACHINE, SOFTWARE\ Microsoft\ Windows\CurrentVers ion\Explorer\ Advanced\ Folder\Hidden\ SHOWALL,checkedvalu e,2
To rectify this, you will have to change these keys in the registry, back to actuals. To open the registry editro, go to Start Menu>> Run>> and type 'regedit'. Browse to find the following entries and change them.HKEY_CURRENT_ USER\Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ Advanced. To the right hand side, you will find the value "Hidden. Right click and modify it to 1. HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Explorer\ Advanced\ Folder\Hidden\ SHOWALL and find the Checked all key to the right and change it to 1 from 2. This will enable "Show hidden files and folders" in the folder option menu.Now open Windows Task Manager and end the process named svchost.exe that runs under your user name. Then delete the folder C:\heap41a and go to HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\ Windows\CurrentV ersion\policies\ Explorer\ Run and clear the entry that says heap41a.
Now to make sure that the computer is free from infections, search the entire computer system and see whether there are any files with the same name as the .exe file mentioned earlier. If found, delete them. Now your computer system is completely free from worm infection. But make sure that you format the USB drive. This will prevent the virus, if present in the USB drive, infect other computers too. If you are a little careful, you can prevent your computer system from virus infections through USB drives, otherwise called Pen drives or Flash drives.