Enable the tools disabled by virus

If you got a virus usually it will disable the following things so that you can't be able to delete the virus.

It will disable Folder Options menu item from View menu, disables the Task Manager, and disables the Registry Editor.

You can enable all these from the Group Policy editor by yourself manually.

• Go to Windows > Run > gpEdit.msc
• Folder Options: Go to User Configuration > Administrative Templates > Windows Components > Windows Explorer > Removes the Folder Options menu item from the Tools menu. Disable this option. Now you should be able to see Folder Options in the View menu of your explorer window.
• Task Manager: Go to User Configuration > Administrative Templates > System > Ctrl+Alt+Del Options > Remove Task Manger. Disable this option.
• Registry Editor: Go to User Configuration > Administrative Templates > System > Prevent Access to Registry Editing Tools. Disable this option.

But, it is good to have alternatives for these things since viruses usually disables the default tools but not the alternative softwares.

You can use Process Explorer as alternative for Task Manager. Similarly you can use Explorer2 as alternative for default windows explorer. If you don't like Explorer2 many more explorer softwares are available, you can choose from any of those. I don't know alternatives for the Registry Editor. Please feel to share those you know in the comments section below.

Related Posts:
Stop viruses coming from Pen Drives
Remove Amvo.exe virus, Funny UST Scandal, Fun.exe DC.exe SVIQ.exe
Task Manager, Registry Accessing disabled?
Disable Autoplay, Messenger Service
Important steps while cleaning virus
What is this process

Subscribe to my site feed for receiving more tips. You can get more tips in your email for free.

Clean New Folder.exe, RegSvr.exe Virus

Recently I got infected with this virus. This virus just shows a message when windows started, "Rundll.exe is not found.......", and infecting the pen drives for first few days. Not much harm. But after 4 or 5 days it is starting creating copies of virus file in many folders. The copy will be having the same name as the folder name and it also having folder icon, so that we will think it as another folder.

When I have searched Internet, I got the following link useful Am I Works. I have developed a tool for removing this virus.

Download New Folder virus removal tool, unzip it, and double click on RemoveVirus.bat file. Tell me if you get rid of virus in comments section.

Note: If you are not able to open Registry Editor (Win+R, regedit.exe), See Accessing Registry disabled?

Subscribe to my site feed for receiving more tips. You can get more tips in your email for free.

Related:
Stop Viruses coming from Pen drives
Task Manager Disabled?
Important Steps when cleaning viruses

Stop viruses coming from pen drives

Now a days pen drives ( or USB drives ) became necessary. But there is a problem with these pen drives. They can be very easily infected by viruses. But we can not live without using pen drives.

You can be a bit more careful and prevent them infecting your system with different types of viruses.

• First disable auto play in your system. This prevents viruses in the pen drive from running automatically when pen drives are inserted into the system. (Please note that this will disable auto playing of CDs also).
• After inserting pen drive into the system open it in explorer mode only, don't open it in My Computer.
• To open Explorer, press Win+E on your keyboard.
• Or right click on My Computer, and select explorer.
• If My Computer is already opened, click on 'Folders' in the tool bar (or View menu> Explorer Bar> Folders).
• Always open pen drive by clicking on the pen drive name from the left pane only. Don't open from right pane.
  
• Don't open the files you don't need. If you find any file suspicious, right click on file name and select properties. It will show complete details about that file. Don't rely on icons. Some viruses use folder icon to make us think that they are folders, and most probably we will double click on that to see what is there in that folder which actually executes the virus.
  

A little careful handling of pen drives will prevent a lot many viruses.

Related:
Remove Amvo.exe virus, Funny UST Scandal, Fun.exe DC.exe SVIQ.exe
Task Manager, Registry Accessing disabled?
Disable Autoplay, Messenger Service
Important steps while cleaning virus
What is this process

Subscribe to my site feed for receiving more tips. You can get more tips in your email for free.

Removed Fun.exe, dc.exe, SVIQ.exe virus

I have got a virus, which automatically opening the Yahoo messenger. So, when I have looked the processes in the task manager, I have found the following processes Fun.exe, dc.exe, SVIQ.exe.

I killed those processes, by right clicking the process and select "End Process Tree". After I have killed all those processes, I searched Internet and found the following link W32.Imaut.AS (also called Dung Coi). Then I have deleted all the virus files and cleaned the registry.

I am describing the exact steps below:

• First go to the task manager (right click on the task bar > task manager) and select the processes tab.
  
• Right click on the Fun.exe, dc.exe, SVIQ.exe and select "End Process Tree". This stops the viruses from interrupting in the cleanup process.
  
• Go to the MSConfig (Win+R, type MSConfig and press enter). Go to the startup tab. Uncheck the dc.exe, fun.exe, SVIQ.exe, Other.exe, Win.exe. This stop the virus processes from starting with the windows.
  
• Next go to the Registry Editor (Win+R, type RegEdit and press enter). Remove the following keys
• dc, dc2k5, fun under the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• load, run under the key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
• Go to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and Modify Shell's value to "Explorer.exe".
• Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc
• Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc2k5
• Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Fun
• Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Load
• Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Run
• Delete the following files.
• %Windir%\Help\Other.exe
• %Windir%\inf\Other.exe
• %Windir%\system\Fun.exe
• %Windir%\System32\config\Win.exe
• %Windir%\System32\WinSit.exe
• %Windir%\dc.exe
• %Windir%\SVIQ.exe
• %Windir%\System32\NWB.dat
• c:\PNga.txt
• %Windir%\wininit.ini

I have created two files to automate the process of deleting the Registry keys, and the virus files. Download Fun Virus Removal, unzip it. Double click on the RemoveVirus.bat file.

Thats it. I got rid from the virus. I read in the net that this virus will create a copy of virus file in directories with the same name and uses a folder icon, so that users will click on it thinking it was a folder. But, I dint get any files like that, if you got any files like that, don't click on them, delete them immediately. If you have any doubt, right click on that and select properties, then you can know whether it is a file or folder.

Read More:
Important steps when cleaning virus
Disabling Auto Play in Windows
Task Manager Disabled?
Registry access disabled?
What is this Process?

Subscribe to my site feed for receiving more tips. You can get more tips in your email for free.

Registry Accessing disabled?

Many viruses disable the access to the registry so that we can't remove the virus entries in the registry. In these cases you can download the following file UnHookExec.inf. After downloaded, right click on the file, and select Install.

You can enable it manually by editing the group policy editor. Go to Windows > Run > gpEdit.msc
Go to User Configuration > Administrative Templates > System > Prevent Access to Registry Editing Tools. Disable it. You should be able to open regedit now.

Source: Tool to reset shell\open\command registry keys

Subscribe to my site feed for receiving more tips. You can get more tips in your email for free.

Disable Messenger Service

If you are receiving this type of unwanted messages, take the following steps to disable messenger service.

• Open Services window (Win+R and type services.msc or you can go to control panel, Performance and Maintenance, Administrative Tools, Services).
• Select Messenger service, right click and select properties. Change startup type to Disabled.
• Thats it. You won't get any popups from Internet.

Some spammers use net send utility to send this type of advertisements on the Internet. If you really wants the net send functionality install a firewall or enable the one which comes default with windows. Then you won't get this type of messages.

Read More:
Disable AutoPlay
Important steps to be taken when cleaning viruses
Remove Funny UST Scandal Virus manually

Cleaned amvo.exe virus manually

Today I got one virus in my system. When I try to login to the Yahoo messenger, it is closing without logging in. I have found a virus (don't know name) and cleaned it manually. I have taken the below steps to remove this virus manually.

• First I have checked in task manager, I didn't find any suspicious processes.
• Next I opened MSConfig (Go to run, and type msconfig). I have found one process with the name amvo.exe under the startup tab. It is located in Windows\System32 folder.
• I unchecked the process, and closed the msconfig window.
• Next I open Registry Editor (go to run, and type regedit). I have searched for "amvo.exe" and found one entry. I have deleted the whole key.
• Next I have tried to set the option to "show hidden files" (Go to Tools> View in windows explorer), as virus file is hidden. But it is not allowing me. As soon as I set it to show hidden files and clicked on ok, it is changing back to "Don't show hidden files".
• Then I have used Bullet Proof FTP software to browse the local disk, because it shows all files even hidden files. (I have already installed FTP software in my system. You can get free trial version from the website.)
• Then I have browsed to Windows\System32 folder, and deleted amvo.exe, amvo0.dll, amvo1.dll.
• This virus put an Autorun.inf file, and .cmd file in every drive's root. I have removed all those.

Thats it. Virus was cleaned. Now, I am able to use my messenger.

Don't forget to disable system restore before starting the cleaning process, and open windows in safe mode.

Update: I built two files to clean this virus automatically. After downloading the AMVO Cleaner, unzip the file to get a folder. Open that folder, and double click on the file named AMVO_Delete. It should have cleaned the virus. Please let me know whether your problem solved in the comments section below.

If you find this information, please leave a comment below. See the following links for more information:
Important steps when cleaning virus
Disable auto play
Task Manager disabled?
Unable to open Registry?
Know about process?
How I removed Funny UST Scandal virus from my system
Removed fun.exe, dc.exe, SVIQ.exe manually


Subscribe to my site feed for receiving more tips. You can get more tips in your email for free.

Get Firefox, and safely browse the Internet.

Utility softwares for Windows XP

You can find lot of utility softwares for windows XP, like Process Explorer, AutoRuns, at the following location.

http://technet.microsoft.com/en-us/sysinternals/bb545027.aspx

Related:
Alternative for Task Manager

Disabling auto play

You might be facing problem with the auto play feature in windows, especially with pen drives (USB Drives). Because unlike CDs, viruses can copy themselves easily into pen drives, so I disabled the autoplay feature. If you want to do the same thing follow these steps.

• Goto Run dialog box, type regedit and hit enter.
• be careful when changing registry, because it might corrupt your system if done wrong. You might choose to take backup, so that you can revert back to your previous settings if anything goes wrong.
• Navigate to the following key
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
  CurrentVersion\Policies\Explorer

• Create NoDriveTypeAutoRun key, if it is not there.
• If it there, set its value as FF, this disables auto play on all drives.
• If you have to create this key,
  
• right click in the right pane, select new > DWORD value
• name it as 'NoDriveTypeAutoRun', and set its value to FF.
• Thats it, you have disabled auto play for all drives.

But even after doing this, don't double click on your pen drives. Because by doing so, you will run the viruses in your pen drive if there are any. Always do right click on pen drives and select right click or open in explorer, select pen drive in left pane to open it.

Update: If you don't want to change the registry manually, download Disable_Auto_Play, unzip it to get registry file. Double click on it, it will ask for the confirmation, click on yes. It will add the key to the registry.

See here for more information.

Even you can do this by using group policy editor. Go to Windows > Run > gpEdit.msc
Go to User Configuration > Administrative Templates > System > Turn Off Autoplay.
Enable it and select the option "All drives" in the below pane.

Read more:
Task Manager Disabled?
Access to Registry Disabled?
Important steps when cleaning virus
Backup Dictionary in Word
Firefox: View status bar in full screen mode

Subscribe to my site feed for receiving more tips. You can get more tips in your email for free.

Funny UST Scandal virus

How I removed Funny UST Scandal virus from my system.

Recently my system infected with a virus. I am using Win XP and using McAFee. But, McAFee did not recognise the threat at all.

Characteristics: The virus is closing every program it thought might be dangerous to its existence. If I open task manager, virus is minimizing it to system tray. There are processes running killer.exe, smss.exe, lsass.exe. Yes, smss.exe and lsass.exe are system processes, but virus is running two processes with the same name. one process is running with the name smss.exe, while two processes are running with the name lsass.exe, in that one is system process, another one is virus.

I have already installed process explorer, otherwise I would have to download it from another system because when I tried to download it from the Net virus is closing the window. I have used this software to kill the above processes. In the process, before I am killing the processes virus is minimizing this process explorer to system tray, I am opening it from there, and I closed all the processes. Two entries are there for lsass.exe, one is child process for System process, another one is child for explorer.exe, this later one is virus process.

Once virus processes are closed, I took the following steps:

• Deleted Funny UST Scandal.exe, smss.exe, and killer.exe in Windows folder, Windows\System, and Windows\System32 folder.
• Checked and deleted root folder of every partition for these files and autorun.inf. In some locations I found xmss.exe also, they all have some icon. So, I recognised them easily.
  
• Usually these files will be hidden. You can use “attrib –h –s smss.exe” in command prompt to unhide them and then delete. But, I have used Bullet Proof FTP for locating these hidden files and deleting them. As I have already installed the software I used it, you can download trial version. It is very easy by using this FTP client. With attrib command we have to go every location and issue command and then delete it. This BP FTP is showing hidden files, and I dont need to use DOS commands.
  
• Deleted C:\Documents and Settings\All Users\Start Menu\Programs\Startup\lsass.exe. I have also deleted Desktop.ini files which are placed in every folder of Start menu for every user. I think this file shouldn't in those locations.
  
• Used MSConfig command to clean the startup items, I have unchecked all suspicious processes from startup tab.
• Using RegEdit tool, deleted Auto Play entries which are pointed to smss.exe
• And then searched for “Funny”, “Killer”, “Smss”, and “lsass”. Be careful when deleting lsass keys as there is an important system process will be running with the same name. System copy of the file will be in the Windows\System32 folder.

If you find this information useful, please leave a comment below.

Related Posts:
Disabling auto play
Task Manager disabled?
Important steps when cleaning virus
What is this process?

This link contain more information
http://www.thinkdigit.com/forum/showthread.php?t=78794


If you like my blog, please subscribe to the feed using e-mail form at the right side or in a news reader.

What is this process?

Want to know about a process running in your system. Check out the following websites.

• Neuber.com
• lilutilities.com

Important steps when cleaning virus

When you are putting scan for viruses you have to disable system restore. Windows XP backups your system at times, so that you can revert back to the working condition if your system is not working after installing X software. You can select the restore point before that day you installed that X software, so your system can work normally.

If your system has a virus, your windows might unknowingly already backed up the virus with other files. Your Anti Virus software can not remove virus from these backed up files because windows is protecting them. So, after your Anti Virus scans and cleans rest of the system, the virus can start spreading again from those backed up files.

So, first turn off the system restore in all drives before starting the scanning. You can do this by going to system properties(either through control panel, or by right clicking on My Computer icon). Then go to System Restore > Turn Off. You can hit the Win + Pause on the keyboard to bring up the System Properties.

And every time scan your system by booting into safe mode because when started in safe mode, windows loads minimal files to start the system.

Read Also:

Disabling auto play
What is this process?
How much Virtual Memory
Mail Store in Outlook Express

Task Manager disabled?

Task manager in your system is disabled by virus? To remove the virus you have to first make the virus not to run. The virus disables registry editor, and MSConfig also along with task manager. So, you can't able to stop the virus from loading with the windows.

You can download Process Explorer and use this utility to view and kill the processes. It offers more features than default task manager bundled with Windows.

If you like your old Task Manger you can enable it by changing options in the Group Policy Editor.

Go to Windows > Run > gpEdit.msc or you can find this in Control Panel > Administrative Tools.

Go to User Configuration > Administrative Templates > System > Ctrl+Alt+Del Options > Remove Task Manger. Disable this option. Now you can see Task Manger option enabled.

Softwares:

Process Explorer
Task Killer

Related:
Disabling auto play
Important steps when cleaning virus