This Yahoo messenger virus attack is one of the most powerful Trojan/virus.. If your computer is infected with this virus; It will sends the nsl-school.org url to all of your friend list in yahoo messenger using your ID . So with in few hours many of your friends will get infected with it.
To solve this problem, Just go through the below steps carefully.
What are those links ?
Nsl-school.org or other (Do not open this url in your browser).
If you are infected with it what is going to happen ?
1: It sets your default IE page to nsl-school.org, you can't even change it back to other page. If you open IE from your comp some malicious code will automatically executed into your computer.
2: It will disables the Task manager / reg edit. So you can't kill the Trojan process anymore.
3: Files that are gonaa installed by this virus are svhost.exe , svhost32.exe , internat.exe. (You can find these files in windows/ & temp/ directories.)
4: It will sends the secured & protected information to attacker
How to remove this manually from your computer ?
1: Close the IE browser. Log out messenger / Remove Internet Cable.
2: Enable your Regedit (Click Start -> Run and type this command exactly as given below: (better - Copy and paste)
Code:
REG add HKCUSoftwareMic*ftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 0 /f 3:
To enable task manager : (To kill the process we need to enable task manager)
Click Start, Run and type this command exactly as given below: (better - Copy and paste)
Code:
REG add HKCUSoftwareMic*ftWindowsCurrentVersionPoliciesSystem /v DisableTaskMgr /t REG_DWORD /d 0 /f 4:
Now we need to change the default page of IE though regedit.
Go to Start -> Run -> Regedit
From the below locations in Regedit chage your default home page to hackgyan.net or other
Code:
HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerMain
HKEY_ LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain
HKEY_USERSDefaultSoftwareMicrosoftInternet ExplorerMain
Just replace the attacker site with hackgyan.net or set it to blank page.
5: Now we need to kill the process from back end. Press Ctrl + Alt + Del
Kill the process svhost32.exe . ( may be more than one process is running.. check properly)
6: Delete svhost32.exe , svhost.exe files from Windows/ & temp/ directories. Or just search for svhost in your comp.. delete those files.
7: Go to regedit search for svhost and delete all the results you get
8: Restart the computer. That's it now you are virus free
Sunday, March 23, 2008
Taskmanager disabled,regedit banned,folder options banned,gepdit.msc banned,cmd banned....Try dis..!!
hi frnds this is an restriction removal tool
download dis and run....all restriction wil be removed 4m ur pc....njoy!!
1.restriction removal tool
link: http://www.softpedia.com/get/Security/Security-Related/RRT-Remove-Ristrictions-Tool.shtml
------------------------------------------------------------------------------------------
if d above given software doesnt work den go for softwares given below....but i thbk above software vl work for u...
----------------------------------------------------------------
2.unhackme
http://www.greatis.com/unhackme/download.htm
3.hijackthis
http://filehippo.com/download_hijackthis/
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
4.process explorer
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
If your pc is affected with some virus the most common of all is your folder otion will be disabled,you may not be able to open task manager, etc etc..
now 1st step is to identify the virus process
process explorer will help u and u may see the path of the installed file on ur system
now use restriction removal tool to remove the task bar ..folder option restrictions...etc...
now our aim is to remove the running virus process..
use hijackthis and select the virus process. it will remove the process from startup registry also..
finally try unhacme.. to remove the rootkits
download dis and run....all restriction wil be removed 4m ur pc....njoy!!
1.restriction removal tool
link: http://www.softpedia.com/get/Security/Security-Related/RRT-Remove-Ristrictions-Tool.shtml
------------------------------------------------------------------------------------------
if d above given software doesnt work den go for softwares given below....but i thbk above software vl work for u...
----------------------------------------------------------------
2.unhackme
http://www.greatis.com/unhackme/download.htm
3.hijackthis
http://filehippo.com/download_hijackthis/
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
4.process explorer
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
If your pc is affected with some virus the most common of all is your folder otion will be disabled,you may not be able to open task manager, etc etc..
now 1st step is to identify the virus process
process explorer will help u and u may see the path of the installed file on ur system
now use restriction removal tool to remove the task bar ..folder option restrictions...etc...
now our aim is to remove the running virus process..
use hijackthis and select the virus process. it will remove the process from startup registry also..
finally try unhacme.. to remove the rootkits
HAPPY BIRTHDAY VIRUS REMOVAL INSTRUCTIONS
below steps are the removal instruction of happy birthday virus.
don’t forget to change the downloaded files extension to .zip and
change exc file extension to exe!!!
Download below links file (Security Task Manager and NOD32 Registry Fix)
http://cid-a8c37fe357e06ebd.skydrive.live.com/self.aspx/System%20Tools/STM.compress
http://cid-a8c37fe357e06ebd.skydrive.live.com/self.aspx/System%20Tools/NOD32%20Registry%20Recovery.compress
1. install security task manager with patch from my attachment and run the program
2.
kill the process of explorcr.exe and delete manually from
%systemroot%\system32 (its hidden). you won't see happy birthday
caption again, as soon as you kill the process
3. delete manually also autorun.inf from the %systemroot% (its hidden)
remark:
if you cant find that files, use other file browser software such as
captain nemo!! cause of virus disabled most of useful system command
such as cmd, regedit, msconfig and much more.
4. insert windows xp cd-rom for copy ntldr from i386\ntldr to %systemdrive%
5. run nod32 registry fix to recover system command
6. restart your computer
dont
forget to check all usb storage and delete manually all of autorun.inf,
explorcr.exe and foldername.exe. explorcr.exe delete ntldr fron the
systemdrive. use windows xp recovery console to recopy the ntldr, if
the computer is already deleted by explorcr.exe
wish all of you to be happy after clean
don’t forget to change the downloaded files extension to .zip and
change exc file extension to exe!!!
Download below links file (Security Task Manager and NOD32 Registry Fix)
http://cid-a8c37fe357e06ebd.skydrive.live.com/self.aspx/System%20Tools/STM.compress
http://cid-a8c37fe357e06ebd.skydrive.live.com/self.aspx/System%20Tools/NOD32%20Registry%20Recovery.compress
1. install security task manager with patch from my attachment and run the program
2.
kill the process of explorcr.exe and delete manually from
%systemroot%\system32 (its hidden). you won't see happy birthday
caption again, as soon as you kill the process
3. delete manually also autorun.inf from the %systemroot% (its hidden)
remark:
if you cant find that files, use other file browser software such as
captain nemo!! cause of virus disabled most of useful system command
such as cmd, regedit, msconfig and much more.
4. insert windows xp cd-rom for copy ntldr from i386\ntldr to %systemdrive%
5. run nod32 registry fix to recover system command
6. restart your computer
dont
forget to check all usb storage and delete manually all of autorun.inf,
explorcr.exe and foldername.exe. explorcr.exe delete ntldr fron the
systemdrive. use windows xp recovery console to recopy the ntldr, if
the computer is already deleted by explorcr.exe
wish all of you to be happy after clean
Thursday, March 13, 2008
Disabled Netwrk drive etc in tools Menu - System.exe Virus
Symptoms
It creates a file hidden system.exe in the Windows directory. McAfee can detect it, but cannot remove because it could not stop it from running, so permission denied.
Folder options are disabled, the tools menu in the explorer is simply filled with stuff like "disable networkd drive" etc.. but no folder options so one cannot view the hidden files...
if you try to run the folder options from Help and suport center, you get the message "The current settings of windows forbid this application..." blah blah...
Task manager is disabled. If you press ctr+alt+del, you get "task manager is disabled..." etc. nothign happens when you run TASKMAN from windows folder....
RUN has been deleted from start menu.
Command prompt (cmd.exe) has been disabled...
Solution
firstly use hijack this to remove all suspesious viruses/worms frm ur system also do a scan wid bitdefender or kaspersky.
---------------
for enabling folder options:
Fire up Group Policy Editor. (Start->Run->"gpedit.msc")
On the left, go to User Configuration.
Then, go to Administrative Templates.
Then, go to Windows Components.
Then, go to Windows Explorer.
Finally, on the right desable the option of "Remove the Folder Options menu item from the Tools Menu".
------------------------
to enable cmd
Open Registry Editor (Regedit.exe) and navigate to:
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
In the right-pane, double-click DisableCMD and set it's data to 0
------------------------
To enable task manager
Click Start, Run and type this command exactly as given below: (better - Copy and paste)
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
-------------------------
To enable Regedit
Click Start, Run and type this command exactly as given below: (better - Copy and paste)
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
----------------
preferably do all the above thing in safe mode.
now remove system.exe
Use Windows Task Manager to Remove system.exe Processes
To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
Click on the "Image Name" button to search for " system.exe" process by name.
Select the " system.exe" process and click on the "End Process" button to kill it.
------------------------------
Use Windows File Search Tool to Find system.exe Path
Go to Start > Search > All Files or Folders.
In the "All or part of the the file name" section, type in " system.exe" file name(s).
To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
When Windows finishes your search, hover over the "In Folder" of " system.exe", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete system.exe in the following manual removal steps.
----------------------------
Detect and Delete Other system.exe Files
To open the Windows Command Prompt, go to Start > Run > cmd and then press the "OK" button.
Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
To change directory, type in "cd name_of_the_folder".
Once you have the file you're looking for type in del "name_of_the_file".
To delete a file in folder, type in "del name_of_the_file".
To delete the entire folder, type in "rmdir /S name_of_the_folder".
Select the " system.exe" process and click on the "End Process" button to kill it.
It creates a file hidden system.exe in the Windows directory. McAfee can detect it, but cannot remove because it could not stop it from running, so permission denied.
Folder options are disabled, the tools menu in the explorer is simply filled with stuff like "disable networkd drive" etc.. but no folder options so one cannot view the hidden files...
if you try to run the folder options from Help and suport center, you get the message "The current settings of windows forbid this application..." blah blah...
Task manager is disabled. If you press ctr+alt+del, you get "task manager is disabled..." etc. nothign happens when you run TASKMAN from windows folder....
RUN has been deleted from start menu.
Command prompt (cmd.exe) has been disabled...
Solution
firstly use hijack this to remove all suspesious viruses/worms frm ur system also do a scan wid bitdefender or kaspersky.
---------------
for enabling folder options:
Fire up Group Policy Editor. (Start->Run->"gpedit.msc")
On the left, go to User Configuration.
Then, go to Administrative Templates.
Then, go to Windows Components.
Then, go to Windows Explorer.
Finally, on the right desable the option of "Remove the Folder Options menu item from the Tools Menu".
------------------------
to enable cmd
Open Registry Editor (Regedit.exe) and navigate to:
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
In the right-pane, double-click DisableCMD and set it's data to 0
------------------------
To enable task manager
Click Start, Run and type this command exactly as given below: (better - Copy and paste)
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
-------------------------
To enable Regedit
Click Start, Run and type this command exactly as given below: (better - Copy and paste)
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
----------------
preferably do all the above thing in safe mode.
now remove system.exe
Use Windows Task Manager to Remove system.exe Processes
To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
Click on the "Image Name" button to search for " system.exe" process by name.
Select the " system.exe" process and click on the "End Process" button to kill it.
------------------------------
Use Windows File Search Tool to Find system.exe Path
Go to Start > Search > All Files or Folders.
In the "All or part of the the file name" section, type in " system.exe" file name(s).
To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
When Windows finishes your search, hover over the "In Folder" of " system.exe", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete system.exe in the following manual removal steps.
----------------------------
Detect and Delete Other system.exe Files
To open the Windows Command Prompt, go to Start > Run > cmd and then press the "OK" button.
Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
To change directory, type in "cd name_of_the_folder".
Once you have the file you're looking for type in del "name_of_the_file".
To delete a file in folder, type in "del name_of_the_file".
To delete the entire folder, type in "rmdir /S name_of_the_folder".
Select the " system.exe" process and click on the "End Process" button to kill it.
Subscribe to:
Posts (Atom)