Now a days those who by Laptop computers they are using Windows Vista Operating System.
In this WindowsVista there is Aerouser interface, Windows Slidebar features. Because of this bettery life gets down.
so go for this url http://www.codeplex.com/vistabattery there will be a programme named vista Battery saver download that programme it will give u a different type of power files that u can install in u'r laptop . this will give good backup for the battery
How to cahange Windows bootscreen safe?
Now a days all are using some sharewares that change the boot screens.
But after unsinstallong these there is a way of not booting also and the system kernell may be currupted.
There is a good way to solve these
use http://www.stardock.com/products/bootskin/index.asp
in this url you can get Bootskin programe for free.
after installing it go to http://www.wincustomize.com/Skins.aspx?LibID=32 for getting screens
But after unsinstallong these there is a way of not booting also and the system kernell may be currupted.
There is a good way to solve these
use http://www.stardock.com/products/bootskin/index.asp
in this url you can get Bootskin programe for free.
after installing it go to http://www.wincustomize.com/Skins.aspx?LibID=32 for getting screens
How to desable Runas option on mouse right click?
you all know when u run an application by your mouse right click like this
this options appear so to desable these options u can modify registry like this
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Policies\Explorer
go to Hide RunAsVerb
create a DWORD and give the valu as 1
then u can remove Runas option in context menu
u can see Run only
W32/Zhelatin.gen!eml
This is a generic detection of spammed email messages used to entice users into visiting sites hosting exploits that would result in a drive-by download. On visiting the link, a cocktail of browser and application exploits that attempts a drive-by install of malware on the users machine is performed. The script which is used for the drive-by download is detected as JS/Downloader-BCZ.
Characteristics
Characteristics
Characteristics -
This threat is updated on a daily basis.
For the latest on the tactics used by this virus family, please check the Avert Blog.
This is a detection of spammed email messages used to entice users into visiting sites hosting exploits that would result in a drive-by download.
This is a detection of spammed email messages used to entice users into visiting sites hosting exploits that would result in a drive-by download.
User receives an email titled “You’re received a postcard” in his inbox and is requested to open the link contained in the message body in order to view the virtual postcard.
On visiting the link, a cocktail of browser and application exploits that attempts a drive-by install of malware on the users machine is performed.
A copy of the spammed message is as follows:
Note: The link in the message has been sanitized to protect users from guessing.
Symptoms
Presence of the W32/Zhelatin.gen!eml detection is not an indication that a system has become actively infected.
Symptoms
Presence of the W32/Zhelatin.gen!eml detection is not an indication that a system has become actively infected.
The from address is spoofed when sending infectious email messages and therefore, it can not be assumed that the from user address is any indication of which user may actually be infected.The following list of subject lines have been observed in the wild:
You’ve received a greeting card from a admirer!
You’ve received a greeting card from a admirer!
You’ve received a greeting card from a class mate!
You’ve received a greeting card from a class-mate!
You’ve received a greeting card from a colleague!
You’ve received a greeting card from a family member!
You’ve received a greeting card from a friend!
You’ve received a greeting card from a mate!
You’ve received a greeting card from a neighbor!
You’ve received a greeting card from a neighbour!
You’ve received a greeting card from a partnerCustomers should simply delete all email messages identified as W32/Zhelatin.gen!eml.
Method of Infection
The URL in the message points to a site hosting the a cocktail of browser and application exploits. On visiting the site, a silent drive-by install of malware is attempted on unpatched machines.
Removal -
A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.
Additional Windows ME/XP removal considerations
Method of Infection
The URL in the message points to a site hosting the a cocktail of browser and application exploits. On visiting the site, a silent drive-by install of malware is attempted on unpatched machines.
Removal -
A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.
Additional Windows ME/XP removal considerations
what is Sohanad.AE
Sohanad.AE is a worm. The worm will infect Windows systems and spreads through Yahoo! Messenger, a popular instant messaging application.
The worm arrives as a downloaded file via Yahoo! Messenger.
Upon execution, this worm copies itself as SVHOST32.EXE and SVHOST.EXE in the Windows folder.
The worm modifies registry at the following location to load itself during each startup.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
It also creates the following registry keys to modify the settings of Yahoo! Messenger.
HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_buzz
HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_Launchcast
The worm also modifies the registry to disable Registry Editor and Task Manager.
It also changes the Internet Explorer (IE) home page to;
http://(BLOCKED)coolpics.net
This worm propagates via Yahoo! Messenger by sending an instant message to all the contacts of an active user. This message contains a link to a remote copy of itself. When the recipient clicks the link, a copy of this worm is downloaded and executed on the recipients' system.
The details of the message sent out by this worm are;
Do you realize who is in this image: http://{BLOCKED}coolpics.net/who.jpg . Just think for a moment and tell me soon ;)) :D who is beside you in this pic http://thecoolpics.net/friendpic1.jpg so good-looking :( the page cannot be displayed http://{BLOCKED}coolpics.net/error.jpg Something was wrong !!! Check it again and tell me later. THanks Images shot in Iraq _ The war will never end http://{BLOCKED}coolpics.net/Iraqwar.jpg << :( Miss World 2006: http://{BLOCKED}coolpics.net/MissWorld.jpg !! << oh my god , i've won a 20000 usd lottery :O http://{BLOCKED}coolpics.net/mylottery.jpg <<
It also attempts to connect to the following website to download and execute some malicious files.
http://{BLOCKED}vey-sales.com/ipn/transactions/en.exe
http://{BLOCKED}vey-sales.com/ipn/transactions/link-en.exe
The worm tries to terminate some of the security related processes.
Nhatquanglan Virus?
A Nhatquanglan Virus?
Sit along with me as you discover what are the three files that make up a Nhatquanglan virus infection and how you can protect yourself from a possible threat to your personal security. A Nhatquanglan Virus is a really annoying virus that takes away your power over your PC by blocking important programs from running.
It disguises itself as a folder but is actually a program that sends out your personal information over the internet for everyone to see. You may or may not have a Nhatquanglan virus on your PC yet, but to be safe, it would be wise for you to discover how it can affect you and ways on how to protect yourself.
When you forgot to take care, below are just some of the ways this virus can affect you.
Nhatquanglan Virus blocks Device Manager
Device Manager is the page where you manage everything that is connected to your PC. This includes hard disk drives, modems, printers, monitors - you name it, it’s there. You use this to replace old software that makes a particular computer part work, or to change hardware settings, add a new piece of hardware, or to stop it from working completely and more.
Aside from this, Device Manager is usually the place where tech support tells their clients to go when dealing with problems with their PC’s. When you are infected by a Nhatquanglan virus, all your power to change the settings of the peripherals on your PC is gone. Now, when a modem does not work, you cannot check what is wrong with it - and you can’t connect to the internet either.
Nhatquanglan Virus and Task Manager
Aside from not letting you use your PC’s Device Manager, there are other ways that this virus can give you a hard day. When your PC is infected with a Nhatquanglan virus, and a program that you are using has crashed or hanged, you no longer have the power to “kill” the offending program because the Nhatquanglan will not let you use Task Manager - one of the useful tools included with your Windows installation.
Because you cannot use Windows Task Manager, you cannot lock your PC everytime you take a break - making it possible for everyone to look at what you are doing. There are other ways that a Nhatquanglan virus can give you a bad day and some of it, you might not want to know.
Let’s not talk about how annoying a Nhatquanglan virus is anymore - I think you already have an idea. If you want more, here is a list of annoyances it can give you - or you can just say goodbye to these problems by getting rid of a Nhatquanglan virus right now.
- It does not allow you to run Regedit to change Windows XP registry settings.
- It will not allow you to run the Command Prompt, where some of the more important Windows XP commands can only be used.
- It will not allow you to change File Type Extensions. Too bad, you can use this tweak to make Microsoft Excel 2007 start faster.
- You cannot change a folder to be hidden or not - you just cannot do that because it takes away the Folder Options.
- It can infect other PCs as well - annoying if you are on a network. It can also transfer itself to thumb drives (Ipods, Flash disks, etc).
Nhatquanglan Virus Files
There are files that you need to remove for you to get rid of a Nhatquanglan virus infection. And they are:
- blastclnnn.exe
- scvshosts.exe
- hinhem.scr
- New Folder.exe
Did you know that you can do a simple test to see if your PC is infected with a Nhatquanglan virus? And as you go along reading this article, you’ll find out for yourself.
For you to be protected, I believe that it is important that you know more about this virus - this will give you the necessary information you need in case you or your friend do get infected.
You have already discovered how a Nhatquanglan virus can annoy you. Now discover how this virus works…
How A Nhatquanglan Virus Ruins Your Day
The Nhatquanglan disguises itself as a folder inside the folder that it has infected. Too confusing? Let me put it this way: Suppose you have a folder named CLEAN. The virus will make copies of itself on the CLEAN folder using CLEAN as its name. Now, you have a program named CLEAN on the CLEAN folder.
Here’s a tip: To tell if it’s a program and not a real folder, hover your mouse over it and look at the tool tip that pops up.
If it’s a real folder, it must not show the word “File Version:” If it does, do not open or double click it!! That might be a Nhatquanglan virus!
Nhatquanglan Virus Removal Instructions
What I am about to reveal to you is how I got rid of a Nhatquanglan infection using only one free tool that you can download over the Internet.
This fix worked for me but yours may vary - use the guide I am about to give at your own risk. Or, avail of those software that scans your PC for viruses and have it scanned for you.
To start, you need to have a copy of ComboFix saved on your PC. ComboFix scans your drive for possible infections and tries to delete the three hidden files that the Nhatquanglan uses to make copies of itself. ComboFix is a free tool.
Avail of your copy and save it on your hard drive and remember where you saved it. For this guide, I am assuming that you have saved it on the C:\ drive.
Restart your PC in Safe Mode. You do this by pressing the F5 key when your pc starts. You need to use Safe Mode with Command Prompt. Don’t mind the list of files that Windows Xp loads as it starts.
Now, while at the Command Prompt, you need to use the ComboFix program by typing (without the quotes): “combofix”And hitting the Enter key.ComboFix will now do its job - scanning your PC for Nhatquanglan infections. Just follow what ComboFix says. After it finishes, the file which shows you what ComboFix had done will open up.
You may read it if you like, but most of them are jargons. Hopefully, Combofix has cleaned your PC of a Nhatquanglan virus infection - but to be sure you need to do some last minute cleaning.
I’ll reveal to you what you should do…
Go to the Command Prompt and do the following (without the quotes), hitting the Enter key after each command:
“cd \”
“del c:\windows\system32\scvshosts.exe”
“del c:\windows\system32\blastclnnn.exe”
“del c:\windows\hinhem.scr”
What you just did is deleted the three Nhatquanglan files. Take note of the spelling specially scvshosts.exe. This is different from svchost.exe which is an important Windows XP file!
You also need to remove a task that is scheduled by the Nhatquanglan virus. This virus adds one task to the Task Scheduler - so everytime you open up your PC, it executes this task, which is to make copies of itself. This is how it manages to appear again and again even if you managed to delete the three nhatquanglan files: scvshosts.exe, blastclnnn.exe and hinhem.scr. To remove the scheduled task, you need to take a peek at the lists. You do this by going to the Command Prompt and typing the following command (without the quotes):
“cd \”
“cd windows\tasks”
“del *.job”
Note: The last command above deletes everything in the Windows\Tasks folder. If you have tasks scheduled and you do not want them to be deleted, you need to manually check each one. A scheduled task that has scvshosts.exe as the program to be performed, needs to be deleted.
When all is ok, you may now restart your PC. Hopefully, you can now use the Task Manager, Device Manager, Folder Options and other commands in Windows XP. Remember the trick I told you about on how to see if there is a Nhatquanglan virus on your PC? I’ll reveal it to you now…
As a preventive measure, you might want to change how your files show when you explore them on your PC. Set them to Details.
That’s all there is to it. Now, when you glance at the folder name, also take a look at its Type column. If the picture of the folder is a folder but under the Type column it reads Application, you might want to reconsider opening it. It might be a virus… just waiting to pounce on you.
Tips On How to Prevent Future Virus Infections
After you have successfully removed a Nhatquanglan virus infection, it would be wise to take extra measures to prevent this virus from infecting your PC again. A simple change in surfing habits - such as looking out for suspicious sites, can dramatically decrease your chance of getting one of these viruses.
A Nhatquanglan virus can also spread itself via your thumb drive such as an Apple Ipod, etc. Speaking from experience, I would recommend that you install reliable software that monitors and protects your PC from viruses.
Your best bet would be an anti-virus and a firewall. The anti-virus is to help detect a virus as it moves, giving you the option to delete it or put it in a quarantine so it won’t infect other files.
A firewall blocks suspicious incoming connections to your PC - pretty much how a Nhatquanglan managed to infect your PC. Having a copy of an anti-spyware/malware can also help a lot.
Subscribe to:
Posts (Atom)