How to remove W32.Sality.AE

For remove W32.Sality.AE virus,please clean/delete all W32.Sality.AE infected files and Delete/Modify any values W32.Sality.AE added to the registry as following:
When the virus is executed, it copies itself as the following file:
%System%\drivers\[RANDOM FILE NAME].sys

The virus creates the following mutex so only one instance of the virus is running:
Op1mutx9

It then creates the following registry subkeys:

• HKEY_CURRENT_USER\Software\[USER NAME]914
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WMI_MFC_TPSHOKER_80
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPFILTERDRIVER

It then creates the following registry entry so that it bypasses the Windows Firewall:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"[INFECTED FILE]" = "[INFECTED FILE]:*:Enabled:ipsec"

It modifies the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Setting\"GlobalUserOffline" = "0"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\"EnableLUA" = "0"

The virus also deletes entries in the following registry subkeys:

• HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

It then registers itself as a new service with the following characteristics:
Service Name: WMI_MFC_TPSHOKER_80
Display Name: WMI_MFC_TPSHOKER_80
Startup Type: Automatic

It then deletes itself.

For futher info Read More

What is W32.Sality.AB?

What is W32.Sality.AB?

W32.Sality.AB is a virus that multiplies itself by infecting executable files.

What is Virus.Virut.r?

Virus.Virut.r is a dangerous computer virus that delivers itself through peer-to-peer file sharing networks, IRC, and over network shares. Once placed on your machine, Virus.Virut.r will remain active in your computer memory and will try to infect any .exe or .scr files that are found on your computer. Virus.Virut.r is also reported to control your computer and perform illegal botnet attacks. Virus.Virut.r shouldn’t remain on your PC and is advised to be removed.

What is Virus.Virut.ak?

Virus.Virut.ak is a dangerous virus that is designed to propagate through P2P (peer-to-peer) file sharing programs, IRC and other network shares. After the execution, Virus.Virut.ak will hide deeply in the system and will attempt to infect all .exe and .scr files. Moreover, Virus.Virut.ak includes backdoor capabilities and has the ability to open up large browser security holes through which a remote attacker may gain full access to your PC and all the stored onto it. We recommend to remove Virus.Virut.ak as soon as it has been detected.

What is Virus.Parite.b?

Virus.Parite.b is a virus program that does it bad actions in computer memory. Virus.Parite.b has two parts: dropper and infection components. Once executed, Virus.Parite.b will employ its dropper part and will place an infection in your temporary files folder. Virus.Parite.b is also capable to import and install additional malware onto your system.

What is Virus.Sality.U?

Virus.Sality.U is a virus that is distributed through infected email attachments. Once inside your machine, it will drop its infected files on your hard drive to start its malicious intentions. Additionally, Virus.Sality.U may embed into processes that are running on your computer. Virus.Sality.U comes with a keylogger that gives access to an attacker to see all the data that was typed by providing a backdoor hole as well. Virus.Sality.U is a serious threat to the security and privacy of your personally indentifiable information. That‘s why removing Virus.Sality.U is a must do issue.

How to Remove Virus.Sality.U? Read More

Drives not opening by double clicking? :here is solution

Drives not opening automatically when double clicked is due to a trojan or virus having put an "autorun.inf" on all your drives. Even if you try to remove it by manually deleting from Windows, it still stays. To delete it, follow these steps :-

Go to Start --> Programs --> Accessories
Take Command prompt
or [ Start --> Run (or Win key + R) and type cmd ]

In the Command Prompt Window type the following commands

cd\
attrib autorun.inf -s -h -r
del autorun.inf

now autorun.inf in your root drive is removed. For deleting autorun.inf in other hard disk drives and usb removable drives or pen drives, type the following commands in the command prompt window itself :-

[drive letter]: ( if drive letter is D, then type D: )
attrib autorun.inf -s -h -r
del autorun.inf

Repeat the above step for all drives

For pen drives, Safely Remove pen drives and plug it again.
For HDD drives, Restart the computer.
Thats it. Your drives will open normally when double-clicked.

To avoid virus from entering your computer the next time you plug in a pen drive, hold 'Shift' while inserting the flash drive for 5 to 10 seconds to disable autoplay feature temporarily. Then using the above commands, delete autorun.inf from your pen drive.

You can also disable Autoplay feature as such from your computer by editing group policy in Windows XP Professional but I don't recommend it to beginning users or amateurs. To edit group policy, Go to Start --> Run and type gpedit.msc

Thank You

Error deleting file? : here is solution

Problem:If you try to delete a file that is write-protected or is currently in use by another user or application,Windows will not allow you to delete it.Access to the file can also be denied if you’re logged into the system with a restricted user account that does not have the necessary privileges to delete files.

Solution:Generally, all that is necessary to resolve this problem, provided you are logged into the system with sufficient privileges,is to shut down all running applications.Once the apps are closed, try deleting the file(s) again. We commonly see this error when doing routine maintenance on some of the systems in the lab.
The Windows TEMP folder usually contains files that can be safely deleted, but when applications are running, some files are placed in this folder and cannot be removed until the application is closed. Email clients and antivirus software are the most common culprits.

Thank You

Bad sectors found on Drive? : here is solution

Problem:The platters used in today’s hard drives are broken down into tracks and sectors. Each sector is a small portion of the drive where data is stored. Inevitably, some of these sectors become corrupt and can no longer be used. When a sector goes “bad” the data stored there is usually lost.

Solution:Disk diagnostic utilities,such as
Scandisk or Norton Disk Doctor,inspect a drive and will attempt to repair bad sectors.More often than not,however,that bad sector can no longer be used because it has become corrupted in some way.These diagnostic utilities will then mark that
bad sector as unusable,and the system will no longer attempt to write new data there. Most drive manufacturers also have free, downloadable.

Thank You

PC turning off automatically? : here is solution

Does your PC turns off while you are playing games or working on something? Here’s what might be wrong.You need to make sure your system hardware such as RAM and CPU is capable of running the intensive software you are. The 512MB RAM you have is kinda small these days especially for the latest games.

Your computer’s power supply unit might be peaking and you may need another more powerful one to handle everything.

Your system might also be overheating when doing anything intensive for long periods so google cpu monitoring tools to download some software to check this. Anything over 50 or 60 degrees Celsius is probably getting too hot so you might need a better cooling solution or some thermal compound. Make sure the cpu is fitted properly too.

Make sure the graphic card is seated properly and all the pins are ok.

As always, make sure you have updated anti-virus and firewall software and run it regularly but maybe try turning these off when you are playing to see if this is an issue.

Thank You

Error copying file? : here is solution

Problem:A hard drive can only hold so much data. If you try to copy 2GB worth of files to a drive that only has 1GB of free space left, you’ll get this error.

Solution:In order to cram those new files onto your hard drive, you’ll have to free up some space. Before you begin uninstalling infrequently used applications, run Disk Cleanup (go to My Computer,right-click on your drive,select Properties from the menu, and then click the Disk Cleanup button) to free you drive of unnecessary temporary files, and compress files that you haven’t accessed in awhile.
You can also try clearing older System Restore points that won’t be used any longer (click on the More Options tab in the Disk Cleanup menu,and click on the Clean Up... button in the System Restore section).You’ll be surprised by the amount of space that you can free by doing these two steps if you’ve never used Windows Disk Cleanup feature before. If that doesn’t free up enough space, though, you can start uninstalling applications that you no longer need. Once you’ve you free up the necessary amount
of space, try copying the files again.

Thank You