How to remove Windows Viruses

How to Remove a Trojan Virus

2012-01-21T14:25:00.001-08:00

A Trojan virus is faulty computer program that can infect remote computers by changing the desktop or deleting important files. Generally called a Trojan Horse, it appears as a legitimate file or software from a trusted source, therefore tricking users into opening it or downloading it. Take action and protect your personal computer files by learning to delete this Trojan virus.

Instructions

Reboot your computer if you have a Mac. Do this by holding down the "Shift" key while the computer restarts itself.
Launch an antivirus program that you should have installed on your computer, such as Symantec's Norton or McAfee. Wait for the program's window to appear, then go to "Disk View." Highlight your computer, then select "Scan/Repair" so that the antivirus can detect the Trojan and trash it.
Exit the antivirus program on your Mac. Restart your computer again to ensure that the Trojan has been deleted. Empty the trash can on your computer once it is back up and running.
Disable the System Restore feature if you're a Windows user. Go to "Start" at the bottom of your screen, then right-click the "My Computer" icon to go to "Properties." Check "Turn off System Restore" under the System Restore tab in the "Properties" window, then select "Apply." Confirm that you want to disable System Restore by clicking "Yes" and "OK."
Update your virus definitions in your antivirus program. Open the program, or go to the website, to download the latest definitions so that you can receive the most recent alerts and keep your computer protected.
Scan your files to detect the Trojan file. Follow the instructions in your antivirus program to delete any suspicious files. You may want to write down the path and file name of the Trojan, which is usually found in the "C:\" hard drive. Then, edit your computer's backup registry by choosing "Start," then "Run." Type "regedit" in the window that appears and click "OK."
Search for the registry entry from which the Trojan derived, which may begin with "HKEY" followed by the file path. Delete the registry entry to ensure that the Trojan is removed. Exit the registry entry, and restart your computer so that the changes can take effect

Tips & Warnings

After you've removed the Trojan and restarted your computer, remember to turn the System Restore function back on. Follow Step 4, then uncheck "Turn off System Restore," then "Apply." Confirm that you want to turn on the feature, then hit "OK."

How to Remove AutoRun Viruses From Vista

2012-01-21T14:22:00.000-08:00

AutoPlay, a feature of Autorun, automatically reads the content of a USB drive upon inserting the removable media into the USB slot. Windows Vista will then, by default, launch any audio, video or setup files contained on the USB drive. Viruses and other malware exploit Autorun and AutoPlay to spread viruses contained on the USB drive and infect the hard drive of any computer that accesses the removable media's contents. However, you can use Command Prompt to manually remove Autorun viruses from Windows Vista.

Instructions

Log in to Windows as an administrator. Click "Start." Type "cmd" into the search prompt. Right-click "cmd.exe" from the results.
Click "Run as administrator." Click "Continue" or enter your password into the security pop-up to proceed.
Type "attrib -s -h -r c:\autorun.inf" and "attrib -s -h -r c:\ntdelect.com" into Command Prompt, pressing "Enter" after each.
Type "del c:\autorun.inf" and "del c:\ntdelect.com" into Command Prompt, pressing "Enter" after each line.
Type "attrib -s -h -r c:\windows\system32\kavo.exe" into Command Prompt. Press "Enter," then type "del c:\windows\system32\kavo.exe." Press "Enter" to delete "kavo.exe."
Type "Exit." Press "Enter." Click "Start." Type "regedit" into the search prompt. Right-click the result "regedit.exe." Click "Run as administrator."
Enter your password if necessary, or click "Continue." Navigate through "HKEY_LOCAL_MACHINE," "SOFTWARE," "Microsoft," "Windows" and "Current Version."
Click "Run." Select any in
Navigate through "HKEY_CURRENT_USER," "SOFTWARE," "Microsoft," "Windows" and "Current Version." Click "Run."
Select any instances of "kavo" or "kavo.exe." Press the "Del" key. Click "Yes." Restart your computer.

Tips & Warnings

Scan and remove any viruses from your USB drives before attempting to manually remove Autorun viruses in Vista.

After removing any traces of these viruses from your system, run your computer in Safe Mode and launch your antivirus software to search for any remaining Autorun malware that may be infecting your computer.

How to Remove a Genuine Virus in Windows

2012-01-21T14:18:00.001-08:00

The Windows Genuine Disadvantage virus is a particular pesky piece of malware that infects computers running Windows XP. When the virus infects your machine, it essentially makes Windows run as though it is not verified. When this virus first came into existence in 2006 it was a bothersome, almost crippling virus. However, with antivirus software always advancing, it is easy to remove this malware from your machine.

Instructions
Things You'll Need
Antivirus software

Download and install an antivirus program. Free antivirus programs are available from Malwarebytes, LavaSoft and Spybot, and most use similar installation processes. Double-click the .exe file, agree to the terms of service and click "Install."
Double-click the desktop icon of your antivirus software or select it from the Start menu. The first time your antivirus program boots, it will take a few moments for it to fully load.
Click the "Scan" button. Allow several minutes for your antivirus program to scan through your PC. When it is complete, you will get a list of "Quarantined" files.
Scroll through the Quarantine list to locate a file called "wgavn." Check the box next to it and click "Delete Quarantined Files" to remove it from your PC.

How to Remove a Virus From System Restore

2012-01-21T14:11:00.000-08:00

Windows System Restore is a feature that allows you to save a restore point of your computer's system files. This restore point can be used to roll back your computer's files to a working condition in case of a crash or file corruptions. However, if a virus has infected your system files, your restore point may be infected with the virus, too. The only way that you can completely remove the risk of this virus is by cleaning out your system restore points.

Instructions

Windows XP

Click on the Start button, right click on the "My Computer" icon and choose "Properties" from the drop-down menu. This will open the Systems Properties window.
Navigate to the "System Restore" tab.
Click the check box next to "Turn off System Restore" and the click "OK" button.
Choose "Yes" when prompted to confirm that you want to make this change.
Allow Windows to change the setting. When it is complete, the dialogue box will close. This will delete any infected system restore points and prevent Windows from making new infected restore points until you have cleaned the virus from your computer.

Windows Vista

Click the Start button, right-click on the "Computer" button and choose "Properties" from the drop-down menu. This will open up the Systems Properties window.
Click the "System Protection" option in the top left hand corner of the window. This will open the System Protection options window.
Remove the check next to your computer's hard drive from the drive select box.
Click the "Turn System Restore Off" button when prompted to make the change. This will delete any infected system restore points and prevent Windows from making new infected restore points until you have cleaned the virus from your computer.

Windows 7

Click on the Start button, right click on the "Computer" button and choose "Properties" from the drop-down menu. This will open the Systems Properties window.
Click the "System Protection" option in the top left hand corner of the window. This will open the System Protection options window.
Choose your computer's hard drive from the drive select and click the "Configure" button.
Click the option next to "Turn off system protection" under the Restore Settings then click the "OK" button. This will delete any infected system restore points and prevent Windows from making new infected restore points until you have cleaned the virus from your computer.

Tips & Warnings

Remember to turn System Restore back on once you have removed the virus from your computer.

How to Remove the Rundll32.exe Virus

2012-01-21T13:58:00.001-08:00

Rundll32.exe is a Windows operating system component responsible for running certain aspects of applications like Internet Explorer. However, Rundll32.exe is also the name of a virus. By impersonating legitimate software, the virus hopes to get you to delete an important file from your computer by mistake. For this reason, you should use a tool on your computer to remove the virus. It will delete the impostor and leave the real.

Instructions

Run Windows' Malware Removal Tool, a useful piece of software included on every Microsoft computer. Select the "Start" menu in the desktop's lower-left corner, choose "Run," type "MRT" and hit "Enter." If you encounter problems, download a replacement from Microsoft for free (see Resources section).
Click on the "Next" button.
Click on "Full Scan." The Full Scan offers a greater chance than the Quick Scan of removing the Rundll32.exe virus.
Click on the "Next" button to start the scan. It could take up to an hour.
Follow the steps that appear on screen to remove the Rundll32.exe virus.
Click on the "Finish" bu
Restart your computer.

How to Manually Remove a Virus Alert From the System Tray

2012-01-21T13:55:00.001-08:00

Computers provide much in terms of business and entertainment. Even so, they are susceptible to viruses. These viruses are programs that cause problems with the computer's operation. Sometimes viruses place false alerts in your computer system tray. These alerts look legitimate but aren't. They can interrupt your work by popping up repeatedly. To get rid of these virus alerts from the system tray in Windows 7, you'll need to remove the file that is generating the popups manually.

Instructions

Look at the popup's title. The title is usually associated closely with the name of the virus.
Open up any browser such as Mozilla Firefox. Search for the popup's title to identify the exact file name for the virus causing the popups. Viruses sometimes take control of browsing applications, so if this is the case on your computer, simply do your research on a friend's machine.
Press "Ctrl," "Shift" and "Esc" on your computer keyboard simultaneously to bring up Task Manager. Task Manager identifies all applications (including any viruses) that are running. Click the Processes tab and look through the list for the virus file. Select the file and click "End Process." Close the Task Manager window.
Click "Start." Type "msconfig" into the search box and press "Enter." Click the Startup tab. This brings up a list of items that are programmed to start with your computer. Look through the file paths under the Command column for anything resembling the name of the virus, including possible abbreviations. Write down the entire file path for each file you find that is associated with the virus so you can remember where they are on your computer. Deselect these virus files so they don't start back up. Click "Apply" and then click "OK" to exit the msconfig program. Reboot if you were unable to stop the virus program through Task Manager.
Click the "Start" menu and choose "Computer." Navigate through the Explorer window to the location of the virus file. Select the file, right-click and choose "Delete." Click "OK" when the computer asks you to verify whether you want the file moved to the Recycle Bin.
Select the Recycle Bin icon on the desktop. Right-click and choose "Empty Recycle Bin." Proceed to Step 7 if this does not get rid of the virus.
Click "Start" and select "Control Panel." Click "Programs." Choose "Uninstall a Program." Select the vi

Tips & Warnings

Some viruses won't allow you into "Task Manager". If this is the case, you'll need to restart your computer in Safe Mode. To do this, shut down your computer, press the "Power" button as normal to boot, and then press "F8" on your keyboard repeatedly. Then use the up and down arrows on your keyboard to select "Safe Mode" or "Safe Mode With Networking." Then proceed with the usual virus removal steps. You must have the name of the virus file before you boot this way.

How to Remove MBR Viruses

2012-01-21T13:53:00.001-08:00

The first sector of a hard drive or disk is the Master Boot Record (MBR). The MBR has the data your computer requires regarding the partition sizes of the hard drive as well as the operating system partition information. When a computer driven by MS-DOS is started, operating system support files are searched for upon booting, and then the Master Boot Record is loaded into the computer's memory. The MBR then continues to load the next operating system support file, which loads the computer's operating system. MBR viruses infect the boot sector, which allow them to avoid detection by your computer's anti-virus system and can continue to spread through copying themselves to new floppy disks inserted into the computer, or through other computer files. Use of updated anti-virus programs is the easiest means to remove a MBR virus from a Windows computer.

Instructions

Download a anti-virus program if you do not have one installed on your computer. If you do, update the anti-virus definitions by selecting the "Update virus definitions" from your anti-virus program main menu.
Restart your computer in Windows safe mode by depressing the "F8" keyboard function key during the rebooting process. The MBR virus will be activated one more time by rebooting, but restarting in Windows safe mode will permit the anti-virus program to fully remove the MBR virus from all drive labels.
Run a complete virus scan of the infected drive with your anti-virus program by selecting "Scan local drives" menu option from your anti-virus menu.
Select "Delete or repair infected files" menu option after the anti-virus scan is complete. Then, reboot your computer normally and the MBR virus should now be removed.

How to Remove a Hotmail Virus

2012-01-21T13:49:00.001-08:00

The Hotmail virus, also known as Hotmail Hacker, is a malicious program designed to steal your passwords. The Hotmail virus has the ability to steal your Hotmail or MSN Messenger password. This allows a remote hacker to view your personal information, which might include online banking passwords, credit card numbers and personal messages. If your computer is infected with the Hotmail virus, you will want to remove it immediately. You can do so manually using utilities available on the Windows Vista or Windows 7 operating systems.

Instructions

Press "Ctrl," "Alt" and "Delete" simultaneously and click "Start Task Manager." The Task Manager opens.
Click "Show Processes From All Users."
Right-click "hotmailhack.exe" (located under the "Image Name" heading) and select "End Process" from the context menu that appears.
Close the Task Manager.
Click "Start" and type "hotmailhack.exe" into the Search box.
Right-click "hotmailhack.exe" (located in the "Results List") and select "Delete" from the context menu that appears.
Restart your computer.

How to Delete Iexplore.exe Virus

2012-01-21T13:48:00.001-08:00

The iexplorer.exe is a file used by the Windows operating system to help run Internet Explorer. However, if the file has become corrupt or taken over by a malware file, you need to correct this issue by stopping the file from running on the computer system. This is because the file begins to slow down the entire computer system. This process is a relatively quick procedure.

Instructions

Hold down "ctrl," "alt" and "delete," then look through all the processes running in the Windows Task Manager. If you see iexplore.exe, select it and click "Remove."
Exit Windows Task Manager, then click "Start" and "Run." If using a Windows Vista or Windows 7 operating system, hold down the "Windows" button and "R" to launch the "Run" window.
Type in "MSCONFIG" and click "OK." Deselect the "Load Startup Items" from the menu, then click "OK" and restart the computer.
Click "Start," "(My) Computer" and double-click the "C:" folder. From here choose "Program Files," then "Internet Explorer." Look through the Internet Explorer window for "iexplore.exe." Right-click the file listing and press "Delete" to delete the file from the computer.

How to Remove Rootkit Virus from Windows XP

2012-01-21T13:46:00.000-08:00

Rootkit is a type of malware. Malware, although technically different than a virus, is just as undesirable for your computer. Rootkit can corrupt your system tools and libraries needed to run Windows programs. They can usually be detected by a signature or heuristics-based anti-virus program. Unless you can discover the specific Rootkit and manually remove it, the only sure-fire way to completely eliminate a Rootkit Virus is to back up all of your important data and reinstall Windows.
Instruction

Save all your important files to a separate medium other than your infected computer.
Insert your Windows install disk in your CD or DVD drive and power off your system.
Turn your computer on. Press any key while your computer begins loading to boot from the CD you inserted. Press "Enter" at the "Welcome to Setup" screen.
Read the Licensing Agreement. Press "F8" to state that you accept the terms and wish to continue.
Select "Format the partition using the NTFS file system" from the next screen.
Give your computer time to completely reformat the hard drive and begin installing Windows. Your computer will restart itself when this process is complete. Windows will now install a fresh copy.
Select your language and regional information when prompted.
Enter your name and organization on the "Personalize Your Software" page. If you don't have an organization, leave this space blank. Click "Next" to continue.
Enter your 25-character Windows XP Product Key, printed on the sleeve of the Windows XP disk you inserted in your computer in Step 2. It may also be on the back or side of your computer itself. Click "Next" to continue.
Enter all required information in the screens that follow. Make sure you register with Microsoft when prompted. This is where your product key will be crucial to complete your working copy of Windows XP.
Click "Finish" when you reach the "Thank You" page. Your installation of Windows XP is complete and the Rootkit virus has been totally removed

Tips & Warnings
Make sure you have a decent anti-virus program that you keep updated regularly to help prevent future infection.

Never throw away any system disks or their sleeves that come with your computer. You never know when you may have to reinstall, and you'll always want the original product keys.

How to Remove a Svchost Virus

2012-01-21T13:41:00.001-08:00

The Microsoft Windows operating system needs the Svchost.exe process to maintain stability because it is used by the system to launch programs. The actual svchost virus is a virus designed to confuse the user by naming itself scvhost.exe. Upon initial viewing, the user will think that this virus is the real Svchost.exe process, and therefore not shut it down and allow it to run. The scvhost.exe virus is designed to take personal information from your system such as passwords, for example. Microsoft provides a way to remove this virus with a tool in its Windows XP operating system. For Windows 7, you can download the tool. This tool is known as the “Microsoft Malicious Software Removal Tool.”

Instructions

Windows XP

Click the "Start" button, which is found in the lower left corner of the desktop.
Click on the "Run" icon and type in "MRT" (without quotes) into the “Run” text box. Click the "OK" button. Microsoft's Malicious Software Removal Tool prompt will appear.
Click on the "Next" button.
Set up the scan option by choosing "Full Scan." This option is longer than “quick scan,” but it thoroughly scans all parts of your system.
Click on the "Next" button. The tool will now scan your system for viruses.
Begin the virus removal. Follow the instructions in the tool wizard once the virus is located.
Click the "Finish" button to remove the Svchost virus from your computer.

Windows 7

Download the Malicious Software Removal Tool from the Microsoft download center. (See Resources.) Click on "Run" to immediately begin the software installation.
Click on "I Accept" to complete the tool installation. Click on "Next" and select the “Full Scan” option to initialize the scan.
Click on the "View detailed results of the scan" link after the scan to see what type of malicious software was discovered by the tool.
Click on the "Finish" button to complete the malicious software removal. Afterward, reboot your system.

How to Remove the RPC Virus From Vista X64

2012-01-21T13:34:00.000-08:00

The Remote Procedure Call (RPC) virus, which is also known as MSBlast or the Blaster virus, is a worm program that propagates itself across the Internet by infecting unprotected computers. If your computer has been infected, you may experience frequent system crashes or be completely unable to access any website. To remove the virus in the Windows Vista operating system you will need to change a system setting and then download a removal tool from Microsoft.

Instructions

Turn off your computer completely. Prevent your computer from accessing the Internet by unplugging the Ethernet cable running either from your modem or your router to your PC. Unplug your router's power cord and Ethernet cable if you are using a wireless router and have a wireless card in your computer.
Turn your computer back on and wait for the operating system to finish loading. Open the "Start" menu by clicking on the Windows icon in the lower left corner of the desktop. Click on the "Control Panel" button.
Scroll down through the list of options and click on the icon labeled "Administrative Tools." Find the entry labeled "Services" and click on it. Click on the "Continue" button when a second window appears asking if you want to proceed.
Right-click the entry named "Remote Procedure Call" and then choose the "Properties" option. Navigate to the "Recovery" tab and find the heading labeled "First Failure." Click on the "Take No Action" box.
Reconnect your computer's Internet connection cable and then restart the machine. Open your web browser and navigate to the Microsoft support website (see Resources). Download the malicious-software removal tool that is compatible with the x64 version of the Windows Vista operating system.
Restart the computer and press the "F8" key on your keyboard as soon as you see the logo for your computer's manufacturer. Scroll down through the list of options that appears and highlight "Safe Mode." Hit the "Enter" key. Wait for the operating system to finish loading.
Navigate to the folder were you saved the malicious-software removal tool. Double-click on the file and follow the instructions on the screen to remove the RPC virus. Restart the computer to finish the removal process.

Tips & Warnings
You can prevent your computer from getting infected by malicious software like the RPC virus by using a firewall and installing an anti-virus program (see Resources).

How to Manually Remove the SIRCAM Worm Virus

2012-01-21T13:30:00.001-08:00

The Sircam virus is a malicious worm created in Delphi that spreads through email and shared network drives. The worm then sends copies of itself to all the email addresses listed in the infected computer’s address book and in temporary Internet cached files. The infected email messages have a random subject line and an attachment with the same name. Read on to learn how to remove the SIRCAM worm virus.

Instructions

Manually Remove the SIRCAM Worm Virus

Disconnect your computer from any local area network. This is important because the Sircam virus can spread through shared network drives.
Rename regedit.exe to regedit.com. Open the Search function in the Start menu to find regedit.exe. Click on START and then click SEARCH. Perform a search for "regedit.exe" Right-click the file once you find it, and click on RENAME. Rename the file to "regedit.com."
Click on the START button in the bottom-left corner of your desktop. Click RUN in the Start menu. Type "regedit" and then click "OK." This will open the Registry Editor.
Use the plus signs to navigate to the following registry entry: HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\RunServices. Look in the right panel and locate the following registry value: "Driver32." Click on this value and delete it.
Navigate to the following registry entry: HKEY_LOCAL_MACHINE\Software\SirCam. Select SirCam. Click on this value and delete it.
Use the plus signs again to navigate to the following registry entry: HKEY+CLASSES_ROOT\exefile\shell\open\command. In the right-hand panel, right click the "DEFAULT" value and select MODIFY. Change "C:\Recycled\SirC32.exe""%1”%* to "%1" %*. This will remove remove “C:\Recycled\SirC32.exe”.
Click on the START button and then click RUN and type in "cmd." Go to the following system directory: C:\Windows\System or C:\Winnt\System32. *Type in ATTRIB -S -H -R SCAM32.EXE. This will unhide the Trojan horse. *Type in DEL SCAM32.EXE. This deletes the file.
Go to C:\Recycled folder. *Type in ATTRIB -S -H -R SIRC32.EXE. *Type in DEL SIRC32.EXE. This will delete the Trojan file
Remove all References from AUTOEXEC.BAT: Use the Search function to look for autoexec.bat. Open the file and remove the following string: "@win \recycled\Sirc32.exe"

Restore the RUNDLL32.EXE File

Do a search for run32.exe in the Windows folder.
Rename this file to rundll32.exe once you find it. (If it is not found, then it means that the worm didn't overwrite the RUNDLL32.EXE)
Reboot your computer after you have completed all of these steps.
Run an up-to-date antivirus program to make sure your computer has been completely cleaned of the SIRCAM virus.

Tips & Warnings

The SIRCAM worm is also called I-Worm.SirCam, W32.Sircam, TROJ_SCAM.A and SCAM.A

How to Remove a Music Virus

2012-01-21T13:26:00.001-08:00

If you are having trouble playing some or all of your music files, your computer may be infected with one of the wide array of viruses that go after music files, folders and applications. Moreover, that same virus could be causing internal damage you aren't even aware of. It's difficult to pinpoint the specific virus affecting your music but Microsoft includes a virus protection tool with Windows that will get your music playing again and protect your PC from further damage.

Instruction

Run Microsoft's Malicious Software Removal Tool. Select "Run" from your "Start" menu and type "MRT." This application comes preinstalled with Windows 7, Windows Vista, Windows XP, Windows 2000 and Windows Server 2003 computers. If the virus is preventing you from accessing the "Run" function, download a new copy of the program from the link in Resources.
Click "Next."
Select "Full Scan." While this takes longer than the default "Quick Scan," it presents a higher likelihood of removing a music virus.
Click "Next." Wait for the tool to finish the scan.
Follow the prompts that appear to remove any viruses or bugs that could be affecting music on your computer.
Click "Finish."
Restart your computer

Tips & Warnings

If you are only having problems with a single music file, the above method may solve your problem. However, there is a chance the issue is not a virus at all but rather corruption of the file itself. In this case, you will have to contact the original source of the file for a replacement.

How to Manually Remove Win32.Brontok Virus

2012-01-21T13:20:00.000-08:00

The Win32.Brontok virus, also known as Win32.Brontok.ao, disguises itself as an antisoftware program. The fake antisoftware program notifies you that your computer is infected with Win32.Brontok and that you must supply certain financial information in order to download the program necessary to remove the infection. This is simply an attempt to procure your financial information and download additional viruses onto your computer. In addition, the Win32.Brontok virus will slow your computer, flood it with popup advertisements, create new shortcuts, and alter your desktop.

Instructions

End Infected Processes

Press Ctrl + Alt + Delete.
Click on \"Task Manager.\"
Click the \"Processes\" tab.
Right-click on \"Zinaps7.exe,\" and select \"End Process.\"

Delete Infected Files

Click on the \"Start\" menu.
Select \"Search Files and Folders.\"
Search for and delete the following files. To delete a file, simply right-click on it and select \"Delete\": \"UserProfile\\Application Data\\Zinaps7\\settings.ini\" \"UserProfile\\Start Menu\\Programs\\Zinaps7\\Uninstall Zinaps Anti-Spyware 7.0.lnk\" \"UserProfile\\Start Menu\\Programs\\Zinaps7\\Zinaps Anti-Spyware 7.0.lnk\"

Delete Infected Registry Keys

Click the \"Start\" menu.
Select \"Run.\"
Type \"regedit\" into the open box and click \"OK.\" This will open the Registry Editor window.
Find the following registry key in the left pane of the Registry Editor and delete it. To delete the registry key, simply right-click on it and select \"Delete\": \"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\run Zinap\"

How to Remove Windows Virus Scan Malware

2012-01-21T13:09:00.001-08:00

Malware often comes disguised as antivirus software, claiming to offer a free Windows virus scan. However, this is really just deceitful marketing. Running one of these scans will find all sorts of “viruses” the scan will offer to remove--for a price, of course. The only malware on your computer is the bug popping up the Windows virus scan ads itself. Remove it with a tool already on your computer, with which you can run a real scan.

Instruction

Launch Windows Defender. This tool comes included on any PC running either Windows 7 or Windows Vista. To locate it, type "Windows Defender" into the Start menu search bar, then hit the "Enter" key. Though Windows XP does not include the tool, XP users can download a compatible version from Microsoft Security (see Resources).
Click once on the arrow next to the “Scan” button. Select the "Full Scan" from the menu that appears.
Click the “Scan” button.
Wait for the full scan to finish. When it does, click "Clean System" or “Repair” to remove the Windows virus scan malware.
Restart your computer.

How to Remove The Win HDD Virus in Windows 7

2012-01-21T13:04:00.000-08:00

The Win HDD virus affects your computer through a Trojan horse. Your Windows 7 system becomes infected when you unsuspectingly click a link that carries the Win HDD virus. The Win HDD virus infects your Windows 7 computer by acting like a security application and scanning your computer. The virus diagnoses your Windows 7 system with false "critical errors" in order to scam you into typing in your credit card information. The virus may prevent you from accessing the Internet. To remove the Win HDD virus from your computer, you will need restore your Windows 7 system to a date before the virus affected your computer.

Instructions

Save any unsaved work, if you can. As soon as you notice a problem with your Windows 7-based computer, save all your work and close out your programs to prevent the Win HDD virus from causing you to lose any data from an unexpected shut down.
Power off your computer. If the Win HDD virus is not allowing you to shut off your Windows 7 computer through the start-up menu, hold down the power button for a few seconds until the computer completely turns off.
Turn on your computer and press and hold the "F8" key before the Windows logo appears. A System Restore screen will appear after a few seconds.
Move the arrow keys to select your advanced boot options. Highlight "Repair your computer" and press "Enter."
Select your keyboard layout from the drop-down menu. For example, a U.S.-based Windows 7 user would select "US."
Select your username from the drop-down menu and type in your password. Once you have been verified, a dialog box of system recovery options will pop up.
Choose "System Restore" from the list of recovery options.
Confirm a restore point. Windows 7 will provide a list of date options to which you may restore your PC. You should select a point before you know the virus affected your Windows 7 system. For example, if your Windows 7-based computer was infected on Dec. 6, restore your computer to Dec. 5. If you are unsure, it is typically best to go back three days so you will not lose many system settings by choosing too early a restore point. It is not likely you had the Win HDD virus without noticing it for more than this amount of time.
Wait while your computer restores. This may take several minutes. Once your computer starts up, a dialog box will tell you the system restore has completed. You will now be able to use Windows 7 as if it were never infected with the Win HDD virus.

Tips & Warnings

When choosing System Restore, you will not lose any personal files saved after the restore point, but you will lose any settings (such as desktop background) and programs installed or downloaded. If Windows 7 ran any updates after the restore point, they will be lost too and simply re-updated the next time you restart Windows 7.

How to Stop Spyware Pop-Ups

2012-01-19T17:00:00.000-08:00

Stop Spyware Pop-Ups

There are different types of pop-ups. Some are legitimate warnings or errors, which Windows or programs such as your antivirus software use to make you aware of a problem. Other times, a new window might open when you click on a link. These types of pop-ups are safe and helpful. However, if your computer is infected with spyware, you might start seeing pop-ups that are annoying, inappropriate or even harmful. Fortunately, you can block them.

Instructions

Things You'll Need

Internet Explorer
Windows Defender

1 Open "Internet Explorer" by double clicking the blue lower case "e" icon on your desktop. Click "Tools" in Internet Explorer's toolbar.

2 Point to "Pop-Up Blocker" and click "Turn On Pop-Up Blocker." A message may appear that asks, "Are you sure you want to turn on Internet Explorer's pop-up blocker?" Click "Yes."

3 Install "Windows Defender." This free application from Microsoft will stop pop-ups and block spyware from getting to your system (see Resources).

4 Update your Windows operating system regularly. Go to the "Start" menu, click on "All Programs" and then click "Windows Updates." On the Windows Updates website, opt to allow your computer to update automatically so that your computer will have advanced protection from spyware pop-ups.

5 Download a spyware removal program, such as "Ad-Aware" (see Resources). Scan your computer to remove any spyware currently causing pop-ups and other problems on your computer. Scan your system two to four times every month for best results.

How to Remove Spyware Tracking Cookies

2012-01-19T16:31:00.000-08:00

Everybody--besides the creators and beneficiaries of spyware--hates spyware. It disrupts everything you try to do online from the very beginning when you open your web browser. To avoid the malware-ridden pop-ups and infected web pages, you have to get rid of the spyware tracking cookies that are ruining your Internet experience. This article will show you how.
Instructions

Deleting Spyware Tracking Cookies by Deleting All Cookies on Your Computer

1 There are two ways to get rid of spyware tracking cookies. You can delete all the cookies off your computer or you can find and delete the spyware tracking cookies and leave the rest. To delete all the cookies, open Internet Explorer.

2 Click on "Tools," and a drop-down menu will appear. Either click on "Delete Browsing History" or click on "Internet Options" (this is the long way).

3 In the "Delete Browsing History" folder, click on "Delete Cookies." You'll be asked "Are you sure you want to delete all cookies in the Temporary Internet Files folder?" Click on the box that says "Yes." All the cookies will be deleted from your computer.

4 Close the "Delete Browsing History" folder.

5 Close and reopen Internet Explorer and make sure the spyware isn't still sending you to infected web pages and causing pop-ups to appear on your computer. If it isn't, you've successfully cleared your computer of spyware tracking cookies.

Deleting Individual Spyware Tracking Cookies from Your Computer

1 Open Internet Explorer and click on "Tools."

2 In the "Tools" folder, go to "Browsing History" and click on the box that says "Settings."

3 In the "Settings" folder, click on "View Files."

4 Locate the cookies that belong to the spyware website that's causing you problems. Right-click on it, and a drop-down menu will appear. Click on "Delete" and the cookies will be deleted from your computer.

How to Check CPU Temperatures With Windows 7

2012-01-19T16:27:00.000-08:00

Too much heat can kill your computer. Unless your computer enclosure is made of glass or see-through plastic, it is hard to tell what is going on inside the case. Since you usually cannot see inside the case, you might not be aware if the processor fan is underperforming or not spinning at all. Over time, an overheated processor can fail or cause damage to other components in your PC. Therefore, to ensure your CPU is not overheating, you should install a CPU temperature monitoring utility.
Instructions

Install Window 7 Gadget

1 Navigate to the Windows Live Gallery page for Core Temp Gadget. Click the "Download" button.

2 Review the confirmation message click "Install."

3 Enable the "Open with Windows Desktop Gadget (default)" option. Click the "OK" button.

4 Click the "Install" button in the "Desktop Gadgets -- Security Warning" window. Wait while Windows installs the gadget on your desktop.

5 Click the "Get Core Temp" link in the "Core Temp" gadget window on the desktop. A new browser tab opens and directs you to the "Core Temp" website.

6 Click the "Download Installer" link. Download and save the file to your computer. Double-click the downloaded file to launch the installer. Click the "Next" button. Accept the License Agreement and click "Next." Follow the remaining prompts to install Core Temp on your computer. Click "Finish" when prompted.

7 Launch Core Temp on your computer. Click the "-" button in the upper-right hand corner of the program window to minimize the application to the system tray. The Core Temp gadget monitors the temperature of the CPU and displays current readings on the screen. If you have a multi-core processor, the gadget monitors and displays temperature settings for all cores inside the CPU.

CPUID HW Monitor

1 Navigate to the CPUID website and download HWMonitor. Save the file to your computer.

2 Double-click the file to launch the Setup Wizard. Accept the terms and conditions of the License Agreement and click "Next." Accept the default installation parameters for the application and click "Next."

3 Wait for the Setup Wizard to install HWMonitor on your computer. Click "Finish" when prompted.

4 Launch HWMonitor on your computer. Double-click the computer icon under the "Sensor" label to expand the display. Click the "+" link next to the "Temperature" label. Review the temperature readings for your CPU.

5 Minimize the application to the system tray. Click the "Lightning Bolt" icon in the system tray to maximize the application window and review current CPU temperature readings.

Install Application from Motherboard Manufacturer

1 Browse to the support website of the company that makes your computer's motherboard. Click the "Support," "Downloads," "Drivers" or other similarly named link.

2 Browse the free downloads section of the site and download a monitoring utility for your motherboard. Major motherboard manufacturers such as ASUS, Gigabyte, Intel and MSI provide monitoring utilities that allow you to monitor CPU temperatures and other important settings.

3 Download the monitoring utility and save it to your computer. Open the installer file and follow the on-screen prompts to install the monitoring utility on your computer. Reboot the PC if prompted to do so.

4 Open the monitoring utility on your PC to check the CPU's current temperature reading.

How to Remove Windows PC Defender Virus

2012-01-16T20:35:00.001-08:00

Windows PC Defender looks identical to an anti-virus or anti-spyware software, but it is actually a virus. Windows PC Defender pretends to scan the computer for infections, displays a fake results log, then demands you to purchase the full program to fix the "detected" viruses. Although the program claims to be an anti-virus program, it actually blocks real anti-virus programs from removing Windows PC Defender. If your PC is infected with the Windows PC Defender virus, but you can't run your anti-virus or anti-malware software, you can remove the infection manually.
Instructions

1 Turn on or restart the computer and press F8 on the boot screen to open the Windows Advanced Boot Options menu. Scroll to "Safe Mode" and press Enter.

2 Sign in to Windows. Hold down Ctrl, Shift and Esc to open Windows Task Manager. Click the "Processes" tab.

3 Click "Image Name" to alphabetize the processes. Right-click "eb.exe." Select "End Process" from the menu. Click "End Process" again.

4 Repeat the above step for fix.exe, ppal.exe and WP345d.exe.

5 Click "File." Click "New Task" to open the "Run" window. Input "cmd" and press Enter.

6 Input "cd c:\windows\system32" into the command-line prompt. Press Enter. Type "regsvr32 -u mozcrt19.dll" and press Enter to unregister the Windows PC Defender DLL.

7 Repeat the process for sqlite3.dll, cid.dll and ddv.dll. Type "cd %userprofile%\recent" into the Command Prompt and press Enter. Unregister tempdoc.dll. Close the Command Prompt.

8 Reopen the "Run" box. Type in "regedit" or "regedit.exe." Press Enter to open Windows Registry Editor.

9 Go through "HKEY_CLASSES_ROOT" and "CLSID" pathes. Right-click "{3F2BBC05-40DF-11D2-9455-00104BC936FF}." Click "Delete." Click "Yes" to confirm.

10 Return to "HKEY_CLASSES_ROOT." Right-click "WP345d.DocHostUIHandler" and click "Delete." Click "Yes."

11 Go through "HKEY_USERS," then ".DEFAULT," then "Software," then "Microsoft" then "Internet Explorer." Click "SearchScopes."

12 Right-click "URL," which has the value of "http://search-gala.com/?&uid=201&q={searchTerms," and click "Delete." Click "Yes."

13 Return to "Internet Explorer." Right-click "PRS," which has the value of "http://127.0.0.1:27777/?inj=%ORIGINAL%." Click "Delete." Click "Yes."

14 Go to "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings." Find and delete "UID" with the "201" value.

15 Click "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform." Delete "89770891803."

16 Open "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run." Delete "Windows PC Defender."

17 Click "Start." Click "Computer." Enter "8424.mof" into the search bar and wait for the computer to locate the file. When the file appears in the results, right-click it, then click "Delete." Click "Yes."

18 Repeat the process for the following files associated with Windows PC Defender: exec.tmp, mozcrt19.dll, CLSV.tmp, fix.exe, search.xml, ddv.dll, eb.exe, sqlite3.dll, tempdoc.dll, WP345d.exe, runddlkey.drv, WPCD.ico, ppal.exe, wpcd.cfg, energy.sys, vd952342.bd, cookies.sqlite, Windows PC Defender.lnk, PE.drv, cid.dll, eb.sys, FS.drv, Instructions.ini, kernel32.drv and PE.tmp.

19 Go to "C:\Documents and Settings\All Users\Application Data." Delete the following folders: "3adffe," "WPCDSys" and "345d567."

20 Input "%userprofile%\application data" into the address bar and press Enter. Right-click "Windows PC Defender" then click "Delete." Click "Yes" to completely remove the Windows PC Defender virus from your computer. Restart your computer.

Tips & Warnings

Enable hidden files on your system if you can't find the files. Select "Tools" from within Windows Explorer. Click "Folder Options." Select the "View" tab and click "Show Hidden Files, Folders and Drives." Click "OK."

If you can't open Task Manager, download and run Pocket KillBox. Locate and select the process in the right pane, then click "EndTask."

How to Remove Programs from Windows 7 Registry

2012-01-16T20:29:00.000-08:00

Removing a program from the Windows 7 Registry Editor ensures that you completely remove the program from your computer. When the Add/Remove utility does not completely get rid of a program, the Registry Editor is a effective alternative. Although using the Registry Editor is a simple process, you must be careful not to delete the wrong registry key.

Instructions

1 Press "F" plus the "Windows" key at the same time. Type "regedit" in the dialog box and press "Enter." This opens the Registry Editor.

2 Navigate the following registry path on the left side of the Editor:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\Uninstall

3 Select the program that you wish to remove in the "Uninstall" folder in the left pane. Double-click "uninstallstring" in the right pane and then copy the "Value data." Exit the Registry Editor.

4 Repeat the first sentence in Step 1. Paste the string in the dialog box and click "OK." This will start the removal of the program.

How to Remove Windows XP Genuine Validation

2012-01-16T20:25:00.001-08:00

Windows automatically checks your copy of Windows to see if it's valid. If your copy is or appears to be pirated, Windows XP will display a Genuine Validation message. The Genuine Validation, or Genuine Advantage Notification, appears as a log-in message, log-in timer and a balloon notification in the notification bar. Reasons this message may appear include the installation of a pirated copy of Windows XP, changed Windows XP license key or a Windows error.

Instructions

Open a command prompt window by going to \"Start\" > \"Run.\" Type "cmd." Click "Enter" to open the command prompt window.

Type "CD C:\\Windows\\System32" and click "Enter" to access the System32 directory.

Open a blank Notepad document by going to \"Start\" > \"All Programs\" > \"Accessories\" > \"Notepad.\"

Type the next three lines into the blank document. Press "Enter" after each line. Note that for Windows Home systems, the command is \"tskill\" instead of \"taskkill.\" "taskkill -IM wgatray.exe" "del wgatray.exe" "del wgalogon.dll"

Press "Ctrl" + "a" to select all three lines. Press "Ctrl" + "C" to copy the lines. Open your command prompt windows and press "Ctrl" + "V" to paste and run the lines. This will stop the Windows XP Genuine Advantage Notification task and delete associated files to prevent the notification from appearing again.

Restart your computer by going to \"Start\" > \"Turn Off Computer\" > \"Restart\" to ensure the notification is gone.

Tips & Warnings

Contact Microsoft Support if the message is caused by a Windows error. A customer service representative will be able to activate and validate your copy of Windows XP remotely.

Removing the Genuine Advantage Notification will prevent you from installing Internet Explorer 7 and other Windows updates.

How to Remove Windows Genuine Advantage Error

2012-01-16T20:21:00.000-08:00

Windows Genuine Advantage (WGA) is an application that attempts to validate that your PC is using a licensed copy of the XP operating system. If the app tags your version of XP as pirated, it will repeatedly prompt the user to install a valid version of the OS.
Some Windows users have reported that Windows Genuine Advantage have been invalidating perfectly legitimate copies of XP, and the incessant error messages are proving extremely bothersome. While Microsoft is creating a fix, frustrated users can disable the error messages manually. This simple process involves editing the computer's registry. Don't be taken aback by the prospect of using the command prompt, it's really quite easy as long as you follow the instructions.

Instructions

Any time you make changes to an operating system, it's advisable to back up all the files and data on your PC.

Once your data is backed up, shut down your computer.

Hold the F8 key down while you restart the computer. At the prompt, choose to reboot in safe mode.

Once your desktop appears, click the "Start" menu, and select "Run." This will open a command prompt. Type "regedit" in the command prompt window to open the registry editor.

Just in case something goes wrong, back up the registry. In the registry editor's menu, Click "File" and then "Export." Select "All" under "Export Range." Save the file to a folder you can easily find.

Now search the editor for the "wgalogon" folder and delete it. Close out of the registry editor.

Use your Windows search to find any "wga*" files and delete these files.

Now reboot your computer in "normal" mode. You should never see another WGA error message again.

How to Manually Delete Spyware From Windows XP

2012-01-16T20:11:00.000-08:00

Spyware is annoying and can compromise your computer security. It's also very hard to get rid of. There are a number of free software programs that scan your computer for spyware, however sometimes these programs overlook troublesome areas. With the help of a few utilities, you can manually go in and delete certain spyware elements from your computer that a normal spyware removal program doesn't recognize.
Instructions
1 Boot your computer in safe mode. Repeatedly press the "F8" key on your keyboard to enter the Windows advanced options menu. Select "Safe Mode with Networking" to allow you to have internet access while in safe mode. Safe mode only enables essential Windows processes and programs, which makes removing spyware possible.

2 Click on "Start" and select "Control Panel." Double-click on "Add or Remove Programs." Search for unwanted spyware programs and click on "Remove." Note that many spyware programs will not allow you to remove them without being in Windows safe mode. Restart the computer if necessary, entering back into safe mode.

3 Click on "Start" and select "My Computer." Click on "Tools" in the file bar and select "Folder Options." Select the "View" tab and enable the show hidden files and folders option. Click "OK" and then double-click on "Local Disk (C:)." Delete any files and folders that do not belong there.

4 Double-click on the "Documents and Settings" icon, double-click on "All Users" and enter the "Application Data" folder. Search for suspicious looking files or folders. Right click and delete anything that you are sure is spyware. Navigate back to the "Local Disk (C:)" folder. Repeat this step in the "C:\Program Files\Common Files" folder and the "C:\Windows\system32" folder. Note that the system32 folder is rather large so you should sort items by the date they were created. Verify any item as spyware before you delete it.

5 Navigate to the "C:\Windows\Download Program Files" and delete all files stored in the folder. Note that it is safe to completely delete these files and that you might have to delete them more than once.

6 Click on "Start" and click on "Run." Type in "regedit" and click "OK" to enter the Windows registry editor. Browse to the "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion" entry and search through the "Run" and "RunServicesOnce" folders for odd or suspicious values. Browse to the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" and search through the "Run," "RunServicesOnce," "RunOnce" and "RunOnceEx" folders for odd or suspicious values. Delete any files that you are positive are spyware files from all of these directories. Research any file that you are unsure about. Deleting the wrong file in the registry can render Windows unbootable.

7 Exit out of the registry editor and reboot your computer in normal operating mode. Check for spyware by opening your browser and searching for toolbars that you did not add, changed homepage settings or pop ups. Hold down the "Control," "Shift" and "Escape" key and click on the Processes tab. Search for any spyware applications that you might have missed, running in the Windows background.

Tips & Warnings
Use spyware removal software in conjunction with manual spyware removal for the best result.

Be extremely careful when deleting files from your "C:" directory or registry. Deleting an essential file can cause Windows to be unbootable. It is advisable to back up your Windows registry before you make changes.