Remove Trouble Shooting

Windows Security Software

noreply@blogger.com (Ric Webmaster) — Sat, 23 Oct 2010 18:16:00 +0800

The Basically Windows Security Software You Should Have Install

To Protect Your Windows Start Affected By Virus, Trojan, Malware, Spyware, Keylogger etc When Your Computer Is Link Networking, Access Internet, Plug n Play Pendrive, Card Reader, Floppy Disk etc

Today, if your Computer just have one or two Protect Security software is not enough, because the technology is growing fastest mean the dangerous code such as virus etc them also growing and duplicated fastest.

The only way to solve this problem is, used different type of Security software or utility to protected your Windows being affected, but the one thing should be understand is "Not Mean you have install more then you won't be able for infected".

We don't want after you have been infected, no matter how many Protector Software or Utilities you just install is not used and also won't solve it 100%.

We want to protected our system is before being attack by virus, malware etc. This is only one way good solution for everybody don't waste a lot time for doing scanning and killing for trojan, malware etc.

Anti Virus - Recommended Avira Personal (non commercial used) and business license. Protect and Avoid for your Windows before attack and infected by virus, malware, trojan etc.

Malware / Spyware / Trojan
1.) MalwareBytes Anti Malware can do all the scanning for trojan, malware, key logger etc, and is FREE for Personal Used.
2.) Spybot & Destroy - Is best and free of used to do any scanning for spyware, also malware etc.

Cleaner / Delete File / Utility
1.) Ccleaner - Clean, disable, and repair etc for unwanted files etc, start up Windows application and Windows Registry.

2.) Unlocker - Used it to force delete any unwanted file which normal delete function are not work. Especially "Recycler".

3.) Auto Run Eater - It special to kill and delete the "autorun,inf" which most used by Malware to attack Windows through the Plug & Play hardware such as Pendrive.

New Folder Create Slow

noreply@blogger.com (Ric Webmaster) — Sat, 23 Oct 2010 17:19:00 +0800

It Was Slow To Create The New Folder Or Files

When You Try To Create The New Folder At Your Windows Anywhere Workplace It Was Slowly...This Will Also Happen Slow When Create The New File Name.

It taken around 12 seconds to 20 seconds after you have Right Click on your Mouse, and Right Context Menu is take time SLOW to open.

This can occur if your Windows System is affected by Virus, Malware, Trojan etc, or something Windows File is conflict or corrupted. If you have try to do a lot scanning with different protect security software also not used. Click Here For "Basically Windows Security Software" should have install on your Windows for Protection and Frequently Updating and do Scanning.

Or it happen when "Bad Context Menu Handler."

Windows System : Windows XP Home, Windows XP Pro SP1, SP2, SP3

Go visit this Kelly Korner for Windows XP
http://www.kellys-korner-xp.com/xp_tweaks.htm

And find out this list and name
* 286. Restore the "New" Context Menu to Default

* 395. Remove or Restore "New" Context Menu (Select NEW and download)

Right Click and select Save As Link, and do saving at your Desktop (after used/install, restart window, delete this file)

After you have download, YOU MUST change the file extension, since the file default is ".txt", click the file named and do "Rename / F2 by keyboard", and change it from :
(just click OK/YES, for accept changing the file type when pop up menu have ask)
restorenew.reg.txt TO retorenew.reg
restorenewcontextmenu.reg.txt TO restorenewcontextmenu.reg

After have changed the file extension, just double click each of them to install, accept YES when they ask you this "Are you sure you want to add the information c:\..." and click OK to proceed. RESTART YOUR WINDOWS after you have done. I have my personal meet up this problem and used this method to solve it.

If you still have the same problem, just contact me, and I try my best way to guide for you. Please allow me time for reply your message.

Application No Appear Windows Taskbar

noreply@blogger.com (Ric Webmaster) — Tue, 12 Oct 2010 15:23:00 +0800

The Application Was Not Appear/Showing At My Windows Taskbar

Windows : Windows XP Service Pack 2, 3

My Windows Software Application Icons was not appear on Windows Taskbar. Please check up which problem you are meet first as below guideline before you do any trouble shooting for solution.

Taskbar 1. The Windows Taskbar Is Appear/Show, But All Application Icons Not Show On Taskbar
Today, one of my computer client, she office personal computer was meet up this problem, "after she log in to windows, and open any software application, and when do "Minimized (-)" of the application, then the applicaion Dont Show On Window Taskbar.

Taskbar 2.) The Windows Taskbar Is Not Appear
When Windows Taskbar is still appear is just the Application Open or Minimized is not showing up at taskbar. You have used mouse to right click to closed down all the "Language Bar, Quick Launch, etc", then after this your "Whole Windows Taskbar" will be totally DISAPPEAR, and you can see it little appear at your very low bottom window, and if you used mouse to "Click+Hold, then Drag Top" and it should not work.

And if press by Keyboard "Start" and Windows Start Up Page will appear at very middle at your Windows Desktop.

Mean, if you have enable back the "language bar, quick launch etc" at your taskbar, then your Windows Taskbar will be APPEARING again at your Windows, but your problem are suited to "Taskbar 1"

All this error maybe can be infected by some virus, malware. You are recommended to scan by this software for more safe reason :
CCleaner
MalwareByte Anti-Malware
Spybot & Destroy

Download each of them and save it to your Desktop, Install, and update the latest definition file. Then start for scanning to detect any dangerous codec hide at your windows. This should taken more than hours to complete. And this was not confirm that your "Windows Taskbar problem will be solve, but is highly recommeded you do scan also", look at below for more direct solution for this taskbar error.

If you feel what you are doing, and comfortable for yourself trouble shooting, then here is fast way to solve the above problem.

Solution 1) For the application running are not showing on the Windows Taskbar
Find Number 240 on the left: Programs aren't minimized to the Taskbar

Solution 2.) For the Windows Taksbar set to Default Functionality (if you used above tool is fix your problem, then this is not need do agian)
Find Number 164: Restore Taskbar to Default Functionality

Step Follow :

- Click to download with above link, and save it to your Desktop or any storage you prefer.
- After finish download, open from containing folder of that downloading file
- Double click the file and just click "YES" for process. Until it will ask you to RESTART for fully complete process, just click Yes also

(if your Windows is hang or stop responding, then just click "Start - Restart" option from there or Windows Task Manager to click for restart)

The above both fixed tool are not guarantee used at your own work, take your own risk. But we have used this (Kellys Korner XP Dot Com XP Tweak recommended tool) to solve for our local client which have to meet up this problem.

Solution Optional 3.) Running Programs Do Not Appear on the Taskbar
This is other sometime you can meet up, try the following step to check out, if yes just follow to remove it.

i) Press CTRL+ALT+DELETE to open the Windows Task Manager box.
ii) At Processes Tab, Find & Click Instant Access (Tbmenu.exe), and then click End Process.
iii) Click Start - All Programs - StartUp - Find "Instant Access" and right click to select Delete/Remove
iv) Restart your computer, if necessay used the Solution 1 & 2 for complete your problem issue

The Instant Access are by Xerox's Text Bridge Instant Access OCR program, it will occur only when for some reason on bug. Remove or not based on your own risk for this utility.

NWPROVAU.DLL Removal Guideline

noreply@blogger.com (Ric Webmaster) — Fri, 21 May 2010 20:30:00 +0800

How to FULLY REMOVE the NWPROVAU.DLL from your Windows

System : Windows XP Service Pack 3

If you have used the HijackThis to scan your computer to track down a virus, malware, trojan, backdoor, spyware etc, then you may see if it appear one component look like below :

O10 - unknow file in winsock LSp : c:windows\system32\nwprovau.dll

Then what is NWPROVAU.DLL?
The file nwprovau.dll is one of the file install by Client Service For Netware from our computer as Network Component, It purposely install for the IPX/SPX.

Then whether delete this file, or keep it in your computer?
If your computer are not using the IPX/SPX protocol and Netware, and you have not install about it. Because now day our Network protocol COMMONLY USED is TCP/IP Protocol, then DELETE this file from your computer is better (Since my case part : When it appear my computer system is starting to slow down for all my working, although I don't know when it start to installed on my system).

In the Windows registry, the nwprovau.dll file will be show up in the following registry key.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries

It will generally be shown under Key # 4 with the following information as show in below picture.

Step to REMOVE the NWPROVAU.DLL

1.) If you are decided to REMOVE it from your System, then you must used this program called LSPFix and save it to your DESKTOP. Click here to download directly, or go to Official Website to understand more about this program.

2.) Open the LSPFix from your Desktop, and follow the instruction. Now you can see like below Screen. If your Window don't have Buggy or improperly removed LSP software then you will see the message "NO PROBLEMS FOUND" appear in box screen.

3.) TICK "I know what I'm doing (or enjoy re-installing my operating system...)" option if not, you are not able to process (unable to click) for next step from button.

NOW at your LEFT SCREEN (Keep area) you can see the file name as "NWPROVAU.DLL" with description "NWLink IPX/SPX/NetBIOS Compatible Transport Protocol", and now Select this File name and click the BUTTON with ">>", and the file will transfer to "REMOVE area"

4.) Click Finish after transfer to REMOVE AREA. And you will get the following "Repair Summary" from below screen picture. Click OK to proceed. NOT NEED RESTART YOUR WINDOWS.

5.) Now open and run HijackThis, and you can see that "O10 - unknow file in winsock LSp : c:windows\system32\nwprovau.dll" NO MORE APPEAR in your scanning result list.

Hope it will work for you.

Find this topic NWPROVAU.DLL related in Facebook

NOTE : for whose are expert and professional Computer Trouble Shooting, then you are at your own risk TO DECIDE fully REMOVE/DELETE all related file name from your Windows Register. Go to START -- RUN -- type regedit -- CTRL+F, and type nwprovau.dll, DELETE all file in your register if you are know what you doing. For me, I delete all without backup. For your own safe, just backup your Registry before do anything.

SpyArsenal.Personal Desktop Spy

noreply@blogger.com (Ric Webmaster) — Thu, 20 May 2010 19:11:00 +0800

The guideline to removing the SpyArsenal.Personal Desktop Spy from your infected computer

This article is share for Manual Removal and 1Click auto guideline for SpyArsenal.Personal Desktop Spy.

When yesterday I have install the SpyArsenal.Personal Desktop Spy at my notebook, then after that the Internet Connection is suddenly slow connecting, and Connection is become as Limited function and conflict. And I try to restart my Windows, then my mouse function become inproperly.

Download the Spybot - Search & Destroy at here and install it and update if you still can online OR MANUAL update the latest version pack at here

Join this NOTE DISCUSSION in my Facebook.

If you just have simple do the UNINSTALL/REMOVE from your Control Panel, it wont clean at all. You must used the Search & Destropy Spy Bot and I used other friend notebook to download the latest updated version pack, and I get the below problem's listed out. After restart my Window, all being solve.

NOTE : If after restart, if your Connection still come out with Limited Function, then go here to download Winsock XP Fix 1.2 (Windows XP or below) OR (Windows Vista and Above). Author by Fabio Pinto.
OR used Microsoft Fix It 50203 version at here, and all the FULL DESCRIPTION and INSTRUCTION also have provided.

This is categories as "Tracking Cookies" (each time Internet Connection is being connected and used the Browser, the cookies will auto in your Windows Temporary Internet Files)
Adviva
CasaleMedia
DoubleClick
FastClick
MediaPlex
Right Media
Statcounter

This is Categories as Spy (the last file in your Windows Registry)
SpyArsenal.Personal Dektop Spy

NOTE : If you feel you are safe and stable used SpyArsenal.Personal Desktop Spy, then this post article are not apply for you. Here is for personal experience and may not being apply to all people.

Manual Way for Removal SpyArsenal.Personal Desktop Spy :- Before that used Control Panel REMOVE/UNINSTALL, then come back to Windows Explorer or another file manager of your choice to locate and delete below files (MAKE SURE YOU HAVE enable the HIDDEN OPTION into your My Computer first). If are fail to DELETE then try used UNLOCKER 1.8.9

This is Files :
The file at "<$PROGRAMS>\Personal Desktop Spy\ Quick Start.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Help.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Personal Desktop Spy.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Spy Config.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Start Capture.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Stop and Exit.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Stop Capture.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Uninstall.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Links\Download lastest version.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Links\Mail to support.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Links\Program's home page.lnk".
The file at "<$PROGRAMS>\Personal Desktop Spy\Links\Registration.lnk".
The file at "<$SYSDIR>\DSA\dsa.cfg".
The file at "<$SYSDIR>\DSA\DSA.chm".
The file at "<$SYSDIR>\DSA\dsa.exe".
The file at "<$SYSDIR>\DSA\dsa-config.bat".
The file at "<$SYSDIR>\DSA\dsa-exit.bat".
The file at "<$SYSDIR>\DSA\dsa-start.bat".
The file at "<$SYSDIR>\DSA\dsa-stop.bat".
The file at "<$SYSDIR>\DSA\license.txt".
The file at "<$SYSDIR>\DSA\QuickStart.html".
The file at "<$SYSDIR>\DSA\readme.txt".
The file at "<$SYSDIR>\DSA\Links\Download lastest version.url".
The file at "<$SYSDIR>\DSA\Links\Mail to support.url".
The file at "<$SYSDIR>\DSA\Links\Program's home page.url".
The file at "<$SYSDIR>\DSA\Links\Registration.url".
The file at "<$SYSDIR>\DSA\Pictures\bat.ico".
The file at "<$SYSDIR>\DSA\Pictures\config.ico".
The file at "<$SYSDIR>\DSA\Pictures\monitor-off.bmp".
The file at "<$SYSDIR>\DSA\Pictures\monitor-on.bmp".
The file at "<$SYSDIR>\DSA\Pictures\quickstart.ico".
The file at "<$DESKTOP>\Personal Desktop Spy.lnk".

This is Folders :
The directory at "<$PROGRAMS>\Personal Desktop Spy".
The directory at "<$PROGRAMS>\Personal Desktop Spy\Links".
The directory at "<$SYSDIR>\DSA".
The directory at "<$SYSDIR>\DSA\Images".
The directory at "<$SYSDIR>\DSA\Links".
The directory at "<$SYSDIR>\DSA\Pictures".

Remember some files are not unable to find out and delete, used Spybot-S&D to remove all of them.

MyWebSearch Removal

noreply@blogger.com (Ric Webmaster) — Wed, 17 Mar 2010 20:21:00 +0800

The tips to remove the MyWebSearch and other trojan etc from your Window.

The Tool Used : MalwareByte's Group

Solution 1 : If your Windows still can running smooth into normal window then,
First download MalwareByte from here, and SAVE it at your desktop

Solution 2 : If your Windows cant log in to normal Windows then
Try used your friends PC, Office PC, or CyberCafe PC if allow and download the Malware Sofware.

MalwareByte's Anti Malware 1.44, database version : 3875

Step 1 : After finish download and Install it at your Window with log in to normal window or safe mode windoe (press F5 after computer start)

Step 2 : And Start Malwarebytes' sofware and click SCAN, after finish scanning just click show details, and make sure all the dangerous code are TICK , then just click REMOVE SELECTED.

Step 3: After finish scanning and removing, you are request to reboot your window, just click YES to proceed it.

SAFE TIPS : After log in to your normal window again, try to SCANNING it again and to double check that all dangerous codec have been remove successful from your window.

MalwareByte's Anti Malware 1.44, database version : 3875 is remove the following codec from my Window
1.) Generic.Bot.H
2.) Adware.MyWebSearch
3.) Trojan.Vundo
4.) Adware.BDSearch
5.) Trojan.Cinmus
6.) Worm.AutoRun
7.) Worm.Autorun.B
8.) Trojan.Agent

And the following is the scanning log file, you can take it as review..

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 23
Registry Values Infected: 1
Registry Data Items Infected: 3
Folders Infected: 6
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-21cx1c643131} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e5d5d4a1-17f0-41d7-b1c6-0979f91e6f46} (Adware.BDSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{77fef28e-eb96-44ff-b511-3185dea48697} (Trojan.Cinmus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a7f05ee4-0426-454f-8013-c41e3596e9e9} (Trojan.Cinmus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b580cf65-e151-49c3-b73f-70b13fca8e86} (Trojan.Cinmus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-21cx1c643131} (Worm.AutoRun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e5d5d4a1-17f0-41d7-b1c6-0979f91e6f46} (Adware.BDSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a7f05ee4-0426-454f-8013-c41e3596e9e9} (Trojan.Cinmus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\TING\Application Data\Baidu (Trojan.Cinmus) -> Quarantined and deleted successfully.
C:\Documents and Settings\TING\Application Data\Baidu\Toolbar (Trojan.Cinmus) -> Quarantined and deleted successfully.
C:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Baidu (Adware.Baidu) -> Quarantined and deleted successfully.
C:\Program Files\Baidu\AddressBar (Adware.Baidu) -> Quarantined and deleted successfully.
C:\Program Files\Baidu\Toolbar (Adware.Baidu) -> Quarantined and deleted successfully.

Files Infected:
C:\RECYCLER\S-1-5-21-117609710-515967899-725345543-1003\Dc1\eXplorer.exe (Worm.Autorun.B) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-117609710-515967899-725345543-1003\Dc1\iExplore.exe (Worm.Autorun.B) -> Quarantined and deleted successfully.
C:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.