Computer Safety and Security Against Viruses and Their tricks to Remove it

Computer Hangs While Booting Because of Kaspersky!

2008-03-12T09:04:00.000-07:00

May be while installing System Mechanics 6.0 if you does not choose custom installation select what ever package you want to install by default Kaspersky anti virus installs. Because of this your computer gets hangs while you reboot or on next restart.
So how to fix the problem.
Restart your computer and press F8 for menu select (this may be Esc,or Delete or Enter). For me F8 and select the Directory Services from the menu. It will go to your user account may be administrative give the corresponding password. After the computer boots in to user mode select no for safe mode it will popup a system restore. Now you can restore or open control panel and from Add or Remove you can remove Kaspersky and other unnecessary softwares.
Try to minimize the system startup programs open Run by pressing Mod4+R and type msconfig it will open System Configuration tool, remove unnecessary startup programs.
Then you can reboot and run Windows Normally.

Enjoy

One thing Kaspersky is good for anti virus but it slow downs PC. If you want Kaspersky then remove other existing antivirus or try for Kaspersky anti virus which is not included with any other software.

How to Remove Ravmon.exe without anti virus

2008-03-12T08:58:00.000-07:00

Remove ravmon.exe without anti virus

Removing ravmon.exe is quite easier than the others. First hope that you have not the problem of Funny UST Scandal .avi.exe or coolpics or dc.exe or New Folder.exe. If you have another problem the prefer the link in the Left Pane CONTENT Field VirusRemovingTips or Click Here.

Symptoms:
How to recognize that you have being attacked by ravmon.exe. The main thing of ravmon.exe is that it just only modifies the drives to be open and it creates an autorun.inf in the drives ( drives may be C:, D:, E:, or pen drives drive letter:). You can't open drives by double clicking it. When you right click on the drive letter it shows some unidentified text. Thats the ravmon.exe

How To Remove:

First open task manager and stop ravmon.exe running in user activity if you can't open Task Manager prefer this Link Click Here and read How to Remove Coolpics .com.
If you have superuser permission then make an advanced search i.e, capable of searching hidden files for autorun.inf ( because autorun.inf always superhides from us)

If you find autorun.inf in c:\ , d:\ or your drives:\ then delete it .
Search once again for autorun.inf so that for confirming autorun.inf is not in C:\ D:\ or E:\ or your drive:\
If there is no autorun.inf in these drives then reboot the System.
After rebooting the system you can now open the drives. If you have still issues repeat the procedures because you may be missing some steps.
Now you can open the drives but the real virus ravmon.exe or virusname.exe is not gone yet. So what to do, you can search ravmon.exe if you confirm that it is the name of the virus in drives by typing ravmon.exe in serach box and if finds delete it.
Or from menu tools>>Folder Option>>View Tab>>select Show Hidden Files and Folder ,uncheck hide extension for known file types and unselect hide protected operating system files(Recommended) you are now capable of seeing all the hidden files .Now Just open the drives if ravmon.exe or unknowprogram.exe finds delete it( but be sure don't let it to execute).

Then after removing the files restart your Computer and see whether the ravmon.exe has gone or not.

One thing autorun.inf is not a virus actually but if a programmer use it in a bad manner it becomes like a virus, How?? The reason is inf is an information file and autorun.inf is the only one by which a drive can directly interact. Suppose for example if you want to run notepad while you double click the C drive then create an autorun.inf in C drive ie C:\autorun.inf and edit autorun.inf with a line open="C:\WINDOWS\notepad.exe" and saves it after rebooting the computer when you try to open C drive notepad will pop up.That way virus can be executed.

If you find this article useful or need more help please email us or me at ensilage@googlemail.com

Related Topics

*Remove Xmss.exe and FunnyUST Scandal.avi.exe

*Remove Coolpics or New Folder.exe

Thank you!

2008-03-12T08:47:00.000-07:00

Thank you for your help. You are always welcome to our community. Please send your website link to ensilage@gmail.com if you need a link in this site.Thank you.
Back to Home

Computer Hangs While Booting Because of Kaspersky

2008-03-08T04:47:00.000-08:00

Remove Coolpics or New Folder.exe

2008-01-11T13:44:00.002-08:00

How to Remove Coolpics from Computer

Name: “Coolpics.com”

Product Name: “Error”

File Version: 1.00

Virtual Name: “New Folder.exe”

Internal Name: “worm2007.exe”

Type: Worm

Infecting Media: CD-ROM, Pen Drive, Floppy and other autorun devices as well as internet, email etc.

Here I have described some of well known and powerful viruses that can attack you off. Here are some handy tricks.

If you have infected with coolpics you are lucky, to learn a lot about registry and system properties. Although it troubles a lot to us.

What happens if coolpics alias worm2007.exe attack on your pc it disable Task Manager, Hide Folder Options, Delete msconfig.exe, Delete System Restore Point, Hide Run, Disable Registry Editor. I have 6^th times attack by this Virus exactly this is not a Virus but it also contains worm which reconfigure all drives and making an autorun in all drives and it super hides from us. If you double clicks any drives C: D: Or E: it gets installed and copies itself in all Folders.

Software You Need for Removing Coolpics

1. Zone Alarm Pro or Security Suite
2. System Mechanics 6

Removing Coolpics

We have no run options to type and no task manager to stop processes.

So I better suggest you to please install System Mechanic 6 and Zone Alarm. The System mechanic 6 can be found in the iolo.com or better Search in the Google.com and Zone Alarm can be found in zonelabs.com or search in Google (this color effect does not show the color abuse to Google ). First run the Zone Alarm stop all activities when the Program Error is trying to run > check always deny and ok and Stop any unidentified program trying to access the process as well as Internet. To do this Open Zone Alarm > Program Control > Programs tab > Select the Programs which is not identified as Windows program and not in your knowing Program list. Select them as Restricted.

Before Doing any Activities

Open System Mechanic 6 Optimize > Manage Running Programs > Stop the Services lsass.exe (users) and stop also the unknown Services.

Showing Hidden Run on Start Menu

Open the System Mechanic 6 and then in Optimize > System Customizer > ”Expand Security” > Single Click “Start Menu” > Navigate Hide “Run..” under start menu click on it and in the below Under Setting uncheck the Hide “Run..” command under Start Menu and then click Apply. So the Run Option has come in the Start Menu.

Enable Registry editor

The registry editor can be found by typing regedit in the Run. But after typing the regedit in the Run There is a massage that Access Denied even you are the administrator. This is because Coolpics has Disable the Registry Editor. To Enable the registry editor open the System Mechanics 6 Optimize > Categories > Expand Security > Miscellaneous > navigate Disable Registry editing tools (Regedit, etc) click on it and in the settings below Uncheck the Disable Registry Editing tools and the click Apply. Now your registry editor is enabled.

Enabling Task Manager

To enable the task manager type gpedit.msc in the Run or in command prompt. If it does not work then your gpedit.msc file must be deleted by coolpics. Then you need to copy gpedit.msc file from your friend PC who is using the same O.S. Windows XP SP2, gpedit.msc is normally found in “C:\Windows\System32”. If you have done this type gpedit.msc in the Run or in Command Prompt. It will open a group policy editor.

In the User Configuration > Administrative Template > System > Ctrl+Alt+Del Options click it and in the Right pane Double Click Remove Task Manager it will Display a small window, in the Setting Select the enabled option and then apply and again select in the Not Configured Option then Click Apply Ok. Now Try Ctrl+Alt+Del by pressing in the same time it will Display the Task manager, your task manager problem is solved. Task manager can be enabled by using System Mechanics 6 Optimize> System Customizer > Categories > Security > NT/2000/XP > in the right pane (click prevent user from starting Task Manager) and in the lower settings uncheck the prevent user from starting Task Manager.

Stopping the Running Process by Coolpics

To stop the Processes running by Coolpics

In the System Mechanics 6 Optimize > Process Manager > Navigate lsass.exe or svchost.exe or any process which have insufficient information about Publisher and Description with the current User (Don’t stop any lasas.exe or svchost.exe System or Local Network process until it has been recognized as a process with Current User e.g. in my computer the Current user is $@NJIB).

But the processes are stop only for a few it will activate in the next reboot. So you have to Disable the processes which you have stop in the Running Process. For this in the System Mechanic 6 Optimize > Single Click The Manage Windows Startup (there will be two options Startup Optimizer and Advanced Startup manager) click the advanced Startup manager > Navigate in all including Services and stop and Delete any processes which have insufficient Publisher or Company Information or better expand the process by clicking in the + which process has in sufficient information and expand the Summary There you see

File Version: 1.00

Description:

Company: Unknown

Name: worm2007

Language: English (USA)

Original Name: worm2007 (sometimes not given)

Product:

Product Version:

See whether any one of the above has the characteristics of Coolpics if Yes Disable the Process (to disable Click Option > Disable) and Delete it (to Delete click Options > Delete) Be Sure First Disable it and then Delete it don’t delete First. There may be two or three process running by Coolpics. Disable and Delete all of them by identifying the properties. Now the Coolpics Processes and coolpics have been deleted but what coolpics have done is not yet done. So let’s take a break.

No Folder Option

No Folder Option in the Windows Explorer tools > Folder Option

To Show the Folder Option open the registry editor by typing regedit in the “run” or in the “command prompt” Navigate in HKCU (HKEY_CURRENT_USER) > Softwares > Microsoft > Windows > Current Version > Policies > Explorer > In the right pane double click the NoFolderOption and set the REG_DWORD to 0. Then restart the explorer your NoFolderOption problem is solved.

To completely removed Coolpics

Open the Folder Option from the windows explorer Tools > Folder Option it will display a property box. Select the view option and in Hidden Files and Folder select the Show Hidden Files and Folder and also Uncheck the Hide extension for Known File types it can also be done by using Registry Editor. Open regedit then HKCU > Software > Microsoft > Windows > Current Version > Explorer > Advanced > HideFileExt (set value to 0) and also do HKCU > Software > Microsoft > Windows > Current Version > Explorer > Advanced > ShowSuperHidden (set value to 1). If this things are done then try Searching for New Folder.exe or coolpics.exe or Fun.exe which has the Windows New Folder like icon if found delete it. Now you are free from coolpics.

Home Page redirect to Coolpics.com

To set the home page as about:blank you need to open the registry and direct

HKCU > Software > Microsoft > Internet Explorer > Main > (double click) Start Page > set about:blank in the value data.

Any Drive is not Opening by Double Click

The drives are not opening by double click. When you double clicks the drives it autoruns and gives an Error Message something I forgot *.vbs is not found. So this is the problem the coolpics has already modify your drives. To overcome this problems make sure that you have configured the registry as shown in the Earlier. Then open each drive by right clicking and open you will see a file Autorun.inf and *.vbs (* actually mean some name which I forgot) then delete it. Similar way open the other drives also and delete the same files in the other drives also. This setting will not affect until the System is restarted. After restarting the System if you double click the drives it will not auto runs. Now you can open the drives as normally.

Many People are attacking by the coolpics. Some coolpics i.e., if they attack in a very few period and they have not chances to configured the drives then the autorun files will not created. Until this autorun.inf files are created in the drives the coolpics will not affect in all folder. If they are attacked in the drives don’t try to open by double clicking the drives because if you try to open by double clicking the drives the coolpics will get worked and try spreading throughout the other files also. The same problem persists even if you reinstall the Operating System. So it is better than reinstalling the Operating System, you try the above procedures you will not get troubled. Otherwise you have to delete all partitions.

System Restore Point Can not be Determined

System Restore point is created at

“C:\WINDOWS\system32\Restore\rstrui.exe”

If the file rstrui.exe is not seen by applying ShowSuperHidden (1), ShowHidden (1), Hidden (0) then it must be deleted by Coolpics. Then you need to copy from your friends PC. Please copy the “rstrui.exe” from your friends PC which has the same OS Windows XP SP2 which is situated as above and paste in the “C:\WINDOWS\system32\Restore\”. Then try to open Start > All Programs > Accessories > System Tools > System Restore if it does not work Right Click the System Restore (provided you must enabled dragging and dropping) in the Shortcut Tab set the Target

“C:\WINDOWS\system32\Restore\rstrui.exe” then your Restore Point will work.

MSCONFIG not worked

This is because of the Coolpics has disabled the service of msconfig.exe or sometimes it has been deleted by Coolpics. If this happen search in the

“C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe”

Provided you have the configuration fully seen the hidden files. If this file is missing copy msconfig.exe from your friends PC then paste it in the directory

“C:\WINDOWS\pchealth\helpctr\binaries\”.

Try by typing msconfig in the Run or in the Command Prompt it will Display the System Configuration Utility. Now your System Configuration Utility is working.

Check whether you’re System Files are in their Original Condition

To do this open the command prompts and types the following

sfc /scannow

It will scan all the protected files and check whether they are in their original condition if not in original condition it will prompt to enter the Windows XP SP2 CD. Then the dll files needed will be copied. That’s all your computer is up in the original condition.

After Making all the changes please make a System Restore point for future use.

Precautions:

Don’t double clicked any USB device especially pen drive. Always right click and open. Otherwise Coolpics may get installed secretly.

Hi I hope that you have gone throughout these tricks. Any bugs please report to me at sanjib.narzary@gmail.com

2008-01-11T13:44:00.001-08:00

How to Remove Coolpics from Computer

Name: “Coolpics.com”

Product Name: “Error”

File Version: 1.00

Virtual Name: “New Folder.exe”

Internal Name: “worm2007.exe”

Type: Worm

Infecting Media: CD-ROM, Pen Drive, Floppy and other autorun devices as well as internet, email etc.

Here I have described some of well known and powerful viruses that can attack you off. Here are some handy

If you have infected with coolpics you are lucky, to learn a lot about registry and system properties. Although it troubles a lot to us.

Software You Need for Removing Coolpics

1. Zone Alarm Pro or Security Suite

2. System Mechanics 6

Removing Coolpics

We have no run options to type and no task manager to stop processes.

So I better suggest you to please install System Mechanic 6 and Zone Alarm. The System mechanic 6 can be found in the iolo.com or better Search in the Google.com and Zone Alarm can be found in zonelabs.com or search in Google (this color effect does not show the color abuse to Google ). First run the Zone Alarm stop all activities when the Program Error is trying to run àcheck always deny and ok and Stop any unidentified program trying to access the process as well as Internet. To do this Open Zone Alarm à Program Control à Programs tab à Select the Programs which is not identified as Windows program and not in your knowing Program list. Select them as Restricted.

Before Doing any Activities

Open System Mechanic 6 Optimize à Manage Running Programs à Stop the Services lsass.exe (users) and stop also the unknown Services.

Showing Hidden Run on Start Menu

Open the System Mechanic 6 and then in Optimize àSystem Customizer à ”Expand Security” à Single Click “Start Menu” àNavigate Hide “Run..” under start menu click on it and in the below Under Setting uncheck the Hide “Run..” command under Start Menu and then click Apply. So the Run Option has come in the Start Menu.

Enable Registry editor

The registry editor can be found by typing regedit in the Run. But after typing the regedit in the Run There is a massage that Access Denied even you are the administrator. This is because Coolpics has Disable the Registry Editor. To Enable the registry editor open the System Mechanics 6 Optimize à Categories à Expand Security à Miscellaneous à navigate Disable Registry editing tools (Regedit, etc) click on it and in the settings below Uncheck the Disable Registry Editing tools and the click Apply. Now your registry editor is enabled.

Enabling Task Manager

In the User Configuration àAdministrative Template à System à Ctrl+Alt+Del Options click it and in the Right pane Double Click Remove Task Manager it will Display a small window, in the Setting Select the enabled option and then apply and again select in the Not Configured Option then Click Apply Ok. Now Try Ctrl+Alt+Del by pressing in the same time it will Display the Task manager, your task manager problem is solved. Task manager can be enabled by using System Mechanics 6 Optimizeà System Customizer àCategories àSecurity àNT/2000/XP àin the right pane (click prevent user from starting Task Manager) and in the lower settings uncheck the prevent user from starting Task Manager.

Stopping the Running Process by Coolpics

To stop the Processes running by Coolpics

In the System Mechanics 6 Optimize àProcess Manager àNavigate lsass.exe or svchost.exe or any process which have insufficient information about Publisher and Description with the current User (Don’t stop any lasas.exe or svchost.exe System or Local Network process until it has been recognized as a process with Current User e.g. in my computer the Current user is $@NJIB).

But the processes are stop only for a few it will activate in the next reboot. So you have to Disable the processes which you have stop in the Running Process. For this in the System Mechanic 6 Optimize àSingle Click The Manage Windows Startup (there will be two options Startup Optimizer and Advanced Startup manager) click the advanced Startup manager à Navigate in all including Services and stop and Delete any processes which have insufficient Publisher or Company Information or better expand the process by clicking in the + which process has in sufficient information and expand the Summary There you see

File Version: 1.00

Description:

Company: Unknown

Name: worm2007

Language: English (USA)

Original Name: worm2007 (sometimes not given)

Product:

Product Version:

See whether any one of the above has the characteristics of Coolpics if Yes Disable the Process (to disable Click Optionà Disable) and Delete it (to Delete click OptionsàDelete) Be Sure First Disable it and then Delete it don’t delete First. There may be two or three process running by Coolpics. Disable and Delete all of them by identifying the properties. Now the Coolpics Processes and coolpics have been deleted but what coolpics have done is not yet done. So let’s take a break.

No Folder Option

No Folder Option in the Windows Explorer toolsà Folder Option

To Show the Folder Option open the registry editor by typing regedit in the “run” or in the “command prompt” Navigate in HKCU (HKEY_CURRENT_USER)à Softwares à Microsoft à Windows à Current Version àPolicies à Explorer à In the right pane double click the NoFolderOption and set the REG_DWORD to 0. Then restart the explorer your NoFolderOption problem is solved.

To completely removed Coolpics

Open the Folder Option from the windows explorer Tools à Folder Option it will display a property box. Select the view option and in Hidden Files and Folder select the Show Hidden Files and Folder and also Uncheck the Hide extension for Known File types it can also be done by using Registry Editor. Open regedit then HKCU à Software à Microsoft à Windows à Current Version à Explorer à Advanced à HideFileExt (set value to 0) and also do HKCU à Software à Microsoft à Windows à Current Version à Explorer à Advanced à ShowSuperHidden (set value to 1). If this things are done then try Searching for New Folder.exe or coolpics.exe or Fun.exe which has the Windows New Folder like icon if found delete it. Now you are free from coolpics.

Home Page redirect to Coolpics.com

To set the home page as about:blank you need to open the registry and direct

HKCU à Software à Microsoft à Internet Explorer à Main à (double click) Start Page à set about:blank in the value data.

Any Drive is not Opening by Double Click

System Restore Point Can not be Determined

System Restore point is created at

“C:\WINDOWS\system32\Restore\rstrui.exe”

If the file rstrui.exe is not seen by applying ShowSuperHidden (1), ShowHidden (1), Hidden (0) then it must be deleted by Coolpics. Then you need to copy from your friends PC. Please copy the “rstrui.exe” from your friends PC which has the same OS Windows XP SP2 which is situated as above and paste in the “C:\WINDOWS\system32\Restore\”. Then try to open StartàAll Programs à Accessories à System Tools à System Restore if it does not work Right Click the System Restore (provided you must enabled dragging and dropping) in the Shortcut Tab set the Target

“C:\WINDOWS\system32\Restore\rstrui.exe” then your Restore Point will work.

MSCONFIG not worked

This is because of the Coolpics has disabled the service of msconfig.exe or sometimes it has been deleted by Coolpics. If this happen search in the

“C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe”

Provided you have the configuration fully seen the hidden files. If this file is missing copy msconfig.exe from your friends PC then paste it in the directory

“C:\WINDOWS\pchealth\helpctr\binaries\”.

Try by typing msconfig in the Run or in the Command Prompt it will Display the System Configuration Utility. Now your System Configuration Utility is working.

Check whether you’re System Files are in their Original Condition

To do this open the command prompts and types the following

sfc /scannow

After Making all the changes please make a System Restore point for future use.

Precautions:

Don’t double clicked any USB device especially pen drive. Always right click and open. Otherwise Coolpics may get installed secretly.

Hi I hope that you have gone throughout these tricks. Any bugs please report to me at

Remove xmss.exe and Funny UST Scandal.avi.exe

2008-01-11T13:12:00.000-08:00

Just You see when Viruses attacks your Computer, Computer crashes or file damages. But xmss.exe is a boot sector virus it does not cause any harm but when it attacks on your PC it damages partition manger even it can cause your Hard Disk Totally destroyed.

But one thing is that if the virus is no longer attacks then you can do one of the following steps.

How to identify that you have attacked by Viruses. Just press Ctrl+Shift+Delete it will show Task manager. Then in Processes if any unwanted processes are there ie not identified as your existing user program then it must be Virus. But when xmss.exe attacks it hide task manager also i.e, task manager will show you for a few seconds the it disappears, it does not allow you to install any softwares PC starts hanging...etc etc........

Reinstalling of OS and formatting of Windows XP default drive will not remove this virus. It direct attacks explorer.exe i.e, it modifies explorer.exe. With any of the USER activity it starts working. It creates its copy on all drives.

So if you want to remove it forever you have to install a firewall software i.e, Zone alarm I suggest.

Do the Following..............

Step1: Format and Reinstall the OS if you can't install any softwares in the existing OS.

Step2: After reinstalling OS don't try to open any of the Drives until you have install Zone Alarm or any other personal firewall softwares. Reboot the System and if Zone Alarm starts working try to open the other drives D:, E: or F: etc. If you try to open the drives then Zone Alarm warns that xmss.exe is trying to Run or Something. Click Always Deny. For all existing drives if this messages appears Always Click Deny.

Step3: Now You could not open any drives. Because you have blocked xmss.exe. So what you do the next open explorer.exe from run and in the tools menu open Folder Option and in the View Click Show Hidden Folder and Unchecked Hide Protected OS Files . Then you try to search xmss.exe in D:, E:, F: etc. provided search option should capable of searching Hidden Files Also. if you find it Shift + Delete it. Then search autorun.inf in all drives also provided autorun.inf should be in D:\autorun.inf or yourdrive:\autorun.inf if you get it Shift + Delete

Step 3: Until you reboot the System you can't open any drives. Reboot the System and try to open the drives then you see that Funny UST.avi is in all the drives Shift Delete it also. Now you are free from these Virus.

Step4: Reboot once again and Create System restore point for future use.

Thats all

If you find this information useful please give a comment and suggest for better understanding because i'm not an English my language may be very difficult to understand.

By Sanjib Narzary
mailto:sanjib.narzary@gmail.com it.

Ensilage Growning

2008-01-06T01:44:00.000-08:00

Ensilage

What is Ensilage?
The Ensilage has its own Dictionary meaning. But we are not that one. We are a small group of student and some are of engineering graduates trying to help the people around the world as well as regional people when they need some ideas or knowledge about something.

We are building our knowledge by blogs and forums and we are trying to give our ideas by blogs also. You need not to worry about us. We are general people also who collects knowledge from people like you. And give away what we know.

We are a very small group of people but having of our experience in making knowledge and giving away it.

Building Knowledge:
There is some techniques how you can get knowledge from the internet

Internet is the store house of everything. If you need any of it you will surely get it. Like you want some information about how to remove viruses without antivirus, then just you have to open www.google.com and search for remove+virus+without+antivrus then it will search a lots of websites and produces various links that has the key features about how to remove viruses without using antivirus.

There are many people around the world are using this internet, many of them may be good but some people having the great knowledge about internet and computer knowledge may be phishing or sniping you. So be aware while surfing the internet. There are lots of tricks in the internet you can search it from google.com Secure+ Surfing then you will get much more information about internet.

Here are some of the computer tricks on how to remove virues without antivirus. These are
*Remove xmss.exe and Funny UST Scandal avi.exe
*Remove Coolpics or New Folder.exe

By Ensilage Groups
Home