; Copy the above paragraph and paste in the text file and save the file with named “boot.ini”
;
; partition is started from 1 and rdisk is started from 0.
; rdisk(0)partition(1) meant first HDD’s first partition.
; multi and disk parameter only required for SCSI.

Blogged with Flock

Tags: WindowsXP, 2000 and 2003′s boot file

Clearing Virus:

If new virus entered into your system, go to “safe Mode” and run msconfig.

See “startup” tab. You will see the path and the file name of virus from there.

Search the file by name. Don’t forget to search in “Hidden & system files”.

And also need to delete “autorun.inf” created by virus created in (windows and system32).

Right click the found file, set all permissions to “Full Control” Deny.

Restart your computer into normal mode and do followings:

1.Go to User…->Administrative…->System->Ctrl+….->Remove Task
Manager and then click (double) this option and changed to Disabled or
Not Configured.

2.Go to User…->Administrative…->Start…..->Remove Search Menu
From Start Menu and then click (double) this option and changed to
And search *.exe and delete the files that have folder
icons (yellow). Please take care not to delete the file with other
icons.

3.Go to User…->Administrative…->System->Prevent access to registry
editing tools click (double) this option and changed to Disabled or
Not Configured. Run regedit and go to
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
choose NOHIDDEN and changed DefaultValue and CheckedValue to 2 and
then choose SHOWALL and changed DefaultValue to 2 and CheckedValue to
1. Now you can see Hidden Files and Folders. Enabled Folder Options by
following those ways:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
“NoFolderOptions” changed to 0

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
“NoBrowserOptions” changed to 0.

Prevention Virus:

Disabled [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies] Explorer and System keys.

It may also disabled the Gpedit.msc configuration changes of per user. It can be made by calling “regedt32″.

Set all permisssions entry to “Read”.

Run “cmd”. Change to the path that you create “Autorun.inf”. Enter “attrib +r +h +s autorun.inf”.

Copy “Autorun.inf” under all drives and system folders (windows and system32).

Right click one after other “autorun.inf” and go to “security tab”and then go to “Advanced”.

Clear the mark from “Inherit from parent…”. Respond by choosing “Remove” button.

Tags: VirusClearing & Prevention

You can re-enable Task Manager, Registry and Search from gpedit.msc
running from Run box.

1.Go to User…->Administrative…->System->Ctrl+….->Remove Task
Manager and then click (double) this option and changed to Disabled or
Not Configured. End Task Flashy.exe from Task Manager.

2.Go to User…->Administrative…->Start…..->Remove Search Menu
From Start Menu and then click (double) this option and changed to
Disabled or Not Configured. Now  you can search Flashy.exe from search
and delete all. And search *.exe and delete the files that have folder
icons (yellow). Please take care not to delete the file with other
icons. Go to this link for enabled Search option->

http://www.infopackets.com/channels/en/windows/gazette/2004/20040810_windows_xp_search_function_missing.htm

3.Go to User…->Administrative…->System->Prevent access to registry
editing tools click (double) this option and changed to Disabled or
Not Configured. Run regedit and go to
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
choose NOHIDDEN and changed DefaultValue and CheckedValue to 2 and
then choose SHOWALL and changed DefaultValue to 2 and CheckedValue to
1. Now you can see Hidden Files and Folders. Enabled Folder Options by
following those ways:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
“NoFolderOptions” changed to 0

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
“NoBrowserOptions” changed to 0.

Run msconfig.exe and choose startup tab and disable FlashyBot entry. And Delete
it from [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
or [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce].

Blogged with Flock

Tags: ComputerSecurity

  I am new to blogging. I am going to introduce you some tech related ideas. I like blogging. It’s free and valuable for all.

Yours
Newtechie

Blogged with Flock