How To remove Jay.exe and mveo.exe Manually

To be able to locate all the mveo.exe and jay.exe files,
1. open a windows explorer window
2. click on tools then click folder options
3. choose the view tab
4. on the hidden files and folders menu tick on show hidden files and folders.
5. uncheck hide extensions for known file types
6. uncheck hide protected operating system files (recommended)
7. click apply then ok

Next we will have to remove the jay.exe and mveo.exe files
1. Press ctrl+alt+del to open taask manager
2. In the processes tab look for the mveo.exe and end process.

To delete all the jay.exe and mveo files, search for it using the search for files and folder option in the start menu.
1. type jay.exe in the searchbar
2. click more advanced option
3. put a check on search hidden files and folders
4. then click on start search
5. delete all jay.exe entries
6. repeat steps 1-5 to search for mveo.exe
7. also delete autorun.inf file

To delete registry entries
1. click on start
2. click on run
3. in the run text box type regedit
4. press ctrl+f and type in the textbox jay.exe
5. delete all entires having jay.exe entries
6. press F3 to search the next entry.

note: if an entry is in c:\windows... edit the value and go to the end of the string and
delete only the jay.exe text on the end of the string

To edit the IE windows back to its original name:
1. open regedit
2. press ctrl+f
3. type in the searchbar window title
4. If the value that appears has the jaymyka.wen9.com value, change it to Internet Explorer
note: this would be the title bar of your Internet Explorer.

After all of these steps are done:
try to look again for the jay.exe and mveo.exe files using the search for files and folders application of windows.

after deleting all those files restart your computer.
Your Done

DESTRUKTO or Explorar.vbs Virus

This is a very annoying virus. Got it from my flash drive. It spreads out in portable media drives so be very careful. My ultimate tip is before you open you're flash drives, scan it first with you're antivirus software or right click the removable drive icon and click "explore" rather than "open or autoplay". I have searched the internet and I havent found a newbie direction of removing this virus so I have made my own user friendly instruction so that people will not have to think for hours just to remove this virus.

Description:
1. Pop-ups Internet browser window with message:
”DESTRUKTO 10 uToS nG mAnGinGiNoM”

2. Disables Folder Options, Task Manager, Registry Editor, System Restore and Run.
3. Presence of the following files:

New Folder.bat\Start Explorar.Vbs

How to remove:
1. Download & install replacement software for Task Manager (since it is disabled) such as Process Explorer

2. Download & install an alternative software for Registry Editor (it is also diasbled by destrukto virus) such as mpam4_regedit_xp

3. Reboot computer in SafeMode
How to reboot in safe mode
a) During BootUp process Press F8 continuously until selection appears
b) Use Arrow Up+Down to select SafeMode on the selections menu.
c) Hit Enter to proceed.

4. Run the downloaded Process Manager and disable the WSCRIPT process. You may disable the processes by right clicking them and choose disable.

5. Using Command Prompt or File Manager go to C:\Windows\system32 and rename WSCRIPT.EXE to WSCRIPT.TMP

6. Run the downloaded mpam4_regedit_xp and do as follows:

Navigate to and delete the subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exlorer\wendows&\system32\explorar.vbs

As you run the program, folders can be seen in the left side of the dialog box, follow the registry path below and convert the values of the registries back to their original values before they were infected by destrukto.

Navigate to subkey and modify value:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind
Data Value from 1 to 0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
Data Value from 1 to 0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
Data Value from 1 to 0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Data Value from 1 to 0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
Data Value from 0 to 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoFolderOptions
Data Value from 1 to 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows NT\SystemRestore\DisableConfig
Data Value from 1 to 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows NT\SystemRestore\DisableSR
Data Value from 1 to 0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun
Data Value from 0 to 91 or 95

7. Exit registry editor and restart the computer.

8. By this time you have successfully removed the destrukto virus

Baca Bro Virus

I would like to share with anyone have this virus.

Symptom
No able to launch TaskManager, as it will auto close (Not Disabled by administrator)
No able to launch Regedit.exe as disabled by administrator
You'll found a txt file at C:\Baca Bro !!!.txt
Unable to install any application/run setup bcoz it will auto close

P/S : You dun have to think you could google Antivirus or similar keyword on your browser, bcoz it will auto close your browser.

1st We need to get alternative 3rd party Task manager, i recommend Starter
http://www.snapfiles.com/opinions/Starter/Starter.html

2nd Replace your Task Manager with Process Explorer, which have more details compare with taskmgr.exe
http://www.microsoft.com/technet/sysintern...ssExplorer.mspx

3rd Enable to view SUPER HIDDEN FOLDER, Please download this regtick
http://www.snapfiles.com/get/regtick.html

4th Disable system restore, by follow these steps
- Right Click "My Computer" select System Restore tab and check the small box "Turn Off System Restore"

Lets Start....

Run Starter, kill these processes currently running, KILL THESE PROCESSES IF RUNS UNDER "YOUR USERNAME" NOT THE "SYSTEM". If you accidently kill any process under System, no worry.. Either your pc auto restart or just u need to reboot your pc.

j.exe
o.exe
b.exe
csrss.exe
lsass.exe
services.exe
smss.exe
sv.exe
winlogon.exe

Done, now you should able to run your task manager. Please user Process Explorer. Double check any of these process listed above still running. If yes, please kill it. Completed then now we'll remove the physical files used by this virus. Please access to these locationd and remove all the files

IMPORTANT : PLEASE USE "SHIFT+DELETE"

User>\Local Settings\Application Data\dv[random>\yesbron.com
User>\Local Settings\Application Data\jalak[random>.com
Windows>\_default[random>.pif
Windows>\j[random>.exe
Windows>\o[random>.exe
Windows>\sa[random>\ib[random>.exe
System>\c[random>.com
System>\n\b[random>.exe
System>\n[random>\csrss.exe
System>\n[random>\lsass.exe
System>\n[random>\services.exe
System>\n[random>\smss.exe
System>\n[random>\sv.exe
System>\n[random>\winlogon.exe
Windows>\Tasks\At1.job
Windows>\Tasks\At2.job
System>\n5817\c.bron.tok.txt
C:\Baca Bro !!!.txt <----- If your window installed on C drive,
if D it would be D:\Baca Bro !!!.txt and so on.



Once done, proceed to remove registry

Use regtick to enable your regedit.exe, done proceed to remove the registry entry

The following registry entries are created to run yesbron.com, _default[random>.pif, j[random>.exe and sv[random>.exe on startup:[/span>

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
[random characters>
User>\Local Settings\Application Data\dv[random>\yesbron.com

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run
[random characters>
Windows>\_default.pif

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
[random characters>
System>\n\sv[random>.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[random characters>
Windows>\j[random>.exe

The following registry entries are changed to run j.exe and o.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe "[Windows>\o[random>.exe"

(the default value for this registry entry is "Explorer.exe" which causes the Microsoft file [Windows>\Explorer.exe to be run on startup).

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
System>\userinit.exe,[Windows>\j[random>.exe

(the default value for this registry entry is "[Windows>\System32\userinit.exe,").

The following registry entry is set, disabling the registry editor (regedit):

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Registry entries are set as follows:

HKCU\Software\Brontok
Message
Look @ "C:\Baca Bro !!!.txt"

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

Registry entries are created under:
HKCU\Software\Brontok\

That's all. Thanks

Credits to: MOFO

Media browser Try it!!

I was looking for an internet media source were i can listen to music watch videos and play some games and i came across this website www.dizzler.com , just open the dizzler player and your on your way. you dont even have to register to use it. if you register you can use it on your friendster or myspace account to entertain yourself or others who views your profile it will be embeded as your media bar. Try it.. please comment if you like it : ). I myself Enjoyed it Cheers!!!!

Show Hidden Files Issue / Problem (due to Virus)

The steps are :-

* Open registry( select run command from start menu and type regedit and then press enter)
Find this key in your registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]

Modify the string value "Type" and enter "group" as value data.

After the edit is complete hit F5 to refresh, and go look in your Folder Options
step 2
* In the left pane goto path HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
\Advanced\Folder\Hidden\SHOWALL

* Delete the value CheckedValue in the Right pane by right clicking it and selecting delete. (Its type should be REG_SZ and data should be 2.)

* Create a new DWORD value called CheckedValue by right clicking in the Right pane and then selecting new -> DWORD Value and then changing the name to CheckedValue. (same as above, except that the type is REG_DWORD). Modify the value data to 1 (0×00000001) by right clicking the CheckedValue in the Right pane and selecting modify and changing the value data to 1.

This should let you change the “Hidden Files and Folders” option.

Install NOD32 and update it Then Scan your PC for viruses, i think its the win32.QQrob-32 virus that disabled this option

hope this helps Darick

Internet Explorer Subtitute

We have been using Microsoft Internet Explorer for a long time now and it has made its name in internet browsing. But now i came across a better browser and it is called Mozilla FireFox, why is it better? its faster, safer, and eats less system memory(less memory usage means faster Pc). I've been using it for about a year and wow, i think its the best. it has the feature of Microsoft internet explorer and it offers more, try it and compare the speed in browsing, and security(some viruses targets IE. so meaning firefox is safer). it also has lots of plugins and addons that will make your internet experience better, one example is the Download helper it helps download videos from youtube and other video streaming websites (you dont have to install a separate downloader that will eat memory). just go to tools and then addons, and another thing it has themes to make your browser look cool or fit your mood.. heres a link MozillaFireFox Enjoy!!!

hakaglan.worm

other Names of the worm :Worm.Win32.AutoIt.e, W32/Cocung.worm,W32.Imaut.N, Worm/Hakaglan, W32/SillyFDC-G..

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It creates registry entries to enable its automatic execution at every system startup. It modifies registry entries to enable its automatic execution at every system startup.

It creates registry key(s)/entry(ies). It drops copies of itself in all removable drives.

It disables Task Manager and registry tools. It connects to Web sites to download a file, As a result, routines of the downloaded worm are also exhibited on the affected system.

It creates a scheduled task.

Solution

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Restarting in Safe Mode

This malware has characteristics that require the computer to be restarted in safe mode. Go to this page for instructions on how to restart your computer in safe mode.

Enabling The Registry Editor

This malware disables the Registry Editor. To restore the said system tool, perform the following instructions:
• On Windows 98 ME, NT, and 2000:

1. Open Notepad. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools" = dword:00000000

3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

• On Windows XP and Server 2003:

1. Open the Run dialog box. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

Removing/Restoring Autostart Entry from the Registry

This solution deletes/modifies registry keys/entries added/modified by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
Yahoo Messengger = "%System%\RVHOST.EXE"
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.)
4. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows NT>CurrentVersion>Winlogon
5. In the right panel, locate the entry:
Shell = "Explorer.exe RVHOST.exe"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
Explorer.exe

Removing Added Entries from the Registry

1. Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Explorer>WorkgroupCrawler>Shares
2. In the right panel, locate and delete the entry:
shared = "\New Folder.exe"
3. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Policies>System
4. In the right panel, locate and delete the entry:
DisableTaskMgr = "1"

Deleting the Malware File(s)

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
%Windows%\tasks\AT1.JOB
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the file then press SHIFT+DELETE.

Restart your computer normally before performing the following solution.

Full Scan with nod32 with full updates or use Avira anti virus

Hope this helps yhanny