Show Hidden Files Issue / Problem (due to Virus)

The steps are :-

* Open registry( select run command from start menu and type regedit and then press enter)
Find this key in your registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]

Modify the string value "Type" and enter "group" as value data.

After the edit is complete hit F5 to refresh, and go look in your Folder Options
step 2
* In the left pane goto path HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
\Advanced\Folder\Hidden\SHOWALL

* Delete the value CheckedValue in the Right pane by right clicking it and selecting delete. (Its type should be REG_SZ and data should be 2.)

* Create a new DWORD value called CheckedValue by right clicking in the Right pane and then selecting new -> DWORD Value and then changing the name to CheckedValue. (same as above, except that the type is REG_DWORD). Modify the value data to 1 (0×00000001) by right clicking the CheckedValue in the Right pane and selecting modify and changing the value data to 1.

This should let you change the “Hidden Files and Folders” option.

Install NOD32 and update it Then Scan your PC for viruses, i think its the win32.QQrob-32 virus that disabled this option

hope this helps Darick

Internet Explorer Subtitute

We have been using Microsoft Internet Explorer for a long time now and it has made its name in internet browsing. But now i came across a better browser and it is called Mozilla FireFox, why is it better? its faster, safer, and eats less system memory(less memory usage means faster Pc). I've been using it for about a year and wow, i think its the best. it has the feature of Microsoft internet explorer and it offers more, try it and compare the speed in browsing, and security(some viruses targets IE. so meaning firefox is safer). it also has lots of plugins and addons that will make your internet experience better, one example is the Download helper it helps download videos from youtube and other video streaming websites (you dont have to install a separate downloader that will eat memory). just go to tools and then addons, and another thing it has themes to make your browser look cool or fit your mood.. heres a link MozillaFireFox Enjoy!!!

hakaglan.worm

other Names of the worm :Worm.Win32.AutoIt.e, W32/Cocung.worm,W32.Imaut.N, Worm/Hakaglan, W32/SillyFDC-G..

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It creates registry entries to enable its automatic execution at every system startup. It modifies registry entries to enable its automatic execution at every system startup.

It creates registry key(s)/entry(ies). It drops copies of itself in all removable drives.

It disables Task Manager and registry tools. It connects to Web sites to download a file, As a result, routines of the downloaded worm are also exhibited on the affected system.

It creates a scheduled task.

Solution

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Restarting in Safe Mode

This malware has characteristics that require the computer to be restarted in safe mode. Go to this page for instructions on how to restart your computer in safe mode.

Enabling The Registry Editor

This malware disables the Registry Editor. To restore the said system tool, perform the following instructions:
• On Windows 98 ME, NT, and 2000:

1. Open Notepad. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools" = dword:00000000

3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

• On Windows XP and Server 2003:

1. Open the Run dialog box. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

Removing/Restoring Autostart Entry from the Registry

This solution deletes/modifies registry keys/entries added/modified by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
Yahoo Messengger = "%System%\RVHOST.EXE"
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.)
4. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows NT>CurrentVersion>Winlogon
5. In the right panel, locate the entry:
Shell = "Explorer.exe RVHOST.exe"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
Explorer.exe

Removing Added Entries from the Registry

1. Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Explorer>WorkgroupCrawler>Shares
2. In the right panel, locate and delete the entry:
shared = "\New Folder.exe"
3. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Policies>System
4. In the right panel, locate and delete the entry:
DisableTaskMgr = "1"

Deleting the Malware File(s)

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
%Windows%\tasks\AT1.JOB
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the file then press SHIFT+DELETE.

Restart your computer normally before performing the following solution.

Full Scan with nod32 with full updates or use Avira anti virus

Hope this helps yhanny