Recently another rogue ware called WiniFighter is making its attempt to misguide users to buy their full version. This software on installation, adds its own files into system and later on it detects those dummy files installed by itself as threats and requires users to buy a full version by paying $49.95.

Here are the removal instructions for WiniFighter:

1. Download and install free version of either Malwarebytes Anti Malware or Super Antispyware. You may use anyone if you have internet connectivity on the system where the rogue software is installed. Super Antispyware has offline definition updates so that it would work for offline computers too. Remember to update the program you just installed.

2. A restart may be required by the program. Its better to carry on a restart manually even if it does not ask for.

3. While booting the system, press F8 and choose Safe Mode to start Windows.

4. In Safe Mode, the startup programs are not loaded and it makes your job much easy. Now, open the anti malware program and perform a complete scan.

5. It detects a number of related files and registry entries for the rogue ware Winifighter.exe, remove all them.

6. It may require you a restart sometimes.

7. Open the quarantine list and if it is found on quarantine list, you may now remove them from that too to get your system completely free of WiniFighter.

Also read: Remove BV:AutoRun-G[Wrm], Remove mediacontrol.exe – virus renaming files to jpg

Related posts:

1. Solving different virus/malware attacks An easy step by step solution to clean all viruses. Viruses that disable task manager,...
2. Remove Virus Renaming your Media-MP3, MPEG, AVI to JPG: MediaControl.exe Mediacontrol.exe is the virus hitting different computers all over renaming the file extensions for mpg,...
3. Powerful Audio Video software | Blaze Media Pro An introduction to the most powerful audio video software Blaze Media Pro. Get all your...

CA antivirus detected few genuine Windows files as threats and moved them to quarantine. This raised a Windows warning to insert the installation disk in order to copy the changed system files.

There has been many discussions carried on CA security support forum and it has been cleared from the forum moderators that this is just a false positive and there is no need to panic. Though this issue has been a hot topic in their forums and all over the internet, there has been no update from CA on their blog, but somewhere on forum it is stated that the next update will carry a solution / fix for this problem.

The other widely detected amalum series viruses are: ZZNRA,ZZOAF,ZZNPB,ZZOKH, ZZNXU

If you are a CA AV user and got the warning, you may safely restore the files from quarantine with no infection on your system.

Other interesting virus solutions: Recycler Virus, Media Control Virus

Related posts:

1. Generic Host Process for Win32 Services Error Solution Fix Generic Host Process for Win32 Services which disconnects your broadband internet connection after few...
2. Solution to Generic Host Process for Win32 Services Here are two different working solutions for Generic Host Process for Win32 Services. One solution...
3. Solving virus/malware attacks: Part 2 Solving virus solutions which even pops its activity in safe mode. Kill viruses in an...

It is the conficker eye chart which easily detects the existence of the worm on your computer. It works in a simple way by fetching the images from different security websites which are being blocked by the virus. If your browser displays every image in a proper way, you are not infected by the worm. If you see few images are loading and rest are being blocked, you may be infected and you can find the explanation on which variant has infected you in the details given in the page.

Conficker eye chart is a free work and everyone is free to use the same without any permission by the author. If you own a website, you can publish the same page on your website too  

Related posts:

1. Upgrade XP/Vista to Windows 7 to Secure from April 1 Worm/Conflicker Virus Conflicker Worm is more expected to hit Windows XP and Vista to a greater extent....
2. April Fool about Conflicker Worm How I fooled all my visitors....
3. How to remove recycler virus / autorun virus from USB flash drives Fix the most bugging virus of today - BV:AutoRun-G[Wrm] or Recycler virus or recycler.exe virus....

To solve the problem, you need to follow these steps to remove the virus from your hard disk.

1. Open task manager [alt+ctrl+del] and move on to processes tab, find mediacontrol.exe. End Process. More on using task manager to kill virus here.

2. Now, Start > Run [keyboard shortcut: Winkey + R] > type msconfig > ok. Move to startup tab, find the mediacontrol.exe and uncheck it.

3. Goto System32 folder in C:\Windows [mostly, may vary based on your OS installation], find folder Mcont and delete. If not possible, you may need to use unlocer to delete the folder. Details here. If you fail in this step, you may start your computer in safe mode and try again.

4. Now, you have cleared your computer from virus. Its time to undo all changes it has done. Use Extension Renamer utility to rename file extensions back to their original file extensions. Some prior knowledge is requried for this about the type of file. You will find it difficult if you have kept all your songs and movies in a single folder.

Note: This virus may also be found in these names: 81308957.EXE, 39715419.EXE, 32454595.EXE, COPY.EXE, MEDIACONTROL.DOC, 23073198.SVD, 63532069.SVD. The file size may vary from 270 to 290kb.

Related posts:

1. Virus Removal Solution: BV:AutoRun-G[Wrm] / Recycler Virus Remove the Recycler Virus - BV:Autorun-G[Wrm]. Follow the instructions to remove Recycler.exe virus from USB...
2. How to remove recycler virus / autorun virus from USB flash drives Fix the most bugging virus of today - BV:AutoRun-G[Wrm] or Recycler virus or recycler.exe virus....
3. Combat multiple virus problems Virus! the most popular application, can affect your system in any way. Thieves always try...

Here are few steps you can try out, though I could not get that virus to deal with again, here is what one can generalize the steps which you may use to disable any virus.

First, once you plug in your pen drive and double click it, the recycler.exe starts running in your system. First stop it running – Open task manager (Alt Ctrl Del or Ctrl Shift Esc), click on Applications tab, and you will be able to see all running processes at the current time. Among these, a few are running under the name of the administrator / user of the computer. Now, if you find any recycler.exe running under user name, right click on that and end process.You can read about virus solution with task manager.

Now, on the explorer (say My Documents), click on Tools > Folder Options > View, now make it to show hidden files and also OS files.

Now, right click on USB drive icon in My Computer and click Explore.

Here you can notice the autorun.inf file (mostly you will not see the file extension, no problem). Also, you will find recycler.exe. Delete both of them.

Get back to My Computer and rename the USB drive.

BV:Autorun-G[Wrm] is a strange virus and following the above procedure will not kill that. The virus will reform itself and still be seen on the Flash drives.

Few antivirus softwares like Kaspersky and Nod32 are said to remove the recycler virus completely. Though Kaspersky removes the recycler.exe, you need to follow the above steps in order to remove the autorun property of pen drive.

You may also try with Autorun Eater. Autorun Eater removes all suspecious autorun.inf files automatically. It is a popular program which may be of help here. If you find this procedure as a tough one for you, you can try disabling BV:Autorun-G[Wrm], but with this way, you will be able to deactivate the effect of this virus.

Related posts:

1. How to remove recycler virus / autorun virus from USB flash drives Fix the most bugging virus of today - BV:AutoRun-G[Wrm] or Recycler virus or recycler.exe virus....
2. Combat multiple virus problems Virus! the most popular application, can affect your system in any way. Thieves always try...
3. Remove Virus Renaming your Media-MP3, MPEG, AVI to JPG: MediaControl.exe Mediacontrol.exe is the virus hitting different computers all over renaming the file extensions for mpg,...

• Download Flash Disinfector and save on some non windows drive.
• Double click on it and it will ask you to insert USB flash drive and click ok. Do so.

• Clicking on ok will make your desktop go blank, don’t worry, its normal.
• It will fix the autorun.inf virus and you are done partially. Yes, its a partial solution, it will lock the autorun file and you will see some file created by flash disinfector. If you remove the file, the virus get re activated. May be some future update of our antivirus softwares will have complete fix for this.

Thanks Sai Computers.

Related posts:

1. Virus Removal Solution: BV:AutoRun-G[Wrm] / Recycler Virus Remove the Recycler Virus - BV:Autorun-G[Wrm]. Follow the instructions to remove Recycler.exe virus from USB...
2. Remove Virus Renaming your Media-MP3, MPEG, AVI to JPG: MediaControl.exe Mediacontrol.exe is the virus hitting different computers all over renaming the file extensions for mpg,...
3. Solving virus/malware attacks: Part 2 Solving virus solutions which even pops its activity in safe mode. Kill viruses in an...

The trojan was reported not to behave as normal malwares or spyware, but used to block two popular torrent sites – Mininova and The Pirate Bay.

Solution to Unblock Torrent Sites:

The blocking of Mininova and The Pirate Bay were due to the fact that the trojan edited the hosts file. This kind of behavior was observed with antivirus 2009. Here are simple steps [windows] to unblock the torrent sites:

• Goto C:WindowsSystem32Driversetc – I assume you have installed windows on C drive, if not make proper changes.
• Find the file hosts – Open it with Notepad.
• You will find few entries which to redirect Mininova, The Pirate Bay and Superbay [The Pirate Bay forum] to 127.0.0.1 – localhost – so those sites cannot be accessed from your computer .
• Now, delete those lines related with Mininova and other torrent sites. Now you have unblocked the torrents.

Note: This post is a solution to the problem based on the source report. We are not sure if the trojan runs continuously on your system or is it a one time affection. So, its recommended for you to go through our general virus solutions to clean your system and also keep your antivirus and antispyware softwares updated.

Solution to kill rootkits

Solution to task manager disabled

Solution to kill virus which run automatically

Related posts:

1. Virus Removal Solution: BV:AutoRun-G[Wrm] / Recycler Virus Remove the Recycler Virus - BV:Autorun-G[Wrm]. Follow the instructions to remove Recycler.exe virus from USB...
2. How to Download if Torrent Blocked at College / Office Here is how you can download torrents even if the torrent is blocked at your...
3. How to remove recycler virus / autorun virus from USB flash drives Fix the most bugging virus of today - BV:AutoRun-G[Wrm] or Recycler virus or recycler.exe virus....

It becomes wise to avoid such infections rather than cleaning PC after infection. It is always recommended to keep updated antivirus, antispyware and firewall running. Here is one firefox addon Web of trust to check your browser security. This add on will check if the site you are visiting is safe or not and warns you before you visit. This also has an added feature that it displays a warning icon next to the search engine results.

You will also be able to setup the protection level of the add on on your system and also you can put some websites in your whitelist which you trust and the add on identifies as restricted for safety.

The specialness of this addon lies in the depth of customization of settings. You can set to rate and warn websites based on vendor reliability, privacy and child safety. Also you can setup for its behavior with search engines and on which search engines it should show the ratings. It would be better to have such an assistant for online security.

Related posts:

1. How to Test Browser for Security Vulnerability Issues Browser is your main gateway to internet, it becomes a primary concern that the browser...
2. IE Tab :: Run Internet Explorer on Firefox Everything runs very fine with firefox. But, whenever I wish to read any non-English blog,...
3. How To Test Website in Multiple Browsers for Compatibility Web developers are required to test website loading, properties, behavior and experience. Its tough to...

Till now we have seen different virus/malwares. Most of them do affect our computer by making its very common features not accessible like making the task manager disabled for the end user. We have even discussed solutions for them. Today, we shall discuss another hack/ tweak in windows xp which disables/ enables the shutdown option or log off option in your windows computer.

I am discussing this as I guess a chance of such attack with coming day viruses. Here is the step by step procedure you need to follow to enable or disable the shutdown/ turn off from start menu or task manager or even from windows security dialog box.

1. Cli ck Start > Run.

2. Type gpedit.msc and press enter to open the group policy editor.

3. Under the User Configuration, goto Administrative templates and further move on to Start Menu and Taskbar.

Under t hat menu, find Remove and prevent access to Shut Down command, double click on that to open a setting dialog box.

• Set it to enabled to disable the turn off option on your windows.
• Set it to disabled to enable the turn off option on your windows.

Setting for Log off option:

Follow the same procedure as above, but choose Remove Logoff on start menu in step 4.

Here is the explanation for Remove and prevent access to shut down command as provided by Microsoft:

Prevents users from shutting down or restarting Windows.

 

This setting removes the Shut Down option from the Start menu and disables the Shut Down button on the Windows Security dialog box, which appears when you press CTRL+ALT+DEL.

 

This setting prevents users from using the Windows user interface to shut down the system, although it does not prevent them from running programs that shut down Windows.

 

If you disable this setting or do not configure it, the Shut Down menu option appears, and the Shut Down button is enabled.

 

Note: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting.

 

And the below one for Remove logoff from start menu:

Removes the "Log Off <username>" item from the Start menu and prevents users from restoring it.

 

If you enable this setting, the Log Off <username> item does not appear in the Start menu. This setting also removes the Display Logoff item from Start Menu Options. As a result, users cannot restore the Log Off <username> item to the Start Menu.

 

If you disable this setting or do not configure it, users can use the Display Logoff item to add and remove the Log Off item.

 

This setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press Ctrl+Alt+Del, and it does not prevent users from using other methods to log off.

 

Tip: To add or remove the Log Off item on a computer, click Start, click Settings, click Taskbar and Start Menu, click the Start Menu Options tab and, in the Start Menu Settings box, click Display Logoff.

 

See also: "Remove Logoff" in User Configuration\Administrative Templates\System\Logon/Logoff.

You may also use this computer prank to play with your friends…

Related posts:

1. Top 10 Best Computer Pranks for April Fool’s Day April Fools day is very funny day. Many people look for pranks to play on...
2. Virus Removal Solution: BV:AutoRun-G[Wrm] / Recycler Virus Remove the Recycler Virus - BV:Autorun-G[Wrm]. Follow the instructions to remove Recycler.exe virus from USB...
3. Combat multiple virus problems Virus! the most popular application, can affect your system in any way. Thieves always try...

The first part of this article made a debut entry on google sharokh.exe, a widespread virus. And now, I am dealing with the next step malwares which will start themselves even in safe mode. To state in particular, I was infected with rqRJyxWO.dll and awtqqNef.dll. The second one was not creating so much inconvinience. I explain how to remove them.

As I told second one was not a big problem but the first one, was the first one of its kind I have ever seen in my life. That was stored in system32 folder and used to start itself in association with winlogon.exe, a critical system process for windows. I could not even end the process nor I could delete the viral file. It was detected by my antivirus program, but that too failed to clean the file. The main problem this dll created was to kill my explorer.exe process, so whenever the windows is startup, this used to get activated with winlogon.exe and end my explorer process, this was even true with safe mode. Even if I start explorer manually, it got killed again. As I was busy with my project work, I restored my system with ghost, but finally got a solution to the problem which I am going to explain step by step.

• You need: Unlocker, RRT and your antivirus updated. Install unlocker.
• I don’t deal much with RRT now as you all are already aware how to solve viral attack with that.
• The central solution here is for a virus/ adware/ malware which is detected but could not be deleted by antivirus tool.
• In your antivirus tool, note down the location of such files.
• Goto that location and right click on the file, use unlocker to delete the file as shown in the snap below.

 I recommend you the most to keep your partition backup using ghost for quick recovery of your system in case of any OS problems.

Solution for autorun.exe virus disabling your partition open/explore:

Though you don’t have any virus detected by your antivirus, whenever you double click on any partition, a "open with" dialogue pops up for you to choose which application to use to open that drive.

That is because of autorun.inf file stored on the drive which instructs computer to open a particular application whenever there is an attempt to open that drive and that application will be a virus which is already deleted / quarantined by your antivirus.

Now, you have to open folder options and make all files visible and delete the autorun.inf file. Alternately, you may create a new autorun.inf file and paste on the existing one to replace that and delete the new one manually. To create a dummy file, open notepad, goto file>save as>choose all files rather than text files(.txt) and key in the file name autorun.inf and save in a location and use that.

Now, just rename your partition and you are done! Now, its accessible.

Related posts:

1. Solving different virus/malware attacks An easy step by step solution to clean all viruses. Viruses that disable task manager,...
2. Virus Removal Solution: BV:AutoRun-G[Wrm] / Recycler Virus Remove the Recycler Virus - BV:Autorun-G[Wrm]. Follow the instructions to remove Recycler.exe virus from USB...
3. How to remove recycler virus / autorun virus from USB flash drives Fix the most bugging virus of today - BV:AutoRun-G[Wrm] or Recycler virus or recycler.exe virus....