Win32.Vitro

Win32.Vitro Description
Win32.Vitro is a trojan that may be found in questionable websites that provide free online movies. Once you try to watch free online movies, Win32.Vitro will try to trick you into downloading a fake video codec in order to watch the movie you want. If you're tricked into downloading the fake video codec, you'll be infected with the Win32.Vitro trojan. Once infected with Win32.Vitro, it will open a conduit in your computer system through which additional spyware may be installed. Due to Win32.Vitro's malicious activities, rogue anti-spyware programs such as Antivirus 2008, Antivirus 360 and System Protector, may leap into the computer system. These rogues may issue fake popups and system alert messages that interfere with your workflow.

How can I Detect Win32.Vitro?

The most common spyware removal tactic is to uninstall Win32.Vitro by using the "Add/Remove Programs" utility. However, as there may still be hidden Win32.Vitro files, it's possible that Win32.Vitro will reappear after reboot. Follow the Win32.Vitro detection and removal methods below.
Win32.Vitro or Win32:Vitro Automatic Detection (Recommended)

Is your PC infected with Win32.Vitro? To safely & quickly detect Win32.Vitro, we highly recommend you...
Download SpyHunter's Malware Scanner Download SpyHunter's Malware Scanner.

SpyHunter's free version is only for malware detection. If SpyHunter's malware scanner detects Win32.Vitro on your PC, you will need to purchase SpyHunter's malware removal tool to remove Win32.Vitro and other malware threats.
Win32.Vitro Manual Removal Instructions

Below is a list of Win32.Vitro manual removal instructions and Win32.Vitro components listed to help you remove Win32.Vitro from your PC. Backup Reminder: Always be sure to back up your PC before making any changes.

Note: This manual removal process may be difficult and you run the risk of destroying your computer. We recommend that you use SpyHunter's malware detection tool to check for Win32.Vitro.
Step 1 : Use Windows File Search Tool to Find Win32.Vitro Path

1. Go to Start > Search > All Files or Folders.
2. In the "All or part of the the file name" section, type in "Win32.Vitro" file name(s).
3. To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
4. When Windows finishes your search, hover over the "In Folder" of "Win32.Vitro", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete Win32.Vitro in the following manual removal steps.



To remove Win32.Vitro, you must first stop any Win32.Vitro processes that are running in your computer's memory. To stop all Win32.Vitro processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for Win32.Vitro, then right-click it and select "End Process" key.

To delete Win32.Vitro registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\Win32.Vitro." Right-click this registry key and select "Delete."

Finally, to completely get rid of Win32.Vitro, you must manually remove other Win32.Vitro files. These Win32.Vitro files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, Win32.Vitro might create a file like
%PROGRAM_FILES%\Win32.Vitro\Win32.Vitro.exe. Locate and remove these files.
Win32.Vitro Recommendation

RECOMMENDED: To avoid the unnecessary risk of damaging your computer, we highly recommend you use a good malware remover to track Win32.Vitro and automatically remove Win32.Vitro as well as other spyware, adware, trojans, and virus threats in your PC.

If you believe you have Win32.Vitro installed on your computer, check for Win32.Vitro with SpyHunter's Malware Scanner.

Download SpyHunter's Malware Scanner.

SpyHunter's free version is only for malware detection. To remove Win32.Vitro and other malware threats, you will need to purchase SpyHunter's malware removal tool. Since new Win32.Vitro files are constantly being released, it is normally advised to run SpyHunter's scanner weekly to get the latest updates on Win32.Vitro and other malware threats.

To learn more on Win32.Vitro, see our Win32.Vitro resource section below.

Read More......

Malware Catcher 2009

Malware Catcher 2009 is a rogue antispyware program that looks like Virus Shield 2009 and other fake programs from Virus Doctor family. Malware Catcher is distributed through the use fake online malware scanners that tells you that your computer infected with spyware, malware and trojans and that you must install Malware Catcher 2009 to clean your computer. Like other rogue antispyware programs, it uses fake alerts and false positives to trick you into buying the software.
During installation, Malware Catcher 2009 configures itself to run automatically every time, when you start your computer. In addition the program creates a few files. These files during the scan will determine as trojans and spyware. Once running, the rogue will scan your computer and list a large amount of infections that cannot be removed unless you first purchase the software. Running of Malware Catcher 2009 may drastically slow the performance of your computer.

While Malware Catcher 2009 is running your computer will display fake security alerts, that will recommend you purchase the software. Ignore these alerts. Computer users are urged to avoid purchasing this bogus program! Malware Catcher 2009 can be safely removed from your computer along with any other malware if the proper steps are taken. If you are a non-techie computer user then this method of removing the rogue is for you.
Symptoms in a HijackThis Log

O4 - HKCU\..\Run: [Malware Catcher 2009] “D:\Documents and Settings\All Users\Application Data\f5bc4e8\MCatcher.exe” /s /d
Use the following instructions to remove Malware Catcher 2009 (Removal guide)

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

Read More......

Cannot View Hidden Files And Folders

As a result of viruses/trojans activity can be blocked showing hidden files. In Folder options can not take the “Show hidden files and folders” option. You choice the radio button for, then press Apply and OK, but hidden files do not be shown by windows explorer. The changes would just disappear upon opening the dialog again. Or more, no Folder Options in the Tools menu.

There are two methods to restore back the showing hidden files.
1. Manually.

* Click Start -> Run.
* Type regedit and press OK.
* In the left panel navigate to the following keys by expanding the + at left of each key at left:

HKEY_CURRENT_USER
Software
Microsoft
Windows
CurrentVersion
Policies
Explorer

* In the right panel Right click NoFolderOptions, choose “delete”. OK the prompt.
* In the left panel navigate to the following keys by expanding the + at left of each key at left:

HKEY_CURRENT_USER
Software
Policies
Microsoft
Internet Explorer
Restrictions

* In the right panel Right click NoBrowserOptions, choose “delete”. OK the prompt.
* In the left panel navigate to the following keys by expanding the + at left of each key at left:

HKEY_LOCAL_MACHINE
SOFTWARE
Microsoft
Windows
CurrentVersion
Explorer
Advanced
Folder
Hidden
SHOWALL

* In the right panel Right click CheckedValue, choose “Edit”. This should be a DWORD key. If it isn’t, delete the key. Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1.
* Reboot your PC.

2. Automatically.

* Open notepad and copy/paste the text in the quotebox below into it:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
“NoFolderOptions”=-

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
“NoBrowserOptions”=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
“CheckedValue”=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
“CheckedValue”=dword:00000001

* Save this as fix.reg to your Desktop (remember to select Save as file type: All files in Notepad.).
* Double-click on the fix.reg. When it asks if you would like to merge the information, press the Yes button and then the OK button when it is done.
* Reboot your PC.

If none of the above methods work, then probably you infected with virus or trojan, that blocked of show hidden files. Then I would recommend you follow the instructions.

or

Go to Start --> Run, then type Regedit
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.)


and hen do this method

and also use repairing cd for registry

Read More......

How to enable registry whe infected by virus

When your registry is being disabled:

First, maybe the administrator disabled it for some restriction purposes

Second, due to virus. Most of the virus disabled the regedit for you to unable to stop the execution of its program.

Here are the solutions for enabling the regedit again.

* Use the gpedit.msc to enable the registry editor.

Step 1: Hit the window or click start button then press "r" or simply click the run

Step 2: type gpedit.msc

Step 3: Click user configuration then Administrative Templates

Step 4: Click the System and locate the Prevent access to registry editing tools and double click on it

Step 5: Select the enabled on the optionbutton the click apply.

This will make a policy to prevent access to the registry editing tools, The computer will automatically made the policy.

Step 6: After clicking on apply select the disabled in the option button then click the apply again then click ok button when finished.

The disabled button will make the policy into default, the computer will automatically configured it and becomes a default comfig which is the registry editor can be access by the user.

And Thats it... Try run the regedit.exe... Have Fun!!!!

Read More......

Boot.com virus

C:/resycled/boot.com is a virus. it doesn't let you open hard drives and external hard drives, including usb drives. The best anti-virus program you can get i AVG.

two ways to do it
A)

Open a cmd prompt. Start > Run... [type in] cmd > Ok
At the prompt, enter the following two commands:

attrib -h -r -s C:\Autorun.inf

del C:\Autorun.inf

--------------------
B)


Start Windows in safe mode, then click Start -> Run. Type in regedit and click okay.

Now at the top of the registry editor, click Edit -> Find. Type boot.com and click Find Next. Every time it finds a new boot.com, press the delete key and then enter. It should find a dozen or so copies.

Now, plug in any external drives or flash drives you have used with this computer. Open My Computer. Click Tools -> Folder Options -> View and select "Show Hidden Files and Folders" and click okay.

For each drive, open it and delete the resycled folder and autorun.inf. Back up each autorun.inf before deleting them off external drives, because they might be important.

Restart the computer and the problem should be gone.

Read More......

Boot.com virus

C:/resycled/boot.com is a virus. it doesn't let you open hard drives and external hard drives, including usb drives. The best anti-virus program you can get i AVG.

two ways to do it
A)

Open a cmd prompt. Start > Run... [type in] cmd > Ok
At the prompt, enter the following two commands:

attrib -h -r -s C:\Autorun.inf

del C:\Autorun.inf

--------------------
B)


Start Windows in safe mode, then click Start -> Run. Type in regedit and click okay.

Now at the top of the registry editor, click Edit -> Find. Type boot.com and click Find Next. Every time it finds a new boot.com, press the delete key and then enter. It should find a dozen or so copies.

Now, plug in any external drives or flash drives you have used with this computer. Open My Computer. Click Tools -> Folder Options -> View and select "Show Hidden Files and Folders" and click okay.

For each drive, open it and delete the resycled folder and autorun.inf. Back up each autorun.inf before deleting them off external drives, because they might be important.

Restart the computer and the problem should be gone.

Read More......

Solving windows XP boot/ StartUp problems

Sometimes you may find that windows XP has suddendly stoped booting. You are giving proper power, than also XP is not booting. You made no change in system, and than also it is not booting. There can be several cause for this. We will discuss few methods to fix the problem.

1) Fixing using Windows startup disk
Sometimes XP fail to boot becaused its startup record and files used by XP to start windows become corrupted. This method can be just perfect to solve the problem.

First we must learn how to create startup disk.Please follow steps to make a startup disk.
Create a windows StartUP Disk

Now, insert the startUp Disk in floopy drive, and go to BIOS setting , by pressing DEL or F2 button at startup.Make your follopy drive as first booting device.Save the setting, and exit BIOS settings. REstart system. System will now boot using the windows startup disk.

When you boot from the Windows startup disk, the computer will bypass the active partition and boot files on the hard disk and attempt to start Windows XP normally.

2) Using Last Known Good Configuration
Windows OS has great feature of using Last Good Configuration. We can use Last Known Good Configuration feature to boot. This feature will undo any changes that is causing problems in the CurrentControlSet registry key which defines hardware and driver settings. The Last Good Configuration keep backup of CurrentControlSet registry key . When we use this feature, Last Known Good Configuration feature will replaces the contents of the CurrentControlSet registry key with a backup copy that was last used to successfully start up the operating system.

How To use Last Known Good Configuration feature:
Press F8 key continuouslt while booting. You will get windows advance optins menu.Select the Last Known Good Configuration item from the menu and press enter key. Also, this feature can be used for only one time. If it fails on first attempt, the backup copy will also get corrupt.

3) Using System Restore
At system startup press F8 key continuously to get Windows Advanced Options menu. From menu select Safe Mode and press enter.Log in as Administrator. If windows boot in safe mode, you can use system restore to solve startup problem.

How To restore windows to best known configuration:
Start -->> All Programs -->> Accessories -->> System Tools -->> System Restore

System Restore page will open -->>click Restore my computer to an earlier time -->> Next -->> select a date -->> select a restore point -->> Next -->> OK -->> Next -->>Restarts the computer.

Read More......

Enable Regedit back When it is Disabled

Sometimes, a virus such Brontok variants could disable your built-in Windows registry editing tool, which is regedit. It might also because of limited account’s level access where you are only a normal user and not an administrator with full access of the system. Now, one simple way to indicate the problem is whenever you are trying to open the regedit program through “run”, you will get the following message:

“Registry Editing Has Been Disabled By Your Administrator”

how to enable it back?

You can try this method if you want. Take the risk on in your responsibility.

How to: Select all the codes below. Copy (Ctrl+C) and paste them (Ctrl+V) in the Run window. Press enter, and there you are!

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

Read More......

Cannot Open Disk Drive On Double Click

Problem:
Double click on disk drive (C:\ D:\ E:\....)in my computer doest open the drive, instead get error as:
1) Access Denied
2) Choose the program you want to use to open this file with.
3) VBScript error with error code of 800A041F
4) Drive opens in new windows.

Cause:
Your system is infected by some virus/ spyware .A autorun.vbs file is created by virus which is causing this problem. The virus creates autorun.inf file to root folder of all hard disk drive or USB drive/ external storage devices.This files creates a autorun.reg file and make some changes in windows registry.



Solution:
1) Log in as Administrator or user with admininstrator rights.
2) Turn Off system restore.
Start-->> Right Click My Computer-->> Properties-->> Systen Restore Tab-->>Turn off System Restore on all drives-->> Apply-->> Ok.
1) Launch Task Manager by pressing alt+ctrl+del
2) click on processes tab.
3) Find wscript.exe, If it is running end this process..
4) End EXPLORER.EXE process from Task Manager
5) In task manager, click File-->> New Task (Run..)-->> type cmd --> ok
6) Command prompt will open.Type these commands one by one after Enter key:
del c:\autorun.* /f /s /q /a
del d:\autorun.* /f /s /q /a
del e:\autorun.* /f /s /q /a

c:/ D:/ E:/ are disk drives.
7) Again in Task Manager-->>File -->> New Task (Run…)-->>Type regedit -->> OK.
8) Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

9) Find this key: userint.exe
make sure its value is Userinit”=”C:\WINDOWS\system32\userinit.exe,
If, It is not, than changed value to this value.

10) Restarst system.Done!!!

Read More......