Your best source of information and news about xp, hardware and winvista on the internet

January 20th, 2009

You are currently browsing the articles from MS Windows Vista Compatible Software written on January 20th, 2009.

Manual Removal of W32/Downadup.AL Worm

Manual Removal of W32/Downadup.AL Worm.
W32/Downadup.AL is a Worm. The worm will infect Windows systems.
This worm first appeared on January 19, 2009.
Other names of W32/Downadup.AL Worm:
This Worm is also known as Win32/Conficker, W32/Conficker.worm.gen, Mal/Conficker.
Read F-Secure Downadup.AL Details
Read Symantec Downadup.AL Details
Damage Level : Medium/High
Distribution Level:
Medium
Symantec Removal Tool for W32/Downadup.AL Worm
F-Secure Removal Tool for W32/Downadup.AL Worm
Worm Manual Removal Instructions
Recommend Removal from Safe Mode:

How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • [ Kill the Process, Use Killbox if your Access Denied ]
  • The Worm copies itself with the random name with *.dll extension in the following locations
  • %Windows System
  • %Programs Files\Internet Explorer
  • %Programs Files\Movie Maker
  • %All Users Application Data
  • %Windows Temp
    ———————————————
  • %System%\[Random].dll
  • %Program Files%\Internet Explorer\[Random].dll
  • %Program Files%\Movie Maker\[Random].dll
  • %All Users Application Data%\[Random].dll
  • %Temp%\[Random].dll
  • %System%\[Random].tmp
  • %Temp%\[Random].tmp
  • %DriveLetter\RECYCLER\[Folder]\[1fe.a3d][3 random characters]
  • %DriveLetter%\autorun.inf
  • The Worm copies itself with the random name with .tmp extension in the following locations
  • Windows System
  • Windows Temp
  • The worm disables the following services:
  • Windows Automatic Update Service (wuauserv)
  • Background Intelligent Transfer Service (BITS)
  • Windows Security Center Service (wscsvc)
  • Windows Defender Service (WinDefend)
  • Windows Error Reporting Service (ERSvc)
  • Windows Error Reporting Service (WerSvc)
  • The worm attempts to block the access to the following security sites which contain the following strings
  • virus, spyware, malware, rootkit, defender, microsoft, symantec, norton, mcafee, trendmicro, sophos, panda, etrust, networkassociates, computerassociates, f-secure, kaspersky, jotti, f-prot, nod32, eset, grisoft, drweb, centralcommand, ahnlab, esafe, avast, avira, quickheal, comodo, clamav, ewido, fortinet, gdata, hacksoft, hauri, ikarus, k7computing, norman, pctools, prevx, rising, securecomputing, sunbelt, emsisoft, arcabit, cpsecure, spamhaus, castlecops, threatexpert, wilderssecurity, windowsupdate, nai, ca, avp, avg, vet, bit9, sans, cert
    If you have any of these files in running process from task manger, end the process before removal.
    Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
    Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Worm Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, and then continue with the removal.Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
The Worm modifies registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    “TcpNumConnections” = dword:0×00FFFFFE
  • The worm deletes a number of keys from the registry, in order to deactivate the Security Center Notifications and prevent Windows Defender from starting. It also bypasses the Windows Firewall by creating the following registry entry, so that the system can download a copy of the worm:
  • HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List, [PortNumber]:TCP = “[PortNumber]:TCP:*Enabled:[random]”
  • To hide its presence in the system, the worm deletes any System Restore points created by the user, then modifies the following registry keys:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHO WALLCheckedValue = dword:00000000
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, netsvcs = %Previous data% and %Random%
  • During infection, the worm may create a temporary (TMP) file in the the System or Temp folders. The TMP file created is registered as a service kernel driver using the following registry entry:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]
    Type = dword:00000001
    Start = dword:00000003
    ErrorControl = dword:00000000
    ImagePath = “\…\%Path%\[random].tmp”
    DisplayName = [Random]
  • Once the key is created, the file %MalwarePath%\[random].tmp is deleted.An interesting change the worm makes to the registry involves the following registry entries:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
    DisplayName = %ServiceName%
    Type = dword:00000020
    Start = dword:00000002
    ErrorControl = dword:00000000
    ImagePath = “%SystemRoot%\system32\svchost.exe -k netsvcs”
    ObjectName = “LocalSystem”
    Description = %description%
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]\Parameters
    ServiceDll = %Path%
Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find
, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Written by FireFly on January 20th, 2009 with no comments.
Read more articles on W32/Downadup.AL and TMP and worm removal and manual removal and BITS and otherSoftware and Windows XP.

19 Free Best Windows XP Themes of 2008

Just a cool collection of the best xp themes from the previous year... compiled by the folks at softarchive.


Author: various | Website: softarchive.net

Download via Rapidshare

Written by magakos on January 20th, 2009 with 1 comment.
Read more articles on XP Themes and otherSoftware and themes.

Register for MIX09 and Save $400!

MIX09Logo

MIX09 is coming up fast – kicking off in Las Vegas at the Venetian March 18th – 20th. If you register between now and Feb. 13th for MIX09 you can save up to $400 off the conference price – that means you get a full conference pass for $995! To take advantage of this offer, go to the MIX09 Registration page and choose "Register for the event using an RSVP Code" option and use the RSVP code MIX09offer to receive your discount.

Not only will folks at MIX09 get the low-down on the next major release of Silverlight – Silverlight 3 – there will be sessions on IE8 as well as Windows 7 and Multi-Touch. The current list of sessions is available here with more to be added soon.

Mike Swanson highlights the return on your investment in attending conferences like MIX09 in person in a really neat video. Mike talks about quite a bit in 4 minutes but is worth watching if you are asking yourself “why should I go to MIX09?”

If you are going to MIX09 you can MIXtify things by adding “Blog Bling” to your website. You can also download awesome MIX09 desktop backgrounds for your PC. The wallpapers look quite nice in the Windows 7 Beta!

For direct updates on MIX09 - follow MIX09 on Twitter.

Digg This

Written by Brandon LeBlanc on January 20th, 2009 with no comments.
Read more articles on Multi-Touch and Silverlight 3 and MIX09 and Silverlight and otherSoftware and internet explorer 8 and windows 7 and IE8 and Internet Explorer.

RED FOX DAVION PC System

In an effort to provide better gaming PCs in demand today, Red Fox has unveiled a new desktop solution via its AMD technology, the Red Fox Davion PC System. There is no question that the demand for higher specs for gamers has become evident and with that in mind, a new market of high-end desktops has become a market opportunity for desktop manufacturers.

Supporting the latest AMD Phenom II X4 940 processor, ATI 4870 iCQGDDR5 1GB 256-Bit PCIe2 Video Card and 4GB DDRII Memory, Red Fox Davion unleashes the full potential of capability that brings spectacular gaming platform delivering the irrefutable performance to satisfy the gaming desire of extreme gamers.

Red Fox is a known name in the motherboard sector and has since ventured out in the world of desktop and mobile solutions. In an effort to push its brand as a complete desktop solution rather than a simple parts provider, the Red Fox Davion PC system may just achieve that niche thanks to the growing demand for efficient gaming systems in the market today.

Source

Written by PC Freak on January 20th, 2009 with no comments.
Read more articles on Chips and notebooks and motherobard and red fox and otherSoftware and Motherboards and computers and Gaming and Desktop and Desktops and News.

Free Windows Vista Tweaker Software


Ultimate Windows Tweaker is a freeware Tweak UI Utility for tweaking and optimizing Windows Vista, 32-bit & 64-bit. It can simply be downloaded and used as a portable application to customize your Windows Vista to meet your requirements. With judicious tweaking, It can make your system faster, more stable, and more secure with just a few mouse clicks. The tweaker detects whether you have IE 7 or IE 8 installed and accordingly offers you the relevant tweaks only.

The utility has a simple easy-to-use user interface, with the tweaks being classified in separate heads based of their functionality. Most tweaks are hidden inside Vista, and what this tweaker does is to try and put the useful one's in one place. It has over 130 tweaks, but is yet, just a 380 KB .exe file, which does not require an install.

Details of Tweaks :

The tweaks are classified under seven categories and can be accessed through a common interface, just like your Windows Vista Control Panel.
1) Personalization,
2) User Accounts & UAC,
3) System & Performance,
4) Security,
5) Internet Explorer (IE7 / IE8)
6) Network Optimization
7) Additional Options

System Requirements :

Ultimate Windows Tweaker is developed for Windows Vista and supported in all available editions under 32 and 64 Bit. Earlier version of Windows - Windows 95, 98, ME, NT and XP are not supported.

Minimum system configuration :

* Microsoft Windows Vista
* 800x600 screen resolution with 256 colors
* 5 MB free disk space
* Internet Explorer 7 or higher

Recommended system configuration :

* Microsoft Windows Vista
* 1024x768 screen resolution with 32-bit colors
* 10 MB free disk space
* Internet Explorer 7 or higher


Website: winvistaclub.com

Download Here

Written by magakos on January 20th, 2009 with no comments.
Read more articles on Misc. Utilities and Shell Modification and otherSoftware.

Antivirus Protection in best Way

What is the best antivirus protection program to have? That is the question that everyone asks when they buy a new computer or upgrade their internet connection. With broadband becoming more and more popular in recent years, a good antivirus protection program is a must. Threats to your computer are everywhere on the net and without good antivirus protection your privacy may be at risk.

When looking for the best antivirus protection there are a few things you should keep in mind.
1. Does the software offer good customer support?

2. Do they keep the software up to date and upgrade it regularly?

3. Do they block spy ware and Trojans?

4. So they have a firewall feature?

5. Is there a money back guarantee if you’re not satisfied?

Remember to keep all this in mind when searching for the best antivirus protection. In my opinion free antivirus programs aren’t really worth bothering with, as there not kept up to date as frequently as paid services. But at the same time don’t pay a fortune for your service. Sometimes the smaller lesser known companies are a lot cheaper than the bigger antivirus companies and have just as good protection.

Finally, you should definitely never be without virus protection especially if your broadband is always connected. With broadband becoming more popular, there are lot more hackers and viruses out there. Always keep your antivirus protection software up to date and scan your computer for viruses regularly and you shouldn’t have any problems.

Written by magakos on January 20th, 2009 with no comments.
Read more articles on anit-virus support and anti virus protection and remove virus and otherSoftware.

« Older articles

No newer articles