Your best source of information and news about winvista, vista and secrets on the internet

May 10th, 2009

You are currently browsing the articles from MS Windows Vista Compatible Software written on May 10th, 2009.

Manual Removal of W32/Rbot.WQV Trojan

Manual W32/Rbot.WQV Trojan
W32/Rbot.WQV is a trojan. The trojan will infect Windows systems.
This trojan Copies its files to Windows\System Folder as hidden files.
This trojan information updated on May 6, 2009.
Other names of W32/Rbot.WQV Trojan:
This trojan is also known as Win32/Rbot, W32.Spybot.Worm, Worm.Rbot.AFAE.
Damage Level : Medium/High
Distribution Level:
Medium
W32/Rbot.WQV Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:

How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • [ Kill the Process, Use Killbox if your Access Denied ]
Download W32/Rbot.WQV Trojan Known File Removal Tool

[In Windows Vista Run As Administrator, After Execution System Will Restart]

  • %Windows\System\ssms.exe [ More Info ]
  • %Windows\System32\ssms.exe
  • %Root Windows Drive\1.reg
  • %Root Windows Drive\a.bat
    [ No Exact Information about Files, search above related files in Program files Folder ]
    If you have any of these files in running process from task manger, end the process before removal.
    Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg [ Right Click - Save Target As/Linked Content As ]
    Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
W32/Rbot.WQV Trojan Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, [ Right Click - Save Target As/Linked Content As ]
    and then continue with the removal. Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]
W32/Rbot.WQV Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:
Delete The Entries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete : ssms.exe
HKEY_CURRENT_USER\Software\Microsoft\OLE
Windows Update ssms.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters
TransportBindName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\parameters
AutoShareWks value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\parameters
AutoShareServer value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
NameServer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
ForwardBroadcasts value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
IPEnableRouter value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Domain
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
SearchList
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
UseDomainNameDevolution value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
EnableICMPRedirect value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DeadGWDetectDefault value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DontAddDefaultGatewayDefault value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
EnableSecurityFilters value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
AllowUnqualifiedQuery value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
PrioritizeRecordData value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
TCP1320Opts value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
KeepAliveTime [REG_DWORD, value: 00023280]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
BcastQueryTimeout [REG_DWORD, value: 000002EE]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
BcastNameQueryCount value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
CacheTimeout [REG_DWORD, value: 0000EA60]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Size/Small/Medium/Large value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
LargeBufferSize [REG_DWORD, value: 00001000]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
SynAckProtect value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
PerformRouterDiscovery value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
EnablePMTUBHDetect value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
FastSendDatagramThreshold [REG_DWORD, value: 00000400]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
StandardAddressLength [REG_DWORD, value: 00000018]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DefaultReceiveWindow [REG_DWORD, value: 00004000]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DefaultSendWindow [REG_DWORD, value: 00004000]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
BufferMultiplier [REG_DWORD, value: 00000200]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
PriorityBoost value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
IrpStackSize value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
IgnorePushBitOnReceives value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DisableAddressSharing value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
AllowUserRawAccess value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DisableRawSecurity value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DynamicBacklogGrowthDelta [REG_DWORD, value: 00000032]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters FastCopyReceiveThreshold [REG_DWORD, value: 00000400]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
LargeBufferListDepth value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
MaxActiveTransmitFileCount value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
MaxFastTransmit [REG_DWORD, value: 00000040]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
OverheadChargeGranularity value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
SmallBufferListDepth [REG_DWORD, value: 00000020]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
SmallerBufferSize [REG_DWORD, value: 00000080]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
TransmitWorker [REG_DWORD, value: 00000020]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DNSQueryTimeouts [REG_MULTI_SZ, value: “1″, size: 26 bytes]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DefaultRegistrationTTL [REG_DWORD, value: 00000014]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DisableReplaceAddressesInConflicts value:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
DisableReverseAddressRegistrations value:

Delete file entries from right side
Search Registry For W32/Rbot.WQV Trojan File Names listed above to remove completely,
Edit Menu - Find
, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)
Ultimate Links PC Tips

Written by FireFly on May 10th, 2009 with no comments.
Read more articles on W32/Rbot and W32/Rbot.WQV and ssms.exe and Backdoor.Win32.Rbot.gen and manual removal and otherSoftware and removal of trojan and Windows.

Remove Malware Catcher 2009 - MalwareCatcher 2009 Removal Instructions

Malware Catcher 2009 is latest rogue antispyware program from the same family as System Guard 2009 and Spyware Protect. Malware Catcher 2009 is advertised with a help of fake online antispyware scanners and Trojan horses. Once installed, Malware Catcher 2009 will configure itself to run automatically every time you turn your computer. While running, parasite will flood your system with annoying pop-ups, fake screens of death. Also Malware Catcher 2009 will constantly perform full system scan and list you variety of infections that cannot be removed until you first purchase licensed version. But you must remember that all those infections are non-existent or legitimate Windows files and displayed with one purpose – to scare you and push into purchasing licensed version. Important to notice that Malware Catcher 2009 can dramatically slow your computer performance, hijack your web browser, download more malware. Remove Malware Catcher 2009 as soon as possible manually or using automatic removal tool.

Type: Rogue Anti-Spyware
Malware Author: Unknown
Threat Level: Critical
Screenshot:

Malware Catcher 2009 Automatical Removal Tool

How to remove Malware Catcher 2009 manually:
It's possible to remove Malware Catcher 2009 manually, but you have to be very experienced in dealing with registry entries, program files and .dll files.

The files to be deleted:

%UserProfile%\Recent\cb.tmp
%UserProfile%\Recent\CLSV.dll
%UserProfile%\Recent\CLSV.drv
%UserProfile%\Recent\eb.tmp
%UserProfile%\Recent\energy.exe
%UserProfile%\Recent\energy.sys
%UserProfile%\Recent\energy.tmp
%UserProfile%\Recent\exec.dll
%UserProfile%\Recent\fix.sys
%UserProfile%\Recent\PE.drv
%UserProfile%\Recent\PE.sys
%UserProfile%\Recent\std.drv
%UserProfile%\Recent\tjd.exe
%UserProfile%\Recent\tjd.tmp
%UserProfile%\Start Menu\Malware Catcher 2009.lnk
%UserProfile%\Start Menu\Programs\Malware Catcher 2009.lnk
c:\Documents and Settings\All Users\Application Data\7c69f0c
c:\Documents and Settings\All Users\Application Data\7c69f0c\MCatcher.exe
c:\Documents and Settings\All Users\Application Data\7c69f0c\SystemFeed
c:\Documents and Settings\All Users\Application Data\7c69f0c\SystemFeed\vd952342.bd
c:\Documents and Settings\All Users\Application Data\SystemFeed
c:\Documents and Settings\All Users\Application Data\SystemFeed\mctch.ini
%UserProfile%\Application Data\Malware Catcher 2009
%UserProfile%\Application Data\Malware Catcher 2009\Instructions.ini
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Catcher 2009.lnk
%UserProfile%\Desktop\Malware Catcher 2009.lnk


Remove registry entries:

HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\MCatcher.DocHostUIHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "[xSP_2:2092962508]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "6989019803"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Malware Catcher 2009"


Please be careful because manual removal of Malware Catcher 2009 may seriously damage operational system and sensitive data. Also there is a big possibility of incomplete removal, because some files could be hidden and program could re-install itself after you delete files and registry entries. So we strongly recommend you to use automatical removal tool.

Written by admin on May 10th, 2009 with no comments.
Read more articles on rogue antispyware and trojan horse and fake warnings and removal tool and AntiSpyware and 2009 and Privacy and malware and otherSoftware and Security.

K Desktop Environment (KDE)

The K Desktop Environment (KDE) is a network-transparent desktop that includes the standard desktop features, such as a window manager and a file manager, as well as an extensive set of applications that covers most Linux tasks. KDE is an Internetaware system that includes a full set of integrated network/Internet applications, including a mailer, a newsreader, and a Web browser. The file manager doubles as a Web and FTP client, enabling you to access Internet sites directly from your desktop. KDE aims to provide a level of desktop functionality and ease of use found in Macintosh and Windows systems, combined with the power and flexibility of the Unix operating system.

Several editions of Ubuntu, such as Xubuntu, use the Xfce desktop instead of either GNOME or KDE. Xfce is designed as a stripped down desktop with very little resource overhead; it’s ideal for laptops or systems dedicated to single tasks. Ubuntu Hardy, Ubuntu 8.04 LTR, will officially support and include KDE 3.5, not KDE 4.0. This is because the long-term release (LTR) of Ubuntu is designed for stability. KDE 4.0 is too new a release to guarantee that stability. Only KDE 3.5 will be provided the full 18 month support provided for the LTR release (this does include the new Dolphin file manager).

However, a KDE 4.0 version for Ubuntu 8.04 will be provided in the Universe repository. This version will offer six-month community-based support until the next Ubuntu short-term release, Ubuntu 8.10. A kubuntu4 disc is available for those who want to install KDE 4 directly. The situation is complicated by the fact that the Kubuntu edition of Ubuntu for 8.04 has integrated some KDE 4 features, namely the Dolphin file manager and the System Settings configuration tool. Kubuntu still provides the KDE 3.5 Konqueror file manager for use on Kubuntu 8.04. The older 3.5 version used for alternate desktop installation on the original desktop still uses the Konqueror file manager and Control Center configuration tool. The Kubuntu edition of Ubuntu installs KDE as the primary desktop from the Kubuntu install disc. You can download this disc from the Kubuntu site at www.kubuntu.org/. Here you will also find download links for the kubuntu4 disc. You can also download the discs directly from http://cdimage.unbuntu.com or http://releases.ubuntu.com.

The KDE desktop is developed and distributed by the KDE Project, a large group of hundreds of programmers from around the world. KDE is open source software provided under a GNU Public License and is available free of charge along with its source code. KDE development is managed by the KDE Core Team. Anyone can apply for team membership, though membership is based on merit.

Numerous applications written specifically for KDE are easily accessible from the desktop. These include editors, photo and paint image applications, spreadsheets, and office applications. Such applications usually have the letter K as part of their name—for example, KWord or KMail. A variety of tools are provided with the KDE desktop. These include calculators, console windows, notepads, and even software package managers.

On a system administration level, KDE provides several tools for configuring your system. With KUser, you can manage user accounts, adding new ones or removing old ones. Practically all your Linux tasks can be performed from the KDE desktop. KDE applications also feature a built-in Help application. Choosing the Contents entry from the Help menu starts the KDE Help viewer, which provides a Web page–like interface with links for navigating through the Help documents. KDE version 3 includes support for the office application suite KOffice, based on KDE’s KParts technology. KOffice includes a presentation application, a spreadsheet, an illustrator, and a word processor, among other components.

In addition, an integrated development environment (IDE), called KDevelop, is available to help programmers create KDE-based software. KDE, which was initiated by Matthias Ettrich in October 1996, was designed to run on any Unix implementation, including Linux, Solaris, HP-UX, and FreeBSD. The official KDE Web site is http://kde.org, where you’ll find news updates, download links, and documentation. KDE software packages can be downloaded from the KDE FTP site at ftp://ftp.kde.org and its mirror sites. Several KDE mailing lists are available for users and developers, including announcements, administration, and other topics (see the KDE Web site to subscribe). A great many software applications are currently available for KDE at http://kde-apps.org. Development support and documentation can be obtained at http://developer.kde.org. Various KDE Web sites

KDE uses as its library of GUI tools the Qt library, developed and supported by Trolltech. Qt is considered one of the best GUI libraries available for Unix/Linux systems. Using Qt has the advantage of relying on a commercially developed and supported GUI library. Also, using the Qt libraries drastically reduces the development time for KDE. Trolltech provides the Qt libraries as open source software that is freely distributable. Certain restrictions exist, however: Qt-based (KDE) applications must be free and open-source, with no modifications made to the Qt libraries. If you develop an application with the Qt libraries and want to sell it, you must first buy a license from Trolltech. In other words, the Qt library is free for free and open source applications but not for commercial applications.

New versions of KDE are released frequently, sometimes every few months. KDE releases are designed to enable users to upgrade their older versions easily. The distribution updater should automatically update KDE from distribution repositories, as updates become available. Alternatively, you can download new KDE packages from your distribution’s FTP site and install them manually. Packages tailored for various distributions can be also downloaded through the KDE Web site at http://kde.org or directly from the KDE FTP site at ftp://ftp.kde.org and its mirror sites in the stable directory

Source of Information : McGraw Hill Ubuntu The Complete Reference

Written by magakos on May 10th, 2009 with no comments.
Read more articles on Ubuntu Linux and otherSoftware.