How to remove new folder exe or regsvr exe or autorun inf virus

I want to tell you a story, two days back i got affected by this virus very badly as it eat up all my empty hard disk space of around 700 MB .

I was surprised that my most reliable friend Avast, for the first time failed me in this war against viruses but then again avg and bitdiffender also failed against it. This virus is know popularly as regsvr.exe virus, or as new folder.exe virus and most people identify this one by seeing autorun.inf file on their pen drives, But trend micro identified it as WORM_DELF.FKZ. It is spreading mostly using pen drives as the medium.

Well, so here is the story of how i was able to kill the monster and reclaim my hard disk space.

If this virus infected in you computer, It will Disable the following …

Task Manager, Registry Editor, Folder Options, Run in start menu

And it will create exes like the icon of folders. If this virus is running it will use more than 50 % of your processor

Download following tools to remove new folder.exe virus

Download Tool 1 | Download Tool 2 ( run tools In safe mode )

Manual Process of removal:-

I prefer manual process simply because it gives me option to learn new things in the process.

So let’s start the process off reclaiming the turf that virus took over from us.

1. Cut The Supply Line
   1. Search for autorun.inf file. It is a read only file so you will have to change it to normal by right clicking the file , selecting the properties and un-check the read only option
   2. Open the file in notepad and delete everything and save the file.
   3. Now change the file status back to read only mode so that the virus could not get access again.
   4. 
   5. Click start->run and type msconfig and click ok
   6. Go to startup tab look for regsvr and uncheck the option click OK.
   7. Click on Exit without Restart, cause there are still few things we need to do before we can restart the PC.
   8. Now go to control panel -> scheduled tasks, and delete the At1 task listed their.
2. Open The Gates Of Castle
   1. Click on start -> run and type gpedit.msc and click Ok.
   2. 
   3. If you are Windows XP Home Edition user you might not have gpedit.msc in that case download and install it from Windows XP Home Edition: gpedit.msc and then follow these steps.
      
   4. Go to users configuration->Administrative templates->system
   5. Find “prevent access to registry editing tools” and change the option to disable.
   6. 
   7. Once you do this you have registry access back.
3. Launch The Attack At Heart Of Castle
   1. Click on start->run and type regedit and click ok
   2. Go to edit->find and start the search for regsvr.exe,
   3. 
   4. Delete all the occurrence of regsvr.exe; remember to take a backup before deleting. KEEP IN MIND regsvr32.exe is not to be deleted. Delete regsvr.exe occurrences only.
   5. At one ore two places you will find it after explorer.exe in theses cases only delete the regsvr.exe part and not the whole part. E.g. Shell = “Explorer.exe regsvr.exe” the just delete the regsvr.exe and leave the explorer.exe
4. Seek And Destroy the enemy soldiers, no one should be left behind
   1. Click on start->search->for files and folders.
   2. Their click all files and folders
   3. Type “*.exe” as filename to search for
   4. Click on ‘when was it modified ‘ option and select the specify date option
   5. Type from date as 1/31/2008 and also type To date as 1/31/2008
   6. 
   7. Now hit search and wait for all the exe’s to show up.
   8. Once search is over select all the exe files and shift+delete the files, caution must be taken so that you don’t delete the legitimate exe file that you have installed on 31^st January.
   9. Also selecting lot of files together might make your computer unresponsive so delete them in small bunches.
   10. Also find and delete regsvr.exe, svchost .exe( notice an extra space between the svchost and .exe)
5. Time For Celebrations
   1. Now do a cold reboot (ie press the reboot button instead) and you are done.

I hope this information helps you win your own battle against this virus. Soon all antivirus programs will be able to automatically detect and clean this virus. Also i hope Avast finds a way to solve this issues.

As a side note i have found a little back dog( winpatrol ) that used to work perfectly on my old system. It was not their in my new PC, I have installed it again , as I want to stay ahead by forever closing the supply line of these virus. You can download it form Winpatrol website.

How to remove RAVMON Virus from your PC ? Show hidden files and folders not working ? Computer shuts down automatically ?

Is your right click context menu showing some Chinese scripts ? Is your show hidden files and folders not working ? Is your command prompt , Registry Editor and task manager disabled ??

If all these things are happening to your Computer , the reason is that it has got infected by a virus named " RAVMON " .What can this Virus do ??

• Disables task manager , Registry Editor and Command prompt .
  
• Right click menu shows some Chinese scripts as shown in the figure.
• Computer shutdown automatically and slogs a lot.
• Folder Options disappear
• Show hidden files and folders Option won't work.

With all these things not working , I can understand what can go with you !! I saw this thing on my friends PC . Then only I decided to write the solution for this.So how are you going to remove this ?

One of my friend has developed a solution to kill this Virus.Download it and remove the Virus.

Download the RAVMON virus removal Tool

One you download the tool , install it.Click on the three of them.and press OK.If you are not infected with RAVMON then the tool automatically shows the error message.So download it and enjoy using your PC.

Can't open any drive with double click(autorun.inf)

I had this problem too, then I made a new topic here .

go to command prompt and write this command

c:\> attrib -r -s -h autorun.inf
c:\> del autorun.inf
d:\> attrib -r -s -h autorun.inf
d:\> del autorun.inf
restart the pc

And follow the steps:-

1Open Start >> Run and type regsvr32 /i shell32.dll
2. press ok
3. You will see a message DllRegisterServer and DllInstall in shell32.dll succeeded

That make's your problem resolved...!

How to Fix Double Click Always Opens Search in Windows Explorer

If you mess around in the registry, or install some different software packages that add things to the right-click menu, you can end up with a problem where the default action on a folder is always "Search…", even though you set it to something else.

There's a quick and easy fix for this problem. Open up regedit.exe by using Start\Run and then browse down to this registry key:

HKEY_CLASSES_ROOT\Directory\shell

Double-click on the default value and set it to "none" without the quotes, as seen here:

This will restore the normal behavior.

Update

If you are also experiencing this problem when you try to click on a drive, you can run this command from the run box or command prompt:

regsvr32 /i shell32.dll

This should restore the normal behavior.

If you are getting a message that says "Windows cannot find 'PET32.exe'", then at some point you had a virus, or still have a virus. First, make sure that you run a virus scanner to get rid of the virus. Then run the regsvr32 command above, which should fix the problem.

Disable All Auto Play in Vista

Below is a way to globally disable auto play in vista:

(1) Open Control Panel, if it is in classic mode, click Control Panel Home to switch to vista default style for control panel. And then click on "Play CDs or other media automatically" (below the title Hardware and Sound).

(2) Select take no Actions for every media.

(3) Save

Or, if you are using Vista Business or Vista Ultimate, edit group policies:

(1) start, run, type: gpedit.msc

(2) press CTRL+SHIFT+Enter to execute group policy in administrator mode

(3) Expand: Computer Configuration, Administrative Template, Windows Components, AutoPlay Policies. Double click at Turn off Autoplay. Set enabled. You can choose Turn Off autoplay on certain drive or All drives.

(4) Expand: User Configuration, Administrative Template, Windows Components, AutoPlay Policies. Double click at Turn off Autoplay. Set enabled. You can choose Turn Off autoplay on certain drive or All drives.

Display flash (swf) as background in html

If we have flash embedded in a html page. Usually, it will be placed on top of other div or other components. There is a way to display other thing on top of flash, that is by adding the parameter: wmode with value opaque. Example:

< name="wmode" value="opaque">


Or, there's a good library for embedding flash object to html by using SWFObject. It is located in here.

Problem of "jwgkvsq.vmx" Has Been Resolved

(PROBLEM)

Now a days this is a very popular problem that when every time you delete "jwgkvsq.vmx" from your removable drive from the following location -------
".\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx" then every time it recreates. But when you scan your system with antivirus then no-one can not detect this.

(SYMPTOMS)

You can not see your hidden files in your computer. You can not open some websites like microsoft.com, spywareterminator.com etc.

(SOLUTION)

To clean up system which automatically creates autorun.inf and RECYCLER folder with jwgkvsq.vmx, download and run this program. After reboot, the system probably will complain about missing dll file. To fix it manually, you can use regedit or msconfig:

Regedit:
(1) run regedit.exe (start menu, run: regedit.exe),
(2) search the dll file name (CTRL+F)
(3) delete the entry which contains the missing dll file. Usually, the entry should be found on registry location: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\

Or MsConfig:
(1) run msconfig.exe (start menu, run: msconfig.exe),
(2) go to startup tab
(3) Uncheck the Startup Item which contains missing dll file on the command.

To clean up the infected flash disk or external disk with FAT file system, simply delete the autorun.inf and RECYCLER folder. But if it has NTFS file system, windows will complain about having unauthorized access to the file and folder. You can use Linux and mount the NTFS volume (probably it must be mounted forcefully with options -o force), then delete them. Live CD such as Ubuntu will do.

That's all :)

Updated:
If the above cleaning process didn't work (somehow, the above process works perfectly on my PC but has no effect on my friend's), scan the system using this tool. After scanning, there are probably some unaccessible files (check the log file). then:
(1) find suspicious hidden dll file on \windows\system32\,
(2) boot to save mode
(3) change the ownership of the file (right click, properties, security, click advanced.. the rest I expect you know how.. ;) ), then
(4) change the access permissions for everyone,
(5) delete the dll file manually.
Perhaps, step (3) to (5) can be applied to remove the autorun.inf and RECYCLER folder too..

That's all :)

Updated #2:
For those who have trouble downloading from antivirus website, I add mirrors for the antivirus:
(1) http://happyfunz.net/antivirus/FixDownadup.zip (MD5 sum: 2363a7fce1919a42095b018f7b49b1aa)
(2) http://happyfunz.net/antivirus/anti-Downadup-EN.zip (MD5 sum: 053c297c3bdb1f86f141176db3d1b42c)

PS. Turn off System Restore and unplug your network before executing the removal tool. Otherwise, the virus might not be cleaned up. And refer to microsoft bulletin here to update the vulnerable patch.

If none of the above methods works for you, perhaps you should try to follow the cleaning process from microsoft knowledge base here.


(Result)

I have succesfully deleted this virus.......after removing the above virus ,,scan with latest kaspersky internet security2009...it will remove the virus called "kido" unless you follow the above procedure....if not it will come again & again even though you remove it...!

Card Recovery

CardRecovery is the leading photo recovery software for memory card used by digital camera. It can effectively recover lost, deleted, corrupted or formatted photos and video files from various memory cards. It supports almost all memory card types including SD (Secure Digital) Card, CF (Compact Flash) Card, xD Picture Card, Memory Stick, MicroDrive, SmartMedia Card, MMC (MultiMediaCard), MicroSD, MiniSD, SDHC and more.

Features

* Recover deleted photos from memory cards.
* Recover lost photos from memory cards.
* Recover photos from formatted memory cards.
* Recover photos from damaged, unreadable or defective memory cards.
* Recover pictures from removable storage including floppy disks, Zip disks etc.
* Recover images, audio/video, MP3/MP4 files from cellular phones, MP3 players, PDAs.

Download [ 9 MB]

Dictionary Of Applied Math For Engineers And Scientists

Product Description
Despite the seemingly close connections between mathematics and other scientific and engineering fields, practical explanations intelligible to those who are not primarily mathematicians are even more difficult to find. The Dictionary of Applied Mathematics for Engineers and Scientists fills that void. It contains authoritative yet accessible definitions of mathematical terms often encountered in other disciplines. There may be bigger dictionaries, more comprehensive dictionaries, and dictionaries that offer more detailed definitions, theorems, and proofs. But there is no other dictionary specifically designed and written for scientists and engineers whose understanding and ability to solve real-world problems work can depend upon the application of mathematics. Concise, comprehensible, and convenient, the Dictionary of Applied Mathematics for Engineers and Scientists is a practical lexicon that helps students and professionals alike use mathematical terminology correctly and fully understand the mathematical literature encountered in their fields.

Book Info
A practical lexicon that helps students and professionals alike make sure they use mathematical terminology correctly and fully understand the mathematical literature encountered in their fields. Provides clear, concise definitions and includes computer related terminology.

Paperback: 168 pages
Publisher: CRC; 1 edition
Language: English

Download [ 4.7 MB]

Atlas of 4000 Years World History

Computer map animation - a great new way to visualize history!
4000 year animation shows empires growing and countries changing. History of Europe, Africa, and Asia from the earliest countries to the year 1000.

Download [2.6 MB]