7 Step Removing Virus' K0pL4xZ '

Virus "K0pL4xZ" that are detected as VBWorm.QTT take computer users, particularly those that have a lot of Office files, by changing the file type icon and Microsoft Office.

However, for, the virus is not to destroy files Office. The virus is created by using Visual Basic. So that the chance the virus, putting it by using the icon "Windows Media Player Classic" with the type of application files (exe). To clean up, follow these steps:

1. Disconnect the computer that will be cleaned from the network (LAN).
2. Turn off "System Restore" during the cleaning process.
3. Turn off the virus is active in memory. Use the tools to turn KillVB process in memory. Please downlod tools are in: http://www.compactbyte.com/brontok/killvb.zip

4. Fix registry that has been altered by a virus. To expedite the repair process registry copy the script under this program in notepad, then store with the name "Repair.inf." Run the file by:

- Click the right repair.inf
- Click Install

[Version]
Signature = "$ $ Chicago"
Provider = Vaksincom Oyee

[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del

[UnhookRegKey]
HKLM, Software \ CLASSES \ batfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ comfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ exefile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ piffile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ regfile \ shell \ open \ command, "regedit.exe"% 1 ""
HKLM, Software \ CLASSES \ scrfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, Shell, 0, "Explorer.exe"
HKLM, SYSTEM \ ControlSet001 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"
HKLM, SYSTEM \ ControlSet002 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"
HKLM, SYSTEM \ CurrentControlSet \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"
HKLM, SOFTWARE \ Classes \ exefile, application
HKCU, Software \ Microsoft \ Internet Explorer \ Main, the start page, 0, "about: blank"
HKCU, Software \ Microsoft \ Internet Explorer \ Main, Search Page, 0, "about: blank"
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ HideFileExt, UncheckedValue, 0x00010001, 0
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ SuperHidden, UncheckedValue, 0x00010001, 1
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion, RegisteredOrganization, 0, "Organization"
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion, RegisteredOwner, 0, "Owner"
HKLM, SOFTWARE \ Classes \ txtfile, FriendlyTypeName, 0, "@ C: \ Windows \ system32 \ notepad.exe, -469"
HKLM, SOFTWARE \ Classes \ Word.Document.8, "Microsoft Word Document"
HKLM, SOFTWARE \ Classes \ Word.Document.8 \ DefaultIcon, "C: \ Windows \ Installer \ (90110409-6000-11D3-8CFE-01500 48383C9) \ wordicon.exe, 1"
HKLM, SOFTWARE \ Classes \ PowerPoint.Show.8, "Microsoft PowerPoint Presentation"
HKLM, SOFTWARE \ Classes \ PowerPoint.Show.8 \ DefaultIcon, "C: \ Windows \ Installer \ (90110409-6000-11D3-8CFE-015 0048383C9) \ pptico.exe, 1"
HKLM, SOFTWARE \ Classes \ Excel.Sheet.8, "Microsoft Excel Worksheet"
HKLM, SOFTWARE \ Classes \ Excel.Sheet.8 \ DefaultIcon, "C: \ Windows \ Installer \ (90110409-6000-11D3-8CFE-01500483 83C9) \ xlicons.exe, 1"
HKLM, SOFTWARE \ Classes \ Access.Application.11, "Microsoft Office Access Application"
HKLM, SOFTWARE \ Classes \ Access.Application.11 \ DefaultIcon, "C: \ Windows \ Installer \ (90110409-6000-11D3-8CFE-01 50048383C9) \ accicons.exe, 1"
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced, Hidden, 0x00010001, 1
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced, HideFileExt, 0x00010001, 0
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced, ShowSuperHidden, 0x00010001, 1
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ SuperHidden, WarningIfNotDefault, 0, "@ shell32.dll, -28964"

[del]
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoFolderOptions
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableRegistryTools
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableTaskMgr
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DIsablecmd
HKCU, Software \ Microsoft \ Internet Explorer \ Main, Window Title
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ policies \ Explorer, NoFolderOptions
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ policies \ System, DisableRegistryTools
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ policies \ System, DisableTaskMgr
HKLM, SOFTWARE \ Policies \ Microsoft \ Windows NT \ SystemRestore
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Run, System
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ ActiveDesktop
HKCU, Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, shell
HKCU, Software \ Policies \ Microsoft \ Windows \ System, DisableCMD
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ HideFileExt, WarningIfNotDefault
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Run, Haha
HKLM, SOFTWARE \ Classes \ exefile, FriendlyTypeName

5. Delete the file "C: \ Windows \ desktop.ini" (the file which function to change the icon into the Windows Control Panel icon). Use a dos prompt to delete the file.

6. Find and delete files parent virus in the Hard Disk and Flash Disk with the first show hidden files. To accelerate the search function use the "Search Windows."

Here are some master file that will be made by Koplaxz:

* C: \ Documents and Settings \% user% \ Start Menu \ Programs \ Startup

Winhelp.exe

* C: \ Documents and Settings \% user% \ Start Menu \ Programs

Hellloo_Gheea.exe

* C: \ Documents and Settings \% user% \ My Documents

Jangan_Dihapus_Apalagi_Dibuka.exe

* C: \ Documents and Settings \% user% \ Start Menu

Koplaxz Kudo Shop.exe

* C: \ Documents and Settings \% user% \ Start Menu \ Programs

Exe Hellloo_Gheea ..

* C: \ Windows

TourWindowsXP.exe

svchost.exe

Kudo.com

command32.pif

KopLaXz@KudoShop.exe

* C: \ F4HM1_KudO_M4n4j3r.exe
* C: \ G0d3G.exe
* C: \ Ghe@_i_miss_u.3gp.exe (All Drive)
* C: \ K0pL4xZ.exe
* C: \ K 0 P L 4 X Z.exe
* C: \ KopLaXz@KudoShoP.exe (All Drive)
* C: \ R0n13G4N_G3Ndut_S3xY.exe
* C: \ R3eve5.exe
* C: \ K0pL4xZ @ KudoShop (All Drive)

folder.htt

msvbvm60.dll

K0pL4xZ.exe

* C: \ K0pl4xZ @ KudoShop \ K0pL4xZ.exe
* C: \ [space] Windows \ System_FriendZ_KopLaXz32

F4HM1_KudO_M4n4j3r.exe

G0d3G.exe

K 0 P L 4 X Z.exe

R0n13G4N_G3Ndut_S3xY

R3eve5.exe

* C: \ [space] Windows \ Zx4Lp0K.html
* C: \ Windows \ system32 \ smkn2majalengka.scr
* C: \ Windows \ system32 \ PCMAV.exe
* C: \ Windows \ system32 \ Asholest.exe
* C: \ Documents and Settings \% user% \ SendTo \ KoPLaXzKudo (e-mail). Exe
* C: \ Autorun.inf (all drives)
* C: \ Desktop.ini (all drives)
* C: \ A Letter Ghe @ 4. Txt (all drives)
* C: \ K0pL4xZ@kUdO_5h0P.txt
* C: \ Documents and Settings \ All Users \ Desktop \ A Letter Ghe @ 4. Inf file
* C: \ Windows \ desktop.ini


Then delete the file parent virus that has characteristics:

* Icon "Windows Media Player" clasic / 3GP Video Format
* The size of 31 KB
* Extension EXE, PIF, COM and SCR
* Type the file "Application"


Delete the following files:

* C: \ Autorun.inf (the root of each drive: c: \ or D: \)
* C: \ Desktop.ini (the root of each drive: c: \ or D: \)
* C: \ A Letter Ghe @ 4. Txt (the root of each drive: c: \ or D: \)
* C: \ K0pL4xZ@kUdO_5h0P.txt (the root of each drive: c: \ or D: \)
* C: \ K0pL4xZ @ KudoShop (in the root drive and Flash Disk)
* C: \ Documents and Settings \ All Users \ Desktop \ A Letter Ghe @ 4. Inf file
* C: \ [space] WINDOWS
* C: \ [space] Windows \ Zx4Lp0K.html


7. For optimal cleaning and prevent re-infection, a scan by using anti-virus up-to-date.

Read More......

Secure off the 'Password' from 'Power-Saving'

Windows password protection on the manifold. There will appear when booting, and have also appeared at the exit from the Stand By mode and Hibernate. Can not use the password?

There is one good reason why the password protection for the power saving mode, that is because when we leave the table, we will be vulnerable computers used by others. Modes. But if you feel safe with the environment where you use a computer, you may think will be removed to speed up the process.

How to make it very simple. The way this works for Standby mode XP, Vista Sleep mode, Hibernation mode and a second version of Windows. Here's how:
- Windows XP
Right-click on the desktop and select Properties. Click the Screen Saver tab, then click the Advanced tab and Power. Uncheck the future any posts "Uncheck Prompt for password when computer resumes from standby", and then click OK.
- Vista
Click Start, type Power Options, and press ENTER. Click "Change plan settings for your selected plan," then click "Change advanced power settings." In the dialog box that appears click on "Change settings that are currently unavailable" and then to User Account Control. Finally, go to the option Require a password on wakeup and select No. Then click OK.

Read More......

Ten Firefox extensions to keep your browsing private and secure

Most people lock their doors and windows, use a paper shredder to protect themselves from identity theft, and install antivirus software on their computers. Yet they routinely surf the Internet without giving a second thought to whether their browser is secure and their personal information safe. Unfortunately, it's easy for someone with nefarious intentions to use a Web site to glean data from -- or introduce spyware to -- your computer. Even worse, sometimes all you have to do is randomly click on a site to have your data probed in a most unwelcome way.

Mozilla Firefox has several security settings you can adjust via the Preferences pane, but there are also more than 150 privacy and security extensions you can add as well. They are easy to install and take little time to set up; some even work automatically after you restart your browser. Let's have a look at some of the most popular and most useful.

One of the best ways to protect your computer is to prevent the browser from using JavaScript at Web sites without permission. JavaScript, though useful for developing glitzy Web sites, has gained something of a reputation as a method for doing Bad Things to unsuspecting computers. NoScript is an extension that makes every site that uses JavaScript ask your permission before running it. NoScript can render JavaScript-heavy sites unreadable, but it provides a whitelist of acceptable sites that you can easily add to in order to speed up your surfing experience.

Many people use Tor to hide their online surfing habits. FoxTor provides a way to mask and unmask your browser on the fly, without having to commit to anonymous surfing throughout an entire browsing session. It requires the use of Tor and Privoxy.

Your browser's history logs help provide a speedier surfing experience for you. Unfortunately, skilled hackers can peek at them remotely to see where you've been. Deleting log information after each browsing session would slow you down, but fortunately, there's another way. Don't delete your data -- hide it with SafeHistory.

Some of the most sensitive information sent over the Internet travels via email, so many people prefer to send their messages encrypted. The Gmail S/MIME extension encrypts Gmail messages, including attachments, automatically, as long as you have the recipient's digital certificate.

While Firefox 2 has built-in phishing protection, it never hurts to have a backup plan. The premise behind Petname is simple: leave reminder notes on your trusted Web sites and the notes will automatically appear each time you return. If you surf to what you assume is one of your whitelisted sites and no reminder note appears, you'll know something's not right. This extension is particularly useful if you're running an older version of Firefox without anti-phishing protection.

SecurePasswordGenerator is a long name for a little extension that sits in your toolbar and helps you create unique passwords. Half the battle of staying safe online is using complex and different passwords whenever you register at a Web site. Use this tool to help you create a unique password everywhere you go.

Have you ever wondered where the information you type into an online form goes once you hit "send"? With FormFox, you can find out. Once you download and enable this extension, hovering your mouse over the data field of a form or search box will reveal exactly who receives the information you enter. Use this extension to check out an unfamiliar Web site before you cough up your name, address, and credit card information while doing your online holiday shopping.

Many people use disposable or temporary email addresses around the Internet to avoid email spam. Although spam is generally considered more of a nusiance than a security issue, there are occasions when a disposable address may be a safer option than providing a real one (on message forums, for example). There are several temporary email services to choose from; the TrashMail.net Firefox extension makes that service an attractive choice.

Sometimes you need to protect your information from the prying eyes of people around you. If you're surfing at an airport or local coffee shop, people wandering past can have a look at the titles of the tabs you have open. Page Title Eraser lets you either blank out the title and icon in your browser's tabs, or replace the text with something of your choice.

When trying to protect your privacy, the last thing you want is for a Web site to collect data on what you do while you visit: where you click, how long you view a page, and so on. That's called profiling. While it's harmless if a site tracks data on how long it took you to read an article on how to install a video game, most people feel that there's no reason a Web site needs to know anything about your surfing habits, even if it's only to collect data for marketing purposes.

Most extensions and tools commonly used to prevent data profiling by search engines work by concealing information from outsiders. TrackMeNot takes the opposite approach and actually sends out a bunch of information for the search engines to process. Of course, it sends mostly false information, which means your search activities remain hidden from view and search engines won't glean any meaningful data from your visit.

These are only a few of several dozen privacy and security extensions available for Firefox; you can find a larger list at Mozilla's Web site. Tools like these can make your surfing experience safer, but remember: nothing is foolproof, and talented hackers can still find ways to pull information from your system if they try hard enough. Always be careful.

Lisa Hoover

Read More......

How About a Free Anti Virus Program - 3 Reasons Why You May Be at Risk

Should I use a free antivirus program or a paid version? In todays world on the internet, we are always looking for a product or service that is free. However, when it comes to a virus protection, free is not always free.

Think about it for a minute. Why would anyone sit down on the computer and spend hours and hours of time to develop and maintain a software program and do it for free. There has got to be someone wanting to make money off of you some how or they could not continue with their activities.

In addition, many of the so called free programs do not have technical support. How would they be able to support technical help if they could not pay them. When you have a problem, you are going to want someone to help you.

Spyware – Many software programs that are free, have some type of spyware attached. If the maker or developer of the program is not charging you, then how are they going to make money. Spyware is attached to the program and your system may be tracked for advertisement purposes.

In some cases your system may be scanned for e-mail address or other information that you may not want to give out. Please be very careful with any free program you install on your computer.

Better yet, make sure you have a firewall, anti virus program and anti spyware program installed on your computer for all of your internet security protection.

Top 5 Virus Protection Software Programs

Norton Anti Virus
Trend Micro PC-cillin Anti Virus
BitDefender Anti Virus
Shield Pro 2007
Mcafee AntiVirus

If you would like to get more information on the Top 5 Virus Protection programs, you can go to http://www.filterguide.com/antivirus.ratings.htm

You can find the top rated Internet Security software programs along with discounts that range from 10% to 25% Off at Internet Security Software

Read More......

AVG Free for Linux Virus Protection

Although Linux systems are among the most resistant to virus attacks, Grisoft has introduced yesterday a new free ( for home use ) version of its software AVG Anti-Virus specifically for the Linux desktop.

Peter Lipa, President of Grisoft said:

With its growing popularity, it is only a matter of time before the Linux operating system becomes more widely targeted by virus and malware writers

Some AVG Free for Linux benefits include:

- Rapid virus database updates for the lifetime of the product
- Small update files that do not drain system resources
- Automatic update functionality
- AVG On-Demand Scanner, which allows users to perform scheduled and
manual tests
- AVG's advanced virus detection methods (heuristic analysis, generic
detection, scanning) designed to provide maximum virus protection

Download page: http://www.grisoft.com/doc/Programs/lng/us/tpl/tpl01

Read More......