Anti virus for nhatquanglan

Answer 1

how can i do remove nhatguanglan Solution

[[User:Lander19|Lander19]] 15:09, 14 Jan 2008 (UTC)Enable Regedit, Task Manager, Regedit, Hidden Files, etc.

Enable Task Manager

-------

1. Start> run

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

2. Start> run

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

Enable Regedit

-----

1. Start> run

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

2. Start> run

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

Folder Option & Hidden Files

----------

1. Start> run

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f

2. Start> run

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f

3. Start> run

reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 1 /f

4. Start>run

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 1 /f

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v DefaultValue /t REG_DWORD /d 2 /f

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN /v CheckedValue /t REG_DWORD /d 2 /f

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN /v DefaultValue /t REG_DWORD /d 2 /f

Other steps

------

Delete the files

C:\WINDOWS\SCVHSOT.exe

C:\WINDOWS\hinhem.scr

C:\WINDOWS\system32\SCVHSOT.exe

C:\WINDOWS\system32\blastclnnn.exe

C:\WINDOWS\system32\autorun.ini

C:\Documents and Settings\All Users\Documents\SCVHSOT.exe

Modify some registries

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Shell REG_SZ --> explorer.exe

\Software\Microsoft\Windows\CurrentVersion\Run\ Yahoo Messengger -->delete

Precaution

[[User:Lander19|Lander19]] 15:09, 14 Jan 2008 (UTC)[[User:Lander19|Lander19]] 15:09, 14 Jan 2008 (UTC)~ Never double click on such files which look like folders, instead use folder view for navigation.

You may like to disable "Shared Documents".