Disclaimer
Welcome to the downloads page.
------------------------------------------------------------------------------------------------
The files linked here are part of my personal archive and some of them
are not my creations. I here by give all due credits to their shear genius
and hard work. I have kept them here so that it might serve as a virus free
backup to download when the need arises. Me nor the authors of these files
cannot be held responsible for the use or mis use of these files.
thank you for understanding and using these files responsibly.
------------------------------------------------------------------------------------------------
1) AIMFIX (anti malware)
2) CAV-0.91 (anti malware)
3) KLWK (anti malware)
4) Hacked taskmanager (when disabled)
5) 'task manager disabled' - removal script
6) Hacked regedit (when disabled)
7) 'registry editing disabled' removal script
8) exe_regfix (fixes the exe unlinking problem after removing malware)
9) UNHOOKEXE (fixes the exe unlinking problem after removing malware)
10) process explorer ( a better option for taskmanger)
11) u.bat(unhides hidden files)
12) shutdown (fast one click shutdown of windows - the file name is ..bat)
13) windows mobile wireless modem driver (HTC USB)
U r also advised to search for a newer possibly better version online.
Try a Google search from with in this page.
Showing posts with label trogan. Show all posts
Showing posts with label trogan. Show all posts
Friday, January 11, 2008
Friday, October 5, 2007
ISDLL.DLL.VBS ... The worm that spreads thru ur pendrive
Is ur system slow and nothing seems to happen when u double click ur c drive or any other drive except ur cd rom drive.. and even if it opens it opens in a new window..
bad new for u..
Ur system is infected and the culprit is a file name ISDLL.DLL.VBS
This is a script file virus.
How did it get tinside ur system
-------------------------------------
Via ur pendrive / mobile
but who ran the script in the first place?
------------------------------------------
sadly the answer is U urself did it.
How it acts
----------------
There are a lot of worms today that spread using pendrives - one of the most famous one is
win32/ahkheap.a (famous bcoz it shows the user something is wrong as they cannot browse certain sites like orkut,youtube etc.. and prevents firefox from opening so users are aware of their system's problem.
This one spreads the same way when a pen drive is plugged into a infected system the virus
makes a copy of itself inside the pendive in the recycler folder as the file autorun.exe
(if u check the properties it has microsoft as the company name with arabic written or some boxes appear after microsoft [if arabic language pack is not installed] and the size is around 32kb or so).
How to remove it
-----------------------
step1: Bring up ur task manager by pressing these buttons together Ctrl + Shift + Esc .
or use process explorer from microsoft sysinternals
step 2: Now stop all instances of wscipt.exe from the process tab (right click on the image name wscript.exe and select stop process tree) make sure u have stopped all wscript.exe.
step2a: Now select folder options and make sure that u can see all hidden and protecte operating system files (detailed instructions available on this topic here
http://dennyphilip.blogspot.com/2007/08/show-hidden-files-and-folders.html)
if u cannot see ur folder options at all (where did the folder options go??) follow instructions in this page and come back to this page
http://dennyphilip.blogspot.com/2007/08/no-folder-options.html)
step 3: Once this is done open my computer and after it is open press these keys together Ctrl+F to bring the search pane up on ur "My computer".
now make sure u have checked hidden files,protected operating system files,search system files (all the three in arow should be checked).
step 4: search for isdll..dll.vbs or isdll*.* by typing any one of these in the search bar.
wait for all the results to appear and select the results by pressing Ctrl + A or cleck and drag a selection box around the results delete all instances of isdll.dll.vbs files by pressing shift +Del buttons together if u r unable to see any file redo step2a agian.
if are denied access to the file redo step2
even after doing it right if u cant see the files open file location by the right click menu on the file
then follow instructions given here.
http://dennyphilip.blogspot.com/2007/08/manualy-unhide-files.html
then search for autorun.exe inside the recycler folder in all removable media including ur pendrives and mobile delete it.
step4: Now go the search bar and search for autorun.inf in all ur harddisks(say c:,D:,E: etc)and ur pendive or any other devices connected to ur pc . delete the files in the root (i.e in c: the autorun .inf in C: [file path will be c:\autorun.exe]) delete the files in the root of all the files except in cd roms (in cd roms they help to launch a file say a set up file when u put a cd in the drive no harm there and the worm doesn't have cd writing capabilities at least yet).
now once u have deleted all these file delete any system restore points u have made earlier and create a new one( as the virus may have copies of itself stored in the system backup).
restart ur system and check if all u can open c: by double clicking the icon in my computer if it opens ur are good to go and u have cleaned ur system manually. Congrats. If not read this post again carefully and do exactlt as it is said i f u have questions.please post in the comments section below by clicking comments and a popup will open with space for writing ur comment.
bad new for u..
Ur system is infected and the culprit is a file name ISDLL.DLL.VBS
This is a script file virus.
How did it get tinside ur system
-------------------------------------
Via ur pendrive / mobile
but who ran the script in the first place?
------------------------------------------
sadly the answer is U urself did it.
How it acts
----------------
There are a lot of worms today that spread using pendrives - one of the most famous one is
win32/ahkheap.a (famous bcoz it shows the user something is wrong as they cannot browse certain sites like orkut,youtube etc.. and prevents firefox from opening so users are aware of their system's problem.
This one spreads the same way when a pen drive is plugged into a infected system the virus
makes a copy of itself inside the pendive in the recycler folder as the file autorun.exe
(if u check the properties it has microsoft as the company name with arabic written or some boxes appear after microsoft [if arabic language pack is not installed] and the size is around 32kb or so).
How to remove it
-----------------------
step1: Bring up ur task manager by pressing these buttons together Ctrl + Shift + Esc .
or use process explorer from microsoft sysinternals
step 2: Now stop all instances of wscipt.exe from the process tab (right click on the image name wscript.exe and select stop process tree) make sure u have stopped all wscript.exe.
step2a: Now select folder options and make sure that u can see all hidden and protecte operating system files (detailed instructions available on this topic here
http://dennyphilip.blogspot.com/2007/08/show-hidden-files-and-folders.html)
if u cannot see ur folder options at all (where did the folder options go??) follow instructions in this page and come back to this page
http://dennyphilip.blogspot.com/2007/08/no-folder-options.html)
step 3: Once this is done open my computer and after it is open press these keys together Ctrl+F to bring the search pane up on ur "My computer".
now make sure u have checked hidden files,protected operating system files,search system files (all the three in arow should be checked).
step 4: search for isdll..dll.vbs or isdll*.* by typing any one of these in the search bar.
wait for all the results to appear and select the results by pressing Ctrl + A or cleck and drag a selection box around the results delete all instances of isdll.dll.vbs files by pressing shift +Del buttons together if u r unable to see any file redo step2a agian.
if are denied access to the file redo step2
even after doing it right if u cant see the files open file location by the right click menu on the file
then follow instructions given here.
http://dennyphilip.blogspot.com/2007/08/manualy-unhide-files.html
then search for autorun.exe inside the recycler folder in all removable media including ur pendrives and mobile delete it.
step4: Now go the search bar and search for autorun.inf in all ur harddisks(say c:,D:,E: etc)and ur pendive or any other devices connected to ur pc . delete the files in the root (i.e in c: the autorun .inf in C: [file path will be c:\autorun.exe]) delete the files in the root of all the files except in cd roms (in cd roms they help to launch a file say a set up file when u put a cd in the drive no harm there and the worm doesn't have cd writing capabilities at least yet).
now once u have deleted all these file delete any system restore points u have made earlier and create a new one( as the virus may have copies of itself stored in the system backup).
restart ur system and check if all u can open c: by double clicking the icon in my computer if it opens ur are good to go and u have cleaned ur system manually. Congrats. If not read this post again carefully and do exactlt as it is said i f u have questions.please post in the comments section below by clicking comments and a popup will open with space for writing ur comment.
Saturday, August 18, 2007
No folder options...
This will help if ur folder options has been disabled by a virus or trogan
this might not work for vista
press start > then select run
type regedit press enter.
if u cannot access ur registry please visit this page to remove registry restrictions
http://dennyphilip.blogspot.com/2007/08/virus-diabled-taskmanger-how-to-get-it.html
once u removed registry manger restrictions using the .vbs files u can continue.
now go to this location in windows registry using the left side explorer style tree view
step 1: Current user
==================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
there find the DWORD value NoFolderOptions
right click on it and select modify set the value to 0
once u have set the DWORD value to zero
Find this location like before
step 2: Local Machine
===================
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
there find the DWORD value NoFolderOptions
right click on it and select modify set the value to 0
once u have set the DWORD value to zero you are done try accessing ur folder options u should be able to access it else there is a virus or trogan active in ur system remove it using NOD32
available from www.eset.com
u can download a 15 day trial upgrade the virus database firstthen run a full system scan then re do the two steps again.
if needed restart the system once u have completed the two steps
this might not work for vista
press start > then select run
type regedit press enter.
if u cannot access ur registry please visit this page to remove registry restrictions
http://dennyphilip.blogspot.com/2007/08/virus-diabled-taskmanger-how-to-get-it.html
once u removed registry manger restrictions using the .vbs files u can continue.
now go to this location in windows registry using the left side explorer style tree view
step 1: Current user
==================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
there find the DWORD value NoFolderOptions
right click on it and select modify set the value to 0
once u have set the DWORD value to zero
Find this location like before
step 2: Local Machine
===================
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
there find the DWORD value NoFolderOptions
right click on it and select modify set the value to 0
once u have set the DWORD value to zero you are done try accessing ur folder options u should be able to access it else there is a virus or trogan active in ur system remove it using NOD32
available from www.eset.com
u can download a 15 day trial upgrade the virus database firstthen run a full system scan then re do the two steps again.
if needed restart the system once u have completed the two steps
Thursday, August 9, 2007
Virus disabled taskmanger how to get it working..
Most of this is actually done by trojans like win32/Agent.aec and win32/PcClient.wi
get by the name of autorun.exe from removable media including ur phones and pendrives.
agent.aec installs a file called sounmix.exe in folder c:\windows\system32\ be carefull as deleting this file will take out registry entries for exe files from ur registry which means if u delete it no program would work in ur system after that so use a latest update of antivirus to remove it but i can give u a few scripts that will help u out with the message says
Resigistry editing has been disabled on ur computer
or
task manger has been disabled by administrator
just follow this link and u will get regedit_block_remove.vbs file double clicking it will deactivate or reactivate ur regedit
http://www.mediafire.com/?1mmumdwyyb4
if ur task manager is deactivated get this file task manager.vbs and double click it to reactivate or deactivate taskmanger
http://www.mediafire.com/?2xnxxivddxy
NB: just incase it opens in notepad right click the file select properties int the dialog box select change and in the list of programms select microsoft(r)windows based script host
then press ok. now double click those files to test the difference for
task manger:
click ctrl+shift+Esc buttons together if it's activated u get task manger or u get the above error message.
Regedit:
press start button then run in the box type regedit press enter or return key
like before either egedit will open or u will get the error message.
if u delete soundmix.exe manually (u will need unlocker to remove its usually) u can use this file to try and fix the exe handling by windows (not checked yet any ways best of luck it should work)
Unhookexec.inf from
http://www.mediafire.com/?9zu4hvgey11
right click the file and select install.
NB:The above hacks can be used to disable administrator restrictions sometimes imposed on pc. Use it to disable or enforce administrator control over pc. how u use it totally upto.
Disclaimer: what ever i put up in this blog are meant for educational purpose only the miss use of these files are not my responsibility.Some of the code were found from various resources and websites me or they cannot be held responsible for the use or miss use of these files.Thank you for understanding and co-operating.
get by the name of autorun.exe from removable media including ur phones and pendrives.
agent.aec installs a file called sounmix.exe in folder c:\windows\system32\ be carefull as deleting this file will take out registry entries for exe files from ur registry which means if u delete it no program would work in ur system after that so use a latest update of antivirus to remove it but i can give u a few scripts that will help u out with the message says
Resigistry editing has been disabled on ur computer
or
task manger has been disabled by administrator
just follow this link and u will get regedit_block_remove.vbs file double clicking it will deactivate or reactivate ur regedit
http://www.mediafire.com/?1mmumdwyyb4
if ur task manager is deactivated get this file task manager.vbs and double click it to reactivate or deactivate taskmanger
http://www.mediafire.com/?2xnxxivddxy
NB: just incase it opens in notepad right click the file select properties int the dialog box select change and in the list of programms select microsoft(r)windows based script host
then press ok. now double click those files to test the difference for
task manger:
click ctrl+shift+Esc buttons together if it's activated u get task manger or u get the above error message.
Regedit:
press start button then run in the box type regedit press enter or return key
like before either egedit will open or u will get the error message.
if u delete soundmix.exe manually (u will need unlocker to remove its usually) u can use this file to try and fix the exe handling by windows (not checked yet any ways best of luck it should work)
Unhookexec.inf from
http://www.mediafire.com/?9zu4hvgey11
right click the file and select install.
NB:The above hacks can be used to disable administrator restrictions sometimes imposed on pc. Use it to disable or enforce administrator control over pc. how u use it totally upto.
Disclaimer: what ever i put up in this blog are meant for educational purpose only the miss use of these files are not my responsibility.Some of the code were found from various resources and websites me or they cannot be held responsible for the use or miss use of these files.Thank you for understanding and co-operating.
Subscribe to:
Posts (Atom)