Delete An "undeletable" File Manually

How to Delete An "undeletable" File Manually Removal

Open a Command Prompt window and leave it open.
Close all open programs.
Click Start, Run and enter TASKMGR.EXE
Go to the Processes tab and End Process on Explorer.exe.
Leave Task Manager open.
Go back to the Command Prompt window and change to the directory the AVI (or other undeletable file) is located in.
At the command prompt type DEL where is the file you wish to delete.
Go back to Task Manager, click File, New Task and enter EXPLORER.EXE to restart the GUI shell.
Close Task Manager.
Or you can try this
Open Notepad.exe
Click File>Save As..>
locate the folder where ur undeletable file is
Choose 'All files' from the file type box
click once on the file u wanna delete so its name appears in the 'filename' box
put a " at the start and end of the filename
(the filename should have the extension of the undeletable file so it will overwrite it)
click save,
It should ask u to overwrite the existing file, choose yes and u can delete it as normal
Here's a manual way of doing it. I'll take this off once you put into your first post zain.
1. Start
2. Run
3. Type: command
4. To move into a directory type: cd c:\*** (The stars stand for your folder)
5. If you cannot access the folder because it has spaces for example Program Files or Kazaa Lite folder you have to do the following. instead of typing in the full folder name only take the first 6 letters then put a ~ and then 1 without spaces. Example: cd c:\progra~1\kazaal~1
6. Once your in the folder the non-deletable file it in type in dir - a list will come up with everything inside.
7. Now to delete the file type in del ***.bmp, txt, jpg, avi, etc... And if the file name has spaces you would use the special 1st 6 letters followed by a ~ and a 1 rule. Example: if your file name was bad file.bmp you would type once in the specific folder thorugh command, del badfil~1.bmp and your file should be gone. Make sure to type in the correct extension.

GET ALL THE UPDATES BY EMAIL BY CLICKING HERE

Tips to Trick a Keylogger

Here is a small step by step procedure which can be used for tricking a keylogger
1) When you need to type a password on a compromised computer, type some portion and use mouse to click on another portion to complete keying in.

2) Avoid entering the full password. Copy and paste from other websites some of the letters or numbers you need.

3) Last but not least, change your password immediately at a secured PC after you use it outside your own computer.

Well.. hopefully these few tricks can fool the poor-programmed keylogger. Anyway, do have an updated antivirus and anti-spyware in check just to be safe.

GET ALL THE UPDATES BY EMAIL BY CLICKING HERE

Create Simple Fake Viruses

If you want to have some fun with your friends, drop these fake viruses into the folder located at “C:\Documents and Settings\All Users\Start Menu\Startup“, then watch them squirm.
Although the following fake viruses may seem malicious to the unsuspecting, they are non-destructive to your computer system. So you don’t need to worry about anything else and just enjoy the fun of making someone else panic.
 Fake Virus Batch File –
I love this fake virus because it looks the most like an actual attack. Copy and paste the following into Notepad, then save the file with any name you choose and an extension of “.bat”
Heres the Code

cls

:A
color 0a
cls
@echo off
echo Wscript.Sleep
echo Wscript.Sleep 5000>C:sleep5000.vbs
echo Wscript.Sleep 3000>C:sleep3000.vbs
echo Wscript.Sleep 4000>C:sleep4000.vbs
echo Wscript.Sleep 2000>C:sleep2000.vbs
cd %systemroot%System32
dir
cls
start /w wscript.exe C:sleep3000.vbs
echo Deleting Critical System Files…
echo del *.*
start /w wscript.exe C:sleep3000.vbs
echo Deletion Successful!
start /w wscript.exe C:sleep2000.vbs
echo:
echo:
echo:
echo Deleting Root Partition…
start /w wscript.exe C:sleep2000.vbs
echo del %SYSTEMROOT%
start /w wscript.exe C:sleep4000.vbs
echo Deletion Successful!
start /w wscript.exe C:sleep2000.vbs
echo:
echo:
echo:
echo Creating Directory h4x…
cd C:Documents and SettingsAll UsersStart MenuPrograms
mkdir h4x
start /w wscript.exe C:sleep3000.vbs
echo Directory Creation Successful!
echo:
echo:
echo:
echo Execution Attempt 1…
start /w wscript.exe C:sleep3000.vbs
echo cd C:Documents and SettingsAll UsersStart MenuProgramsStartuph4x
echo start hax.exe
start /w wscript.exe C:sleep3000.vbs
echo Virus Executed!
echo:
echo:
echo:
start /w wscript.exe C:sleep2000.vbs
echo Disabling Windows Firewall…
start /w wscript.exe C:sleep2000.vbs
echo Killing all processes…
start /w wscript.exe C:sleep2000.vbs
echo Allowing virus to boot from startup…
start /w wscript.exe C:sleep2000.vbs
echo:
echo:
echo Virus has been executed successfully!
start /w wscript.exe C:sleep2000.vbs
echo:
echo Have fun!
start /w wscript.exe C:sleep2000.vbs
pause
shutdown -s -t 10 -c “Your computer has committed suicide. Have a nice day pal.”

And here is the screenshot

GET ALL THE UPDATES BY EMAIL BY CLICKING HERE

Some more batch file funny Virus

1. Hack your friend's keyboard and make him type "You are a fool" simultaneously:
Open Notepad and Type :
Set wshShell = wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshshell.sendkeys "You are a fool."
loop
Save it as "Anything.VBS" and send it to your friends.




2. Frustrate your friend by making this VBScript hit Enter simultaneously:
Open Notepad and Type :
Set wshShell = wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshshell.sendkeys "~(enter)"
loop
Save it as "Anything.VBS" and send it to your friends.


3. Opens Notepad, slowly type "Hello, how are you? I am good thanks" and freak your friend out:
Open Notepad and Type :
WScript.Sleep 180000
WScript.Sleep 10000
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.Run "notepad"
WScript.Sleep 100
WshShell.AppActivate "Notepad"
WScript.Sleep 500
WshShell.SendKeys "Hel"
WScript.Sleep 500
WshShell.SendKeys "lo "
WScript.Sleep 500
WshShell.SendKeys ", ho"
WScript.Sleep 500
WshShell.SendKeys "w a"
WScript.Sleep 500
WshShell.SendKeys "re "
WScript.Sleep 500
WshShell.SendKeys "you"
WScript.Sleep 500
WshShell.SendKeys "? "
WScript.Sleep 500
WshShell.SendKeys "I a"
WScript.Sleep 500
WshShell.SendKeys "m g"
WScript.Sleep 500
WshShell.SendKeys "ood"
WScript.Sleep 500
WshShell.SendKeys " th"
WScript.Sleep 500
WshShell.SendKeys "ank"
WScript.Sleep 500
WshShell.SendKeys "s! "
Save it as "Anything.VBS" and send it to your friends.




4. Frustrate your friend by making this VBScript hit Backspace simultaneously:
Open Notepad and Type :
MsgBox "Let's go back a few steps"
Set wshShell =wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshshell.sendkeys "{bs}"
loop
Save it as "Anything.VBS" and send it to your friends.


5. Cycle a message in your friend's computer:
Open Notepad and Type :
@ECHO off
:Begin
msg * Hi
msg * Are you having fun?
msg * I am!
msg * Lets have fun together!
msg * Because you have been o-w-n-e-d
GOTO BEGIN
Save it as "Anything.BAT" and send it to your friends.

6. Convey your friend a lil' message and shut down his/her computer:
Open Notepad and Type :
@echo off
msg * I don't like you
shutdown -c "Error! You are too stupid!" -s
Save it as "Anything.BAT" in All Files and send it to your friends.

7. Open Notepad continually in your friend's computer:

Open Notepad and Type :
@ECHO off
:top
START %SystemRoot%\system32\notepad.exe
GOTO top
Save it as "Anything.BAT" and send it to your friends.


8. Hard prank: Pick your poison batch file. It asks your friend to choose a number between 1-5 and then does a certain action:
1: Shutdown
2: Restart
3: Wipes out your hard drive (BEWARE)
4: Net send
5: Messages then shutdown
Open Notepad and Type :
@echo off
title The end of the world
cd C:\
:menu
cls echo I take no responsibility for your actions. Beyond this point it is you that has the power to kill yourself. If you press 'x' then your PC will be formatted. Do not come crying to me when you fried your computer or if you lost your project etc...
pause
echo Pick your poison:
echo 1. Die this way (Wimp)
echo 2. Die this way (WIMP!)
echo 3. DO NOT DIE THIS WAY
echo 4. Die this way (you're boring)
echo 5. Easy way out
set input=nothing
set /p input=Choice:
if %input%==1 goto one
if %input%==2 goto two
Save it as "Anything.BAT" and send it to your friends.



GET ALL THE UPDATES BY EMAIL BY CLICKING HERE

How to Make a Fake and Harmless Virus

In this tutorial I teach you how to make a harmless and fake virus using Windows XP. Basically what it does is just logoff, and then "Shutdown" your computer. It gives you the option to give the exact time before the shutdown is initiated, and it also gives you the option to leave a comment on the infected computer.

I take no responsibility on how you use this program, or what you do with it!

Ok, so let's start!

1.) Go to the desktop, or anywhere really, and Right click > New > Shortcut

2.) You should notice how an item is created on your desktop, and a window should also pop up. It should ask you to "Type the location of the item". In that box, type in 

shutdown -s -t XX -c "YY"

  (XX representing the amount of time you want to give before the shutdown is initiated, and YY representing the comment you want to leave.) 

If you are using Vista, Most of it is the same exept for instead of 

shutdown -s -t 100 -c "This is fake virus" 

Here 100 is time to intialize shutdown 

3.) Click Next

4.) Give the new shortcut a name, and hit Next. 

   

To STOP Shutdown Type 

shutdown -a

here a stands for abort

If you would like to give this new "virus" an icon, and view the entire process as a video, watch this:

GET ALL THE UPDATES BY EMAIL BY CLICKING HERE

Restore folder option

• click start
• click run
• type: rundll32.exe shell32.dll,Options_RunDLL 0

 

 

 

GET ALL THE UPDATES BY EMAIL BY CLICKING HERE


Thanks for visiting

A Virus Program to restart comp every boot

Today I will show you how to create a virus that restarts the computer upon every startup. That is, upon infection, the computer will get restarted every time the system is booted. This means that the computer will become inoperable since it reboots as soon as the desktop is loaded.
For this, the virus need to be doubleclicked only once and from then onwards it will carry out rest of the operations. And one more thing, none of the antivirus softwares detect’s this as a virus since I have coded this virus in C. So if you are familiar with C language then it’s too easy to understand the logic behind the coding.
Here is the source code.
`````````````````````````````````virus code`````````````````````````````````

Newfolder.exe virus SOLUTION

NEWFOLDER.EXE,AUTOPLAY VIRUS,SSCVIIHOST.exe,


if u r infected with this virus then the following problems will occur in ur pc:

1. u'll find New Folder.exe file in the root path of every storage media you have?

2. u'll find a new folder inside every folder you have?

3. When you doubleclick on one of your hard drive partitions, it shows you some unexpected results?

4. When you rightclick on one of your hard drive partitions, you see a new item called "Autoplay" on top of other items with bold face?


5. When you right click on one of your hard drive partitions, you see some new items with garbage text?

6. When your Antivirus detects and deletes the malware that causes all of that and restart your system, you see an error message similar to: "Windows cannot find SSCVIIHOST.exe..."?

If your answer was ‘Yes’ to any of the above questions then the chances are that you may be infected with the Sohanad virus (otherwise known as New Folder.exe) or one of its variants:

IM-Worm.Win32.Sohanad.as
IM-Worm.Win32.Sohanad.ao
IM-Worm.Win32.Sohanad.am


The problem is that this virus is particulary cumbersome to remove, even by reputable anti-virus programs. But their is a solution and it is called SRT (or Sohanad Removal Tool)!

What does this tool do?
It detects and reoves all traces of the Sohanad virus from your system, including floppy disks and USB flash disks (the latter ones must be write enabled during the scan process).

It also removes the leftovers of this virus by removing the 'autorun.inf' files and cleaning up you system registry, so you won’t see the 'autoplay' item anymore.

How to use it?
Start your computer in Safe mode and run this tool. If you have infected floppy/flash disks you can insert them and click start. You can repeat this process for every disk you have.

click here to download

Conficker Manual Removal

Conficker Description

Conficker, also known as W32/Conficker.worm, Win32/Conficker.A, W32.Downadup, Downadup and Kido, is a worm that exploits flaws found in Windows MS08-067 vulnerability. When Conficker infects your PC, it may prevent you from accessing security websites and disables Windows system services such as Windows Security Center, Windows Error Reporting and Windows Defender. The danger with Conficker is its ability to spread itself to other vulnerable computers through network shares. If one computer in a network is infected, then it can spread to other computers within that network. Microsoft has released a patch to fix the Windows vulnerability.

Conficker Manual Removal Instructions

How to Kill Conficker DLL files.

1. Right-click the Explorer.exe process and choose the option “Properties”.
2. Click on the “Threads” Tab, locate and highlight the Conficker DLL files listed below.
3. To kill Conficker DLL files, click the “Kill” button.
4. Kill the following Conficker DLL files:

• %All Users Application Data%\[RANDOM FILE NAME].dll
  
  
  
• %Program Files%\Movie Maker\[RANDOM FILE NAME].dll
  
  
  
• %Program Files%\Internet Explorer\[RANDOM FILE NAME].dll
  
  
  
• %Temp%\[RANDOM FILE NAME].dll
  
  
  
• vhoinp.dll
  
  
  
• %System%\[RANDOM FILE NAME].dll
  
  
  

Step 1: How to Delete Conficker Registry Keys and Values.

1. Right-click on your Desktop > select “New” option > select “Text Document” (.txt file) option.
2. Rename the .txt file as a .reg file and call it “Delete_Registry_Conficker_Entities.reg”. This renamed .reg file is a command that creates a shortcut to your Windows registry and allows you to easily delete registry values.
3. Right-click and select the “Edit” option.
4. Copy and paste the Conficker keys listed below.
5. In the menu bar, go to “File” > select “Save” > then click the “X” button to close the file.
6. Double-click on the .reg file.
7. When the message box appears saying “Are you sure you want to add the information in C:DOCUME~1%username%DesktopDELETE~1.REG to the registry?”, click the “Yes” button.
8. When the message box appears saying “Information in C:DOCUME~1%username%DesktopDELETE~1.REG has been successfully entered into the registry.”, click the “OK” button.
9. The Conficker registry keys have been deleted from your registry.
10. Copy and paste the following Conficker keys:Windows Registry Editor Version 5.00
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\vhoinp.dll]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\vhoinp.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\vhoinp.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\vhoinp.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\vhoinp.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\vhoinp.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\vhoinp.dll]
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\vhoinp.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\vhoinp.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\vhoinp.dll]
    [-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\vhoinp.dll]

Where do Viruses and Trojan Hide?

1. START-UP FOLDER.

WINDOWS opens every item in the Start Menu's Start Up folder. This folder is prominent in the Programs folder of the Start Menu. Notice that I did not say that WINDOWS "runs" every program that is represented in the Start Up folder.

It means "opens every item." There's an important difference. Programs represented in the Start Up folder will run, of course. But you can have shortcuts in the Start Up folder that represent documents, not programs.

For example, if you put a MICROSOFT Word document in the Start Up folder, Word will run and automatically open that document at bootup; if you put a WAV file there, your audio software will play the music at bootup, and if you put a Web-page Favourites there, Internet Explorer (or your own choice of a browser) will run and open that Web page for you when the computer starts up. (The examples cited here could just as easily be shortcuts to a WAV file or a Word document, and so on.)

2. REGISTRY.

WINDOWS executes all instructions in the "Run" section of the WINDOWS Registry. Items in the "Run" section (and in other parts of the Registry listed below) can be programs or files that programs open (documents), as explained in No. 1 above.

3. REGISTRY.

WINDOWS executes all instructions in the "RunServices" section of the Registry.

4. REGISTRY.

WINDOWS executes all instructions in the "RunOnce" part of the Registry.

5. REGISTRY.

WINDOWS executes instructions in the "RunServicesOnce" section of the Registry. (WINDOWS uses the two "RunOnce" sections to run programs a single time only, usually on the next bootup after a program installation.)

6. REGISTRY.

WINDOWS executes instructions in the HKEY_CLASSES_ROOTexefileshellopencommand "%1" %* section of the Registry. Any command imbedded here will open when any exe file is executed.

Other possibles:

[HKEY_CLASSES_ROOTexefileshellopencommand] =""%1" %*"
[HKEY_CLASSES_ROOTcomfileshellopencommand] =""%1" %*"
[HKEY_CLASSES_ROOTbatfileshellopencommand] =""%1" %*"
[HKEY_CLASSES_ROOThtafileShellOpenCommand] =""%1" %*"
[HKEY_CLASSES_ROOTpiffileshellopencommand] =""%1" %*"
[HKEY_LOCAL_MACHINESoftwareCLASSESbatfileshellopenc ommand] =""%1"%*"
[HKEY_LOCAL_MACHINESoftwareCLASSEScomfileshellopenc ommand] =""%1"%*"
[HKEY_LOCAL_MACHINESoftwareCLASSESexefileshellopenc ommand] =""%1" %*"
[HKEY_LOCAL_MACHINESoftwareCLASSEShtafileShellOpenC ommand] =""%1"%*"
[HKEY_LOCAL_MACHINESoftwareCLASSESpiffileshellopenc ommand] =""%1" %*"

If keys don't have the ""%1" %*" value as shown, and are changed to something like ""somefilename.exe %1" %*" than they are automatically invoking the specified file.

7. BATCH FILE.

WINDOWS executes all instructions in the Winstart batch file, located in the WINDOWS folder. (This file is unknown to nearly all WINDOWS users and most W*NDOW$ experts, and might not exist on your system. You can easily create it, however. Note that some versions of W*NDOW$ call the WINDOWS folder the "WinNT" folder.) The full filename is WINSTART.BAT.

8. INITIALIZATION FILE.

WINDOWS executes instructions in the "RUN=" line in the WIN.INI file, located in the WINDOWS (or WinNT) folder.

9. INITIALIZATION FILE.

WINDOWS executes instructions in the "LOAD=" line in the WIN.INI file, located in the WINDOWS (or WinNT) folder.

It also runs things in shell= in System.ini or c:WINDOWS system.ini:

[boot] shell=explorer.exe C:W*NDOW$filename

The file name following explorer.exe will start whenever WINDOWS starts. As with Win.ini, file names might be preceeded by considerable space on such a line, to reduce the chance that they will be seen. Normally, the full path of the file will be included in this entry. If not, check the WINDOWS directory

10. RELAUNCHING.

WINDOWS reruns programs that were running when WINDOWS shut down. WINDOWS cannot do this with most non-MICROSOFT programs, but it will do it easily with Internet Explorer and with WINDOWS Explorer, the file-and-folder manager built into WINDOWS. If you have Internet Explorer open when you shut WINDOWS down, WINDOWS will reopen IE with the same page open when you boot up again. (If this does not happen on your WINDOWS PC, someone has turned that feature off. Use Tweak UI, the free MICROSOFT WINDOWS user interface manager, to reactivate "Remember Explorer settings," or whatever it is called in your version of WINDOWS.)

11. TASK SCHEDULER.

WINDOWS executes autorun instructions in the WINDOWS Task Scheduler (or any other scheduler that supplements or replaces the Task Scheduler). The Task Scheduler is an official part of all WINDOWS versions except the first version of WINDOWS 95, but is included in WINDOWS 95 if the MICROSOFT Plus Pack was installed.

12. SECONDARY INSTRUCTIONS.

Programs that WINDOWS launches at startup are free to launch separate programs on their own. Technically, these are not programs that WINDOWS launches, but they are often indistinguishable from ordinary auto-running programs if they are launched right after their "parent" programs run.

13.C:EXPLORER.EXE METHOD.

C:Explorer.exe

WINDOWS loads explorer.exe (typically located in the WINDOWS directory)during the boot process. However, if c:explorer.exe exists, it will be executed instead of the WINDOWS explorer.exe. If c:explorer.exe is corrupt, the user will effectively be locked out of their system after they reboot.

If c:explorer.exe is a trojan, it will be executed. Unlike all other autostart methods, there is no need for any file or registry changes - the file just simply has to be named c:explorer.exe

14. ADDITIONAL METHODS.

Additional autostart methods. The first two are used by Trojan SubSeven 2.2.

HKEY_LOCAL_MACHINESoftwareMICROSOFTActive SetupInstalled Components
HKEY_LOCAL_MACHINESoftwareMICROSOFTWINDOWSCurrentv ersionexplorerUsershell folders
Icq Inet
[HKEY_CURRENT_USERSoftwareMirabilisICQAgentAppstest]
"Path"="test.exe"
"Startup"="c:test"
"Parameters"=""
"Enable"="Yes"
[HKEY_CURRENT_USERSoftwareMirabilisICQAgentApps]
This key specifies that all applications will be executed if ICQNET Detects an Internet Connection.
[HKEY_LOCAL_MACHINESoftwareCLASSESShellScrap] ="Scrap object"
"NeverShowExt"=""

This key changes your file's specified extension

USB Device Spreading Viruses

Funny UST Scandal Virus

These Viruses Are Mainly Spreading From The USB Devices Like Pendrive , Mobile Memory Cards etc...

Some of the Symptoms Of Funny UST SCandal.avi.exe
• A orange icon with image of a Foot.
• Files missing, Not able to view hidden files.
• Every time you click on My Computer opens a new instance of it.
• Task Manager automatically disappearing after few seconds, not able to view process.
• System deadly slow
• Installations not occurring.




How To Remove This Virus ?


* Follow These Steps

1. Download and install TaskKiller. TaskKiller forcefully kills the task and hence stops virus from replicating. Run Task Killer, and a red skull icon will appear on the system tray.Left click it, and click Processes
2. Select to kill these processes -
• killer.exe
• lsass.exe
• smss.exe
3. Now open up Command Prompt (Start>Run>command). Type each command and press Enter to run it -
• cd\
• attrib -h -s smss.exe
• attrib -h -s autorun.inf
4. Open My Computer and go to "C:\", then "C:\Windows\System32" and "C:\Windows\System".
5. Delete the following files -
• smss.exe
• autorun.inf
• Funny UST Scandal.avi.exe
6. Now, go to C:\Documents and Settings\All users\Startmenu\Programs\Startup and delete the file lsass.exe.
7. Open Registry Editor (Start>Run>regedit)
8. Delete the key HKEY_LOCAL_MACHINE\Software\
   Microsoft\WindowNT\CurrentVersion\Winlogon=shell(killer.exe
9. Delete the key HKEY_CURRENT_USER\Software\
   Microsoft\windows\Currentversion\Run=runonce(c:\windows\smss.exe)
10. Check For the virus in the other root partitions and remove the Funny UST Scandal.avi.exe

Another Method For Removing Funny UST Scandal Virus

You Can Remove Funny UST Scandal Virus Using The Funny UST Scandal Virus Remover

This Remover Tool Works Only If Your Computer Is Infected With Funny UST Scandal Virus. Otherwise It Displays A Message "No Funny Virus Running!!!!!"

Download link 1

Alternate link


2.

“I Dont hate Mozilla but use IE or Else” Virus

Few days back when i tried to open mozilla firefox i got a message “I Dont hate mozilla but use IE or Else”… this was my first encounter with a virus… My antiVirus couldn’t detect it… thats bad..
My senior Colleague at office Mr. Mohan, he is a person who guides me in all my system related queries. Thanks Mohan. when i said him about this he went through google…. and landed on to a site “mozillaZine” where people discuss about the virus. Thankfully people had already found solution for this virus. Which had blocked my mozilla firefox but IE was accessible. even with IE i was unable to visit orkut.

Disable Autorun Feature

1. Click Start -> Run.
2. Type RegEdit in the Open text box, then press ENTER.
3. In the Registry Editor, locate and click the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDRom

1. Modify the value of the Autorun to 0 (zero) so that CD-ROMs and Audio CDs do not run and start automatically when inserted.
2. Next navigate to the following registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

1. Modify the value of the NoDriveTypeAutoRun entry to 0xb5 value to turn off the AutoRun feature for CD-ROMs by right-click NoDriveTypeAutoRun and then click Modify to type B5 in the Value data box. Select Hexadecimal, and then click OK.
2. Quit Registry Editor.
3. Restart your computer.

The steps to kill the virus :

1. Go to Task Manager (Ctrl+Alt+Del)
2. in that click on Process Tab
3. Delete only the svchost.exe of your user name
4. type c:\heap41a in you address barof your explorer and you can trace this folder
5. Done.

RATS the virus

What? Rats? Those pesky black things that always cause damage in the house. Very cute to look still very destructive all the same. This is supposed to be a site on Internet Security not household and pest management. So why all this here?Put your thoughts aside for a while and let me continue. I am not talking about the above rats. This is in continuation on what the uninitiated call as Trojans which I had hinted upon in my earlier article and what the refined call as Remote Administrative Tools or RATS. Trojans can be very destructive if you're not careful. So tighten your seat belts as we gear up for take-off.
To define Trojans, we refresh our knowledge of a virus. A virus is a self-replicating piece of code designed to cause damage or irritation. Trojans assume much greater risk proportions. As the name RATS suggest, they allow a remote user to operate your PC sitting thousands of miles away via the Internet. Surprised? No need to be. The Internet today imparts such power that even a lame user can do this to you.
Note: Lame means a user possessing limited knowledge. In other words, a naive user, not a professional.
Evolution
Every thing has a beginning. This is the most basic principle of evolution. Trojans evolved from what can be termed as an exploitation of a basic administrative need. When Internet began to spread its wings in late 90s, corporations found the regional barriers too small for comfort. They wanted to expand their horizons. For this, they needed a software which could help in remote management of resources. Wherein a person can manage all the company resources spread across the world. Microsoft, as it always does, recognized this need and came up with a software package Microsoft Back Office.
The Underground was quick to pounce upon this thought. It is a fundamental rule in computing (or for anything) that Nothing is perfect. There are always some loopholes left open for exploitation. The Underground came up with what can be branded as the first Trojan known as Back Orifice (a lash at Microsoft). This had limited remote administrative powers still it pioneered the Underground in this direction. Today Back Orifice remains as one of the all-time powerful Trojan. It is managed by Cult Of Dead Cow (www.cultofdeadcow.com). Many soon followed suite and the next popular one was Netbus.
Today, Trojans impart a lot of power and are extremely easy to use. In the next article, we will try to classify Trojans based on their remote administrating prowess. Till then adieu.
Trojans-The Beginning Read on to know more about the supreme tool of novice and advanced hacking. The tool that got through Microsoft's defense. One that can create havoc on your PC also. This is just the beginning.

REMOVE THE DANGEROUS KAVO VIRUS

Hi guys,
I am writing this article to help those people who are infected with this recent spread of a virus commonly known as "Kavo" virus. Its a very dangerous virus as it sneaks through infected files very secretly does not affect system performance or net speeds. Just takes its time establishes its network in all the drives { this means that if u format a disk drive on your computer the virus wont be deleted }. It downloads data from internet secretly and may be add a few adwares to your comp advertising unnecessarily.
I was recently infected with this virus and i brought the hell outtaa me for 2 days. I searched like mad for methods to remove it none worked at last i came across this blog and NOW THE VIRUS IS TOTALLY GONE. all those suffering from kavo virus click here and download KAVO VIRUS REMOVER
It instantly removed the virus within 5 mins from the whole hard drive and the best part is that u have to do nothing just run it and relax The virus would not let me see my hidden files or open my yahoo messenger. but now its all working fine.TO check whether you are infected with this drastically spreading virus or not

go to control panel>run>type these words "msconfig" without codes and click on startup tab. Scroll down and see whether a file name " Kavo.exe" is there or not. If its there then u are infected.

How To Manually Remove Vundo Trojan ?

Vundo Description:

Vundo is a widely-spread trojan that shows large amount of unsolicited pop-up advertisements. The spyware also silently downloads from the Internet and runs arbitrary potentially harmful files, mostly adware components. Vundo is distributed by e-mail in messages containing links to insecure web sites, which exploit certain security vulnerabilities of the Internet Explorer web browser. Once the user clicks on such a link, Internet Explorer opens a dangerous site that automatically installs the trojan into the computer without user knowledge and consent. Vundo is responsible for the severe decrease of the amount of computer virtual memory available. This results in noticeable PC performance slowdowns. Vundo secretly runs on every Windows startup.

Vundo Manual Removal Instructions:

Step 1 : Use Windows File Search Tool to Find Vundo Path

1. Go to Start > Search > All Files or Folders.
2. In the "All or part of the the file name" section, type in "Vundo" file name(s).
3. To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
4. When Windows finishes your search, hover over the "In Folder" of "Vundo", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete Vundo in the following manual removal steps.
   

Step 2 : Use Registry Editor to Remove Vundo Registry Values

1. To open the Registry Editor, go to Start > Run > type regedit and then press the "OK" button.
2. Locate and delete the entry or entries whose data value (in the rightmost column) is the spyware file(s) detected earlier.
3. To delete "Vundo" value, right-click on it and select the "Delete" option.
4. Locate and delete "Vundo" registry entries:

• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainActiveState 02F96FB7-8AF6-439B-B7BA-2F952F9E4800
• HKEY_LOCAL_MACHINESOFTWAREClassesATLEvents.ATLEvents.1
• HKEY_LOCAL_MACHINESOFTWAREClassesATLEvents.ATLEvents 8109AF33-6949-4833-8881-43DCC232B7B2 2316230A-C89C-4BCC-95C2-66659AC7A775
• HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce*[filename]
• HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainActive State
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce*WinLogon
• HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{8109AF33-6949-4833-8881-43DCC232B7B2}
• HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{2316230A-C89C-4BCC-95C2-66659AC7A775}
• HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
• HKEY_LOCAL_MACHINE SOFTWAREClassesCLSID{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
• HKEY_LOCAL_MACHINE SOFTWAREClassesATLEvents.ATLEvents.1
• HKEY_LOCAL_MACHINE SOFTWAREClassesATLEvents.ATLEvents
• HKEY_CLASSES_ROOTCLSID{8109AF33-6949-4833-8881-43DCC232B7B2}
• HKEY_CLASSES_ROOTCLSID{2316230A-C89C-4BCC-95C2-66659AC7A775}
• HKEY_LOCAL_MACHINE SoftwareMicrosoftWindows CurrentVersionRunOnce*[filename]
• HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionRunOnce*WinLogon
  

Step 3 : Use Windows Command Prompt to Unregister Vundo DLL Files

1. To open the Windows Command Prompt, go to Start > Run > type cmd and then click the "OK" button.
2. Type "cd" in order to change the current directory, press the "space" button, enter the full path to where you believe the Vundo DLL file is located and press the "Enter" button on your keyboard. If you don't know where Vundo DLL file is located, use the "dir" command to display the directory's contents.
3. To unregister "Vundo" DLL file, type in the exact directory path + "regsvr32 /u" + [DLL_NAME] (for example, :C\Spyware-folder\> regsvr32 /u Vundo.dll) and press the "Enter" button. A message will pop up that says you successfully unregistered the file.
4. Search and unregister "Vundo" DLL files: vzbb.dll
   

Step 4 : Detect and Delete Other Vundo Files

1. To open the Windows Command Prompt, go to Start > Run > type cmd and then press the "OK" button.
2. Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
3. To change directory, type in "cd name_of_the_folder".
4. Once you have the file you're looking for type in "del name_of_the_file".
5. To delete a file in folder, type in "del name_of_the_file".
6. To delete the entire folder, type in "rmdir /S name_of_the_folder".
7. Select the "Vundo" process and click on the "End Process" button to kill it.
8. 
   
   
   Remove the "Vundo" processes files: vzbb.dll
   
   
   
   
   

Trojan Horse Removal

What is a trojan?

Trojan horse removal is essential. But first lets define what a trojan horse is in the computer world. A trojan horse is an executable program that is designed to disrupt or hijack applications on your computer. The reason why these programs are developed are often to initiate other attacks from more advance malware such as spyware. In essence, trojan horses are used to break down security to make your computer more vulnerable to attack. A good AntiSpyware program can be an easy step for trojan horse removal .

Trojan Horse Removal Steps

Trojan horse deletion can sometimes be as easy as using a spyware removal program. These programs can identify the trojan by name or behavior. This should be your first step before moving on to more difficult removal procedures.

Step 1: Identify the Trojan

If you know the trojan you have you can move on to step 2. Before you begin trojan horse removal, you must be able to identify the malware. Luckily your computer will have already given you clear signs that you have a trojan horse infection. When you have a trojan horse your computer will often send you an error message that an abnormal process is occurring in an application. This error is called a DLL error. This dll process is linked to an specific trojan. So, if you can identify the dll, you can identify the trojan. There a tons a places on the net that will help you identify the dll process. Just copy and paste the error dll error into one of the websites like www.processlibrary.com. It will then give you all the info you its a malware or normal process. If its a trojan it will give you the name of exe file.

Step 2: Display Hidden Files

Hidden files can make manual trojan horse removal impossible. It is often necessary to search the hidden contents of your computer to unearth malware. Most good anti-spyware programs can search through your hidden files automatically. You will need to need take a few steps to display all hidden files and folders.

In XP

1. Close all programs
2. Click on the My Computer icon.
3. Select the Tools menu and click Folder Options.
4. Select the View tab in the new window.
5. Check Display the contents of system folders.
6. Under the Hidden files and folders, select Show hidden files and folders.
7. Uncheck Hide file extensions for known file types and Hide protected operating system files.

8. Click Apply button and Restart

In Vista

1. Close all programs so that you are at your desktop.
2. Click Start button.
3. Click Control Panel.
4. In the control panel, Click on the Appearance and Personalization.
5. Click on Show Hidden Files or Folders.
6. Under the Hidden files and folders section select Show hidden files and folders.
7. Uncheck Hide extensions for known file types and Hide protected operating system files.
8. Click Apply button and restart.

Step 3: Stop the Trojan's Processes
Before attempting to purge your system of a trojan, the first step is to Load your PC into SAFE MODE and stop all processes related to the trojan.

1. In Safe Mode, open up the task manager by pressing CTRL-ALT-DELETE.
2. Highlight the process by clicking it.
3.Click the End Process

 

 Step 4: Edit the Registry
In order for the trojan to be completely removed from your system, you need to remove its registry entries. This way it will not be able to re-install itself. The Trojan is a "exe" process so you can find int the RUN folder of your registry. The registry key: HKEY_LOCAL_MACHINE> SOFTWARE>Microsoft>Windows>CurrentVersion>RUN

This action will help you eliminate and chance of it reinstalling itself. Here is how:

1. Click Start
2. Click Run
3. Type regedit
4. Find this registry key:

HKEY_LOCAL_MACHINE/
SOFTWARE/
Microsoft/
Windows/
CurrentVersion/
RUN/

5. In the right section click the process. For example is the trojan is "rusvdgpo". Delete all exe and dlls associated with the trojan names .
6. Delete the value.

Step 5: Check your Startups

1. Open your Start menu.
2. Click Run
3. In the command screen type "msconfig.exe"
4. In the "system configuration utility",click "startup" tab
5. Uncheck any process that is associate with the trojan.
6. Click "OK"
7. Restart

Error Message Orkut Is Banned You Fool

Error Message Orkut Is Banned You Fool

Have you got this message that Orkut has banned you and you are left wondering what wrong you have done for Orkut to ban you.

The fact is that Orkut has not banned you..but the virus in your system is preventing you from accessing Orkut. Actually W32/AHKHeap has attacked your system. You will find a folder Heap C created in your system. The virus registers itself in the registry and automatically starts when you boot the system. The main source of this virus is removable disk.

Solution

Press Ctrl+Atl+Delete and the task manager will appear as below.

Try and locate svchost.exe. The chances are that there will be many scvhost. exe. The culprit here is the who's user name is the login name of the computer. Select the once which has your login name and end the process. This will help you temporarily disabling the virus.

Now learn how to kill the culprit permanantly. Click on Start and then on Run command.

Type: C:\heap41a.

Heap41a is a hidden folder and not visible. So press Crtl+a and then press Shift+del. The Click of start and then select run. Type Regedit and press Enter. This will open the registry. Press Ctrl+f and search for Heap41a. Your search result will look something like this -

“[winlogon] C:\heap41a\svchost.exe” and “C:\heap(some number)\std.txt”

Select both the results and delete. Close the registry.

Your computer is free from this deadly Orkut Virus.

Removing Autorun.inf Virus & Viruses that uses Autorun.INF

Removing Autorun.inf Virus & Viruses that uses Autorun.INF

There are several viruses that uses the autorun.inf to spread itself such as the Bacalid (hides itself in ctfmon.exe) and the RavMon.EXE. These viruses set its file attributes to System+Hidden+Read-Only attributes so some anti-viruses will have a hard time detecting or finding them. These viruses save itself in the root directory of every available drives of the current infected computer and runs itself every time you Double-Click the drive. In USB Sticks and CDs that are infected by the virus runs automatically especially if drive autorun is enabled for the current drives (which is usually by default, autorun for drives are enabled).
Autorun.INF is usually used by CD Installers to autoplay their installations but Hard disks by default should not have AUTORUN.INF in the drive.
Now, it is possible that your computer is infected by those viruses if you try to display the content of the your computer through command prompt, using the dir /ah command. You will see the following window if you try this:

You will see from this window that drive C contains a hidden file autorun.inf, this is a possibility that the computer is infected. Now to erase this, restart your window to Safe Mode Command Prompt. (Do this by rebooting your computer and pressing F8 before windows go out and select from the boot menu). On drive C and other drives type the following commands: 1. attrib -h -r -s autorun.inf 2. del autorun.inf
Do this steps to other drives to disable the autorun.inf .
Disable AUTORUN from Registry
Now you can disable the AUTORUN for all drives by configuring the registry. Open the registry by typing regedit.exe to the command prompt (if your still at the command prompt) or execute it in Run. Look for the HKEY_CURRENT_USER\Software\ Microsoft\Windows\CurrentVersion\Policies\Explorer as shown below:


Double-click the NoDriveAutorun DWORD entry and type the value HEX: FF (255 in Decimal). (If the NoDriveAutorun does not exists, you can creat it by right-clicking the right side area of the regedit window, then click New->DWord Value -> type NoDriveAutorun) Close the registry and restart the computer. This procedure will disable all the autorun for all drives of your computer and at least will prevent the autorun function of infected USB drives or CDs and avoid the infection of viruses like the Bacalid and RavMon.exe.
Update:
If you want to prevent viruses that uses autorun.inf to infect your USB flash drive, try to do this:
1. Open your flash drive via Command Prompt (do this via Start->Run->cmd.exe)
2. Change your logged drive to your USB flash drive (e.g. if your drive is at drive E: then type E: on the command prompt then press enter)
3. Create a folder named: AUTORUN.INF on the root directory of your flash drive. (to do this type the command: MD\AUTORUN.INF). If an error: a subdirectory already exists… shows, try to follow the instruction above to remove existing autorun.inf before doing this instruction.
The reason why this will avoid future infection is that autorun.inf viruses usually generates a file autorun.inf. Having an AUTORUN.INF folder on the root directory of your drives will make virus programs unable to create their own autorun.inf file, virus can’t even overwrite it because it’s a folder and not a file. See my point?
Read also my current post on free tools on removing autorun.inf virus and other malware.
If this post helps you on your PC problem, please link back to this blog: http://bleuken.i.ph as a sign of your gratitude. Thank you!
Removing SCVHOST.exe or W32/YahLover.Worm.gen
November 5, 2007
There’s a strain of computer virus/worm that hide itself using the name SCVHOST.EXE or SCVHOSTS.EXE, (don’t mistaken it as SVCHOST.EXE, it’s one of the vital programs of Windows, see the difference in spelling). It was detected as W32/YahLover.Worm.gen of McAfee Antivirus and as Win32/Autorun.R.worm by NOD32. This virus infects your computer by different means.
• One is it install itself in autorun.inf in Open option of the AUTORUN. Once you double click it will run and start spreading itself to your system.
• The other event that I observed is it copy itself through all the shared files of the computers on your network and install itself in the registry entries remotely using a GUEST account (through System:Remote).
Characteristic of the Virus
• This virus/worm when blocks the task manager when you press Ctrl+Alt+Del to invoke the task manager
• It blocks the registry (The worm change the registry to prevent running task manager and registry for harder detection).
• It also restarts the computer when you try to go to the command prompt. (This is based on my experience on this worm/virus when I try to disinfect it manually)
• It copy itself to different folders of drives and uses the name of the folder where it belongs. The copied virus/worm uses a FOLDER icon
• According to McAfee it changes the configuration of your Yahoo Messenger (see McAfee info)
• It autostart via registry keys Windows->Run and add itself to WinNT->WinLogon->Explorer.exe
To remove the virus manually, (try this it works with my computer but if you can’t try using an ANTI-VIRUS like McAfee or NOD32):
1. Boot your system in Safe Mode Command Prompt Only (Press F8 when your computer restarts, a menu will be shown and select the option)
2. After you log-in the command prompt will be opened (LOG-IN AS ADMINISTRATOR).
3. Type CD C:\WINDOWS\SYSTEM32 (assuming that your Windows System files are located at Drive C)
4. Type DIR /AH, this will display all hidden files of this folder. You will see the following file which is used by the virus to spread itself: AUTORUN.INI, BLASTCLNNN.EXE, and SCVHOST.EXE
5. Type ATTRIB -H -R -S SCVHOST.EXE
6. Type ATTRIB -H -R -S BLASTCLNNN.EXE
7. Type ATTRIB -H -R -S AUTORUN.INI
8. Type DEL SCVHOST.EXE
9. Type DEL BLASTCLNNNN.EXE
10. Type DEL AUTORUN.INI
11. Type CD\
12. Type ATTRIB -H -R -S AUTORUN.INF
13. Type DEL AUTORUN.INF
After removing the virus/worm files, it should be removed from the registry of your system.
1. From the command prompt type REGEDIT.EXE this will run the Registry Editor
2. From the registry, look for the key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, you will see an entry Yahoo! Messengger (it’s spelled like this) with a value c:\windows\system32\scvhost.exe, Delete this entry.
3. Look again for the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, there’s an entry named: SHELL, it has a value = Explorer.exe SCVHOST.EXE , don’t delete this entry!!! Just edit this entry and REMOVE the SCVHOST.EXE so that Explorer.exe will be the only value that will remain from this registry entry.
I’ve tried this steps and this works. You should try this if you’re only know how to edit registry entries. (try it at your own risk) Hope this will help you

How can you prevent and fix DLL corruption problems?

Introduction

When using an application, if you receive an error message like "Illegal Operation", "Incorrect DLL Version" or similar types of errors, it could be because you don’t have the latest DLL or it could be because one of DLLs of that application was overwritten when you installed a new program. In this article, you’ll learn why DLLs are a problem and how to locate and replace the offending DLL.

What is a DLL?

In the early days, computer applications contained all their code in a single executable file. But applications quickly grew larger than the available memory on most systems. So the code in an application is divided into parts; the main executable file, and files containing functionality that could be swapped in and out of memory as needed. A part that could be swapped in and out of memory is called a Dynamically Linked Library (DLL).

       Initially, the DLL of an application would be stored in the same folder as the main executable file. But application developers soon realized that rather than re-inventing the wheel, they could re-use code by sharing the same DLL between several different applications. Instead of writing new code, developers can get functionality they need by licensing a DLL from another developer. Companies were started just for the purpose of developing and licensing DLLs. Since these DLLs could be shared among several different applications, they were stored in the operating system folder (c:’Windows).

An application developer who wants to increase or improve the functionality of a DLL can create a new version. The software community agreed that if one created a new version of a DLL, along with the new functions, that DLL would continue to contain the interfaces implemented by the old functions. That way, you could overwrite the old DLL without breaking existing applications. In addition, the software community agreed that installation programs would check the system for a newer
of a DLL before it installed a DLL. That way, the installation of an older application wouldn’t break new applications.

Causes of DLL Problems

Unfortunately, since anybody can write a software application, many amateur developers created DLLs that did not implement existing interfaces correctly. When their applications where installed, existing applications broke. Many amateur developers used installation programs that did not check the version of the DLL before overwriting it. And, they thought their DLL was so wonderful that everybody in the world would want to share it, so instead of putting it in the same folder with their application, where it could cause less harm, they put it in the folder of the operating system.

Windows Installer Service

The InstallShield Corporation developed an installation program that carefully checked for newer version DLLs before overwriting them. Their installer was used by many professional application developers. Microsoft licensed InstallShield’s technology and implemented it as part of Windows Installer Service.
Windows Installer Service requires application developers to provide a special file in Windows Installer format (.inf) that describes how the application is to be installed. The Windows Installer Service will use the file to perform the installation. During the installation, the Windows Installer Service creates an uninstall log.

System File Protection

The Windows 2000 and Windows XP operating systems implement the Windows File Protection (WFP) feature. WFP keeps cached versions of the important operating system files. WFP runs in the background to detects attempts to replace a system file. If a program tries to replace a system file, WFP checks the digital signature of the replacement file to determine if it’s a correct version. If the file is not a correct version, WFP automatically replaces the file with a cached version of the original DLL.

The Windows Installer works with WFP when installing essential system files. It calls WFP with a request to install or replace the protected file. If the file version in the install package is incompatible with the operating system, WFP informs the user that it cannot update the system and that an update of the operating system may be required for the application.

DLL Corruption

In addition to blaming the programmers for the new drivers development mistakes, there are other reasons of DLL files get corrupted or missing. Among them:

1. Removal of an important DLL file by mistake.
2. Performing illegal operation during the new software install or uninstall. That might be also related to the unclean installation or un-installation process, when user is trying to exit it on the middle being frustrated by the appeared computer freezing.
3. Operation system damage and other problems in your hard disk.
4. Infection by spyware or virus.
5. A hardware issue exists with the computer, such as a bad hard disk drive, causing the data on the drive to become corrupt, leading to the .dll problems display.

Fixing DLL Problems

There are numerous ways to resolve DLL errors. Whenever your PC warns you of a DLL error, usually it displays the name of the specific DLL file such as xvidcore.dll, msvcr71.dll or msvcrt.dll that has become corrupt or has been deleted. You can note down the file name and perform a search for this DLL file on the internet. By downloading this file and replacing the old one, you may rectify the problem.

Another easy method

Another easy method to correct the DLL error may be to perform a system restore. Make sure to set the date of the system restore to the day before you started encountering this error. If the DLL error does not allow your PC to start, just restart your PC in Safe mode and start system restore.

In case you encounter a DLL error just after you have installed a new program, you should uninstall the program and see if the error goes away. If it does, you should contact the manufacturer of the program and seek technical support to resolve the issue.
Sometimes, however, a DLL file error will make it impossible for your computer to start. If that’s the case, simply start your computer in safe mode then you can run the system restore.It is important to mention that trying to repair DLL errors can be cumbersome and even risky at times. Therefore, a popular way to repair DLL errors is to use a registry cleaner tool. This tool will help you look for invalid DLL entries in the registry and repair them.

DLL Error Prevention

1. The first DLL error prevention measure would be to NOT install and uninstall programs any more often than you have to. In other words, unless you are certain that the program that you are about to install is one that you are going to use and keep, do not install it!
2. Be extra careful when uninstalling programs from your machine. For example, if you have ever uninstalled programs, you have probably seen a message telling you that the program is going to uninstall ABC.dll as part of the process, after which, it asked you whether it should go ahead and do so. If it tells you that it is about to uninstall a DLL, go find out what that DLL actually does before giving the machine the go-ahead! (check out Microsoft’s own site for the answer to this question, or run a search on Google or Yahoo).
3. Be patient when installing and uninstalling new programs. Sometimes a very complicated setup is long and demanding extensive resources. At this time, it is not recommended to use your computer for anything else. Give your PC a rest and let it concentrate on the task. Even thou you do not touch it, it might become unresponsive for some time. Be patient and give your computer a fair chance to complete the process normally. Trust me, trying to repair the damage later will be more time and nerves consuming.