facebook virus july 26-27 2011

Tools needed:
Process Explorer
Kaspersky Virus Removal Tool 2011
Antivirus, we use free AVG antivirus
 HijackThis
Malwarebytes
Closing ports 445 and 135  - fix Generic Host for Win32 Process and svchost.exe errors.
 or update your windows security patches

Step 1

Before we begin first download Process Explorer if the browser wont allow, open task manager and kill in the process the falshplayer.exe (press Delete then ok or right click the flashplayer.exe and delete.).
and second download the above tools needed.
when all the tools are ready, install the Kaspersky Virus Removal Tool 2011 and make a quick scan, after it removes the infection reboot the computer if needed, after the reboot  click Start >>> click Run then type msconfig, go to Startup tab uncheck  flashpalyer.exe and any application with 32 example services32.exe, ccdrive32.exe,  and also application with no name.

 Step 2

Open the process explorer again and look if the flashplayer.exe, and any apps name with 32 is running , if it is press Delete then ok or right click the flashplayer.exe and delete. you can see mostly the virus stay below the windows explorer. click here

Step 3
Open windows explorer go to tools  then click folder option, In the View tab under the Hidden files and folders click Show hidden files and folders and Uncheck Hide extensions for known file types and Hide protected operating system files.

In the WINDOWS folder in C: delete the folder name update 1, update 01, update -1,update 02 and etc.. or any folder name update/s there's no such thing name updates in WINDOWS sub folder, look at the picture below.

Step 4

Install  free AVG antivirus

Step 5

Run  HijackThis
and  accept then do a system scan, find flashplayer.exe or any name of an application with 32.exe and delete. note! (NvMediaCenter and NvCplDaemon is not included this is not a virus)

Step 6
Install Malwarebytes
update and do a quick scan and remove infections, reboot if needed, if you want to be sure that no virus is still running, repeat step 2.

Step 7

Closing ports 445 and 135 - fix Generic Host for Win32 Process and svchost.exe errors.

 or update your windows security patches

if the virus is still running backup your important files and do a REFORMAT.
.

Registry Cure

A simple utility program to cure the registry damage by a virus, it restores the Windows Task Manager, Run, Folder Option and Registry Editor. If the program won't run, Get Microsoft .NET Framework Version 2.0.
Download DotNet Framework 2

 Download  Reg Cure

Freeware AntiKeylogger

What are keyloggers? 

 

Keylogger is a malicious program (usually known as spyware) it intercepts and logs every  keystroke. These log file can be stored locally or sent to an attacker using FTP, e-mail, etc.
Some of the keyloggers contain additional features, like stealing data from clipboard, taking screenshots (i.e. copies of what you see on the screen), and reading information directly from opened documents, even if you have just opened document to read!
Trojans, worms and viruses usually contain keylogging module inside, which sends collected private data to the hackers.

Updated link! Download here

How to fix Generic Host for Win32 Process and svchost.exe errors.

“Generic Host for Win32 Process” and the faulting Svchost.exe are dreaded errors on Windows XP (SP2).These errors can also occur on windows server 2003 and windows 2000, and on both 32-bit (x86) and 64-bit (x64) editions.

Earlier we covered a few solutions to fix Generic Host Process Win32 Services error. Here is one more solution that requires you to close ports 445 and 135 on your PC/computer.

Fixing Generic Host for Win32 Process and svchost.exe errors.

To close Port 445:

! WARNING! Backup the Registry first before you make changes, just for safety!

• Click Start >> Run, to open the Run dialog box
• Here, type regedit to open the registry
• Navigate to the following registry key – HKEY_LOCAL_MACHINE >> System >> CurrentControlSet >> Services >> NetBT >> Parameters

• On the right-hand pane find the option TransportBindName.
• Double click on TransportBindName and delete the existing default value.
• click Ok

From the above, it is clear, that you have closed Port 445 by giving a blank value to TransportBindName for NetBT services.
 

To close Port 135:

! WARNING! Backup the Registry first before you make changes, just for safety!

• Click Start >> Run, to open the Run dialog box
• Here, type regedit to open the registry
• Navigate to the following registry key – HKEY_LOCAL_MACHINE >> software >> microsoft >> Ole

• On the right hand window pane find an option called EnableDCOM
• Double-click EnableDCOM and change the value from Y to N
• click Ok
• Close the Registry Editor and restart your computer

If  problem still exist  

• Click Start >> Run, to open the Run dialog box

  In the box type services.msc and find error reporting service and stop service then disable.

For another option, you just update security patches for windows xp.