Remove NsCpuCNMiner.exe or NsCpuCNMiner64.exe manually

Remove NsCpuCNMiner.exe manually.

These are the steps I followed when one of my colleague's system was infected with this Malware.

What it is ?
It is a process which runs in the background and mines for crypto-currency using your system as the resource.




Symptoms:
Disk utilization & CPU usage will be max. So your system will be slow.
Application will take longer time to open.
In some cases you get some popups in your web-browser.

Steps to Remove:

Step 1 - Stop the process
Goto Task Manager->Services -> select NsCpuCNMiner or NsCpuCNMiner64 -> right click - end process

Step 2 - Remove related extensions from browser
Goto chrome browser extensions and check if any miners are present and remove them.

Step 3 - Disable From startup
Goto Win+R run -> msconfig.exe -> startup -> Disable the NsCpuCNMiner or NsCpuCNMiner64
For win 10
Goto task manager -> startup services -> Disable the NsCpuCNMiner or NsCpuCNMiner64 or Folder (Yes it is the malware and not the WindowsExplorer process)

Step 4 - Delete the source file
Goto Win+R run -> type %AppData% -> Navigate to "Roaming" -> "Images" and delete all the contents of the folder. (This contains the exe :see image)

Step 5 - Delete from registry
Goto Win+R run -> type regedit -> Once the registry editor is opened -> type Cntrl + F
-> search for "NsCpuCNMiner" and delete every occurrence of this.

If you face any issues while removing the malware, do comment below - I shall respond.

Remove HulaToo adware manually

HulaToo is an Adware that puts ads on ur browsers and slows down ur system. It comes with unwanted downloads.


Anyways if you begin to see HulaToo ads on ur browsers its safe to remove them.

Steps:
1. Go to Control Panel and select Install/Uninstall Software and select HulaToo and Unistall it.

2. Reset ur Browsers.

3. Go to Win+R type regedit and hit ctrl + F and search for HulaToo and delete all the entries that contains this. Repeat this search and delete till there are no such entries

If the above steps does'nt work then do the following
Steps
1. Go to Win+R (run window) type services.msc

2. All the services running in your system opens up. Search for updateHulaToo.exe and utilHulaToo.exe and just to make sure look out for any name containing HulaToo in the window.

3. Now double Click on one process like updateHulaToo.exe select startUp type in the window as Disabled repeat the same for the other process i.e. utilHulaToo.exe and other services with the HulaToo in it.

4. Restart System

5. Go to MyComputer-> C Drive > ProgramFiles (x86) or ProgramFIles and delete HulaToo Folder. Later Reset ur Browsers.
6. Go to Win+R type regedit and hit ctrl + F and search for HulaToo and delete all the entries that contains this. Repeat this search and delete till there are no such entries

If u have any doubts or need assistance do as in the comment section

Sorry, Movie Maker can't start. PROBLEM SOLVED

Error you get when you click on Windows movie maker

This is the annoying error you get while trying to open Movie Maker.

"Sorry, Movie Maker can't start. Make sure your computer meets the minimum system requirements before trying to start Movie Maker again, and then try to update the driver for your video card if Movie Maker still doesn't start."

As said I tried updating my video card driver but it was already upto date.

The Microsoft Support said that the new versions had some bugs in it and it affected some graphic cards.

Here are the Solutions that will work out:

Soln 1: Update your graphic card. HERE are the LINKS for the drivers. 

Soln 2:  Offline Install of Live Essentials 2011 not 2012 . In this LINK go to Show all and select Vista and select english (though your using Windows 7 ) as shown in the image. The download will start. The file size is 214 mb.

Once the download is complete, uninstall Windows Live Essentials from the Control Panel (How to Uninstall Windows Live Essentials) and then Restart System.

After Restarting Install Movie Maker from the freshly Downloaded Installer File.

Soln 3: Recommended . This worked for me.

5 Simple Steps:

Step 1: Download the offline installer of Live Essentials 2011 as mentioned in the Soln 2.

Step 2: Create a new USER ACCOUNT on the system with ADMINISTRATOR privileges (How to create admin Account)

Step 3: Uninstall Windows Live Installer from Control Panel. (How to Uninstall Windows Live Essentials) Now Restart System.

Step 4: Login to New Administrator account that you created in STEP 2. Install Movie Maker from the freshly downloaded file as mentioned in Step 1. Once you start the Installer Select USE RECOMMENDED SETTINGS. 

Step 5: Start Windows Movie Maker . No error.

System Fix - A virus/Malware/Randomware--BEWARE

This is a malware and not any program to fix your system. It connects to the internet and asks them to buy the product to fix all the fake system errors it provides.

symptoms:
1) The background turned to black.
2) The only two desktop icons left are "My Computer" and the "Recycle Bin".
3) The "Start" menu, "All Programs" and all the folders in "My computer" are completely empty.
4) A lot of message boxes appear on startup saying stuff like "Failed to save all the components for the file xxxxxxxxxx. The file is corrupted or unreadable.". Even if u close them, the same amount of messages appears at once after a couple of minutes.
5) A legit-looking program called "System Fix" appears on its own, pretends to scan the computer and detect a number of "Critical" errors with the hardware and software and also pretends to be able to fix some of them. Finally, it claims that it's a trial version and prompts the user to buy a full version to fix the rest.

Many of the solutions that were on the web dint work out except this one
 http://www.2-viruses.com/remove-system-fix
It requires you to modify registry
. If you got any doubts ask in the comments.

Remove regsvr.exe virus manually

1)Goto task manager Ctrl + Alt + del (task manager disabled by Admin? Click here)

2)locate regsvr.exe right click on it and select end process tree and then click YES

3)start>run or Win + R

4)type regedit and windows registry will open up (registry Disabled ? Click here)

5)Press Ctrl + F then type regsvr.exe and click FIND NEXT
4)you ll get 4-5 locations where its present just delete it by pressing the delete key

Note:Once this virus is running in your system it creates copies of itself in all the folders you open with that folder name on it, for ex if there is a folder MUSIC then in that folder there will be a copy of this virus in the name MUSIC.exe

Once you've removed this virus by this method the virus wont spread but you'll need to avoid clicking on the virus file (music.exe)If you click on it you'll be again infected and you'll need to perform the entire above said procedure again .SO, to prevent all this just get an free antivirus Click Here to get a free antivirus and scan your PC, it'll detect all the copies of virus and deletes them.

Regsvr.exe is missing.

Regsvr.exe is missing / windows cannot find regsvr.exe

This is a common startup error displayed by windows Xp

regsvr.exe is not a system file its a virus.regsvr32.exe is an system file.
So when regsvr.exe is removed by an antivirus or any other virus removal tools it displays this error.

To get rid of this all you need to do is

1)Start>run OR win key + R
2)type "regedit" without the quotes windows registry opens up
3)press Ctrl + F then type regsvr.exe and click FIND NEXT
4)you ll get 1-2 locations where its present just delete it by pressing the delete key

change windows xp startup music

change windows xp startup music?
1.Start->Control Panel->Sounds and Audio Devices->Sounds (Tab)

Then you will be getting a Sounds Popup Menu where you can change the Sounds in the Windows Startup and Shutdown music and all available options.

Dont forget to change music/audio to wave formate else they will not play

Remove shared documents from My Computer window

Remove shared documents from My Computer window
Some people don't like shared documents folder option. If you are one of that, here is a trick to remove it.


Open registry editor by going to START-RUN and entering regedit.

Once in registry, navigate to key HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \
Windows \ CurrentVersion \ Explorer \ My Computer \ NameSpace \ DelegateFolders
You must see a sub-key named {59031a47-3f72-44a7-89c5-5595fe6b30ee}.

If you delete this key, you have effectively removed the my shared documents folder.

Open each folder in the same window

Sometimes the viruses causes each folder to open in a different window . To prevent this there are 2 ways.

1)Open Control Panel, double-click Folder Options and select the General tab. Select the Open each folder in the same window option and click OK.

Else

2)Download the reg file below and merge it with your registry.

DOWNLOAD

Enable Control Panel

Some of the viruses diasable control panel.

To enable it
Download this reg file and run it, restart if necessary

DOWNLOAD

Enable Task Manager

Disabled task manager is automatically fixed these days by the av's

Anyways you can use this Task manager Fix to enable the Task Manager or
DOWNLOAD

OR

u can also use this registry file just merge it into the registry to fix task manager

DOWNLOAD

show/display hidden files

Some times even after selecting the option show hidden files from the folder options menu ,still xp/vista doesn't display the hidden files.

to fix hidden files problem:

Download this and double click, then merge in the registry, and u r done. this works on both vista and xp

DOWNLOAD

Enable Registry

Is your registry blocked by viruses?
Do you get the message "registry editing has been disabled by your admin"? then follow the instructions below

Enable Registry Editor
1:Extract the file
2:Right click on the file unhook.inf and select install

DOWNLOAD

How to remove khatra.exe ?

Follow the steps below and you will need no antivirus / removal tool to get rid of em.

If you need any help/have any doubts,post it in comments,so that i'll be able to help you out.

Procedure to remove Khatra.exe virus

1)Go to task manager and select regsvr.exe(if found), gHost.exe , khatra.exe , Xplorer.exe rt click and select end process tree.
press WIN+r or start>RUN

2)type cmd and hit enter

3)GO to the the drive where your OS is installed

4)In the command prompt make sure you get the command line as c:\ or d:\ (this can be achieved by the command "cd .." without quotes)

5)Type attrib -s -h -r khatra.exe
Repeat the same process for the location c:\windows\system32

6)type del khatra.exe

7)Follow the same process for gHost.exe & Xplorer.exe as they are also part of the virus.

To make sure that the virus is out of you pc , check your registry
1)win+R type regedit

2)ctrl+F type in search one by 1 the names of the 3 processes i.e khatra,gHost,Xplorer

3)search the entire registry n go-on deleting the values you find.

Registry Disabled?Click Here

After deleting khatra from your pc, your control panel will be disabled.. to enable it go here.
http://dungeonworks.blogspot.com/search?q=control+panel


To remove regsvr.exe(virus) click here

** Originally Posted Here @ D Works **

If you need any help/have any doubts,post it in comments,so that i'll be able to help you out.

Disabling Display of Drives in My Computer

Worried that someone keeps checking the content of your drives??
Then Disable em

To disable the display of local or networked drives when you click My
Computer go to : HKEY_CURRENT_USER\Software\Microsoft\Win
dows\CurrentVersion
\Policies\Explorer

Now in the right pane create a new DWORD item and name it
NoDrives. Now modify it's value and set it to 3FFFFFF (Hexadecimal)
Now press F5 to refresh. When you click on My Computer, no drives
will be shown. To enable display of drives in My Computer, simply
delete this DWORD item. It's .reg file is as follows:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio
n\Policies\Explorer]

"NoDrives"=dword:03ffffff

Renaming The Start Button:

To rename the start button, you will need a hex editor.(ultraEdit)

Copy the \windows\explore.exe file to a new name (e.g. explorer_1.exe)
With the hex editor, open that file and go to offset 412b6
You will see the word start with blanks between each letter
Edit it be any 5 characters or less
Save the file
Boot to DOS
Copy the existing c:\windows\explorer.exe to explorer.org
Copy explorer_1.exe to explorer.exe
You will also need to replace the explorer.exe in the c:\windows\system32\dllcache file as well with the new one.
Note: If the partition is NTFS and you can't access the files from DOS:

Start Regedit
Go to HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon.
Change the value of Shell from Explorer.exe to explorer_1.exe.

MAKE FOLDERS WITH SAME NAME

Make a folder n name it with d name of existing folder. At last press Alt+255 hit enter
Alt+255 is d ASCII code for space bar .

You can also press Alt+0160 and
Alt+255 can also be used to make folder with no name.