how can i do remove nhatguanglan Solution
[[User:Lander19|Lander19]] 15:09, 14 Jan 2008 (UTC)Enable Regedit, Task Manager, Regedit, Hidden Files, etc.
Enable Task Manager
-------
1. Start> run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
2. Start> run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
Enable Regedit
-----
1. Start> run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
2. Start> run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
Folder Option & Hidden Files
----------
1. Start> run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f
2. Start> run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f
3. Start> run
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 1 /f
4. Start>run
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v DefaultValue /t REG_DWORD /d 2 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN /v CheckedValue /t REG_DWORD /d 2 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN /v DefaultValue /t REG_DWORD /d 2 /f
Other steps
------
Delete the files
C:\WINDOWS\SCVHSOT.exe
C:\WINDOWS\hinhem.scr
C:\WINDOWS\system32\SCVHSOT.exe
C:\WINDOWS\system32\blastclnnn.exe
C:\WINDOWS\system32\autorun.ini
C:\Documents and Settings\All Users\Documents\SCVHSOT.exe
Modify some registries
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Shell REG_SZ --> explorer.exe
\Software\Microsoft\Windows\CurrentVersion\Run\ Yahoo Messengger -->delete
Precaution
[[User:Lander19|Lander19]] 15:09, 14 Jan 2008 (UTC)[[User:Lander19|Lander19]] 15:09, 14 Jan 2008 (UTC)~ Never double click on such files which look like folders, instead use folder view for navigation.
You may like to disable "Shared Documents".
To remove this virus install escan and update virus definition. Scan full computer & USB device. I too have a problem with nhatquanglan, I was infected with this virus. Usually the target is a shared folder. From my own experience, all my shared folder and sub folder has an nhatquanglan inside. Just buy kaspersky anti virus 7.0 or try the trial version it works fine for me.
Well, you need a anti-virus - In addition, I suggest you to format HD
Check this out http://www.supertechtips.info/nhatquanglan-virus-removal.html
See the link below for free tools to use against this virus.
I consistently suggest the use of Spybot Search and Destroy (http://www.safer-networking.org,) AVG Anti-Virus (http://www.grisoft.com,) and Site Advisor (Internet Explorer and Firefox Add-On at http://www.siteadvisor.com).
anti virus grisoft or Anti Viral Guard or Anti Virus Group
Anti Virus Grisoft
anti virus grisoft or Anti Viral Guard or Anti Virus Group
What is the name of the first anti-virus
your anti virus scans for virus
Anti-Virus,Anti-Spyware,and many more.
These are 2 good best anti virus programs. You have to pay to get spyware docter with anti virus. Avg anti virus free edition : http://www.avg.com/ and spyware docter with anti virus: http://www.pctools.com/spyware-doctor/