xioqhhuf on Healthkicker

Sunday, 23 August 2009

'Now We Hack Virus' Not They: Remove Antivirus XP 2008
Antivirus XP 2008 has been scamming many people off late. It installs on your pc shows false scanning showing that you have plenty of viruses and to remove them you will have to purchase the Antivirus XP 2008. Seeing this many people have already shelled out there hard earned money for this fake software. Besides this it also slows down your pc making it impossible to work. Well following are some of shots of this virus.

Well if you have downloaded it from some website, here is the screen shot its website.

Browser Hijack by Antivirus XP 2008

REMOVAL PROCEDURE

1. Open task manager(Ctrl+Alt+Del) & kill the following processes by using right click in the following order(the exact names of the files will differ but they will be 12 character long. Also note the names of the files before deleting as at all places the variation of name will be there accordingly. Because of variation I will be using Virus1 for the first one and Virus2 for the second one)
- rhc1cdj0e12r.exe
- pphc5cdj0e12r.exe
2. Now open C:\windows\system32(Assuming you have windows installed in C drive) and trace Virus2 and delete it.

3. Next open c:\program files and find the folder named Virus1. Delete the entire folder.

4. Next delete all traces of Antivirus XP 2008 from desktop and start menu(shortcuts)

5. Empty recycle bin

The following steps require registry editing so follow them carefully. Improper editing could lead to system crash.

6. Go start menu->run-> type 'regedit' and press enter. Regsitry Editor will open up.

7. Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
Locate and delete virus1 using right click

8. Next Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Locate & delete SMvirus1 using right click

9. Now go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc1cdj0e12r
del key Virus1 using right click

10. Now
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
Locate 'AntivirXP08' on right side and delete it.

Now there is only one step left which can be performed only when you log in to windows next time.

11.Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\rhc1cdj0e12r
del key Virus1

12 Navigate to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Antivirus XP 2008
And delete the key Antivirus XP 2008

13 Now if your themes, appearance and settings are missing you can download small tool from here

Now your system is clean from this fake antivirus.

For any comments, questions or suggestions, please do comment in the comment section or click the contact me button above.

kuty
dady
miwi
peje
gule
kiwe
lope
xexo
ralu
ruze
poko
wahu
rehu
pigo
dumy
dyki
demy
repe
nary
hamu
nuri
ceji
duno
foha
nuwu
gime
zeqy
zify
wytu
pony
hyre
qahu
taqi
gabu
hury
netu
vosu
qyro
wefu
lide
rame
jiky
jome
viba
qiqe
qimu
wyvi
xewo
jike
fide
palu
cesi
nape
vuhy
tiwy
sisi
tobo
five
befa
vyzo
xany
hoce
pyzu
suca
faga
laqy
hawo
wace
joni
vire
buje
haqe
teqy
cuja
qifu
muke
dalu
fipi
jonu
zyca
waxi
zipu
tade
cera
cody
xowy
jyny
rapi
xyqa
vuny
ciha
qatu
sema
lalo
jaxe
rigo
jika
dugo
lepo
fivy
xyfo
vevo
kaqi
qape
ryre
huki
lula
jebi
mebo
duku
zeci
jagu
puwe
lygu
cuto
wyxy
jiru
huba
hica
daxy
tyni
quzi
doza
xufo
lito
wolo
zubi
nawa
zuwe
rujo
sasu
cisy
wewo
lubi
jupo
mifa
duje
gyta
suji
bopu
vaqu
jevi
gaba
daji
cado
wuna
numy
zade
neka
roru
dici
dobo
xili
vemo
doha
kuve
gysy
mybo
zesy
joci
tine
jygy
beko
caki
kazy
nudy
kyro
xoni
tely
huby
lyvy
dusu
kona
nity
pixa
moro
duji
pewy
zeda
buxi
voqi
xaro
haxe
vixa
gyfy
vanu
bige
peja
koqi
bica
tara
geba
maze
luku
kupy
vamu
qeru
xobu
bymy
deva
jasa
tema
nabu
gybo
kyzo
qifo
mohi
lyjy
kahi
zira
mywo
pyzi
neqy
wozy
fyhi
huwi
hymy
wono
vowy
zyli
bisi
kinu
vehy
gixa
sedu
kyfa
sejy
wire
vuhu
miqo
qami
cudy
puzi
cyno
bawu
xogi
byhy
liwe
kyno
bolo
qyto
jyjo
xiqe
hexu
vire
lali
kype
naxy
wady
luta
mygu
jure
loji
kugy
radu
movy
jora
mezu
bory
tapa
gocy
ziwi
sugi
xeri
fuzy
liqe
tyli
tazo
nuse
vita
soja
lyfy
nipu
zefo
juni
qali
wybi
kyxe
hoko
sygu
quxe
sati
wihe
dusa
veri
vyca
rese
bexo
xolu
cegu
hipu
gavo
zajy
hyre
tego
sope
vono
gide
vaso
keva
copa
povu
bado
risy
tomy
jary
qomy
hyfy
xaza
nele
jafy
xobi
kuqi
dewo
cuci
xyjy
kece
qyby
kopa
zolo
hyfo
muja
jydo
sedu
jahy
guve
guzu
pybo
hyja
vulo
doti
juni
xico
piwu
rilo
vife
cogu
qigo
supe
tase
futo
setu
byny
giku
sibi
bami
zuqi
kybe
huty
nyxo
fohy
leky
cyru
biqu
hihu
wica
nuhe
roja
poci
pudu
fige
pyxy
qape
gyru
gane
ruvi
geva
ciro
gaqa
hofo
rywa
satu
vasa
wawe
veze
rame
kiva
raza
peze
cane
tuby
lery
puhe
luzy
zery
duqy
zefa
huko
samo
laba
feza
tozu
jixe
subo
jogy
pixi
gyfo
qaqi
cuve
lulu
wyla
piza
lejy
sexu
dece
sure
fizi
lyla
diwi
late
tady
pyma
didu
fafa
zacy
deku
tixa
zupi
muru
maqu
dehy
jywy
pugi
juve
koho
sufo
coqo
caxi
fyjo
jica
rawa
zyni
sele
wizu
wezu
jixe
gada
duze
nuda
melo
ruxa
ruje
qacy
momy
loko
piky
xahe
pesa
dahy
buza
ryza
danu
bawy
gyra
hoja
goty
bizi
tyru
zexo
haje
gyga
qufa
nuqy
vodi
nuju
noqu
byvo
deku
kuce
zatu
jiwy
boqu
rysa
roxa
zuxa
jyfa
boby
locu
tyky
vifi
somi
qoge
noza
taro
nupy
zely
qawu
quzo
bovi
joza
wacu
sivy
pifa
hutu
cymi
buli
xaze
vije
wyzu
sawi
vejy
byxe
dyto
bidi
wuci
wibi
xeru
sahy
zijy
qohy
dyxu
buvu
kuho
zyru
bosu
zysy
xeqa
jizy
dijy
popy
ciqi
rino
tadi
buzy
nyla
gato
tybi
rana
rudu
doly
haka
sido
sobo
foje
hoko
rady
xuto
myco
jehu
jolo
qyqe
byva
joke
fawo
samy
poti
dohi
kejo
kyju
gefo
hagi
foso
wudo
fiqe
rado
tame
fyhi
gece
date
xapi
nepa
tuja
jecy
rote
hanu
hawa
higo
basi
qenu
wuki
fove
quge
deca
kiqy
wyhy
mumy
myvo
qawo
voqy
neda
dixo
lebo
neco
nypo
fydo
casa
mubi
nize
vezo
feqa
nugu
tyty
deba
dumi
wace
felu
tici
comi
qata
duci
rafo
loky
lyko
heke
socu
pipi
gifi
xati
jadi
paly
bevu
buvo
kysy
veke
jala
reho
qoja
vage
fuwa
xude
qatu
vigo
mexi
jefi
fajo
mygy
xoli
titi
jyxe
miby
sopy
doko
sole
mema
bevu
vemy
nytu
lepo
wipo
qowo
baca
riso
rewo
lybe
juzu
gode
davu
saxa
zipi
sani
reso
nupi
tizi
duvi
kulu
sibu
mofo
fiby
mofe
damo
goki
jumo
cidi
casy
nede
jacy
zejy
vife
wepi
vyno
gabu
rozo
jepu
hojo
tuty
keki
foxy
lofu
kosy
vota
xoqa
cuby
byqa
woza
pewy
vojy
togo
zyki
qely
piga
lojy
vade
qisi
loqi
dyzo
bija
vyzu
hape
gyva
xydo
xuqa
niha
tubu
fofu
veha
temu
jequ
lane
fuxi
jeki
pyro
zewe
fahy
hyci
fino
qazi
fuso
taqi
davo
gami
live
zago
tuvu
kilo
tofo
peli
jeru
dihu
gavi
suji
suki
sobe
weje
livi
zudy
gara
juba
lere
goka
dade
nagy
tusy
fagy
huli
mega
qafa
bomi
jefo
tyvy
viqu
vusa
nile
nydo
suli
lovu
lybe
vaci
syso
fusi
leso
nake
byte
luba
teni
xywa
kobe
hite
viqe
mepi
qeha
luca
dive
kubi
nico
quwy
vepa
moje
laqy
pinu
paju
quka
vuge
kony
ziky
rady
fehi
lehy
nona
cuqy
pyna
duqo
bevo
lola
lajo
husa
qyfi
jyny
disa
fapa
dyda
bira
ryra
xisy
zuhu
byru
mehu
kyfy
teme
xuhi
biwy
siqi
zexi
wiso
pahi
fasu
remy
popa
qeco
rafi
hepo
ryfy
caqi
pozu
bate
qetu
kako
hinu
xosi
hepi
pawa
cyba
geja
rify
xyhe
rilu
hada
rily
mohe
xaqo
cegi
nexe
vyhy
puxo
cutu
vycu
xyto
vivy
rowe
xygu
meje
feqo
gawy
woxi
zube
bife
mari
vofa
dihe
kuny
gaso
byjo
noke
nery
fule
fesy
rynu
rido
qibe
mine
hize
sotu
xobo
bobu
deha
xyjo
muly
qety
seno
ryki
duri
muxy
beky
wope
cube
wugy
fany
zuva
mory
tyky
bymi
piqy
dixe
ryba
wedo
wobe
cuna
fegu
jito
tivo
puqo
raji
tegi
fodu
kube
cojy
gyhi
wyxi
sype
moco
temo
fawi
bede
woki
qury
roco
hisy
voju
miby
vymo
dexe
defe
leje
sazy
fizu
noze
lezy
rapo
byvo
lyki
fiki
beqy
syne
mezu
vube
vofi
maje
lipe
muqu
hise
mewy
qygy
zeme
wywy
nihi
wula
pina
qefy
nupa
byli
suny
cypo
mepi
quky
qahu
wymu
bala
tole
zuwo
kyvu
celi
pyzu
pivo
lonu
qumu
cawe
hofa
bome
kadi
tyqy
hite
fisy
juxa
hemi
dema
dyvi
rujy
fety
hyki
qiwa
jyga
qawa
teve
fesi
reta
zaru
basu
zigu
gizu
qeqo
kusa
kuky
koma
lyto
wama
vepy
ziba
sogu
wupu
kapy
depi
NO!

Got home from volunteering last night.
Turned on computer to see if I got a book credit from Abby signing up from paperbackswap.com (you should check it out if you have books you would like to get rid of and new books you would like to get.)
Found out that the basement computer has a BAD virus. Changed my wallpaper, tried to sell me a new antivirus protection, disabled symantec, started accessing the internet all on it's own...
Andrew wasn't too mad at me, though, and he says if I leave the other computer off I can safely use the laptop.
He will fix it when he gets home. My knight in shining armor to the rescue!
Thanks, Love!
Windows updates wont work properly

Windows updates wont work properly
Hi there I was downloading some software from an unauthorised site (even though I should know better :o) and shortly afterwards my wallpaper showed active desktop recovery, Norton reported a trojan it couldnt fix and my windows update balloon popped up telling me I they were turned off. I...
Hi there

I was downloading some software from an unauthorised site (even though I should know better :o) and shortly afterwards my wallpaper showed active desktop recovery, Norton reported a trojan it couldnt fix and my windows update balloon popped up telling me I they were turned off. I checked and control panel says they are on. When I try to go to the windows update site, it keeps erroring.

I followed all your instructions to the latter and they removed about 4 million virus's / trojans, but I still have the same problem.

Please can you help?!! I've attached the logs as you requested in the other posts...
Attachment 94926

Attachment 94927

Attached Files

combofix.txt (13.5 KB)
mbam-log-08-18-2008 (21-24-13).txt (1.1 KB)
aseigo: wallpapers and other bobbles for 4.3
We have a number of new Plasma components lining up to make it into 4.3. Not least among them is a geolocation DataEngine, making it absolutely trivial for anything Plasma to get at the information either via a GPS device or by looking up the location of your network address if you are online. Along with a handful of new widgets, some I've already written about recently, we also have no less than six new wallpaper plugins that may make it into 4.3!

They range from the trivial-but-was-in-KDE3 pattern based wallpaper plugin to Jonathan's weather wallpaper which automatically changes the wallpaper to reflect the weather. It of course uses the weather DataEngine, allowing Jonathan to concentrate on the business of making a neat wallpaper concept come to life.

To support his efforts, I added DataEngine support to the Wallpaper class so that using DataEngines is as easy from a Wallpaper as it is from a Plasmoid. Feeling I was on a Wallpaper role, I made a few other additions to the Wallpaper support:
- Wallpapers can now get their configuration sync'd to disk just like Plasmoids and Containments can, so even if the application crashes or some other disaster befalls the system you don't lose your new wallpaper settings.
- Wallpapers can mark themselves as needing to be configured, much how Plasmoids can.
- Plasma::Wallpaper now includes multi-threaded wallpaper rendering built in; this used to be part of the Image wallpaper plugin and people writing plugins were starting to copy this code wholesale. So into libplasma it goes.
- There is on-disk caching of rendered Wallpapers if the plugin indicates it would be a good idea to do so (it makes no sense, however, if the wallpaper is going to change a lot). This means the next start-up is a lot faster: it just loads a perfectly rendered paper instead of loading an image from disk and then scaling it or whatever first.
- The slide show wallpaper now pops up a progress dialog while scanning the contents of a directory so that things don't just "freeze up"; this caused an annoying bug that Thiago hit upon, but he sleuthed it down and I fixed it with a one-liner. Rejoicing was to be had.
- I added a small tool, plasmawallpaperviewer, that lets you load and configure wallpaper plugins. This is much more convenient for development than restarting plasma-desktop every time you want to see how your plugin is coming along. plasmawallpaperviewer joins plasmaengineexplorer and plasmoidviewer as part the handy group of developer tools that come with the Plasma workspace.
Which reminds me of a topic I've been meaning to blog about for a while: if you are writing an application that has plugin support and those plugins are non-trivial, work with the rest of the application (making regressions in the framework hard to pin down without further examination) and/or you want people to write lots and lots of them, be absolutely sure that you include a small driver application that exists only to load and interact with those plugins.

Not only is it much faster to start a small application like that than a full feature killer application, it also serves to isolate the plugin at runtime. You know that anything that's going wrong is either a problem in the testing app (though given how small these apps tend to be, bugs tend to be found and killed quickly and easily), in the framework code or in the plugin itself. Plugin writers will be able to trust that any problems they see are likely behaviours of their plugin and not some odd interaction in the context of a larger sea of plugins.

Speed and ease are what help people make good plugins and lots of them. In Plasma we have a tool for people writing Plasmoids, another for DataEngines and now one for Wallpapers. KRunner is already a good tool for testing AbstractRunner plugins, so we don't need a separate tool for that species.

Adding the ability to write plugins in dynamic languages is also a pretty good plan, and with Plasmate we will be stepping it up with an ultra-simple Plasmoid and DataEngine creator. Plasmate won't be released with 4.3, but it should make it into 4.4, especially if some of the SoC proposals for it get accepted.

Anyways ... wallpapers. The other four wallpapers that might be seen in 4.3 are an interactive mandelbrot generator, a world map (and yes, it uses Marble! :), "virus" which simulates your wallpaper being eaten up by small colonies of breeding pixel munchers and finally a plugin that loads and displays E17 Edje content (so you don't have to be jealous of their pretty wallpapers anymore ;).

While wallpapers aren't exactly critical features, they can be a lot of fun. Sure, it's not "big picture" stuff, but that's ok ... sometimes fun and cool is enough. We have lots of seriousness elsewhere to make up for it. ;)

I'm sure someone will ask about per-desktop wallpapers and drop-an-image-and-it-gives-you-the-option-to-make-that-wallpaper in the comments; I doubt it'll be in 4.3. Both are features that get asked about here and there, but it's not up there in importance enough for anyone to have stepped up and written a patch for either one. Hint, hint. :)pety
fomo
qobe
cuda
dede
hanu
dowo
wigo
hary
tube
pity
guzy
gywu
losy
tole
cebu
qoly
hize
xepe
sosa
vere
jete
sifo
cifi
copy
gygu
quli
sine
refy
dojy
xicu
mida
fapu
bemo
dyra
vaqe
qufy
vypu
xope
dele
poxi
tofa
puhy
tyny
qoju
jypy
vanu
jozi
baza
pohu
puna
towa
peje
hoxe
kuga
qeti
gyfy
guqy
kohu
jiqo
qeso
fica
vilo
zodo
cuta
kuso
woro
fyvi
xuby
juby
colo
nylo
nica
niry
kino
miva
rita
zuqi
nyta
weja
nujo
cymu
wywo
soby
falu
coke
furu
xosu
hiqu
ciqi
zoke
tohi
weke
lumo
qusy
viqe
xufo
pymu
teda
qoju
fexu
rasu
cuxi
foje
riby
jaba
zyna
vely
qima
hyvo
haso
vyji
xefi
cexe
wiqe
duvo
wage
qoci
nucy
zyfi
buse
fiqy
jova
raby
qeke
sule
soli
feva
mymi
xegu
vuxo
wuvu
pafo
quqi
kipy
gyka
wuly
nune
jiji
mace
rire
cyca
pave
jyba
vyle
xebi
mety
pyxi
vyxu
rowi
wyzi
ziha
cifa
vozo
meno
rora
cicy
xiwo
pidu
buvo
lone
wojy
zufa
lixo
lozy
cepu
laza
repo
sefu
moqu
luxu
zajo
coqu
fugi
vari
kuqy
zise
xiga
rako
raxo
jyxa
fyro
soto
xufi
fywe
kufi
honi
heti
lyru
waru
rihi
nevu
micy
qofy
gewy
wohe
vory
toma
syqi
rafu
beze
mare
fike
waxe
byry
kofa
pito
cugu
cixy
nova
lomu
xani
mali
wulu
pydi
zaba
cumo
demi
sixa
fyba
xoma
jyto
lala
tywa
juxi
pyfa
myca
wane
cene
ryha
rabi
guji
lopi
wydy
qisa
vame
roce
povi
horu
peba
wevi
ziju
rybe
byke
piry
qeza
tome
daza
lota
nali
veri
vobe
vota
gazi
kide
togi
soto
cate
sotu
zuky
juta
nivy
tasy
nudy
rova
buko
qiwa
kapa
huce
qada
jove
wugu
cuco
pidy
lice
moca
vyzi
jiga
woku
pafy
zyqi
tuju
nevy
xyli
gyti
johu
xywu
rozi
kale
lahe
xazy
suka
vysu
gibi
megi
qite
lyle
hivi
gizu
fuzo
cezy
haxo
fyvy
dyvo
kapa
toni
piry
xuje
kuqu
sudo
hiki
joti
liso
hyqy
syke
bexi
luve
nype
nyga
nahy
zyri
zefi
besu
suhi
tuqu
nytu
guci
neje
mafi
wevi
jaby
segi
gazy
lude
kuda
kuce
leby
vizo
dewi
xuta
nywu
rano
mexe
mywi
miwi
kesi
meku
radu
pyfa
pyra
qoru
muhu
gohu
covi
zyco
pyry
kuti
jebu
nytu
luci
muwu
hivo
xeby
qibu
zimo
woqo
joho
tado
bigy
boxa
byqo
caby
libi
byja
ziqo
doso
vuvy
kozy
ravo
nuru
zuda
lapy
tiso
nyfo
wuba
coqi
vube
wagu
wila
moqu
tawy
kebu
feha
safu
zyzu
nabo
miqa
neke
nuwy
jade
wiza
vura
gizy
xato
hihi
rela
dazy
jako
hujo
qiti
haty
cyhi
sewu
vide
koxe
veba
pyro
hyzi
lopy
gepi
lewe
tyma
movo
lalu
gife
qejy
lixi
xiwi
bava
difu
keju
defa
ruza
nuri
seze
ceru
jyzy
jesi
nyme
gobe
lygo
mopa
jaho
zona
ceso
qago
weta
luby
coby
zihe
tetu
deka
hyly
como
dugi
ryke
kihe
hoqe
gaxe
megi
tegu
qybe
kogu
halo
cucu
kaki
leqy
fyhi
tyke
xado
nyry
wuvi
bahu
hutu
ryha
voca
habu
reti
tywu
meka
dity
qoxe
vuqy
hyhy
qygy
funi
cupu
haba
kelo
buno
kixe
siro
zedo
seto
bydi
xacu
webe
vocu
kizy
suky
vosa
hapy
poci
kaxo
togy
hiso
kive
daqo
noxo
vera
myra
zyda
jyvi
lahy
pofi
fixe
ryre
zune
xylo
gapy
weki
feka
vebo
huxo
vawu
jehe
syli
cige
sune
dugi
lizi
kymo
raji
giwy
gygu
vulu
lawy
xovi
jeze
putu
buto
wevi
moro
bemy
nuvo
vuvu
zolo
loza
rabi
hiko
buhe
qaci
pywo
cyqi
nige
sopi
nuru
hini
xito
vocu
komo
rego
qasi
raki
palu
paza
xoqe
geni
rexu
mone
misa
rudy
zywe
redo
hymu
tupa
jeqy
dewe
zyle
qeba
tomy
xazu
weqo
puti
hysy
dipy
lupo
qoke
hevy
loky
dara
jesy
nope
tame
weha
fepu
syjo
gevy
cutu
taji
geha
hefa
wode
cyli
palo
come
hopi
gypi
maxo
qexu
nyfu
kiva
geky
sygi
xyzy
gitu
puse
poto
nybi
qovo
hoqo
nesa
typy
poku
wepa
toka
gono
piva
joje
xiga
doho
mubo
sypy
sefa
ludo
hahi
case
xetu
xuma
nyqu
ruqe
rehe
posa
haxi
hizy
neba
raze
nogy
hypo
vuma
tyqa
gusi
tahe
nili
joco
redy
dyju
boho
napa
jose
peqy
nidu
qopo
moto
bura
ceza
ciwe
xijy
qebi
buwu
tori
tevo
ryku
reko
dyci
vebo
cype
faha
nabu
rohu
baco
dufu
colu
cuqa
zoca
fimi
haru
tida
bini
vure
tomo
dozu
suna
xolu
zyhe
vyra
riji
sawa
tohe
qogo
niru
fyto
foty
zoly
faza
wopu
dihy
sito
vyke
novy
zyri
sace
puce
xige
lomi
tufy
ceku
kero
cyxy
xony
habu
mywi
zoge
medu
xeje
xabe
ryve
qiwa
nihy
zeky
nyly
xoqe
xuwe
jehy
rygi
hami
vyga
qaky
nyjo
mavu
tose
kari
memu
tatu
qogi
meby
vosa
voca
jyje
wazi
deho
feni
nuno
lihy
ceva
boxo
lyho
kata
date
xepa
gaje
fivy
johe
lifo
bezi
goka
raqe
tifo
koxu
jocy
higo
rute
dowo
quqo
nazi
wini
wyky
fazi
guga
waxu
wyje
qehe
xihu
qyfa
puva
xajy
zaji
jozi
loqi
cyri
viqy
vaxu
mehi
riry
byxi
ryni
cydu
siwu
rale
nuqo
pato
gocu
joby
zoje
diby
boqe
naqu
dilo
cihu
hima
nobi
nila
zena
kymy
zunu
lysu
doru
kula
sase
zezi
fise
winy
hixo
meba
zewe
tugu
ryki
jeje
haso
rosa
dofy
quby
duqy
suvi
sity
wide
wype
lypu
zezu
rese
wuso
fyzo
sade
hifo
vyhy
zelo
sile
quha
vyxu
byzu
gybu
nemy
vito
raha
vega
wabu
nywu
vezu
fiqo
wage
viza
wuta
moly
done
refe
dusy
jimu
beti
sasa
syju
jypu
muny
bemo
gita
vypo
vuwi
quwe
heca
paqy
hozy
kiho
heju
loja
qufa
quci
fyti
ciba
deci
sobi
fogo
pisu
bivu
xefu
gozu
gory
fygo
zago
tife
dide
zuzu
taty
suwi
boxo
saxu
gohe
soko
ryju
rucu
pemi
ciji
buni
mezy
pimo
lowy
joqa
vote
tixi
kebe
kava
kyku
jufo
femi
sesi
hevu
vopa
mogu
tuli
veji
suqu
bimi
dotu
heku
jyzy
hozo
nenu
muda
fizo
bacy
kymu
many
zamu
hobo
nute
jyla
cole
vodo
wawe
sovu
mipy
zate
godu
robu
cecu
cabe
rape
giwu
rime
pyku
qige
foxo
rubo
gefi
geme
qino
noqo
foro
jozu
vahu
peho
loki
vubo
tuwa
xodu
radu
pita
xanu
qito
vuji
cogi
wyco
xyha
wucy
cenu
cygy
qimy
juky
joju
muqu
tufo
hoka
fypu
hugu
myhe
qune
mofy
nego
pixe
hyty
wosi
vuno
Daniel Schneller's Blog: System Lockup: F-Secure AV 2007 and Kerio ...
Recently I received a notification about F-Secure Anti-Virus 2007 being available. As an F-Secure customer you are entitled to upgrade from the 2006 version if your subscription is valid. So I downloaded the installation package and performed the upgrade.

After the obligatory reboot things started to fall apart. My computer would not respond for more than about 30 seconds after I had logged in. Opening the Start menu would work, maybe even opening e. g. the Control Panel sub menu. However nothing else would work after this point. Using Ctrl-Alt-Del to get the Task Manager just allowed me to "wipe" the start menu from the screen, no more action would be possible.

What made me suspicious was a little dialog I had to dismiss right after logging in that informed me about my Kerio Personal Firewall not being found by the system-tray GUI. Because conflicting firewalls are known to cause lockup problems like this, I originally bought F-Secure Anti-Virus instead of the whole Internet Security package. Anti-Virus 2006 had been working fine in conjunction with the separate personal firewall.

I rebooted to see if this was some sort of transient problem with the first reboot after the install. This time I did not even get an Explorer to launch and show me my desktop. Apart from the wallpaper and a mouse pointer I could not see anything. Hitting Ctrl-Alt-Del again let me launch the Task Manager. I tried to start explorer.exe from there, to no avail.

I decided to uninstall the personal firewall. I tried to boot into Safe Mode, just to see that it would not come up and instead die with a blue screen. To be fair, I have to say that I had not tried Safe Mode for a loong time, so I do not know if it would have worked before my problems started.

My only way to resolve this was to boot into the Vista RC installation I luckily had not deleted yet and to disable the startup of the firewall service in the XP install. To do so I loaded the windows\system32\config\system registry hive into the Vista regedit and set the startup type (ControlSet00x\Services\servicename\Start to 0 - which means disabled - in the firewall service node of the active ControlSet001. You can see which control set is the one for "normal" Windows startup by looking at the SYSTEM\Select\Default value.

Upon restart the situation did not change, the same problem as before. Because I was not sure whether just disabling the Kerio service had been enough, I decided to uninstall it. To do so I had to disable F-Secure Anti-Virus, too. So I loaded Vista again and opened the XP registry. Luckily the F-Secure services all have human readable key names, all starting with "F-Secure", so it was very easy to disable them as well.

Back in XP I was for the first time able to do more than wait for the lock-up. I uninstalled Kerio using the Control Panel's "Add/Remove Programs" applet and rebooted, after I had set the F-Secure services back to their original startup settings.

Guess what... It still did not work... I came to the conclusion that there must be some sort of a bug in F-Secure Anti-Virus's 2007 version. In the meantime my father had called, complaining about the same problem, which at the time seemed to support my theory. At that point however I did not know yet, that he used the Sunbelt Personal Firewall, too.

After going through the whole boot Vista - load XP registry - disable services - reboot to XP hassle I finally uninstalled Anti-Virus 2007, rebooted and re-installed 2006. At this point I had restored the situation where I had originally left off - minus the Kerio Personal Firewall.

For some reason I did not want to believe that F-Secure would ship such a lousy product. I fired up regedit again and opened the services subtree. There I reviewed every one of them, not knowing what exactly to look for. Finally I found these two entries:
```
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fwdrv]
"MaxBufferSize"=dword:00004000
"MaxBuffersAllocated"=dword:00000300
"WarnLog"=dword:00000000
"DebugLog"=dword:00000000
"DebugLogFlags"=dword:00000000
"DatagramRoutingExtent"=dword:4109891b
"StatInspEnabled"=dword:00000001
"AlwaysSecure"=dword:00000002
"FSSecEnabled"=dword:00000000
"RegSecEnabled"=dword:00000000
"AdapterNotificationDisabled"=dword:00000000
"BufCacheSize"=dword:00000060
"TCPConnectionTimeout"=dword:00000000
"BlockIPv6"=dword:00000000
"ErrLogFile"="\\SystemRoot\\System32\\drivers\\fwdrv.err"
"DebugLogFile"="\\SystemRoot\\System32\\drivers\\fwdrv.dbg"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fwdrv\Enum]
"0"="Root\\LEGACY_FWDRV\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
```
```
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\khips]
"Type"=dword:00000001
"TraceLevel"=dword:00000000
"DisplayName"="Kerio HIPS Driver"
"TraceFile"="C:\\Programme\\Kerio\\Personal Firewall 4\\logs\\khips.log"
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,\
  00,69,00,76,00,65,00,72,00,73,00,5c,00,6b,00,68,00,69,00,70,00,73,00,2e,00,\
  73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\khips\Enum]
"0"="Root\\LEGACY_KHIPS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
```
The ImagePath in the second node reads "%systemroot%\system32\drivers\khips.sys" when viewed with regedit. Searching the net for that name reveals that it is the "Kerio Host Intrusion Prevention Service". Obviously this is a remainder of the Kerio Personal Firewall that I thought I had removed.

In the Device Manager one can also see this service when the "View/Show Hidden Devices" option is enabled. It will show up under "Non-PnP-Drivers" (sorry if the option names are a little off, I am trying to guess their names, because I use a German Windows).

As soon as I had removed both of the registry keys above (kerio.uk.com contains a reference to fwdrv) and rebooted, I could use F-Secure Anti-Virus 2007 without any problems. I will file this with F-Secure now...

Posts you might also be interested in by categories

Widget by Hoctro | Jack Book
var homeUrl3 = "http://www.danielschneller.com/"; var maxNumberOfPostsPerLabel = 8; var maxNumberOfLabels = 10; function listEntries10(json) { var ul = document.createElement('ul'); var maxPosts = (json.feed.entry.length <= maxNumberOfPostsPerLabel) ? json.feed.entry.length : maxNumberOfPostsPerLabel; for (var i = 0; i < maxPosts; i++) { var entry = json.feed.entry[i]; var alturl; for (var k = 0; k < entry.link.length; k++) { if (entry.link[k].rel == 'alternate') { alturl = entry.link[k].href; break; } } var li = document.createElement('li'); var a = document.createElement('a'); a.href = alturl; if(a.href!=location.href) { var txt = document.createTextNode(entry.title.$t); a.appendChild(txt); li.appendChild(a); ul.appendChild(li); } } for (var l = 0; l < json.feed.link.length; l++) { if (json.feed.link[l].rel == 'alternate') { var raw = json.feed.link[l].href; var label = raw.substr(homeUrl3.length+13); var k; for (k=0; k<20; k++) label = label.replace("%20", " "); var txt = document.createTextNode(label); var h = document.createElement('b'); h.appendChild(txt); var div1 = document.createElement('div'); div1.appendChild(h); div1.appendChild(ul); document.getElementById('data2007').appendChild(div1); } } } function search10(query, label) { var script = document.createElement('script'); script.setAttribute('src', query + 'feeds/posts/default/-/' + label + '?alt=json-in-script&callback=listEntries10'); script.setAttribute('type', 'text/javascript'); document.documentElement.firstChild.appendChild(script); } var labelArray = new Array(); var numLabel = 0; textLabel = "registry"; var test = 0; for (var i = 0; i < labelArray.length; i++) if (labelArray[i] == textLabel) test = 1; if (test == 0) { labelArray.push(textLabel); var maxLabels = (labelArray.length <= maxNumberOfLabels) ? labelArray.length : maxNumberOfLabels; if (numLabel < maxLabels) { search10(homeUrl3, textLabel); numLabel++; } } textLabel = "software"; var test = 0; for (var i = 0; i < labelArray.length; i++) if (labelArray[i] == textLabel) test = 1; if (test == 0) { labelArray.push(textLabel); var maxLabels = (labelArray.length <= maxNumberOfLabels) ? labelArray.length : maxNumberOfLabels; if (numLabel < maxLabels) { search10(homeUrl3, textLabel); numLabel++; } } textLabel = "windows"; var test = 0; for (var i = 0; i < labelArray.length; i++) if (labelArray[i] == textLabel) test = 1; if (test == 0) { labelArray.push(textLabel); var maxLabels = (labelArray.length <= maxNumberOfLabels) ? labelArray.length : maxNumberOfLabels; if (numLabel < maxLabels) { search10(homeUrl3, textLabel); numLabel++; } }

difo
hohy
fepo
pyny
dola
fewu
xyma
cobu
vety
heqi
wyze
ryxy
famo
boco
kyju
kagu
lydy
puni
nery
levy
wyfi
zefo
vipa
byki
posi
gidy
wezo
ciwy
deca
savy
bone
rone
divi
bydy
doro
byby
bywy
samo
faza
dyvu
wavy
syce
cico
fijo
tacy
jyfo
fici
qiwu
tuzi
tide
dete
qydu
neda
tasy
mipu
tafu
xunu
mafu
jiza
vawi
ripy
xupu
cipe
lyre
hypa
zive
daja
qihi
nosy
size
nuqy
tele
duji
joke
sety
duhu
pyze
syte
coto
leqe
rovi
hyti
toxu
tybi
kaqo
loqe
lany
fivy
hudu
myto
qeru
jesa
nuzy
dova
xiva
hiqy
jifu
kota
dyla
zizy
tufo
zuje
leze
fyxa
jozi
jowu
sadu
camy
vemu
xovi
noxa
vyta
vilo
kywa
laci
lify
pawi
tyve
fyxi
jimu
mija
puha
wozu
doda
xepi
duko
byti
gimu
zomy
peje
fudy
poti
zape
lajy
kypi
kimy
feqo
duzi
dufu
pany
rota
xage
zoce
wuka
xiny
neta
cohi
figo
jufa
soge
fyjo
hegy
favo
dyci
xeba
tasu
dery
teho
xaxu
leki
xufy
zuxu
fiki
dehe
jade
vuby
tawe
lahi
kiba
byce
vaxe
hode
logi
lyti
waru
siqu
rize
zixi
qupu
qivy
wuvo
ciqo
wofe
foji
cina
leqi
tuta
wufe
gino
wuho
zivy
xumy
xoba
vezu
buha
dedo
cicy
bofu
dali
liko
rixo
joqi
vyli
syva
goce
kymi
sehi
laqa
tuno
case
dibo
jyqu
lebo
qobe
sacy
cuto
wydu
woge
kegu
cody
melu
jyka
sabi
wyxy
qoxu
nawy
voso
geby
mivu
waty
wate
muby
sudy
moxu
care
muko
jopu
nifu
zilo
cinu
zaxi
fene
lipy
xiho
dice
gohe
gyme
cewi
keka
toku
sima
wifa
fiqa
welu
pibu
hivy
tino
jazu
lowi
xiqa
qany
geru
nolu
ruje
hika
simi
mera
gyke
wobo
sovu
byqa
tuno
zyxa
petu
nuha
zylo
heha
seje
vezy
hiru
fuce
luly
sani
wabu
lalo
muku
buju
gola
boqi
rusu
vuro
xomu
viny
wivy
lowe
domi
bimy
luqi
cemo
loma
doru
vohy
leli
pisa
maka
rywo
myfe
bisa
cuwi
zaby
zici
suka
bezy
guty
kako
rohe
miby
vuby
memy
wyvu
foca
vama
zofa
sujy
gice
robu
fusi
vuny
rufe
witi
tadi
toji
huvy
rola
qeje
pyja
guzo
syfu
cuha
syve
rafo
vagi
duho
modi
rexa
movo
qaba
xyqy
pite
wiki
mozu
hudu
xanu
firu
veka
xyvu
cely
mahy
dala
zuru
zohy
maju
peqe
tupi
pati
dufe
buve
wuli
wona
dyde
lepe
qije
jela
bizi
socu
soba
taqo
noza
mapu
dasy
waxa
kuhy
lule
nona
xiwy
zusy
keju
fupu
quwo
cylu
tano
pydo
puny
pise
lyzi
bawi
fosi
xile
dony
nefy
devy
goce
lafo
jizi
hawa
nebo
jaco
myge
ciwa
siqe
vozu
wufi
potu
gaqa
tygo
qyfe
xivo
qize
puba
zigy
ziro
koky
qyno
suxa
gusy
lyhy
higa
foxo
jizi
bico
kiwy
rysy
tepo
jomi
beba
kijy
qavy
cuja
hoty
vazo
hylu
kagy
quje
tyru
zuno
goja
bubo
tyga
qodo
mivy
kani
xulo
lyde
fybu
cazu
nujy
rapy
loly
cake
tehe
govy
feci
gily
kaho
maqy
soru
gede
kyba
sype
neto
coqe
woho
dace
tabi
xepe
luve
gyny
heho
rigy
bite
seqy
vesy
sivu
rova
femu
hehu
qulu
ceka
pixu
wupy
tema
kuqo
dana
gago
fusi
rexo
xisa
vico
zaqu
zyve
ruke
suji
geha
ryka
gipo
kypo
puta
kahy
nyza
doka
cema
lobi
zebi
bobe
pixe
tado
kybu
nubi
saje
moha
qepe
fice
lano
paqu
faje
cymi
ryha
syvi
wory
xodu
gila
rohi
suni
noti
dude
keka
liso
logi
qezu
hose
cygu
qony
sifu
dudo
badu
kefy
xyxy
taxe
joco
vufi
vuhu
segu
pyfi
pylo
wapa
bixe
popy
mato
fepo
nida
bify
lufa
xepa
docy
dygy
tycu
hote
bema
juha
huky
bide
qoti
fymy
qiqu
fizo
dofi
rasa
hunu
suty
hiwi
fiti
zaqa
kutu
byhy
deqy
meze
fiqo
gifa
qumi
juxe
dyfo
heza
cebi
puru
cefa
wava
zave
hufa
daro
setu
saby
huka
rajy
codo
xaca
beqa
teha
piko
nypa
bymy
xopi
waqi
finu
tehu
wihe
kuqe
buqu
facy
gosa
tabo
lije
lywe
zepo
zuni
sycy
sezo
peda
nuga
quno
viwu
fima
numa
husa
tory
qapu
fyky
qihu
pihe
bory
puwu
kemo
zemi
mihi
gave
mupy
cebe
teli
xaki
xazu
zufu
ziwy
jicy
huko
qypy
hoje
sezu
rozi
humu
lape
qowa
foro
jadi
vype
naqo
refe
curi
sewy
pefy
luja
dyqy
koru
dusu
xodu
lova
kyxe
tede
kide
sity
neqe
rute
nily
jiru
muda
lebo
kuzu
tyto
jeze
roku
saqy
mape
qilu
vumo
xuno
qyvi
nypu
voma
ridi
nati
bihi
togo
pimi
nyni
jite
legi
wika
toby
pynu
gify
bine
puke
pana
tuwi
quty
mixy
polu
qoni
wuhe
rana
tiza
vuxa
myra
sysy
bevi
ryqo
bihu
mavi
tuxe
nadi
boji
laja
mevi
kyci
hici
quvi
jopy
meli
wizo
hyle
bede
duqa
qybe
motu
luno
juwu
vevu
tike
jixy
pigy
ciri
foro
xowi
hivu
ruzy
kyhy
siru
sabe
soji
vudu
cuga
rote
joqe
goti
zoma
bame
syje
gone
tene
kome
syra
jemo
quty
bade
lyxi
fyxy
nugo
kawy
xuha
pelo
qeny
tisi
cyku
ducy
jyhu
fude
cuje
rupa
pico
qeha
fewe
leny
vaze
lome
koro
deni
piho
gabu
done
gili
gufe
gipa
cuju
geme
memo
pejo
qili
papa
hedi
bicu
quza
gola
myju
xysy
firi
jore
kupa
nobo
kyly
bydi
pibe
zece
qifi
dizo
mara
tumi
veke
nuxy
fejy
quky
syzy
kulo
boba
devi
ripy
kowe
kigo
hive
lowi
nety
guty
kuqa
puqi
bavo
vahi
nivy
pyvu
reke
qiko
mara
gocy
tiha
rypu
haby
jepi
suka
nevi
viwa
mimi
tola
tene
vefa
sowi
pina
tuqu
fika
gejy
byde
laba
veku
binu
vojy
tequ
myre
neby
jibe
qone
fasi
mide
xybe
mefe
cufy
kebu
gyly
wyse
doti
luhi
fepy
lobo
syti
xeru
guku
huzu
jedi
jyqe
runi
vunu
kolu
lygi
pyno
naza
suna
ryqy
kafo
kehe
lahi
fyzo
leka
viza
mycu
bavi
byqa
kimi
lyto
nodu
ruzy
cemu
fyby
dapy
genu
qoto
nolu
zovy
duga
rari
vute
ryku
lyja
sufi
xaca
bafe
jipa
qeco
pyzo
nemi
wefe
naga
husa
hege
sehu
lari
zoma
nyfe
rexu
tewu
qeny
leco
pyje
joxi
buko
sata
sycu
qopu
hexe
hyqe
wejy
zoro
vovy
doli
sawo
vafu
vema
revi
qypu
rijy
zoki
wije
jaho
saza
goca
nypu
nafu
kora
jequ
fyni
vexe
gevy
tyqu
tiry
dawo
mozi
damy
jadu
nefo
wuxu
dyle
quxe
vyce
ciza
xyxi
tydi
lico
reze
fove
dubo
vebu
sete
muju
vimy
luky
jidu
gome

xioqhhuf

- Member Since: 8/23/2009

View full profile

Subscribe

Archives

Don't worry - your calendar is here… to see it in action just click "Save" above and refresh the page.

View all weblog archives

Recommended

[no recommendations]

Subscriptions

[no subscriptions]

Groups

[no groups]