W@freak

hi guys! i need your help! i think my pc is infected of a virus..

i want to manual remove it but i cannot uncheck the hide protected hidden files (recommended).

I already try and change this: HKLM\software\microsoft\windows\currentversion\exp lorer\advanced\folder\hidden\showall
checkedValue = 1

from 0 I changed it to 1

after that i try to refresh it using f5, suddenly it become 0 again..

and I already changed the value of:

HKCU\software\microsoft\windows\currentversion\exp lorer\advanced
hidden = 1
showsupperhidden = 1

but if I try to refresh it, it will back to 0 again..

Now I dont know what to do.. pls help!!!!!!!.

i need help

1mAn3rd

Is this in Vista or XP... are you sure that you're pressing the mouse button hard enough . I'm just kidding. It sound like a microsoft bug. E-Mail or call them, they will definitely know what to do, unless someone else here knows. Wait a day or so for bakuryu or Strider to help you, they always know the answer

__________________
--1mAn3rd

W@freak

hi 1man3rd! thanks for replying.. my os is whistler.. i think this is not a bug.. there is a virus in my pc semo2x and i try to manual delete it.. but i cannot show the hidden files... i dont want to use attrib command... i think the problem is in the registry... thanks...

Strider

This means you still have that virus infection in your PC. I recommend downloading NOD32 Antivirus and doing a full system scan after a virus definition update.

http://download.eset.com/eval/win/eav/eav_nt32_enu.msi

Once you are clean the registry entries you mentioned.

We had a similar problem in my office network and we struggled for a few days with it. Only in the fourth day the Antivirus companies released the virus signatures for tat virus.

__________________




Want to ask a question? Try This! A guide on how to post a question, reply to a post etc.

W@freak

thanks strider! is there a posible way to manual delete it? I know somethings wrong with the registry but i can't locate it...

Strider

It's possible to manually remove it. But first you need to find out which service/start up executable is the culprit. Then remove that file and all rem=lated entries from the registry.

But it's always better to take help from a trusted anti virus solution.

__________________




Want to ask a question? Try This! A guide on how to post a question, reply to a post etc.

bakuryu

You can right set the permission settings for the registry keys to read only (right click on keys -> Permission) for all users except your username. That will stop the system from automatically overriding the setting.

__________________
Please don't click here

Albin

Yes, this happens mostly of Virus or spyware.
Try to download Spyware Doctor and do a Scan.

Is ur hidden file option (Show/hide all hidden files) working correctly?

Regards
Albin

__________________
--------------------------
http://www.albinjey.co.nr

REDANT21LTD

i encounter that before...
your problem is, everytime you change the value of checkedvalue from 1 it will back again to 0... right?...

I think there is no problem with your registry!
just try this:

all you have to do is boot from safemode using f8 and once your are in, try to manual delete the virus...

try to go to Hklm\software\microsoft\windows\current version\run..
delete the suspected virus(amva).. but before you delete it try to locate the location
for ex. c:\windows\system32\amva.exe

if you dont see it, maybe the virus is hidden try to use attrib command using batch file

the command:
attrib -r -s -h c:\windows\system32\amvo.exe

after that go to your registry in:
hklm\software\microsoft\windows\currentversion\exp lorer\advanced\folder\showall\ checkedvalue = 0 change it to 1

try to refresh it using f5... it will not change again to 0
that's it... trust me...

then restart your system

go to my computer
note: dont doubleclick any of the drives, just use the address bar (c: or d
then try to go to tools - folder options - view and try to select the
show hidden files and folders and
hide extension for known file types --> to show the extension files
hide protected operating system files (recommended) then
ok

now you can see the autorun.inf and q.com or semo2x.exe. delete it using SHIFT+DELETE..

then restart..

I hope you get it..

if symptoms persist consult your doctor... hehe...

__________________
Michael Louie C. Jose
System Administrator
Power Skills Technical Center
Philippines

W@freak

Thanks man! you are right! there is no problem with the registry! thanks to all of you guys! finally I already solve my problem. tnx