Back to Top

How to Remove the Win32/Poly Crypt Virus

Win32/Poly Crypt, also known as WinReanimator, is a fake antispyware program that can affect the Windows operating system. The program installs itself on your computer and immediately begins launching popups telling you that your computer is infected with spyware and that you must purchase the "full version" of WinReanimator to remove the spyware. In addition, the fake antispyware program may disable your legitimate antispyware programs, forcing you to remove the malicious program manually.

Delete Files

Step 1
Click "Start," type "cmd" into the search field and press "Enter." The Windows Command Prompt opens.
Step 2
Type the following commands into the Windows Command Prompt. Press "Enter" after each command: del WinReanimator.dll del buritos.exe del WinReanimator.lnk del winivstr.exe del WinReanimator.exe del winivstr.exe del buritos.exe del cru629.dat del braviax.exe del braviax.exe del cru629.dat del 4scan[1].exe del qajamowel.dll del WinReanimator del winreanimator.exe
Step 3
Type "exit" and press "Enter" to close the Windows Command Prompt.

Delete Registry Values

Step 1
Click "Start," type "regedit" into the search field and press "Enter" to open the Registry Editor.
Step 2
Delete the following registry values from the right pane of the Registry Editor. To delete a registry value, right-click the entry and select "Delete." If you have trouble locating a registry value, click "Edit," "Find," type the name of the value into the search field and click "Find Next." HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\buritos HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WinReanimator
Step 3
Close the Registry Editor.

Most common registry key to check while dealing with Virus issue

Most common registry key to check while 
dealing with Virus issue

1) StartUp
C:\windows\start menu\programs\startup
* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup="C:\windows\start menu\programs\startup"
* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup="C:\windows\start menu\programs\startup"
* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"
* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"
"Anything over here execute when you start up your computer"
2) Windows Scheduler:
Check for entries in the Scheduled Tasks, as well as via the AT command at a command prompt.
3) c:\windows\winstart.bat
'It basically behaves like a normal batch file, then only difference is that it can be used to delete files when you start up your computer
4) Registry :
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
"Whatever"="c:\runfolder\program.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"
5) "Autoexec.bat"
6) These reg keys will basically spawn your programs, as you can see this is very dangerous because these keys are very used by viruses and Trojans.
[HKEY_CLASSES_ROOT\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\piffile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @="\"%1\" %*"
The key should have a value of Value "%1 %*", if this is changed to "server.exe %1 %*", the
server.exe will be executed EVERYTIME an exe/pif/com/bat/hta is executed.
7) Explorer start-up
The problem with these operating systems is that they look for a file called "explorer.exe" whenever you start up your computer, that file is basically the one that you see all the time but don’t realize it is there , if you go to your taskmaganer you can see it, you can even kill it and you will see that everything in your computer that belongs to Microsoft will disappear, except for the extra windows that you open such as cmd, regedit, services.msc etc, but your desktop will be gone.
As you can see this is dangerous because it also means that if somebody modify your explorer.exe file then your computer will be corrupted. In fact, to change the name of the start bottom, has to be done by modifying the explorer.exe file, so there is a clue of a small difference that can have an effect in your computer.
here is the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
if a Trojan changes that to a path of another "infected explorer.exe file" your computer will start up the file the Trojan told it to and not the one used by Microsoft.
8)"Active-X Component"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]
StubPath=C:\PathToFile\Filename.exe
This key is great because it starts the program that it has in its path BEFORE the explorer.exe file and any other program starts in your computer, so if you can understand why your antivirus can't detect the virus when you boot up, it is maybe because your "virus" is taking care of it before it starts up. It could even kill your antivirus before your antivirus starts up

A user profile has been deleted accidentally

user profile has been deleted accidentally


In case the user profile has been deleted accidentally, only the administrator’s login will be shown at the Welcome screen; the user’s personal login icon will not be shown. To recover the lost user profile, we will need to use Windows Registry editor.

Note: The Registry is one of the most crucial components of Windows operating systems, therefore it is important to backup the current Registry prior to making any changes to it. To create a backup, follow these simple steps

Useful Scripts To Modify Your Proxy Settings For Internet Explorer

Useful Scripts To Modify Your Proxy Settings For Internet Explorer

Where A Proxy Server Is Configured

Before we get into the ways that you can automate your computer through scripting, let’s take a quick look at the manual way people would have to do this. Most people know how to configure their LAN settings – it’s one of the first things you should check if you’re ever having Internet connection problems. Typically you want your proxy settings to be set to “Automatically detect settings” when you’re at home or at a public hotspot.
However, at work, you’ll need to set up a proxy server. You do this within “Internet Properties” in the control panel by clicking on the “LAN settings” button.
proxy settings
Inside your network settings dialog, you’ll see the two settings – you either have a proxy server enabled or you don’t. This is the setting that you want to toggle when you switch from your home network to a work network, or if you want to switch to running under a “cloaked” anonymous IP server.
using batch file to set proxy settings

You can also find these settings in your registry (click Run and type “regedit“), and this is what you want your scripts to edit. By changing the registry settings, you’re essentially changing those settings in the LAN Settings window.
how to set the proxy settings in the registry i   
What we really want to do is toggle those settings only when and where you really want to. There are three scenarios that I’m going to cover, and you can copy and paste the code to tweak it to your liking.  You can put the script in your startup folder so that it launches whenever you boot your computer, or you can just run the scripts whenever you want your computer to automatically set the correct IP settings.
The three scenarios I’m going to provide scripts for include the following.
  1. Prompt the user whether or not they want to use an anonymous proxy for Internet access.
  2. Prompt the user to type in the name of the proxy server they want to use.
  3. Automatically check whether you’re home or not, and set the appropriate proxy server settings.
The cool thing about Windows Scripting Host is that each of these options aren’t that hard to do.

Ask User To Enable A Proxy Server

This script will pop-up a message box asking whether or not the user wants to use a proxy server. If yes, then the script will enable proxy servers and fill in a hard-coded anonymous proxy server. You can tweak the script to use your favorite anonymous proxy.
Here’s what the script looks like.
<job>
<script language="VBScript">
Option Explicit
Dim valUserIn
Dim objShell, RegLocate, RegLocate1
Set objShell = WScript.CreateObject("WScript.Shell")
On Error Resume Next
valUserIn = MsgBox("Use A Cloaked Proxy?",4,"Cloaked Select")
If valUserIn=vbYes Then
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"
objShell.RegWrite RegLocate,"http://www.youareanonymous.com:80","REG_SZ"
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"
objShell.RegWrite RegLocate,"1","REG_DWORD"
MsgBox "Cloaked Proxy is Enabled"
else
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"
objShell.RegWrite RegLocate,"0.0.0.0:80","REG_SZ"
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"
objShell.RegWrite RegLocate,"0","REG_DWORD"
MsgBox "Cloaked Proxy is Disabled"
End If
WScript.Quit
</script>
</job></textarea>
 
When you run it, the user sees the following prompt.
how to set the proxy settings in the registry
  
A “Yes” loads the anonymous proxy as your proxy server and sets “ProxyEnable” to 1. A “No” sets the proxy to default all zeros, and disables the proxy setting.

Prompt User To Type Proxy

The other approach is to ask the user what exact server they want to use. This allows the flexibility of changing the proxy server constantly without the need to edit the script itself. You can do this by changing the “MsgBox” command to an “InputBox”.
<job> <script language="VBScript"> Option Explicit Dim valUserIn Dim objShell, RegLocate, RegLocate1 Set objShell = WScript.CreateObject("WScript.Shell") On Error Resume Next valUserIn = Inputbox("Enter the Proxy server you want to use.","Proxy Server Required") RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer" objShell.RegWrite RegLocate,valUserIn,"REG_SZ" RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable" objShell.RegWrite RegLocate,"1","REG_DWORD" MsgBox "Proxy is Enabled" WScript.Quit </script> </job> When you save this as a .wsf file and run it, the following window will appear.
how to set the proxy settings in the registry
Just type in your preferred proxy server, click okay, and your Internet settings are automatically updated.

Set Proxy Settings Based On Location

This next script is a little bit more flexible, so it’s also a little longer. But what it can do is check your current IP address, and if it is within the range that you expect when you’re on your home ISP, it’ll disable using a proxy server. If it sees that you’re not on your typically home IP domain, it’ll automatically configure your Internet with a proxy server that you can hard code into the script.
Here’s what the script looks like.
<job> <script language="VBScript"> Option Explicit Dim valUserIn Dim objShell, RegLocate, RegLocate1 Dim objRemXML Dim objMyIP Dim strIPAddress Dim strHostname Dim strHomeDomain On Error Resume Next Set objShell = WScript.CreateObject("WScript.Shell") On Error Resume Next Const cstrShowMyIP = "http://www.showmyip.com/xml/" Set objRemXML = CreateObject("Microsoft.XMLDOM") objRemXML.async = False objRemXML.load(cstrShowMyIP) ' Get our IP address Set objMyIP = objRemXML.selectSingleNode("/ip_address/ip") strIPAddress = objMyIP.text ' Print info WScript.Echo "IP address : " & strIPAddress strHomeDomain = Left (strIPAddress,6) If strHomeDomain = "69.161" then RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer" objShell.RegWrite RegLocate,"0.0.0.0:80","REG_SZ" RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable" objShell.RegWrite RegLocate,"0","REG_DWORD" MsgBox "Cloaked Proxy is Disabled" else RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer" objShell.RegWrite RegLocate,"http://www.youareanonymous.com:80","REG_SZ" RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable" objShell.RegWrite RegLocate,"1","REG_DWORD" MsgBox "Cloaked Proxy is Enabled" end if ' Finish Set objMyIP = Nothing Set objRemXML = Nothing WScript.Quit </script> </job> You set set this up to run on startup, and the computer will automatically configure the Internet settings as needed. The program will show you your current IP each time – if you don’t want that, just remove the “WPScript.Echo” line. When I run it here at home, it recognizes I’m on my safe home ISP and disables the anonymous proxy.
proxy settings
If you were on a public hotspot, it would recognize the foreign IP address and enable the cloaked proxy instead.
These are just a few examples of the sort of automation you can build into your Windows PC with Windows Scripting Host. You don’t have to be an expert programmer – just learn a few of the commands in these scripts and you can really work some magic.
Did you try any of these scripts? Let me know what you think, and please offer any tweaks or improvements that could make them even better. Offer your insight in the comments section below.