Today I'm going to post a solution of a weird problem which I faced yesterday. When I updated the driver of my network card and restarted my computer system, I faced a strange problem.

Suddenly the "Network Connection" icon in system tray started showing a yellow triangle with exclamation mark (!) on it as shown in following screenshot:

I double-checked the Internet connectivity and it was working absolutely fine. I was able to browse on Internet.

To investigate the issue, I checked the Network Connections folder, it was empty. It was not showing any network adapter. It was absolutely blank as shown in following screenshot:

I did lots of things to fix the issue like restarting the router, enabling/disabling network services but all in vain.

At last I tried resetting network adapters configuration using Windows registry and it did the trick. I was able to fix this annoying issue using my favorite Registry Editor. Actually Windows stores a cache of network adapters configuration in registry and if by any chance the cache becomes corrupted, you might face such kind of strange issues.

Anyway I'm sharing the solutions here so that if anyone else faces this problem, he'll be able to fix it easily without any hard work.

To fix this issue, you just need to follow these simple steps:

METHOD 1:

1. Type regedit in RUN or Start search box and press Enter. It'll open Registry Editor.

2. Now go to following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network

3. In right-side pane, you'll see a binary key "Config". Select it and press Delete key on your keyboard. You just need to delete Config key.

Don't worry. When you delete the key and open Network Connections folder or restart your system, Windows automatically re-creates the key. By deleting the key we are just clearing the configuration cache.

4. Once you delete the key, close Registry Editor and open Network Connections folder again and now it should show all network adapters without any problem.

PS: If you don't want to edit registry manually and want a ready-made registry script to do the task automatically, download following ZIP file, extract it and run extracted REG file. It'll ask for confirmation, accept it:

Download Registry Script

METHOD 2:

If the above mentioned method doesn't work for you, try following solution given by our reader "Campbell":

1. Open Device Manager using devmgmt.msc command and locate the Network adapters.

2. Right-click on each network adapter one bye one and select Uninstall.

3. Once all have been removed, right-click again and select Scan for hardware changes.

The adapters will be rediscovered and when the drivers are loaded back, the devices will re-appear in Network Connections.

METHOD 3:

If none of the above mentioned methods work for you, try following solution given by our reader "Rusty":

1. Type regedit in RUN or Start search box and press Enter. It'll open Registry Editor.

2. Now go to following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\Connections

3. In right-side pane, you'll see a multi-string key "ClassManagers". Double-click on it and it'll open the edit dialog box to change its value.

4. The dialog box will contain 4 GUIDs and each GUID must present on a separate line. If you find that all GUIDs are present in a single line, put them on separate lines by pressing Enter key after each closing curly bracket '}'.

For your convenience, we are providing the correct value of the key. Copy following text and paste it in the edit dialog box:

{B4C8DF59-D16F-4042-80B7-3557A254B7C5}
{BA126AD3-2166-11D1-B1D0-00805FC1270E}
{BA126AD5-2166-11D1-B1D0-00805FC1270E}
{BA126ADD-2166-11D1-B1D0-00805FC1270E}

After correcting the value, click on OK button to apply changes.

5. That's it. Close Registry Editor and open Network Connections folder again and now it should show all network adapters without any problem.

PS: If you are not familiar with modifying registry, you can download

1. Does the issue persist only with .netframework?

2. How are you  installing it? Is it through windows update or manually?

a: Click Start > Run.

b: Type cmd and press Enter.

Please run the following command in the opened window.

net stop WuAuServ

c: Click Start > Run Type %windir% and press Enter.
d: In the opened folder, rename the folder SoftwareDistribution to SDold.

e: Click Start> Run type cmd and press Enter.
Please run the following command in the opened window.

net start WuAuServ

Win32/Poly Crypt, also known as WinReanimator, is a fake antispyware program that can affect the Windows operating system. The program installs itself on your computer and immediately begins launching popups telling you that your computer is infected with spyware and that you must purchase the "full version" of WinReanimator to remove the spyware. In addition, the fake antispyware program may disable your legitimate antispyware programs, forcing you to remove the malicious program manually.

Delete Files

Step 1

Click "Start," type "cmd" into the search field and press "Enter." The Windows Command Prompt opens.

Step 2

Type the following commands into the Windows Command Prompt. Press "Enter" after each command: del WinReanimator.dll del buritos.exe del WinReanimator.lnk del winivstr.exe del WinReanimator.exe del winivstr.exe del buritos.exe del cru629.dat del braviax.exe del braviax.exe del cru629.dat del 4scan[1].exe del qajamowel.dll del WinReanimator del winreanimator.exe

Related Reading: How to Remove and Disable the CSRSS Virus With Regedit

Step 3

Type "exit" and press "Enter" to close the Windows Command Prompt.

Delete Registry Values

Step 1

Click "Start," type "regedit" into the search field and press "Enter" to open the Registry Editor.

Step 2

Delete the following registry values from the right pane of the Registry Editor. To delete a registry value, right-click the entry and select "Delete." If you have trouble locating a registry value, click "Edit," "Find," type the name of the value into the search field and click "Find Next." HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\buritos HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WinReanimator

Step 3

Close the Registry Editor.

Most common registry key to check while 

dealing with Virus issue

1) StartUp

C:\windows\start menu\programs\startup

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup="C:\windows\start menu\programs\startup"

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup="C:\windows\start menu\programs\startup"

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"

"Anything over here execute when you start up your computer"

2) Windows Scheduler:
Check for entries in the Scheduled Tasks, as well as via the AT command at a command prompt.

3) c:\windows\winstart.bat
'It basically behaves like a normal batch file, then only difference is that it can be used to delete files when you start up your computer

4) Registry :

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"

5) "Autoexec.bat"

6) These reg keys will basically spawn your programs, as you can see this is very dangerous because these keys are very used by viruses and Trojans.

[HKEY_CLASSES_ROOT\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\piffile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @="\"%1\" %*"
The key should have a value of Value "%1 %*", if this is changed to "server.exe %1 %*", the

server.exe will be executed EVERYTIME an exe/pif/com/bat/hta is executed.

7) Explorer start-up

The problem with these operating systems is that they look for a file called "explorer.exe" whenever you start up your computer, that file is basically the one that you see all the time but don’t realize it is there , if you go to your taskmaganer you can see it, you can even kill it and you will see that everything in your computer that belongs to Microsoft will disappear, except for the extra windows that you open such as cmd, regedit, services.msc etc, but your desktop will be gone.
As you can see this is dangerous because it also means that if somebody modify your explorer.exe file then your computer will be corrupted. In fact, to change the name of the start bottom, has to be done by modifying the explorer.exe file, so there is a clue of a small difference that can have an effect in your computer.

here is the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
if a Trojan changes that to a path of another "infected explorer.exe file" your computer will start up the file the Trojan told it to and not the one used by Microsoft.

8)"Active-X Component"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]
StubPath=C:\PathToFile\Filename.exe
This key is great because it starts the program that it has in its path BEFORE the explorer.exe file and any other program starts in your computer, so if you can understand why your antivirus can't detect the virus when you boot up, it is maybe because your "virus" is taking care of it before it starts up. It could even kill your antivirus before your antivirus starts up

user profile has been deleted accidentally


In case the user profile has been deleted accidentally, only the administrator’s login will be shown at the Welcome screen; the user’s personal login icon will not be shown. To recover the lost user profile, we will need to use Windows Registry editor.

Note: The Registry is one of the most crucial components of Windows operating systems, therefore it is important to backup the current Registry prior to making any changes to it. To create a backup, follow these simple steps

Useful Scripts To Modify Your Proxy Settings For Internet Explorer

Where A Proxy Server Is Configured

Before we get into the ways that you can automate your computer through scripting, let’s take a quick look at the manual way people would have to do this. Most people know how to configure their LAN settings – it’s one of the first things you should check if you’re ever having Internet connection problems. Typically you want your proxy settings to be set to “Automatically detect settings” when you’re at home or at a public hotspot.
However, at work, you’ll need to set up a proxy server. You do this within “Internet Properties” in the control panel by clicking on the “LAN settings” button.

Inside your network settings dialog, you’ll see the two settings – you either have a proxy server enabled or you don’t. This is the setting that you want to toggle when you switch from your home network to a work network, or if you want to switch to running under a “cloaked” anonymous IP server.

You can also find these settings in your registry (click Run and type “regedit“), and this is what you want your scripts to edit. By changing the registry settings, you’re essentially changing those settings in the LAN Settings window.

   

What we really want to do is toggle those settings only when and where you really want to. There are three scenarios that I’m going to cover, and you can copy and paste the code to tweak it to your liking.  You can put the script in your startup folder so that it launches whenever you boot your computer, or you can just run the scripts whenever you want your computer to automatically set the correct IP settings.
The three scenarios I’m going to provide scripts for include the following.

1. Prompt the user whether or not they want to use an anonymous proxy for Internet access.
2. Prompt the user to type in the name of the proxy server they want to use.
3. Automatically check whether you’re home or not, and set the appropriate proxy server settings.

The cool thing about Windows Scripting Host is that each of these options aren’t that hard to do.

Ask User To Enable A Proxy Server

This script will pop-up a message box asking whether or not the user wants to use a proxy server. If yes, then the script will enable proxy servers and fill in a hard-coded anonymous proxy server. You can tweak the script to use your favorite anonymous proxy.
Here’s what the script looks like.

<job>
<script language="VBScript">
Option Explicit
Dim valUserIn
Dim objShell, RegLocate, RegLocate1
Set objShell = WScript.CreateObject("WScript.Shell")
On Error Resume Next
valUserIn = MsgBox("Use A Cloaked Proxy?",4,"Cloaked Select")
If valUserIn=vbYes Then
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"
objShell.RegWrite RegLocate,"http://www.youareanonymous.com:80","REG_SZ"
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"
objShell.RegWrite RegLocate,"1","REG_DWORD"
MsgBox "Cloaked Proxy is Enabled"
else
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"
objShell.RegWrite RegLocate,"0.0.0.0:80","REG_SZ"
RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"
objShell.RegWrite RegLocate,"0","REG_DWORD"
MsgBox "Cloaked Proxy is Disabled"
End If
WScript.Quit
</script>
</job></textarea>

When you run it, the user sees the following prompt.

A “Yes” loads the anonymous proxy as your proxy server and sets “ProxyEnable” to 1. A “No” sets the proxy to default all zeros, and disables the proxy setting.

Prompt User To Type Proxy

The other approach is to ask the user what exact server they want to use. This allows the flexibility of changing the proxy server constantly without the need to edit the script itself. You can do this by changing the “MsgBox” command to an “InputBox”.
<job> <script language="VBScript"> Option Explicit Dim valUserIn Dim objShell, RegLocate, RegLocate1 Set objShell = WScript.CreateObject("WScript.Shell") On Error Resume Next valUserIn = Inputbox("Enter the Proxy server you want to use.","Proxy Server Required") RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer" objShell.RegWrite RegLocate,valUserIn,"REG_SZ" RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable" objShell.RegWrite RegLocate,"1","REG_DWORD" MsgBox "Proxy is Enabled" WScript.Quit </script> </job> When you save this as a .wsf file and run it, the following window will appear.

Just type in your preferred proxy server, click okay, and your Internet settings are automatically updated.

Set Proxy Settings Based On Location

This next script is a little bit more flexible, so it’s also a little longer. But what it can do is check your current IP address, and if it is within the range that you expect when you’re on your home ISP, it’ll disable using a proxy server. If it sees that you’re not on your typically home IP domain, it’ll automatically configure your Internet with a proxy server that you can hard code into the script.
Here’s what the script looks like.
<job> <script language="VBScript"> Option Explicit Dim valUserIn Dim objShell, RegLocate, RegLocate1 Dim objRemXML Dim objMyIP Dim strIPAddress Dim strHostname Dim strHomeDomain On Error Resume Next Set objShell = WScript.CreateObject("WScript.Shell") On Error Resume Next Const cstrShowMyIP = "http://www.showmyip.com/xml/" Set objRemXML = CreateObject("Microsoft.XMLDOM") objRemXML.async = False objRemXML.load(cstrShowMyIP) ' Get our IP address Set objMyIP = objRemXML.selectSingleNode("/ip_address/ip") strIPAddress = objMyIP.text ' Print info WScript.Echo "IP address : " & strIPAddress strHomeDomain = Left (strIPAddress,6) If strHomeDomain = "69.161" then RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer" objShell.RegWrite RegLocate,"0.0.0.0:80","REG_SZ" RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable" objShell.RegWrite RegLocate,"0","REG_DWORD" MsgBox "Cloaked Proxy is Disabled" else RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer" objShell.RegWrite RegLocate,"http://www.youareanonymous.com:80","REG_SZ" RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable" objShell.RegWrite RegLocate,"1","REG_DWORD" MsgBox "Cloaked Proxy is Enabled" end if ' Finish Set objMyIP = Nothing Set objRemXML = Nothing WScript.Quit </script> </job> You set set this up to run on startup, and the computer will automatically configure the Internet settings as needed. The program will show you your current IP each time – if you don’t want that, just remove the “WPScript.Echo” line. When I run it here at home, it recognizes I’m on my safe home ISP and disables the anonymous proxy.

If you were on a public hotspot, it would recognize the foreign IP address and enable the cloaked proxy instead.
These are just a few examples of the sort of automation you can build into your Windows PC with Windows Scripting Host. You don’t have to be an expert programmer – just learn a few of the commands in these scripts and you can really work some magic.
Did you try any of these scripts? Let me know what you think, and please offer any tweaks or improvements that could make them even better. Offer your insight in the comments section below.

 

Prevent and remove autorun virus from USB drive, hard disk

Removal instructions

Remove autorun.inf virus on USB drive

1. plug the USB drive into your computer, a window dialogue may appear, don’t click on Ok , just choose ‘Cancel’.
2. Go to command prompt and type your USB drive letter.
3. Type dir /w/a and press enter, this will display a list of the files in in your flash drive. Remove the files: Ravmon.exe, ntdelect.com, New Folder.exe, kavo.exe  svchost.exe, autorun.inf  If you find them.
4. To delete the virus just type del and the filename example. F:\del autorun.inf and hit enter.
5. Run a antivirus scan on your USB drives just to make sure that all threats are removed successfully

Delete autorun.inf on hard drive of computer

1. Boot your system in the safe mode and then open a command prompt.
2. Delete the following files:
   %System%\config\csrss.exe
   %WinDir%\media\arona.exe
   %System%\logon.bat
   %System%\config\autorun.inf
   C:\autorun.inf
   D:\autorun.inf
   E:\ autorun.inf
   F:\autorun.inf
   autorun.inf files in all drives.
3. Open the registry editor and delete following parameters:
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   DisableTaskMgr = 1
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   NoFolderOptions = 1
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "Worms" = "%System%\logon.bat"
4. Reboot your computer
   
   See more information about Win32.AutoRun.

How to remove autorun recycler virus completely

Sometimes, you may see an Recycler folder in the root of each drive in USB drives or
hard disk and you may treat it as recycler virus. The Recycler folder is an system folder that used to keep the deleted files, when you want to recover the deleted data before, the system will recover them from the Recyclers folder. You can click into the folder, and find the deleted files, picture, folders in it.
The attribute of Recycler folder is hidden, only when the 'show hidden files and folders' option is checked, you can see it.
Also System Volume Information is a system folder, it save the system restoration information.

However, more and more autorun virus hide themselves in the recycler bin folder, if you find any executable file such as RECYCLER.exe, or vbs file in it, and autorun.inf file in the root of the drive, and the content as
[AutoRun]
open=RECYCLER.exe
shellexecute=RECYCLER.exe
shell\Auto\command=RECYCLE.exe






      



That means your computer and USB sticks have been infected with virus.

Remove viruses in Recycler folder

Update antivirus software such as AVG, kaspersky, Nod32 to the latest version, do a thorough scan of the computer and USB storage devices. If the virus/worms come back again after removal, or the antivirus software could not detect the virus even, try to remove the virus manually.

1. Reboot your system and tap F8 to enter safe mode;
2. Close the RECYCLER.exe process in the task manager;
3. Delete the autorun.inf and other suspicious exe files in the recycler folder
4. Open registry editor and modify the NoDriveTypeAutoRun key with 03ffffff in following key: HKEY_LOCAL_MACHINE\SOFTWARE\ and HKEY_CURRENT_USER\SOFTWARE
5. Using the antivirus product to scan again.

The manual removal of the infection is not recommended because it requires an expertise to edit registry. In case you modify a registry entry wrongly, that may cause damage to the system. Therefore, it is always better to remove virus with a specialized removal tool.

Using Recycler Virus Removal Tool to delete the virus automatically

Autorun Remover is a specialized autorun removal tool to clean the autorun type virus including recycler virus, with it, you can get rid of the autorun.inf and recycler.exe easily and quickly.

1. Download and install Autorun Virus Remover;
2. if you USB drives has autorun.inf folder in it, insert it into computer;
3. Execute the tool, Click 'Start' to execute the scan.