tools > folder options vanished!!

[Sheriff Ice]

format and install kaspersky 7 pm to let it work for life this is the best thing u do

[Genius704]

Try this ..it is 100% efficient..
http://www.majorgeeks.com/Trend_Micr...his_d5554.html
Click the first mirror MajorGeeks FL - |USA|
after install..
check all the ones u think are suspicious...and then press fix checked
if u have windows vista make sure u right click the program and click run as administrator.

[SysTaMatIcS]

Okey this is getting really annoying , no sound driver is working! and now after reviewing the un identified hardware i found this !

http://www.drivermax.com/driver/iden...05YF23QFE30U1O

check the 1st table , nd the 3rd table , which model do i have ?? intel or realtek!!!

[Wixel]

try to type in msconfig in your run comand and edit some of the startup items located. this might help in a way. But the best way is using a virus removal tool.

I suggest you check out what MorpheusP said, it's your best shot or Kaspersky.

[SysTaMatIcS]

Guyz kaspersky is F*** AMAZIN!! the 2009 edition immediately! got my folder options bak , my contol+alt+delete nd the regedit!! KASPERSKY RULESSssSSS , nd so is russia!

[Google]

Originally Posted by MORPHEUSP

S2AL MJARREB (me), WLA TES2AL 7AKIM (eddy)

Man ana 2el mjarreb wel 7akim
Ma3 2e7tiramete...
Me, 5 years experience in the viruses and the rootkits field...
Viruses are like dogs, they don't bite you if you don't mess with them... They are friendly...
I made some viruses for proof of concept not more... ma nezzalet shi 3al sou2 ba3ed
And I advice all the users to use Kaspersky as antivirus...

Brontok is a virus that works in kernel mode some system process files becomes infected and it is hard to disinfect them manually because of 2al 3ibara 2al shahira "You cannot terminate the process while it is being used by windows"... So Kaspersky needs to restart the computer in order to disinfect the windows system files...
You may ask, how Kaspersky disinfect those file?

The Rootkit hooks the windiows API functions...

The windows API functions begin with this standard:

--------------------------------------
Code Bytes|||||||Assembly
--------------------------------------
8bff||||||||||||||mov edi, edi
--------------------------------------
55|||||||||||||||push ebp
--------------------------------------
8bec|||||||||||||mov ebp, esp
--------------------------------------

The Rootkit can safely overwrite the first five bytes of the function because that is the same amount of space required for many types of jumps or for a call instruction...

The hooked API function:

--------------------------------------
Code Bytes||||||||Assembly
--------------------------------------
e9 xx xx xx xx|||||jmp xxxxxxxx
--------------------------------------
...
--------------------------------------

So Kaspersky will block the Rootkit from hooking the API functions...
Note that the xxxxxxxx after the jmp is the address of the Rootkit code...

[P337]

+++STEP 1+++
Regedit
so to enable it here we go ..
open notepad and jot this down

Option Explicit
'Declare variables
Dim WSHShell, rr, rr2, MyBox, val, val2, ttl, toggle
Dim jobfunc, itemtype

On Error Resume Next

Set WSHShell = WScript.CreateObject("WScript.Shell")
val = "HKCU\Software\Microsoft\Windows\CurrentVersion\Po licies\System\DisableRegistryTools"
val2 = "HKLM\Software\Microsoft\Windows\CurrentVersion\Po licies\System\DisableRegistryTools"
itemtype = "REG_DWORD"
jobfunc = "Registry Editing Tools are now "
ttl = "Result"

'reads the registry key value.
rr = WSHShell.RegRead (val)
rr2 = WSHShell.RegRead (val2)

toggle=1
If (rr=1 or rr2=1) Then toggle=0

If toggle = 1 Then
WSHShell.RegWrite val, 1, itemtype
WSHShell.RegWrite val2, 1, itemtype
Mybox = MsgBox(jobfunc & "disabled.", 4096, ttl)
Else
WSHShell.RegDelete val
WSHShell.RegDelete val2
Mybox = MsgBox(jobfunc & "enabled.", 4096, ttl)
End If


Save it as "name".vbs
this script will enable/disable ur regedit

+++STEP 2+++
then to enable folder options u just have to copy paste this script into notepad again and save it as "folderopetions.reg"

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer]
"NoFolderOptions"=dword:0000000
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\Restrictions]
"NoBrowserOptions"=dword:00000000

Tada!! u have it all configured .. any other problem feel free to pm me.

[Google]

Originally Posted by P337

+++STEP 1+++
Regedit
so to enable it here we go ..
open notepad and jot this down

Option Explicit
'Declare variables
Dim WSHShell, rr, rr2, MyBox, val, val2, ttl, toggle
Dim jobfunc, itemtype

On Error Resume Next

Set WSHShell = WScript.CreateObject("WScript.Shell")
val = "HKCU\Software\Microsoft\Windows\CurrentVersion\Po licies\System\DisableRegistryTools"
val2 = "HKLM\Software\Microsoft\Windows\CurrentVersion\Po licies\System\DisableRegistryTools"
itemtype = "REG_DWORD"
jobfunc = "Registry Editing Tools are now "
ttl = "Result"

'reads the registry key value.
rr = WSHShell.RegRead (val)
rr2 = WSHShell.RegRead (val2)

toggle=1
If (rr=1 or rr2=1) Then toggle=0

If toggle = 1 Then
WSHShell.RegWrite val, 1, itemtype
WSHShell.RegWrite val2, 1, itemtype
Mybox = MsgBox(jobfunc & "disabled.", 4096, ttl)
Else
WSHShell.RegDelete val
WSHShell.RegDelete val2
Mybox = MsgBox(jobfunc & "enabled.", 4096, ttl)
End If


Save it as "name".vbs
this script will enable/disable ur regedit

+++STEP 2+++
then to enable folder options u just have to copy paste this script into notepad again and save it as "folderopetions.reg"

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer]
"NoFolderOptions"=dword:0000000
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\Restrictions]
"NoBrowserOptions"=dword:00000000

Tada!! u have it all configured .. any other problem feel free to pm me.

In the case where you have a virus that is running, you will not succeed with this... You do this after you delete the virus completely from the PC...
Because right after you enable those things, the virus will redisable them automatically...