NETWORK SYSTEM: quick heal Supp

Problem Reported as-

# Getting Message of low disk space in c drive.
# unable to Install Quick Heal as well as any Application.
# Unable to execute any application due to low disk space on root drive
Solution:
We have released the solution for same under QH Genguard i.e. under self protection.

Unless & until QH self protection is enable, winsta.exe file will not dropped/created at given location (i.e. at system32 folder)
If you face any difficulty please revert back to me.

2-IP address has been changed in Admin Console Server m/c
Answer

Problem:
Quick Heal online/virus protection continuously Detecting w32.ramnit.A in system files as well as installed software files."Action taken-Repaired"

Infection/suspicious files found in Below system location-

C:\Program Files\Microsoft\WaterMark.exe
"WaterMark.exe Handel with svchost.exe"

Registry Keys Created under the userinit-
"Userinit"="c:\\windows\\system32\\userinit.exe,,c:\\program files\\microsoft\\watermark.exe"

Found watermark.exe Different-Different size like-[77 KB,61KB,66KB,]

Solution:
Still generic solution not released. We need some time for that.
Please send Quick Heal System info file to "dinesh_net08@rediffmail.com" to find out the suspicious files and their solution.
3-Invalid Subscrition Error in Quick Heal 2010

Answer

This error shows when one serial no. is fetching updates from multiple location.

In such cases, we allow only one installation number to receive the updates
for that particular serial number of QH 2009 and all other installations are blocked.

In such case, please do follows

Kindly reinstall and activate Quick Heal & then generate Info.qhc. Send this to us:[This should be done the same system where you wants to receive the update].
Kindly give the following details through mail for the confirmation:-

1) Name of customer
2) Company Name(if Any)
3) Address
4) E-mail address
5) Purchase from
6) Date of first time registration
7) Batch Number of the serial number
8) Invoice copy
9) Latest generated system information of Quick Heal(Make sure copy is activated)
4-Show virus in autocad files in version autocad 2004,2006
Answer
Problem:
Show virus in autocad files in version autocad 2004,2006
1.When open AutoCAD 2006 or .dwg files display a massage "Fail to create CommCntrClientSink objects!".
2.After first point a massage display "**Express Tools**" Unable to load acetauto.lsp/fas bad argument type:stringp nil.
3.Then a massage display logo.gif file was repaired.logo.gif suspicious file generate automatically in C:\Program Files\AutoCAD 2006\Help\logo.gif.
Note: This Problem only occurred on Autocad crack version...
Solution:
In every AutoCAD infection problem the main dropper files which create the problem are.

1) Acad.vlx
2) Logo.gif

This 2 files are located in AutoCAD Installation directory i.e. C:\Program Files\AutoCAD 20XX\
if you face such kind of AutoCAD infection problem please do send above mention 2 files along with the infected (modified) files to viruslab.

4-System disconnected from Network & Random name numeric exe file dropping in system32 and temp folder.

problem:
1)Suspicious files detected as a TrojanDropper.Agent.gen
2)Infection is on all type of Windows os for e.g Windows XP, Windows Server 2003,etc
3)Commonly found below files in many location
C:\WINDOWS\cfdrive32.exe
c:\windows\system32\msvmiode.exe
c:\windows\system32\syscache.exe
4)Some times found modified host file.
Solution:
Still generic solution not released.We need some time for that.
Please send Quick Heal System info file to "dinesh_net08@rediffmail.com" to find out the suspicious files and their solution.
Kindly also apply below MS-patches on all systems.
http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx
http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx
http://support.microsoft.com/kb/971029

5-IP address has been changed in Admin Console Server m/c

Problem:
(i) Admin Console Webpage not opening
(ii) Quick Heal client installation problem.
(iii) Update problem in client pc & Quick Heal server pc.

Solution:
1.Under Quick heal admin cosole Pc, change the Ip from old IP to (New)Current Ip
from following location:-> C:\Program Files\Quick Heal\Admin Console 4.2\Admin\config->Open acasconf file -> Replace Current IP at the place of Old IP->Save the file.
2.Click on Start->Program->Quick Heal Admin console 4.2->Rt. click on Quick Heal admin console->properties->go to target option then change the IP from Old Ip to current IP->Apply->Ok.
3.In client pc change the Ip & computer Name of QH admin server from following location:-
C:\Program Files\Quick Heal\Client Agent 4.2\config->Open accaconf file ->Use Current Server IP & server Name of QH at place of Old server IP & server Name then save the file.
4. Restart the server.
7-Remove Boot Sector Infection
Solution:
Kindly Download the bootable image from below link & extract the zip file

http://122.169.101.123/file/qhbootcd.zip

Create bootable image CD from that ISO file.

Boot system from the CD Rom.

Go to R: (type R: then press enter btn.)>
Type "cd QHDOS" then press enter btn.>
Type QH then press enter btn.>
Press any key to continue>
Press tab btn. to select Partition/Boot Sectors>
Press tab btn. to select Drive c:>ok>After that it will clean the system automatically & scan status will be shown>ok>
Exit>
To restart the system Press ALT+Ctrl+Delete & remove the cd
6-TS Error/Winlogon fail during login from Thin client pc

Answer

Reason:
1.This type of error comes in case of the devices which uses Windows on LAN protocol,i.e, ULX and BLX models of Thin PC.
2.Some Microsoft patches block the winlogon connections,that is why in case of WindowsXP-SP3 this error comes frequently.

Solution:
Presently the Driver provided with the devices, only supports Windows XP with Service Pack 2 and Windows 2003 standard.
In case of above operating systems if the error comes, try deleting the Microsoft Hotfixes (KB956572 & KB9565293)

9-Uncompressing Linux Error

Problem:
This error normaly occcured in THIN PC with enjay thin card installed.
Solution:
1.Check the version of MAC ID file :
If image file size for mac id is 11,055 than enjay version is 3
If image file size for mac id is 9600 than enajy version is 2
2.Check the assigned dhcp ip address for problematic PC mac id from DHCP Server.
3. find out the hex value for last octet of ip address
4.Open “enjay-tc.cfg” folder and open the file with “wordpad” whose last 2 digit will be above hex value.
5. Modify the file as below and save the file.
For enjay version 2:
Label1
Kernel enjay2
Ramdisksize 10480
For enjay version 3:
Label1
Kernel enjay3
Ramdisksize 15000
7-Continuous Detection of w32.ramnit.A

Answer

Description:

When I-Worm.VB.CA executed it perform following activities.
Drop file to the following location:
\windows\system32\svch0st.exe
\WINDOWS/system/wincirl.com
\Documents and Settings\Administrator\Start Menu\Programs\Startup\
Microsoft Common Items.cmd
\Documents and Settings\ All Users\Start Menu\Programs\Startup\
Microsoft Common Items.cmd
Documents and Settings\Users\Start Menu\Programs\Startup\
Microsoft Common Items.cmd
\DOCUME~1\user\~1LOCALS~1Temp\.exe

It creates/modifies the below registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
load = C:\WINDOWS\system\wincirl.com

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Agent = C:\WINDOWS\system32\SVCH0ST.EXE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe C:\WINDOWS/system32/SVCH0ST.EXE

Payload:
Disabled Task Manager,Command prompt,Services,Registry Editor,msconfig etc..

Solution : Generic solution released on Quick Heal 09th july update.After updating to latest date
please run Nativ Boot scan.Still if you face any problem please contact us.

9- Local Drives not opening while double clicking from My Computer

Answer

This problem comes due to the autorun type of infections.
go to command prompt ( write "cmd" in Start-> Run and press OK).
Got to C: drive and type the following commands,
< attrib autorun.* >
if there is one then it will show you something like this,
c:> SHR autorun.inf
Then type
< attrib autorun.inf -s -h -r >
< del autorun.inf >
To avoid further infections, create a folder with same name "autorun.inf" in C: drive.
Repeat these steps for all other drives.

10-My Documents Open Automatically at Windows startup.

Answer

Solution:
1.Open Registy Editor from Start->Run->Type regedit-> OK
2.Take the BackUp of Registry.(File->Export->Save)

3. Check the Userinit and PersistBrowsers registry entries to make sure that they contain
the correct values. To check the Userinit and PersistBrowsers registry entries,
follow these steps:

a. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

b. In the right pane, right-click Userinit, and then click Modify.

c. In the Edit String dialog box,
type Windows installation drive letter:\WINDOWS\system32\userinit.exe under Value data,
and then click OK. (example-c:\windows\system32\userinit.exe)

d. Locate and then click the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

e. In the right pane, right-click PersistBrowsers, and then click Modify.

f. In the Edit DWORD Value dialog box, type 0 under Value data, and then click OK.

g. Quit Registry Editor, and then restart the computer.

11-New spyware infection : Security Tool.

Answer

Problem:
Security Tool Spyware problem.
When it installed in system no execution is work in normal mode. Not able to run any exe file not even QH.
System is able to work fine in safe mode/safe mode in N/W only.
Solution:
Kindly download rmrgware.rar tool & follow the below given steps to resolve the problem.

1)      Download the attached tool & extract it.

2)      Rename the tool from “rmrgware.exe” to “svchost.exe”

3)      Execute the file on problematic system & restart the system.

At present the tool is not compatible on the Windows Vista / Windows 7 (32bit) and 64 bit machines.
We will soon release the full fledged tool on the site itself. Meanwhile use this tool to resolve the problem.
15-Search window is opening while double clicking on any folder or drive

Answer

Problem:
Search window is opening while double clicking on any folder or drive. Even while right clicking on the Folder it is showing "Search" highlighted.

Solution :
Go to the below registry locations:

[HKEY_CLASSES_ROOT\Directory\shell]

[HKEY_CLASSES_ROOT\Drive\shell]

and make the default value none

12-Shortcuts creates in Pendrive

Answer

Problem:

After connecting Pen Drive in System shortcut of each folder created and original folders hide automatically from Pen Drive.

Observation:
Hosts file modified. No antivirus site is opening.

Solution:
Generic Solution released on update of 31-07-2010.Please update the QH Virus database and scan system and Pen Drive .It will delete also shortcut files from Pen Drive.
Kindly update the status of the case if anyone of you still facing this problem
13-Show virus in autocad files in version autocad 2004,2006

Answer

Problem:
Show virus in autocad files in version autocad 2004,2006
1.When open AutoCAD 2006 or .dwg files display a massage "Fail to create CommCntrClientSink objects!".
2.After first point a massage display "**Express Tools**" Unable to load acetauto.lsp/fas bad argument type:stringp nil.
3.Then a massage display logo.gif file was repaired.logo.gif suspicious file generate automatically in C:\Program Files\AutoCAD 2006\Help\logo.gif.
Note: This Problem only occurred on Autocad crack version...
Solution:
In every AutoCAD infection problem the main dropper files which create the problem are.

1) Acad.vlx
2) Logo.gif

This 2 files are located in AutoCAD Installation directory i.e. C:\Program Files\AutoCAD 20XX\
if you face such kind of AutoCAD infection problem please do send above mention 2 files along with the infected (modified) files to viruslab.
14-System disconnected from Network & Random name numeric exe file dropping in system32 and temp folder.

Answer

problem:
1)Suspicious files detected as a TrojanDropper.Agent.gen
2)Infection is on all type of Windows os for e.g Windows XP, Windows Server 2003,etc
3)Commonly found below files in many location
C:\WINDOWS\cfdrive32.exe
c:\windows\system32\msvmiode.exe
c:\windows\system32\syscache.exe
4)Some times found modified host file.
Solution:
Still generic solution not released.We need some time for that.
Please send Quick Heal System info file to "support@ncs.net.in" to find out the suspicious files and their solution.
Kindly also apply below MS-patches on all systems.
http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx

http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx

http://support.microsoft.com/kb/971029
15-The Computer Browser Service does not start.

Answer

To resolve this problem so that the Computer Browser service starts,

follow these steps:

1. Click Start, click Run, type firewall.cpl in the Open box, and
then click OK.
2. Click the Exceptions tab.
3. Click to select the File and Printer Sharing check box, and then
click OK.

The Computer Browser service automatically starts after you

unblock the ports that are used for file and printer sharing.
26-Win32 Generic Host Error or Computer Browser service suddenly dropping

Answer

This is a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. On Microsoft Windows 2000-based, Windows XP-based, and Windows Server 2003-based systems, an attacker could exploit this vulnerability over RPC without authentication and could run arbitrary code. If an exploit attempt fails, this could also lead to a crash in Svchost.exe.

To download security patches for this type of vulnerability visit the link given below.

http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx

17-Windows XP Login Problem

Answer

Problem:
- After shut down system not login.
- Black screen with only mouse point is highlighted.
Sources:-
- Some websites are highly infected and from there system is getting infected.
New solution for black screen problem. No need to reload the application. Please do the below step and get problem solve :-

01. Boot the system by Third party bootable cd. Like ERD.

01. Open the registry and delete the one entry from the below location :- HKEY_LOCAL_MACHINE_SOFTWARE_MICROSOFT_WINDOWSNT_DRIVERS32> ON RIGTH SIDE YOU GOT THE LOTS OF ENTRY JUST THE DELET THE KEY WHICH IS LOAD THE FILE FROM C:\WINDOWS\TEMP folder. Entry name may be different.

02. Delete the temp folder all file. If possible please collect and send the file to me in zip format with password protected.

03. Reboot the system and check problem resolve are not??

04. No need to reload the application.

Still if you have any quarries you are feel free to contact me by mail/phone. Still we are working on and that ASAP we will provide the solution in updates.

If problem is not resolve second option is always with you. It will cover maximum area

Else:

- Boot the system by third party bootable media/as secondary hard disk.
- Rename these files Security, Sam, Software, default and system. From Windows \system32\Config folder.
- Replace all the above files from ..Windows\Repair folder.
- While doing this activities your system get up but you have to reload all the application except windows. It will cover maximum area.

For complete solution we are working on it. Shortly we will provide the complete solution. Thanks for your co-operation.

18-“.exe” file was not opening even not regedit

Answer

Solution:
a. Rename “regedit.exe” as “regedit.com” from C:\Windows
b. Open regedit.com
c. Go to HKEY_CLASSES_ROOT->.exe
d. Data for “Default” should be exefile
e. Then go to HKEY_CLASSES_ROOT->exefile->shell->open->command
f. Here data for “Default” should be "%1" %*

19-"Low Disk Space" in Activation process

Answer

Quick Heal Showing Low Disk Space while activating .........
error

Solution :
Please check by updating 'Self Protection' configuration files.

To update ‘Self Protection’ configuration files, take below given steps.

1. Go to Quick Heal installation folder. i.e. C:\Program Files\Quick Heal\Quick Heal Internet Security.
2. Search & execute spconf.exe
3. Click on Update.
Clicking on update will update ‘Self Protection’ configuration files as per your new volume information.
Then Try Activating the Quick Heal.
Also you can check after disabling Self-Protection from QH->Option->General->Self protection.
Please let us know if same problem is coming after doing the above steps.

20-Unable to retrive updates" from Update Manager in AdminConsole 4.1

Answer

Problem:
"Unable to retrive updates" message showing while downloading updates from Update Manager in Admin console 4.1
Solution:
You need to replace the files from below link where you are facing update download related problems (Unable to retrieve updates) with Update Manager.
Replace these files only in case of Quick Heal Admin Console 4.1 and as per the product (IS/TS).
For Internet Security:

21-Activation problem in QH 2010

Answer

Problem:
While doing activation if below error shows:
"Unable to detect internet connection."
Then please perform following steps:

Solution:
1.If your internet connection is working through proxy Server then proxy settings required in Quick Heal also.
2.Turn off "DNS Client" from Administrative Tools -> Services
3.Turn Off "Windows Firewall" from Administrative Tools -> Services
4.Uncheck"Work Offline" option from Internet Explorer->File menu, if "work Offline" is selected there.

Note :For Windows 2000 operating System minimum internet Explorere version should be 6.

22-After installing Quick Heal 2010 in a single PC “Online Protection” and “DNA scan” both showing “OFF”

Answer

1. At first update virus database to latest date and scan total system for viruses. Run Antimalware and Antirootkit. If system is virus free and same problem persist then go to step 2.
2. Uninstall Quick Heal totally from your system .For that follow below mentioned process.
a. Uninstall Quick Heal from Add/Remove program.
b. Run Quick Heal 2010 removal tool.
c. Delete “Quick Heal” folder totally from your system.
d. Delete all entry of “quick heal” from Windows Registry also.
Then reboot the system and install latest version of Quick Heal.

Quick Heal 2010 Removal tool and Latest version of Quick Heal 2010 installer can be downloaded from following website:
23-After uninstall Quick Heal firewall, LAN card drivers display yellow exclamation mark in device manager (Wan Miniport)

Answer

Solution:
1.    Open registry editor.
2.    Deleted this entry HKLM\system\current control set\control\network\---config (*/Don’t restart the machine /*)
3.    Close registry window and open Network Connections. */Refresh the window/*
4.    Installed again firewall in the normal mode.
5.    Restart machine in Safe mode and uninstall firewall, run the clean.exe and remove the LAN cad drivers from device manager.
6.    Reboot the machine in Normal Mode and install LAN card drivers.

Note: Link contains two cliean.exe files one is for 32-bit OS (Clean.exe) and other is for 64-bit OS(Clean64.exe).

24- All protection off after installation qhserver edition in 2003 server

Answer

solution:
1.Download Config .rar file.
2.Boot the pc in safe mode.
3.Extract the config.rar & replace the config folder in Quick Heal folder (C:\Program Files\Quick Heal\Quick Heal Internet Security)
3.Restart the pc and boot in normal mode.
4.Go to Quick Heal folder. i.e. C:\Program Files\Quick Heal\Quick Heal Internet Security.
Search & execute spconf.exe, Click on Update, Clicking on update will update ‘Self Protection’ configuration files.
5. Restart the PC & check.
25-Continuous Nativ boot scan running

Answer

Solution:
1. Open registry editor.
2. Delete following entry from Registry and then restart the PC.
HKEY_LOCAL_MACHINE->SYSTEM->CurrentControSet->Control->Session Manager->boot execute

26-How to install Quick Heal Admin Console in a system where multiple LAN card is present ?

Answer

Always install on “computer Name/host name”, not on IP

27-Invalid Subscrition Error in Quick Heal 2010

Answer

This error shows when one serial no. is fetching updates from multiple location.

Pages

quick heal Supp

Answer

5-IP address has been changed in Admin Console Server m/c

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer

Answer