Can I let Malwarebytes Remove "Vundo" infected psqlpdw.dll in c:\windows\system32 ?

The Problem:
- I updated Malwarebytes on my XP Pro Toshiba Tecra laptop last night and ran it.
- This morning it reports Trojan Vundo in...
C:\Windows\System32\psqlpdw.dll
HKey_LocalMachine\software\microsoft\windows\CurrentVersion\SharedDLL\Windows\System32\psqlpwd.dll
Value c:\windows\system32\psqlpwd.dll
HKey_LocalMachine\software\microsoft\windows NT\Current Version\Winlogon\Notify\psfus
Apparently this has to do with the fingerpring device on my Toshiba Tecra laptop (Fingerprint Potector Suite Check) and Googling it I find at least one place that tells me not to remove it.
The Question:
- What will happen if I just let Malware bytes remove it and the two registry entries?
- How do I get rid of this Malware without having to reinstall the system.
I really appriceate any help. Thanks.

Vundo is best removed using a specific removal tool. There is more to it than just deleting files and obvious registry entries. The link HERE discusses step by step manual removal and also has a link to a removal tool. According to their website, Malwarebytes is supposedly capable of removing it as well. One caveat - I know nothing about Malwarebytes and how reliable they are. It is not uncommon for a piece of software to hit a false positive on a program that it feels is acting suspiciously. If it were me, I'd try the tool mentioned in the link above and see if it agrees that Vundo is installed.

Similar Messages

How can I use PowerShell to Remove "Ghost" (Old Hidden) VMware Network Adapters in Windows 7?

We recently upgrade the virtual hardware of some of our VMware VM's running Windows 7. One side-effect is that in Windows on these machines, an instance of the NIC from the previous version of virtual hardware remains, as a hidden
device. This can be easily found manually on a machine by enabling Device manager to show hidden devices (registry and a menu option - View...Show Hidden Devices). You can then just right-click on the device in question and uninstall.
The problem here, like in so many other tasks, is that you may have multiple instances, on multiple machines. We had just that, and in scouring the internet for a PowerShell only script to resolve the issue, I could not find one. Therefore, I've written
my own.
This exact script is only seeking out VMware "VMXNET3" nic cards, but could be easily adapted to find Ghost NIC's for a different vendor using my example. There are also some commented lines left in to aid you as an example of how you can
test the various queries in your own environment, on a test machine, before a full-blown deployment.
NOTE: Please try this out (at your own risk - I am not responsible for how this works out for you), and please vote for my answer to this dilemma if this helped you. I'd appreciate it after all of the sweat the script took to crank out.
Thanks!
P.S. This script, of course, requires that Powershell is installed and enabled on the target computer. It then must be run as System - In our environment it is being remotely pushed through a software delivery systems, which runs this scrpt
as system.
THE SCRIPT:
CLS
#Querying WMI for Ghost NICs and Returning Criteria...
Write-Host "VMware Ghost NIC Remover" -Foreground GREEN
Write-Host "Author: Octavio Serpa AKA Octavio-Admin"
Write-Host "Copyright Octavio Serpa - Octavio-Admin - 2014"
Write-Host ""
Write-Host "Checking Powershell Version" -Foreground Yellow
$host.version
Write-Host ""
Write-Host "Searching for Ghost NIC's" -Foreground Yellow
$Ghosts = gwmi win32_NetworkAdapter | ?{$_.Description -like "vm*" -and $_.Installed -like "True" -and $_.MACAddress -eq $null}
$Ghosts | Select-Object Name,DeviceID
If ($Ghosts -NE $NULL)
  Write-Host "One or more ghost NIC'S do exist on this machine. Script will continue..." -foreground RED
  Write-Host ""
  else
  Write-Host "No ghost NIC's Found :) - Exiting..." -Foreground Green
  Write-Host ""
  EXIT 0
#Using Criteria to Obtain the GUID of each Ghost NIC
Write-Host "Getting NIC Variables" -Foreground Yellow
foreach ($_ in $Ghosts) {
  $DID = $_.DeviceID
  If ($DID -NE $NULL)
  Write-Host "The NIC DID: $DID"
  else
  Write-Host "$DID is NULL - Exiting..."
  EXIT 666
  if($DID -NOTLIKE "1*")
   Write-Host "Adding additional 0 to registry lookup since the DID is just one character..." - foreground yellow
   Write-Host ""
   $NICREG = Get-ItemProperty "hklm:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\000$DID"
  ELSE
   $NICREG = Get-ItemProperty "hklm:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\00$DID"
  $GUID = $NICREG.NetCfgInstanceId
  Write-Host "The NIC GUID: $GUID"
                $PNPDID = $NICREG.DeviceInstanceID
  $PNPDID = $PNPDID.Trimstart("PCI\VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01\")
  Write-Host "The truncated PNPDevice ID is $PNPDID"
  Write-Host ""
  Write-Host "Searching for Registry Keys that match NIC GUID: $GUID" -Foreground Yellow
  $NICREGPATH = @(1..50)
  foreach ($_ in $NICREGPATH)
   $TESTREG = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\$_" -Verbose
   if($TESTREG -EQ $FALSE)
    #Write-Host ""
    #Write-Host "FALSE: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\$_ DOES NOT EXIST" -Foreground RED
    ELSE
    #Write-Host "True - NIC $_ Exists" -Foreground Green
    $NICID = $_
    $SubPath1 = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\'+$NICID
    #Write-Host "The Sub-Key Path To Query = $SubPath1"
    $SubPath2 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\NetworkCards\'+$NICID
    #Write-Host "The Sub-Key Path To Query = $SubPath2"
    $NICProperties = Get-ItemProperty $SubPath1
    #$NICProperties
    $Match = $NICProperties.ServiceName
    #$Match
    foreach ($_ in $Match) {
    #Write-Host "The NIC GUID found in this registry key is: $_" -Foreground Yellow
    #Write-Host ""
    if($_ -NE $GUID)
    #Write-Host "NO MATCH - THIS NIC HAS NOT BEEN TOUCHED" -Foreground GREEN
                               #Write-Host ""
    ELSE
    Write-Host "MATCH - Registry Entries for this NIC will be DELETED" -Foreground RED
    Remove-Item $SubPath1 -Recurse -ErrorAction SilentlyContinue
    Remove-Item $SubPath2 -Recurse -ErrorAction SilentlyContinue
    $CCS = @("ControlSet001", "ControlSet002")
    foreach ($_ in $CCS) {
     $CCS = $_
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Services\'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Services\Tcpip\Parameters\Adapters\'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01#$PNPDID#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\JNPRNA\Parameters\Adapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\NetBT\Parameters\Interfaces\Tcpip_' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Psched\Parameters\NdisAdapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\Adapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\DNSRegisteredAdapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\Interfaces\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\WfpLwf\Parameters\NdisAdapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
                                         if($DID -NOTLIKE
"1*")
              $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\000' + $DID
                         Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
       ELSE
       $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\00' + $DID
       Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Enum\PCI\VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01\' + $PNPDID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
#This is our Success check at the end
Write-Host ""
Write-Host "Searching for any remaining Ghost NICs:" -Foreground Yellow
          $Ghosts = gwmi win32_NetworkAdapter | ?{$_.Description -like "vm*" -and $_.Installed -like "True" -and $_.MACAddress -eq $null}
$Ghosts | Select-Object Name,DeviceID
  If ($Ghosts -NE $NULL)
  Write-Host "There is still at least one ghost NIC present. The remover script may not be functioning correctly. Please contact Octavio-Admin on Microsoft Technet Forums with any questions" -foreground RED
  Write-Host ""
  EXIT 666
  else
  Write-Host "No ghost NIC's Found :) - Exiting..." -Foreground Green
  Write-Host ""
  EXIT 0

THE SCRIPT:
CLS
#Querying WMI for Ghost NICs and Returning Criteria...
Write-Host "VMware Ghost NIC Remover" -Foreground GREEN
Write-Host "Author: Octavio Serpa AKA Octavio-Admin"
Write-Host "Copyright Octavio Serpa - Octavio-Admin - 2014"
Write-Host ""
Write-Host "Checking Powershell Version" -Foreground Yellow
$host.version
Write-Host ""
Write-Host "Searching for Ghost NIC's" -Foreground Yellow
$Ghosts = gwmi win32_NetworkAdapter | ?{$_.Description -like "vm*" -and $_.Installed -like "True" -and $_.MACAddress -eq $null}
$Ghosts | Select-Object Name,DeviceID
If ($Ghosts -NE $NULL)
Write-Host "One or more ghost NIC'S do exist on this machine. Script will continue..." -foreground RED
Write-Host ""
else
Write-Host "No ghost NIC's Found :) - Exiting..." -Foreground Green
Write-Host ""
EXIT 0
#Using Criteria to Obtain the GUID of each Ghost NIC
Write-Host "Getting NIC Variables" -Foreground Yellow
foreach ($_ in $Ghosts) {
$DID = $_.DeviceID
If ($DID -NE $NULL)
Write-Host "The NIC DID: $DID"
else
Write-Host "$DID is NULL - Exiting..."
EXIT 666
if($DID -NOTLIKE "1*")
   Write-Host "Adding additional 0 to registry lookup since the DID is just one character..." - foreground yellow
   Write-Host ""
   $NICREG = Get-ItemProperty "hklm:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\000$DID"
ELSE
   $NICREG = Get-ItemProperty "hklm:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\00$DID"
$GUID = $NICREG.NetCfgInstanceId
Write-Host "The NIC GUID: $GUID"
                $PNPDID = $NICREG.DeviceInstanceID
$PNPDID = $PNPDID.Trimstart("PCI\VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01\")
Write-Host "The truncated PNPDevice ID is $PNPDID"
Write-Host ""
Write-Host "Searching for Registry Keys that match NIC GUID: $GUID" -Foreground Yellow
$NICREGPATH = @(1..50)
foreach ($_ in $NICREGPATH)
   $TESTREG = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\$_" -Verbose
   if($TESTREG -EQ $FALSE)
    #Write-Host ""
    #Write-Host "FALSE: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\$_ DOES NOT EXIST" -Foreground RED
    ELSE
    #Write-Host "True - NIC $_ Exists" -Foreground Green
    $NICID = $_
    $SubPath1 = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\'+$NICID
    #Write-Host "The Sub-Key Path To Query = $SubPath1"
    $SubPath2 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\NetworkCards\'+$NICID
    #Write-Host "The Sub-Key Path To Query = $SubPath2"
    $NICProperties = Get-ItemProperty $SubPath1
    #$NICProperties
    $Match = $NICProperties.ServiceName
    #$Match
    foreach ($_ in $Match) {
    #Write-Host "The NIC GUID found in this registry key is: $_" -Foreground Yellow
    #Write-Host ""
    if($_ -NE $GUID)
    #Write-Host "NO MATCH - THIS NIC HAS NOT BEEN TOUCHED" -Foreground GREEN
                                #Write-Host ""
    ELSE
    Write-Host "MATCH - Registry Entries for this NIC will be DELETED" -Foreground RED
    Remove-Item $SubPath1 -Recurse -ErrorAction SilentlyContinue
    Remove-Item $SubPath2 -Recurse -ErrorAction SilentlyContinue
    $CCS = @("ControlSet001", "ControlSet002")
    foreach ($_ in $CCS) {
     $CCS = $_
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Services\'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Services\Tcpip\Parameters\Adapters\'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01#$PNPDID#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\'+$GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\JNPRNA\Parameters\Adapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\NetBT\Parameters\Interfaces\Tcpip_' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Psched\Parameters\NdisAdapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\Adapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\DNSRegisteredAdapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\Interfaces\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\WfpLwf\Parameters\NdisAdapters\' + $GUID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
                                         if($DID -NOTLIKE
"1*")
              $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\000' + $DID
                         Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
       ELSE
       $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\00' + $DID
       Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
     $reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Enum\PCI\VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01\' + $PNPDID
     Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
#This is our Success check at the end
Write-Host ""
Write-Host "Searching for any remaining Ghost NICs:" -Foreground Yellow
          $Ghosts = gwmi win32_NetworkAdapter | ?{$_.Description -like "vm*" -and $_.Installed -like "True" -and $_.MACAddress -eq $null}
$Ghosts | Select-Object Name,DeviceID
If ($Ghosts -NE $NULL)
Write-Host "There is still at least one ghost NIC present. The remover script may not be functioning correctly. Please contact Octavio-Admin on Microsoft Technet Forums with any questions" -foreground RED
Write-Host ""
EXIT 666
else
Write-Host "No ghost NIC's Found :) - Exiting..." -Foreground Green
Write-Host ""
EXIT 0
Hello Octavio,
I'm having similar issues with azure VMs (windows server 2008 and 2012). I noticed that the name of the network adapter changes every time the servers are turned off and then on.
For example every time I perform that action on each VM, the network adapter became to "Microsoft Hyper-V Network Adapter #3" (and then #4, #5, etc).
I found in to many forums that to resolve that is needed to remove Hidden (Ghost) Network Adapters and most of the people is doing that manually from the device manager (right click on the hidden network adapter and select uninstall).
Then I found this script created by you and made some changes to find Description -like "Microsoft Hyper-V Network*".
It seems to find the adapters and also remove them (based on the script results). But if I go to the device manager after restarting the server, all hidden (ghost) adapters are still there (for example Microsoft Hyper-V Network Adapter
#2, Microsoft Hyper-V Network Adapter #3, Microsoft Hyper-V Network Adapter #4, Microsoft Hyper-V Network Adapter #n).
The only thing I noticed after running the script is that, in the Control Panel -> Network and Sharing Center, the name of the adapter has no # (Now is shown as “Ethernet” and before as “Ethernet #”)
This is my script, could you please take a look and tell me if there is something wrong o missing?
CLS
#Querying WMI for Ghost NICs and Returning Criteria...
Write-Host "VMware Ghost NIC Remover" -Foreground GREEN
Write-Host "Author: Octavio Serpa AKA Octavio-Admin"
Write-Host "Copyright Octavio Serpa - Octavio-Admin - 2014"
Write-Host ""
Write-Host "Checking Powershell Version" -Foreground Yellow
$host.version
Write-Host ""
Write-Host "Searching for Ghost NIC's" -Foreground Yellow
$Ghosts = gwmi win32_NetworkAdapter | ?{$_.Description -like "Microsoft Hyper-V Network*" -and $_.Installed -like "True" -and $_.MACAddress -eq $null}
$Ghosts | Select-Object Name,DeviceID
If ($Ghosts -NE $NULL)
Write-Host "One or more ghost NIC'S do exist on this machine. Script will continue..." -foreground RED
Write-Host ""
else
Write-Host "No ghost NIC's Found :) - Exiting..." -Foreground Green
Write-Host ""
EXIT 0
#Using Criteria to Obtain the GUID of each Ghost NIC
Write-Host "Getting NIC Variables" -Foreground Yellow
foreach ($_ in $Ghosts) {
$DID = $_.DeviceID
If ($DID -NE $NULL)
Write-Host "The NIC DID: $DID"
else
Write-Host "$DID is NULL - Exiting..."
EXIT 666
if($DID -NOTLIKE "1*")
Write-Host "Adding additional 0 to registry lookup since the DID is just one character..." - foreground yellow
Write-Host ""
$NICREG = Get-ItemProperty "hklm:\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\000$DID"
ELSE
$NICREG = Get-ItemProperty "hklm:\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\00$DID"
$GUID = $NICREG.NetCfgInstanceId
Write-Host "The NIC GUID: $GUID"
$PNPDID = $NICREG.DeviceInstanceID
$PNPDID = $PNPDID.Trimstart("PCI\VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01\")
Write-Host "The truncated PNPDevice ID is $PNPDID"
Write-Host ""
Write-Host "Searching for Registry Keys that match NIC GUID: $GUID" -Foreground Yellow
$NICREGPATH = @(1..50)
foreach ($_ in $NICREGPATH)
$TESTREG = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\$_" -Verbose
if($TESTREG -EQ $FALSE)
#Write-Host ""
#Write-Host "FALSE: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\$_ DOES NOT EXIST" -Foreground RED
ELSE
#Write-Host "True - NIC $_ Exists" -Foreground Green
$NICID = $_
$SubPath1 = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\'+$NICID
#Write-Host "The Sub-Key Path To Query = $SubPath1"
$SubPath2 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\NetworkCards\'+$NICID
#Write-Host "The Sub-Key Path To Query = $SubPath2"
$NICProperties = Get-ItemProperty $SubPath1
#$NICProperties
$Match = $NICProperties.ServiceName
#$Match
foreach ($_ in $Match) {
#Write-Host "The NIC GUID found in this registry key is: $_" -Foreground Yellow
#Write-Host ""
if($_ -NE $GUID)
#Write-Host "NO MATCH - THIS NIC HAS NOT BEEN TOUCHED" -Foreground GREEN
#Write-Host ""
ELSE
Write-Host "MATCH - Registry Entries for this NIC will be DELETED" -Foreground RED
Remove-Item $SubPath1 -Recurse -ErrorAction SilentlyContinue
Remove-Item $SubPath2 -Recurse -ErrorAction SilentlyContinue
$CCS = @("ControlSet001", "ControlSet002")
foreach ($_ in $CCS) {
$CCS = $_
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Services\'+$GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Services\Tcpip\Parameters\Adapters\'+$GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01#$PNPDID#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#'+$GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\'+$GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\JNPRNA\Parameters\Adapters\' + $GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\NetBT\Parameters\Interfaces\Tcpip_' + $GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Psched\Parameters\NdisAdapters\' + $GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\Adapters\' + $GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\DNSRegisteredAdapters\' + $GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\Tcpip\Parameters\Interfaces\' + $GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\services\WfpLwf\Parameters\NdisAdapters\' + $GUID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
if($DID -NOTLIKE "1*")
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\000' + $DID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
ELSE
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\00' + $DID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
$reg1 = 'HKLM:\SYSTEM\' + $CCS + '\Enum\PCI\VEN_15AD&DEV_07B0&SUBSYS_07B015AD&REV_01\' + $PNPDID
Remove-Item $reg1 -Recurse -ErrorAction SilentlyContinue -verbose
#This is our Success check at the end
Write-Host ""
Write-Host "Searching for any remaining Ghost NICs:" -Foreground Yellow
$Ghosts = gwmi win32_NetworkAdapter | ?{$_.Description -like "Microsoft Hyper-V Network*" -and $_.Installed -like "True" -and $_.MACAddress -eq $null}
$Ghosts | Select-Object Name,DeviceID
If ($Ghosts -NE $NULL)
Write-Host "There is still at least one ghost NIC present. The remover script may not be functioning correctly. Please contact Octavio-Admin on Microsoft Technet Forums with any questions" -foreground RED
Write-Host ""
EXIT 666
else
Write-Host "No ghost NIC's Found :) - Exiting..." -Foreground Green
Write-Host ""
EXIT 0

How can I tell if my Macbook is infected with the botnet described at Dr. Wed?

How can I tell if my Macbook is infected with the botnet described at Dr. Wed?

How deal with FLASHBACK trojan? - https://discussions.apple.com/message/16505583
Flashback Trojan - Detection, and how to remove - http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml
http://arstechnica.com/apple/news/2012/04/flashback-trojan-reportedly-controls-h alf-a-million-macs-and-counting.ars

Can final cut pro x remove vocals on mp3?

I want to Karaoke 'Try' by Dolly Parton on Blue Smoke as there are no available karaokes of it commercially, so I want to remove the vocals on the song but keep the musical arrangement. Can Final Cut Pro X do that? Thanks, GoDeAn

I don't know anything that can do that. If you find one can you let us know?

I have problem " verify your emal " i can't change account , i removed application and instell again , same problem fix email and " verify email"

i have problem " verify your emal " i can't change account , i removed application and instell again , same problem fix email and " verify email"

The Email ID provided here has CC registered to it in active status. The Email also stands verified. Are you using any other Email ID ?
Let me know if you are facing issue regarding verification by activating the Cc with the email ID provided here.
Regards
Rajshree

Hi all can anyone let me know about navigational attributes?

hi all,
Can anyone let me know the importance of navigational attributes with examples.
if docs pls email at [email protected]
regds
haritha

HI haritha,
Navigational attribute is used for drilling down in the report. We don't need to maintain Navigational attribute in the cube as a characteristic (that is the advantage) to drill down
0MATERIAL has a Display attribute called MATGROUP and a Navigational attribute called MATTYPE.
If you want your report to show MATGROUP, you need to have 0MATERIAL in the query too. A Display attribute always 'tags' along with the 'parent' characteristic.
However you can include MATTYPE in your report without using 0MATERIAL. For reporting purposes a navigational attribute behaves just like another characteristic. This means that you can also have variables for navigational attributes.
One drawback is that since they are stored outside your Info Cube (in master data tables), the OLAP has to perform an extra step to pull in this data and this leads to some performance impact, although in most cases this is negligible.
When you double click on a cell in a report which contains a characteristic value, the report is filtered for this value and the entire characteristic column is removed from the results area. If you double click on material 1001, the material column goes away from the results and in the filter cells above the report, you can see value 1001 against Material.
If you double click on a key figure value, nothing
happens.
If you double click on a Char column heading, the char is removed from the drill down.
If you double click on a key figure column heading, all key figures go away, and the values that are left are for the key figure you double clicked. Again you can verify this by looking at the filter cells against the key figure structure.
Re: Navigate Attribute
assign points if helps,
regards,
yunus

Battery , time , signal strength bar is not getting displayed in home screen , these will be displayed only when i click on any app. Can u let me know the setting change ?

Battery , time , signal strength bar is not getting displayed in home screen , these will be displayed only when i click on any app. Can u let me know the setting change ?

Did you check the Zoom setting?
Have you tried a reset (reboot)? Hold HOME and SLEEP until an Apple logo appears.
If it isn't Zoom and a reboot doesn't help try Settings/General/Reset - Reset all settings

I ordered a battery for my laptop because it said to replace battery soon. How long can I let the new battery sit around as I wait for the old one to run out of more charge?

I ordered a battery for my laptop because it said to replace battery soon. How long can I let the new battery sit around as I wait for the old one to run out of more charge? Will the new one become less effective if it sits around too long?

How much capacity is remaining on your current battery?
Check your power status
From the  menu: Hold OPTION and click System Information... èHardware è Power
Copy and Paste in your reply.
The new battery will become less effective if you store it in a hot or humid environment. It should be stored at room temperature (22 C).
Long term storage (6 months):
Apple recommends that you store the battery with a 50% charge. If you store a battery when it’s fully discharged, it could fall into a deep discharge state, which renders it incapable of holding any charge. Conversely, if you store it fully charged for an extended period of time, the battery may experience some loss of battery capacity, meaning it will have a shorter life.
http://www.apple.com/batteries/

Can anyone let me know how can i get the ouput from BW in .txt format.

Can anyone let me know how can i get the ouput from BW in .txt format. See we can get output as Excel(i.e BEX) and manually convert it into txt format. I need a direct or automated way to do the same.no human intervention.
mail me at [email protected] or post answer in sdn.

Please do not multiple post across forums..
how can i save the data in BEX reports in .txt format automatically
This helps in keeping track of answers and avoids the issue of repeated answers across forums...
Please close one of the threads as answered and provide the link that you want to follow
Arun

HT1918 Please can you advise how I remove a credit card from my account

I am trying to remove my bank details from my account but can't find where to remove them

Changing your account information using a computer:
Open iTunes.
Choose Store > Sign In.
Enter your Apple ID and password, then click the Sign In button.
Choose Store > View My Account.
Enter your account password, and click the View Account button.
To update your email address, follow these instructions:
From the Apple Account Information page, click the Edit button to the right of your Apple ID.
Enter your new email address into the Email Address field.
Click the Done button.
To update your name, billing address, or payment information, follow these instructions:
From the Apple Account Information page, click the Edit Payment Information button.
Edit the information that you would like to change.Note: The payment methods that the iTunes Store accepts can be found in the payment type section. If you do not want a payment method on your account, select None in the payment type section.
Click the Done button once you've updated all of your information.

I bought an old iPod touch It is 6.1.6, i would like to add a new icloud account but it can't let me. this iPod touch belonged to another person and i don't know where is he can you tell me please how to add a new icloud account??

I bought an old iPod touch It is 6.1.6, i would like to add a new icloud account but it can't let me. this iPod touch belonged to another person and i don't know where is he can you tell me please how to add a new icloud account??

The 4G/iOS 6 does not have an Activation Lock. That started with iOS 7.
Place the iOS device in Recovery Mode and then connect to your computer and restore via iTunes. The iPod will be erased.
If recovery mode does not work try DFU mode.
How to put iPod touch / iPhone into DFU mode « Karthik's scribblings
For how to restore:
iTunes: Restoring iOS software

I am using my Description as the caption on Slideshow. I ticked the "Show Title Slide" button and iPhoto physically copied the description on the first slide onto the end of every other description. I can find no way of removing them other than by hand.

I am using my Description as the caption on Slideshow. I ticked the "Show Title Slide" button and iPhoto physically copied the description on the first slide onto the end of every other description. I can find no way of removing them other than by hand. Unticking the "show title slide" did not reverse the situation back to my required state. Any ideas why it might have happened or how it might br resolved? Regards, Marshfrog1

Attached is Dennis Linam’s Audition – “Log File” and “Log – Last File”
Contact information Dennis [email protected]
Previous contact information with your organization (DURIM):
Dennis - i just finished my audition trial and bought the subscription the 2014 version.
created by durin in Audition CS5.5, CS6 & CC - View the full discussion
DURIM - Okay. I would expect the "Cache Warning" message because your default directories would not be the same as the ones in the settings file I generated.
If you go back to the "7.0" directory and open the "Logs" folder, can you copy the "Audition Log.txt" file and send it as an attachment to [email protected]? We'll take a look in that logfile and see if it gives us more information about why this is failing now.
Also, do you have any other Adobe applications installed on this machine, such as Premiere Pro? If so, do they launch as expected or fail as well?
I do have the trial Pro version of Adobe reader, but I have not activated it, because I fear the same thing will happen did it. I cannot afford to activate the subscription for that product and take the chance of it not working either. I depend on those two programs religiously. Here is the files that you requested. I appreciate any help you can give me to get this audition program started
Audition Log- file
Ticks = 16 C:\Program Files (x86)\Common Files\Adobe\dynamiclink\7.0\dynamiclinkmanager.exe
Sent from Windows Mail

Can you get your cracked iPod Touch screen repaired if you colored the top of it with highlighters? If you can't, how do I remove the highlighter?

I cracked my iPod Touch screen at the top where the front camera is and colored the cracks in with highlighter. I want to know if I can still get it repaired even if its colored in? If I can't, how do I remove the highlighter?

If your iPod Touch, iPhone, or iPad is Broken
Apple does not fix iDevices. Instead, they exchange yours for a refurbished or new replacement depending upon the age of your device and refurbished inventories. On rare occasions when there are no longer refurbished units for your older model, they may replace it with the next newer model.
ATTN: Beginning July 2013 Apple Stores are now equipped to do screen repairs/replacements in-house on iPhone 5s. In some cases while you wait. According to Apple this is the beginning of equipping Apple Stores with the resources needed to do most repairs for iPhones, iPads, and iPod Touches that would not require major replacements. Later in the year the services may be extended as Apple Stores become equipped and staffed with the proper repair expertise. So, if you need a screen repaired or a broken screen replaced or have your stuck Home button fixed, call your local Apple Store to see if they are now doing these in-house.
You may take your device to an Apple retailer for help or you may call Customer Service and arrange to send your device to Apple:
Apple Store Customer Service at 1-800-676-2775 or visit online Help for more information.
To contact product and tech support: Contacting Apple for support and service - this includes international calling numbers.
iPod Service Support and Costs
iPhone Service Support and Costs
iPad Service Support and Costs
There are third-party firms that do repairs on iDevices, and there are places where you can order parts to DIY if you feel up to the task. Start with Google to search for these.

How can I add the "Profile Removal Password Payload" to a configuration Profile?

How can I add the “Profile Removal Password Payload” to a configuration Profile?
I’m not seeing an option to add this option when I edit the configuration profile within Apple Configurator.
Do I have to edit the configuration profile(xml file) within a text editor?
FYI:
https://developer.apple.com/library/ios/featuredarticles/iPhoneConfigurationProf ileRef/Introduction/Introduction.html
Profile Removal Password Payload
The Removal Password payload is designated by specifying com.apple.profileRemovalPassword value as the PayloadType value.
A password removal policy payload provides a password to allow users to remove a locked configuration profile from the device. If this payload is present and has a password value set, the device asks for the password when the user taps a profile's Remove button. This payload is encrypted with the rest of the profile.
Key
Type
Value
RemovalPassword
String
Optional. Specifies the removal password for the profile.

You have found where it is stored in Thunderbird?
Delete it. When Thunderbird needs it again, it will ask you for it.

Can anyone let me know how to install hadoop in mac OS X

Can anyone let me know how to install hadoop in mac OS X

Read http://shayanmasood.com/blog/how-to-setup-hadoop-on-mac-os-x-10-9-mavericks/

Can I let Malwarebyt​es Remove "Vundo" infected psqlpdw.dl​l in c:\windows​\system32 ?

Similar Messages

Maybe you are looking for

Can I let Malwarebytes Remove "Vundo" infected psqlpdw.dll in c:\windows\system32 ?