New Folder.exe (new)

Old New Folder.exe has the effect on the hidden files.
But in the new virus with same name has a property to make the files super hidden
i.e Hide the protected os files.

• It will make Files super hidden
• It will make the files as system files
• It will make the files read only

so some extra efforts are needed with the normal New Folder.exe
read the procedure for New Folder.exe removal at New Folder.exe(old)
and read how to enable the hidden files manually at EnableHiddenFiles



Step 1

Remove the virus by any good anti virus like kaspersky, AVG,Avast.



Step 2

Now Fixing the superhidden open registry editor and navigate to the key

"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
\Advanced\Folder\SuperHidden
And delete the Existing "CheckedValue" of the type "String" and create another one of the same name but of the type "DWORD" and set it's value to "1" Then open "My Computer" and go to: Tools> Folder Options> View> and select "Show hidden files and folders" and Uncheck "Hide protected operating system files".



Step 3

Restart the computer



Step 4

Relax problem solved

New Folder.exe(old) solutions

Removing technique 1:-

I was surprised that my most favourite antivirus Avast, for the first time failed against viruses but then again avg can remove it if the virus is not the latest version .Latest can't be removed by any antivirus . This virus is know popularly as regsvr.exe virus, or as new folder.exe virus and most people identify this one by seeing autorun.inf file on their pen drives, But trend micro identified it as WORM_DELF.FKZ. It is spreading mostly using pen drives as the medium.

Manual Process of removal
I prefer manual process simply because it gives me option to learn new things in the process.

So let’s start the process off reclaiming the turf that virus took over from us.

1. Dissable to read only Options
   1. Search for autorun.inf file. It is a read only file so you will have to change it to normal by right clicking the file , selecting the properties and un-check the read only option
   2. Open the file in notepad and delete everything and save the file.
   3. Now change the file status back to read only mode so that the virus could not get access again.
   4. 
   5. Click start->run and type msconfig and click ok
   6. Go to startup tab look for regsvr and uncheck the option click OK.
   7. Click on Exit without Restart, cause there are still few things we need to do before we can restart the PC.
   8. Now go to control panel -> scheduled tasks, and delete the At1 task listed their.
2. Open GPEDIT if the regedit is dissabled
   1. Click on start -> run and type gpedit.msc(xp professional ) and click Ok.
   2. 
   3. If you are Windows XP Home Edition user you might not have gpedit.msc in that case download and install it from Windows XP Home Edition: gpedit.msc and then follow these steps.
      
   4. Go to users configuration->Administrative templates->system
   5. Find “prevent access to registry editing tools” and change the option to disable.
   6. 
   7. Once you do this you have registry access back.
   8. or visit my post registry is dissable by administratot
      
3. Run the regedit
   1. Click on start->run and type regedit and click ok
   2. Go to edit->find and start the search for regsvr.exe,
   3. 
   4. Delete all the occurrence of regsvr.exe; remember to take a backup before deleting. KEEP IN MIND regsvr32.exe is not to be deleted. Delete regsvr.exe occurrences only.
   5. At one ore two places you will find it after explorer.exe in theses cases only delete the regsvr.exe part and not the whole part. E.g. Shell = “Explorer.exe regsvr.exe” the just delete the regsvr.exe and leave the explorer.exe
4. Search and destroy the virus files as mentioned-
   1. Click on start->search->for files and folders.
   2. Their click all files and folders
   3. Type “*.exe” as filename to search for
   4. Click on ‘when was it modified ‘ option and select the specify date option
   5. Type from date as 1/31/2008 and also type To date as 1/31/2008
   6. 
   7. Now hit search and wait for all the exe’s to show up.
   8. Once search is over select all the exe files and shift+delete the files, caution must be taken so that you don’t delete the legitimate exe file that you have installed on 31^st January.
   9. Also selecting lot of files together might make your computer unresponsive so delete them in small bunches.
   10. Also find and delete regsvr.exe, svchost .exe( notice an extra space between the svchost and .exe)
5. Reboot the system
   1. Now you are done.

Removing technique 2

Use the tools to remove it
there are several tools on the internet some of the links are here
Rapidshare Link to newfolder_killer exe