Virus: PC Tips by Anu

Showing posts with label Virus. Show all posts

Friday, January 7, 2011

Some hacks with VB Script...

Friday, January 07, 2011

Anu

Some windows n computer hacks via vb script n you can also say that VB Script Tweaks for fun or hack...

Continue message :

This is a VBs file so of course save as VBS, it gives so many messages…

do
WScript.Echo (“This is JAIMIN WORLD”)
loop

Notepad Hacks :

This is a VBs file so of course save as VBS, you can replace the txt in this code with whatever you want

Keyboards hack :

This is a VBS code that each time you pree the letter “E”, it willclose without saving, the reason “E” was chosen is because E is themost common used letter in the english language.

Open MS Word And Press F11, To Open The MS Vbs Editor. Then input this

Caps lock, Num lock n Scroll lock hack :
we have a code that turns on and off your capslock repeatedly, alsovbs, end same way as last time, this turns on and off your capslockevery tenth of a second until shutdown, or (don’t tell your friends,you press ctrl + alt + delete and go to processes, and end wscript.exe (this code is vbs so save in note pad as whateveryouwant.vbs)

Just replace CAPSLOCK by SCROLLLOCK and NUMLOCK and run it..

CD drive hack :
The first code we are going to look at is one that makes the cdtray open and close repeatedly until shutdown, or (don’t tell yourfriends, you press ctrl + alt + delete and go to processes, and end wscript.exe (this code is vbs so save in note pad as whateveryouwant.vbs)

Thanks...

Powerfull C++ code (Deadly script/code)...

Friday, January 07, 2011

Anu

Wednesday, December 22, 2010

How to check n clean Master Boot Record from viruses?

Wednesday, December 22, 2010

Anu

MBR (Master Boot Record) rootkit infection...

Wednesday, December 22, 2010

Anu

Intro

It is a rootkit-type infection.

This malware steals confidential information, particularly passwords and bank details.
It will be necessary to change passwords after disinfection and check with your bank that nothing unusual happened.

Method: Gmer

Download HERE
Turn off your antivirus and cut the connection.
Double-click mbr.exe.
A report will be generated: mbr.log
In cases of infection, this message MBR rootkit code detected will appear in the report.
In the Start Menu> Run, type:

"%userprofile%Bureaumbr" -f

In mbr.log this line appears: the original MBR restored successfully!
You can post the report to get some help on the Forum.

Restart mbr.exe to check that the infection is no longer present and the new report should no longer find rootkit.

Example report uninfected:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net      

device: opened successfully      
user: MBR read successfully      
kernel: MBR read successfully      
user & kernel MBR OK

Under Vista and Seven, do not forget to start mbr.exe right-click and Run as administrator.

Method: Recovery Console and fixmbr

You need to have in your possession the Windows CD.
Start on the Windows CD.
Start the Recovery Console as explained here.
Once the Recovery Console, type the following command:

fixmbr deviceharddisk0

And validate by [Enter] key on your keyboard.

Method: Combofix

To all readers:

- This software is used as prescribed by a qualified and trained helper to the tool.
- Do not use outside of this scenario: dangerous!

Right click here.
Choose: Save target as
Choose the Desktop as the destination.
In the "File Name", rename ComboFix.exe to pctipsbyanu.exe example, then save.
Warning! The renaming stage is mandatory under penalty ofdisplaying the message "ComboFix.exe is not a valid win32 application"and thus make it completely unnecessary and inefficient.
Disconnect from the Internet and close all applications and programs running.
Double-click pctipsbyanu.exe to start the fix (Vista and Seven: right-click and choose "Run as administrator").
Accept the warning message and accept the installation of the Recovery Console (in XP).
The report will be created under the root: C:Combofix.txt

Example of infection found by Combofix:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net      

device: opened successfully      
user: MBR read successfully      
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys ACPI.sys hal.dll atapi.sys spzt.sys >>UNKNOWN [0x86F80938]<<      
kernel: MBR read successfully      
detected MBR rootkit hooks:      
DriverDisk -> CLASSPNP.SYS @ 0xf7749f28      
DriverACPI -> ACPI.sys @ 0xf7422cb8      
Driveratapi -> atapi.sys @ 0xf739fb40      
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8      
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8      
DeviceHarddisk0DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8      
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8      
NDIS: Broadcom NetLink (TM) Gigabit Ethernet -> SendCompleteHandler -> NDIS.sys @ 0xf72b5bb0      
PacketIndicateHandler -> NDIS.sys @ 0xf72a4a0d      
SendHandler -> NDIS.sys @ 0xf72b8b40      
user & kernel MBR OK

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net      
device: opened successfully      
user: MBR read successfully      
kernel: MBR read successfully      
MBR rootkit code detected !      
malicious code @ sector 0x12a14c0 size 0x1ad !      
copy of MBR has been found in sector 62 !      
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

Sample of disinfection report:

(((((((((((((((((((((((((((((((((( PC Tips by Anu
Other deletions )))))))))))))))))))))))))))))))))))))))))))))))))
\ \. \ PhysicalDrive0 - bootkit Sinowal WAS found and disinfected
\ \. \ PhysicalDrive0 - bootkit Sinowal WAS found and disinfected
.
(((((((((((((((((((( PC Tips by Anu 2010-11-18 to 2010-12-18
Files created between 2010-11-18 and 2010-12-18 ))))))))))))))))))))))))))))))

Method: Bootkit Remover

Download and unzip Bootkit Remover to the desktop.
Download BTKR_Runbox on the desktop.
- Note that: You must have the remover.exe and BTKR_Runbox.exe on the desktop for tool works correctly.
Start BTKR_Runbox then select option 3
Confirm by pressing "1" then [Enter]
The PC will restart. After reboot, restart BTKR_Runbox by selecting option 1
If the procedure worked well, it should be written " OK [DOS/Win32 Boot code found] "

Method: MBRCheck

Download MBRCheck on the desktop.
Close all applications.
Follow the instructions, you'll be prompted to restart the PC.
If you get this:
- Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Press the Y key and validate using the [Enter] key
You should get this:

Options:     

[1] Dump the MBR of a physical disk to file.     

[2] Restore the MBR of a physical disk with a standard boot code.     

[3] Exit.

Choose option [2]

You will get this:
- Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel):
- The disk number to use is 0
From now on you will have to chose between several MBR codes:
- Available MBR codes:

[ 0] Default (Windows XP)     

[ 1] Windows XP     

[ 2] Windows Server 2003     

[ 3] Windows Vista     

[ 4] Windows 2008     

[ 5] Windows 7     

[-1] Cancel

Type the number corresponding to your operating system and confirm with [Enter]
Then you will have this:
Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue:
You should have this message:
Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue: Successfully wrote new MBR code!

..followed by "Please reboot your computer to complete the fix."

Restart your PC and post the report generated on the appropriate forum.
Following this, restart MBRCheck that would normally tell you "Windows XX (XX is your version of Windows) MBR code detected".

Method: ZhpFix

If you used ZHPDiag and infection of this type is detected, as shown in the following report:

---\\ Search infection Master Boot Record (O80)    
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net    
Run by Sabrina at 28/06/2010 18:29:00    
device: opened successfully    
user: MBR read successfully    
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8410A328]<<    
kernel: MBR read successfully    
detected MBR rootkit hooks:    
\Driver\atapi -> 0x8410a328    
Warning: possible MBR rootkit infection !    
copy of MBR has been found in sector 0x05D267C0    
malicious code @ sector 0x05D267C3 !    
PE file found in sector at 0x05D267D9 !    
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.    
Use "ZHPFix" command "MBRFix" to clear infection !

Start ZHPFix from the desktop shortcut ( under Vista and 7: runas administrator mode) or from ZHPDiag that contains the shortcut toZhpFix (an icon located at the top)
Click MBRfix located on the right side of the screen ,
Click 'No' to the message that appears on the screen,
Leave the tool work
At the end of treatment, a report is displayed
You can post the report on the appropriate forum.
Restart the PC for the modifications to be taken in consideration and check with ZHPDiag that the infection is no more.

Method: Antiboot from Kaspersky

The whole procedure is described here.

Other methods

Online Scan

To verify that nothing remains, it is better to do an online scan of your computer:

Thanks...

Tuesday, December 21, 2010

How to fix/remove/clean Viruses in/from Windows?

Tuesday, December 21, 2010

Anu

Viruses. They happen to almost everyone. If they don’t happen toyou, it’ll be your cousin Stan who get joins the malware-of-the-monthclub, and you’re the only person he knows who can fix a computer. Theproblem is, things are so screwed up that Windowswon’t even start properly. And if it does, the virus has embeddeditself so deeply that you can’t access the files and tools you’d needto remove it. Enter Linux. By booting from a Linux Live CD or USB, youcan remove the offending programs manually or with a Linux-basedanti-virus program. This guide will cover creation of a bootable USBLinux system as well as a comparison of the antivirus software options.

Choosing a Linux Distro

Thereare a few criteria to look at when deciding exactly which to go with.We’ll want something fairly small, runs well from USB, auto-detectslocal hard drives, and able to work with a persistence file so we cansave our new programs and updates directly to the USB stick.
I’d recommend Crunchbang Linux.It meets all of the above criteria, it’s Ubuntu-based, and it’s just avery slick distro that would work well for this purpose. Also,whichever distro you decide, choose the 32 bit option. Your computermay be 64-bit ready but Cousin Stan’s might not, and we need thissoftware to be as portable as possible.

Installing Linux to USB

This is a topic we’ve covered before at MakeTechEasier, for Windows with Lili USB Creator and Linux with UNetbootin.
Ofthe two, I’d actually recommend Lili, the Windows software, to createyour USB stick. Lili makes it easy to create a persistence file so yourchanges can be saved on the USB stick so you won’t have to reinstalland update your AV every time you use it.

Linux Antivirus Software

Anumber of commercial and independent AV vendors make Linux versions,with various amounts of hassle and levels of functionality. A few ofthe more well known ones include…

Name	License	Registration Required	Scan	Repair
AVG	Closed	No	Yes	No
Avast	Closed	Yes	Yes	Yes
Panda	Closed	Yes	Yes	Yes
ClamAV	Open	No	Yes	Yes

We’ll be using Clam Antivirus because it’s the simplest install,requires no registration, and does an excellent job of detecting andremoving infected files. It should be available for download for justabout any Linux system from the Clam website or your distro’s online repositories. Ubuntu users can also install it by clicking here.

Running the Scan

Forstarters, you’ll want to run an update once Clam is installed so thatour scan will have the newest virus definitions. To do this, open acommand prompt and run

sudo freshclam

Whilethere is a GUI called Clamtk available for download, we’ll be using thecommand line interface. This is because Clamtk lacks some of theconfiguration options that we’ll be passing to the antivirus.
Torun the scan we’ll need to know a few things. First is the locationthat you intend to scan. If you’re scanning a Windows drive from a liveLinux system as intended, you can find this by clicking that drive fromthe left pane of your file browser and looking at the path shown in theaddress bar.
linuxantivirus-drivelocation

Then we’ve got a few options we may want to pass to Clam regarding how to perform the scan. Some options worth considering are:

-r                   #perform recursive scan - good for a whole drive
--exclude=.mp3       #set exclusion pattern to skip things like music and videos
--scan-mail=yes/no   #include mail files in system scan
--remove=yes/no      #delete infected files, yes or no.  Careful with this.

So when you’re ready, your full command will look something like this:

clamscan -r --exclude=.avi --remove=yes /media/disk

When all’s said and done, you’ll get a fairly detailed report.
linuxantivirus-scansummary

If all went well, you’re set until next time Stan clicks a popup.

Thanks

Sunday, November 7, 2010

How to make a trojan horse?

Sunday, November 07, 2010

Anu

Most of you may be curious to know about how to make a Trojan or Virus on your own. Here is an answer for your curiosity. In this post I’ll show you how to make a Trojan on your own usingC programming language. This Trojan when executed will eat up the harddisk space on the root drive (The drive on which Windows is installed,usually C: Drive) of the computer on which it is run. Also this Trojanworks pretty quickly and is capable of eating up approximately 1 GB ofhard disk space for every minute it is run. So, I’ll call this as SpaceEater Trojan. Since this Trojan is written using a high levelprogramming language it is often undetected by antivirus. The Trojan isavailable for download along with the source code at the end of thispost. Let’s see how this Trojan works…
Before I move to explain the features of this Trojan you need to know what exactly is a Trojan horseand how it works. As most of us think a Trojan or a Trojan horse is nota virus. In simple words a Trojan horse is a program that appears toperform a desirable function but in fact performs undisclosed maliciousfunctions that allow unauthorized access to the host machine or createa damage to the computer.

Now lets move to the working of our Trojan
TheTrojan horse which I have made appears itself as an antivirus programthat scans the computer and removes the threats. But in reality it doesnothing but occupy the hard disk space on the root drive by justfilling it up with a huge junk file. The rate at which it fills up thehard disk space it too high. As a result the the disk gets filled up to100% with in minutes of running this Trojan. Once the disk space isfull, the Trojan reports that the scan is complete. The victim will notbe able to clean up the hard disk space using any cleanup program. Thisis because the Trojan intelligently creates a huge file in the WindowsSystem32 folder with the .dll extension. Since the junk file has the .dll extentionit is often ignored by disk cleanup softwares. So for the victim, thereis now way to recover the hard disk space unless reformatting his drive.

The algorithm of the Trojan is as follows
1. Search for the root drive
2. Navigate to WindowsSystem32 on the root drive
3. Create the file named “spceshot.dll”
4. Start dumping the junk data onto the above file and keep increasing it’s size until the drive is full
5. Once the drive is full, stop the process.

You can download the Trojan along with it’s source code HERE.

How to compile, test and remove the damage?

Compilation:
You can use Borland C++ compiler (or equivalent) to compile the Trojan.

Testing:
To test the Trojan, just run the SpaceEater.exefile on your computer. It’ll generate a warning message at thebeginning. Once you accept it, the Trojan runs and eats up hard diskspace.

NOTE: To remove the warning message you’ve to edit the source code and then re-compile it.

How to remove the Damage and free up the space?
To remove the damage and free up the space, just type the following in the “run” dialog box.

%systemroot%system32

Now search for the file “spceshot.dll“. Just delete it and you’re done. No need to re-format the hard disk.

Thanks

Tuesday, September 7, 2010

How to disable Autorun feature of CDs/DVDs?

Tuesday, September 07, 2010

Anu

Sunday, September 5, 2010

How to protect your Computer from Hacker, Viruses and any other malicious softwares?

Sunday, September 05, 2010

Anu

Malicioussoftware, known as malware, affects many computers that are connectedto the Internet. Malware can get onto your computer without yourknowledge and cause it to become unreliable and slow. Malware oftenmakes itself known by opening unwanted windows and displayingadvertisements, but it also runs invisibly in the background. Malwaremight monitor and report on your Internet usage, send your privatefiles to people on the Internet, or even delete your data.

Malware falls into two broad categories:

1.	Viruses, worms, and Trojan horses.These types of software are clearly bad and offer no value to the user.Typically, the software either tricks the user into installing it ortakes advantage of a security vulnerability to install itself.
2.	Spyware and adware.These types of software might offer some value, such as the ability totrade files with other people on the Internet. However, they might alsodo things you don't want, such as monitor your Web usage, display ads,or install other software. Often this category of malware installsitself without your knowledge and is difficult to remove.

To protect yourself from malware, you need to do several things for every computer in your home:

•	Keep your software up to date.To prevent malware from taking advantage of software vulnerabilities inWindows and other programs, Microsoft and other software companiesregularly release updated software. Make sure to install the updates.You can set up Microsoft Windows XP to install updates automatically.
•	Install antivirus software to protect your computer from viruses, worms, and Trojan horses.
•	Install antispyware software to protect your computer from spyware and adware.

Anotherthing you can do to protect all the computers in your home is toinstall a router. A router is a networking device that goes betweenyour computer and the Internet. One of the functions of a router is toprovide protection with a firewall, which automatically blocks manyattacks from the Internet. If you have a wireless network or more thanone computer connected to the Internet, you probably already have arouter. If you're using Windows XP and have installed the necessary updates,you have a built-in firewall enabled by default. However, the firewallin the router is still useful because it provides an additional layerof protection (known as "belt-and-suspenders" protection).

Install antivirus software

Viruses,along with worms and Trojan horses, are types of malicious softwarethat install themselves on your computer without your knowledge. Thenthey attempt to replicate themselves to other computers across theInternet. Some viruses make your computer crash, delete your files,prevent your computer from starting, or expose your personalinformation to attackers on the Internet. Viruses are designed to hidethemselves from you, so they are difficult to find and remove.

Withoutantivirus software, there's a good chance your computer will beinfected by a virus. Antivirus software is different from other typesof software, because it must be updated often to detect and block newviruses that are released daily. Typically, you purchase an annualsubscription to use antivirus software and receive updates.
Most new computers come with antivirus software, so you might already have it installed.

To determine if you already have antivirus software installed on your computer

1.	Click Start, and then click Control Panel.
2.	From the Control Panel, click Security Center.

IfSecurity Center shows that Virus Protection is turned on, thenantivirus software is installed. However, this doesn't guarantee thatyou are protected. Open your antivirus program and make sure:

•	Your subscription is up to date.
•	Updates are set up for automatic download.
•	The program is set up to automatically scan your computer weekly.

If these three conditions are met, you are already protected from viruses. You can now install antispyware software.

However, if Security Center shows that Virus Protection is Not Found or that your antivirus subscription has expired, then purchase and install an antivirus program such as Windows Live OneCare. Many other software vendors also offer antivirus software.

Like : NORTON, QUICK H.....

Virus Protection Not Found warning

Install antispyware software

Spywareis a type of malware that can change your personal settings, sendinformation about your browsing habits to marketing companies, insertextra advertisements in Web pages, or perform other unwanted taskswithout your knowledge. Typically, spyware installs itself without yourpermission and hides on your computer. It's a program, but it might notappear in your All Programs group or in Add/Remove Programs. In fact,spyware might be installed on your computer right now without your evenknowing it.

Toprevent spyware from being installed, and to remove spyware that isalready on your computer, you need antispyware software. Antispywaresoftware searches your computer for signs that spyware is installed andthen gives you the option of uninstalling it. This is a challengingtask, because new spyware appears every day. Therefore, the people whomake antispyware software have to constantly identify new spyware,create new definitions to enable their software to find and remove thespyware, and then distribute the updated definitions to you. A numberof antispyware programs are available for download and require nosubscription fee.

If you use Microsoft Windows 2000 or Windows XP, you can download Microsoft Windows Defenderat no cost. Windows Defender is a powerful and easy-to-use tool foridentifying and removing most spyware installed on your computer.Windows Defender automatically downloads new updates, so it is alwaysready to protect your computer from newly released spyware.

Windows Defender Warning message

Youcan also use Windows Defender to find and remove spyware that hasalready been installed, so it's never too late to protect yourself fromspyware.

Windows Defender status screen

I think that this information is usefull for you.......

Wednesday, August 4, 2010

How to auto execute a program at Start-up & How to STOP them?

Wednesday, August 04, 2010

Anu

Where do things load from?
How do you stop them?
A program can be loaded at startup from various places. By knowing where these are located, you have more direct control over them. How to edit and control startup program launching is different in Windows XP than in Windows 2003 and Vista, primarily due to the innovation in Win98 of MSCONFIG.EXE.

In the instructions below, the programs MSCONFIG, SYSEDIT, and REGEDIT each can be launched by clicking Start, then Run, typing in the program name, and clicking OK.

Locations that control startup loading of programs include the following:

The CONFIG.SYS and AUTOEXEC.BATfiles.

Launch SYSEDIT and examine the AUTOEXEC.BAT and CONFIG.SYS files.
At machine startup, configuration steps in CONFIG.SYS and command lines listed in AUTOEXEC.BAT will execute.

For more information on individual MS-DOS or command prompt commands, open a DOS or command prompt window and type the individual command followed by /?.

For more information on special batch file commands, see the Batch File Commands article on this site. You can temporarily suspend any line of this file by placing REM (followed by a space) in front of the line.
QUIRKS by QUIRKE: South African Windows watchdog, Chris Quirke, has alerted me to a strange Windows quirk I never knew about. In Win95/98, COMMAND.COM launches not “Autoexec.bat” per se but, rather, the simple command AUTOEXEC. This means that the usual command line launching rules apply so that a .BAT file is first sought (AUTOEXEC.BAT) but, if one isn’t found, the OS next will look for AUTOEXEC.COM and, thereafter, AUTOEXEC.EXE! On the one hand, this is a useful trick; on the other hand, it’s an especially useful trick for malware designers!
In Windows Millennium Edition, the MSCONFIG method, or editing AUTOEXEC.BAT and CONFIG.SYS with Notepad, are your only options unless you migrate SYSEDIT.EXE to your system.
In Windows XP, the only option is to edit AUTOEXEC.BAT (if it exists) with Notepad.

THE WINSTART.BAT FILE

The WINSTART.BAT file in Windows 95 and 98 loads TSR programs required for Windows-based programs but not needed in MS-DOS sessions. This file, if it exists, is usually in the C:\Windows folder, and is executed every time Windows starts — just like AUTOEXEC.BAT, except that AUTOEXEC.BAT is also launched during a DOS startup. You can examine and edit the contents of WINSTART.BAT with Notepad. You can temporarily suspend any line of WINSTART.BAT by placing REM (followed by a space) in front of the line. (Note that this is ignored in all other versions of Windows, since there is no need to differentiate MS-DOS session behavior.)

THE STARTUP FOLDER

This is usually located at C:\Documents and Settings\All Users\Start Menu\Programs\Startup.
However, it may be at a different location on your computer. You can view the Startup folder in Windows Explorer by clicking the appropriate link (immediately above) if you have used the default; or you can view it by clicking Start | Programs | StartUp.
In Windows, you also can suspend the action of individual startup programs by launching MSCONFIG, clicking the Startup tab, and unchecking the box of any startup items you want to suspend.

You can freely delete any items in this folder without risking modifying or damaging any existing programs, because everything in this folder is a shortcut. (It doesn’t have to be. You can put an actual program or batch file here. But, almost always, it’s a shortcut.)

The actual program is somewhere else. (You must, of course, know how to create a new shortcut if you want to restore it in the future.)

You also may want to remove them to a different (storage) folder. (Disabling them with MSCONFIG actually moves them to a separate folder titled Disabled Startup Items.)

NOTE: In Windows XP there normally is an additional Startup folder for each user account. These are found by going to C:\Documents and Settings, clicking the folder for the particular user name, and navigating down through Start Menu and Programs folders to the individual Startup folder. Please note that a number of the points made in this article may have multiple elements in a multi-user environment.

The location of the folders that Windows treats as the Startup folder (including the individual user profile’s Startup folder) is stored in the Startup key of

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

and the Common Startup key of

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

THE WIN.INI FILE

WINDOWS XP NOTE: I have not seen WIN.INI used Windows XP for startup purposes. However, Microsoft continues to include WIN.INI in their XP Help and Support instructions for Selective Startup troubleshooting, so it may still be in use in addition to the Registry key mentioned immediately below.
In Windows XP, launch SYSEDIT and examine the WIN.INI file. In the first section (titled [windows]), look for any files beginning with LOAD= or RUN=. These are executed at startup. (Empty LOAD= or RUN= lines do not launch anything.)
You can temporarily suspend these by placing a semi-colon in front of the line.

In Windows Millennium Edition and Windows XP, the MSCONFIG method, or editing WIN.INI with Notepad, are your only options (unless you migrate SYSEDIT.EXE to your Windows ME system).

In Windows 2000 and XP, the LOAD= and RUN= items are usually stored, instead, in the Registry key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

— this (at least generally) replaces the WIN.INI file in those operating systems. Some viruses and parasites exploit this key; see Common Loading Points of Threats in Windows NT/2000/XP.

THE WININIT.INI FILE

In Windows 2000 and XP, the WININIT.INI file, if existing, will be executed. However it is usually replaced by the “PendingFileRenameOperations” sub-key in the Registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager

REGISTRY KEYS

The following Registry keys may contain items to execute at launch.

******************************************************

WARNING: Do not edit the Registry directly without first backing it up. For Registry backup recommendations, see Registry Patches.

******************************************************

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Additionally, the

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key

(on Windows NT, 2000, and XP, and Server 2003 systems) has a Userint item which normally points to the perfectly legitimate and important program C:\WINDOWS\system32\userinit.exe.

However, other programs can be made to launch from the same key by appending them to the legitimate value data, separated by a comma.
Please note that in Win XP, these items will appear on the Startup tab of MSCONFIG along with items in the StartUp folder. You can most safely and most easily disable them by unchecking the box in front of them. Also, please note that some items may appear twice in these Registry keys, and thus twice on MSCONFIG’s Startup tab.

For some items — such as power management and TweakUI — this is normal, and both are needed for normal functioning. (They do different jobs, at different stages of system startup.) Some other duplicates may, in fact, be unnecessary.
It is not possible to give a complete list, in advance, of all possible examples.

If there are duplicates that are truly unnecessary, the simplest way to get rid of them is to be sure that both are checked, click OK to close MSCONFIG, and reboot the computer.

DRIVER FILES

Driver files (.VXD files) are also loaded at system startup in Windows. These are primarily loaded from the following locations:

• The SYSTEM.INI file in the the [386enh] section (edit with SYSEDIT or MSCONFIG).

• The following Registry keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\VxD

• In Windows ME, on the Static VxDs tab of MSCONFIG.

SERVICES in WINDOWS XP

In addition to the foregoing, in Windows XP you should examine the Services that are automatically launched at startup. You can see these by pressing Ctrl+Alt+Del, then clicking the Processes tab, or by launching the Services management tool that you will use to modify them.
To launch the Services tool, log in as an Administrator, then click

Start | Control Panel | Performance & Maintenance | Administrative Tools | Services.

(Note that this Control Panel item is simply a shortcut, which you can copy to your desktop or anywhere else you want it.) Even faster, from a Run box (click Start | Run or press Win+R) type SERVICES.MSC.

By default, Windows initiates many Services you just don’t need. For example, if you aren’t on a network, there are at least half a dozen Services that should be set to Manual rather than Automatic — meaning, they still can be launched, but will not launch automatically at Windows startup.

MORE HIDDEN LOADS...

Here, is a list of some non-startup loading mechanisms:
1. Network logon processes (e.g., Novell Client)
2. Tasks, both time-based and event-based (e.g., associated with on network login, or executed by a task scheduler)
3. Magic-name dropper attacks (e.g., AutoRun.inf)
4. File infection (what a true “virus” does)

There are several other possibilities which, however, come under the heading of malware detection more than the simpler topic to which this page is dedicated, viz., a general user’s management of their startup process.
For example, we could go into topics of file substitutions (dropping a malicious or alternate program onto the computer to replace one with a known name, e.g., replacing ScanDisk), or the well-known use of the SHELL= line in SYSTEM.INI to launch more than one program. These are well-known to malicious hackers, virus developers, etc.
There are still other startup locations that have not been mentioned here because, according to security experts I know, they haven’t yet been used in malware attacks, and don’t really have any practical use for the typical user.
I do hope, however, that this page helps you control what programs your computer does, and does not, load at startup.

WHAT SHOULD I LOAD?

Okay, now you know how to control what loads at Windows startup. But, what should you let Windows load? Often, there are so many programs or features that come pre-installed on a computer, or automatically launched by Windows — most of them with obscure, abbreviated names — that it is hard to know what to enable and what not to enable. Since these startup items lower the baseline of available System Resources in Windows, it is advisable to only load those programs at startup that you have to, and that you want to — and get rid of the rest!

After that TUTORIAL, i think that you can easily autorun your programs at logon and also disable some malwares on your pc.

Thursday, July 15, 2010

TUT : ANSI Bombs

Thursday, July 15, 2010

Anu

The image “http://vxheavens.com/lib/img/ajt/fig3.gif” cannot be displayed, because it contains errors.

Of course, ANSI bombing isn't as dangerous as a lot of people make it out to be, but bombs are still fun to make and with a little planning deliver some degree of success.
ANSI bombing can be dangerous, so I am tired of hearing people say that an ANSI bomb is harmless, another misconception I hope to clear up.
Now, most people that have spent time experimenting with ANSI bombs probably know most of the material in this file, but it might be fun just to read anyway.

ANSI codes, including those that redefine keys, are sent over the
lines, but most comm programs don't use ANSI.SYS; they use their own version of ANSI, which doesn't support key redefinition. Some people might have a program that supports it, but I haven't seen it yet.

I have tested bombs on systems on my own and proved to myself that they don't work.

I have also seen people fuck up bombs that would have worked by uploading them in a message.

ANSI bombs are dangerous when put into zips. I haven't really tested this out much, but from what I hear with the newer versions of PKZIP, you have to specify that you want to see ANSI comments when unzipping. It is unlikely that you would waste your time unzipping something again after seeing "Format C:" in the middle of an escape code.

VANSI.SYS will protect your system from key redefinition. Maybe the newer versions don't support key redefinition, but mine sure as hell does. There are pro grams out there that don't support it, but I don't know any of the names. Of course, if I were you, I would be wary about using some thing other then ANSI. I have a few friends that are working on "A Better ANSI" for PDers, which, instead of being better, really screws them over.

Now, in case you haven't read my other file (it's called ANSI.DOC,
kind of lame but fairly informative), I'll briefly go over the structure of an ANSI bomb.
Skip this part if you know what an ANSI bomb is and how to make one.

In ANSI everything is done with a system of escape codes. Key
redefinition is one of those codes. (From now, whenever I say ESC, I really mean the arrow, ). Here is a basic command:

ESC [13;27p

This would make the key (13 is the code for enter) turn
into the key (27 is the code for escape). The always has to be there, as do the bracket and the "p", but what is between the
bracket and the "p" is up to you. The first number is always the key
that you want to be redefined. If there is a zero for the first num
ber, that means the key is in the extended set, and therefore, the
first two numbers are the code.
The bracket signifies the beginning of the definition, and the "p" signifies the end. Whenever you want a key pressed, you have to use it's numerical code (i.e. 13 is the code for ). You can't redefine strings, but you can redefine a key to become a string (i.e. ESC [13;"Blah"p would make say "Blah").
Strings must be inside of quotes, which includes commands that you want typed on the DOS prompt (i.e. ESC [13;"Del *.*";13p would delete everything in the directory, note that 13 stands for Enter in this case, not the redefinition).
An escape code can have as many commands as you want in it, but each one has to be separated by a semi-colon. You can only redefine one key in each escape code, so if you want to redefine another key, you have to start another escape code.
That's about it when it comes to bombs, now that you have the basics, all you really need is a little imagination.

TIPS AND TRICKS

A. The Y/N Redefinition

Now, here's a simple but fun little ANSI bomb:

ESC [78;89;13p ESC [110;121;13p

Basically, all this does is turn a capital "N" into "Y" and a
lower-case "n" into "y". Alone this doesn't do too much, except for screw around with what they are typing. On the other hand, try adding this line of code to the ANSI bomb:

ESC [13;27;13;"del *.*";13p

Most people would automatically press "N" when they see "Del *.*", but when they do, they will be screwed over. This portion of a bomb is very useful when it comes to making good bombs.

B. Screwing with the Autoexec.bat

Here is another line of code that you may find useful in future
bombing projects:

ESC [13;27;13;"copy bomb.ans c:\";13;"copy con
c:\autoexec.bat";13;"type bomb.ans";13;0;109;13;"cls";13p

This line of code makes the bomb a little more permanent and a
little more dangerous. It copies the bomb into the root directory,
then it change/creates the autoexec.bat, so the bomb is typed after
every boot-up. Of course, the person could just boot off a disk, but
I'm sure this would get them a few time. It could also probably
appear as though it were a virus, scaring the shit out of the owner of
the computer.

C. Turning Commands into Other Commands

One of the best pranks to do to someone using an ANSI bomb is to
redefine commands. That way if they type in "copy", it will turn into "Del *.*". Since you can't actually change the whole string, you have to take a different approach. You have to change a few of the keys, so when typed, they type and execute the desired command. I guess it would be coolest to have to command exactly the same length; that way you could redefine one key at a time to obtain the desired effect.
It doesn't really matter how you do it, just as long as it works. You
might make an ANSI that says "Wow, check out what this bomb did to your directory", and then have it redefine the keys, so when they type in "dir", it turns into "del". I think you get the idea.

D. Trojans

By now, everybody knows what a Trojan is. You probably wouldn't
think so, but ANSI bombs can be used as Trojans and in Trojans.

First, if you are planning on crashing a board, but you're not very good at programming, then make yourself an ANSI bomb. Try to find out in which directory the main files for running the BBS are stored. They are usually under the name BBS or the name of the software, like WWIV or Telegard. Then, make a bomb that either just deletes all the files in that directory, or if you want the board to be down a longer time, then make one that formats the Hard Drive. In this form ANSI bombs, if they are well planned out, can be easy to make Trojans.

Second, ANSI bombs can used in Trojans.
This is probably stretching it a little, but say you wanted to write a Trojan that would delete a directory, every time you typed a certain key, then you could use an ANSI bomb. First make some batch and com/exe files that would search for protecting programs like Norton and turn them off. Then you could copy the file into the root directory, along with your versions of autoexec.bat, config.sys, ANSI.sys, and whatever else. (To make it look more realistic make the files Resource.00x to trick the user, then when copying, use the real name). Then somehow lock the computer up or do a warm boot through some pd program, which is easily attain able. When the computer loads back up, you can screw that shit out of them with your ANSI bomb.

It would seem to some people that ANSI bombs are very dangerous,
and to others that they are stupid or lame. Personally, I think that
ANSI bombs are just plain old fun. They're not too hard to make, but there is a lot that you can do with them. They are nowhere near as malicious as virii, so if you're looking for unstoppable destruction,
look elsewhere, but they do serve their purpose. I know that there
are programs out there that help you program ANSI bombs, but I think that they kind of take the fun out of them.
Probably, some day soon, I'll quit making ANSI bombs and start looking more into virii and pure Trojans. But for now, ANSI bombs suit my purpose.

-TRG

Key Code Program
Here is a small program, which I find very helpful. After loading
it up, it tells you the numeric code for every key you type in. Special means that it is in the extended set and therefore uses zero, and "q" ends the program.
Unfortunately, I can't take any credit for this program.
It is in Pascal and can be compiled in most Turbo Pascal compilers.

    Use CRT;
    Var
      CH : CHAR;
    Begin
      Repeat
        CH := ReadKey;
        If CH = #0 then
          Begin
            CH := ReadKey;
            WriteLn(CH,'(Special) - ',ORD(CH));
          End
        Else
          WriteLn(CH,' - ',ORD(CH));
      Until
        CH = 'q';
    End.

Thanks.

Wednesday, July 14, 2010

Restore Task Manager, Regedit, Folder Option, RUN and many more System Tools that are Disabled by Viruses

Wednesday, July 14, 2010

Anu

http://ricomoss.files.wordpress.com/2009/04/problem-solved.jpg

Let’s face it.
All of us have been infected by virus before. Even if you have anti-virus installed, you can still be infected by a new or custom virus that is not recognized by your anti-virus.
Sometimes after removing the virus completely from our system, you’ll face new problems such as you can no longer bring up Windows Task Manager from CTRL+ALT+DEL. You get the error message saying “Task Manager has been disabled by your administrator”.

Task Manager has been disabled by your administrator

You think that it’s easy to fix this problem by going to Registry Editor but you can’t! You get the error message “Registry editing has been disabled by your administrator“.

Registry editing has been disabled by your administrator

Folder Options and even Show Hidden Files & Folder is disabled! How frustrating! Don’t worry, here’s how to restore your Windows Task Manager, Registry Editor, Folder Options and Show hidden files & folders.
This problem is most commonly caused by a virus called “Brontok“. Brontok virus will make some changes to the system restrictions in order to hide itself from easy detection and also from easy cleaning.
Here’s a free tool called Remove Restrictions Tool (RRT) which is able to re-enables all what the virus had previously disabled, and gives you back the control over your own computer.

Restore windows restrictions

Remove Restrictions Tool is able to re-enable:

- Registry Tools (regedit)
- Ctrl+Alt+Del
- Folder Options
- Show Hidden Files
- Task Manager
- RUN Command
- No Search
- No Display
- Windows Update
- IE Home Page Change
- IE Closing
- IE Internet Option
- IE Address Bar
- Execution Debugger
- IE Navigator Button
- IE Right Click Menu
- IE Toolbar
- CMD Prompt
- Control Panel
- System Files and Folders
- Hidden Files Check
- System Files Check
- Show All Files Check
- Show Desktop Icons
- Hide File Extension
- File Extension Check
- Corrupted Safe Mode
- Shutdown Command
- Settings Folder
- Taskbar Context Menu
- Logoff Command
- Start Menu Logoff
- Add/Remove Programs
- File Extension Default
- No Windows Update
- R-Media Malware
- Hidden Drives
- Restricted Drives
- Internet Connection Sharing
- Windows Security Center

Small and easy to use. Make sure you boot in to Safe Mode to use Remove Restrictions Tool (RRT). Just click on the buttons and it’ll do it’s job.

DOWLNOAD RRT

Comment on this post if you like it....

Tuesday, June 29, 2010

BAT : Virus Maker

Tuesday, June 29, 2010

Anu

Blog Archive

Popular Posts

Friday, January 7, 2011

Wednesday, December 22, 2010

Check MBR for viruses

Intro

Method: Gmer

Method: Recovery Console and fixmbr

Method: Combofix

Method: Bootkit Remover

Method: MBRCheck

Method: ZhpFix

Method: Antiboot from Kaspersky

Other methods

Online Scan

Tuesday, December 21, 2010

Choosing a Linux Distro

Installing Linux to USB

Linux Antivirus Software

Running the Scan

Sunday, November 7, 2010

How to compile, test and remove the damage?

Tuesday, September 7, 2010

Sunday, September 5, 2010

Install antivirus software

Install antispyware software

Wednesday, August 4, 2010

Thursday, July 15, 2010

Wednesday, July 14, 2010

Tuesday, June 29, 2010

Followers

Facebook

Networked Blogs