10/30/08

SPEED YOUR PC


This trick only work on Windows Xp and i did't sure how about Vista. You all can try this and see the different....

Windows with the same view
Windows XP tries to anticipate the preferred way to display files listed in Windows Explorer (thumbnails in My Pictures, simple filenames in My Documents, and so on). If you prefer that all folders be displayed the same way (for instance, showing full details of each file), setting these preferences for each folder can be a drag. But XP lets you set your preferences globally. Go to Start > My Documents, click on the Views icon (to the right of the Search and Folders icons), and select your desired view. Then click on the Tools menu and scroll down to Folder Options. Select the View tab, then click the Apply to All Folders button.

Keep XP to yourself
On your XP-based system, you can grant limited access to someone who needs it for a brief time. Do this by setting up a Guest User account. In Control Panel, double-click User Accounts, then click on Guest (under "pick an account to change") to enable a guest account. The person won't be able to access password-protected files, and won't be able to install or delete programs. When the guest is finished, go through the same steps, but this time select "Turn off the Guest account".

Remember the alphabet
It's hard to believe, but as you add programs to your PC, Windows XP doesn't automatically alphabetise the list of apps it shows when you select All Programs from the Start menu. But you can tell XP to sort them alphabetically by simply right-clicking on a program or folder name in the All Programs list and selecting Sort by Name in the pop-up menu.

Keep your drive tidy
Windows XP has a handy disk defragmentation utility to keep your hard drive humming at optimal speed. You can schedule XP to run it automatically. Choose Performance and Maintenance from the Control Panel and select Scheduled Tasks. Double-click on Add Scheduled Task to launch XP's Scheduled Task wizard. Select Next, click on the Browse button, enter %systemroot%\system32\defrag.exe in the "File name" field and click Open. Select the frequency (weekly is fine) and time of day (when your PC will be on, but ideally when you won't be using it). Make sure the "Open advanced properties..." box is checked, and click on Finish. In the Run box of the advanced properties pane, add the drive letter you want to defrag to the end of the command in the window (be sure to include a space before the drive letter), and click OK.

Have a good feel....

8/23/08

Computer Infected Virus??


Sometimes an inexperienced will not relies their computers are infected with virus. This is because all of the virus can hide among regular file usually in c/windows/system32 (directory of windows systems). Sometimes, the virus can disguise themselves as a standard file and they can create a file that name autorun in your system windows and also other storages. So? How to discover the virus file and how to clean this virus easily from your computers, make sure your pc is safe from virus infection.
There are some situations of effect which indicated that your computer has been infected by virus. Remember that and take care of them, these situation are:
1. Unexpected images or messages are suddenly displayed
2. Unusual sounds or music are played at random
3. Your cd-rom drive are mysteriously open and close
4. Receive a notification from your computer firewall
5. Computers freeze frequently or encounters error
6. Computer slowdown when you start windows or start run new program
7. File or folder have been automatically delete or their contents are change
8. Your hidden file or folder cannot appear
9. Folder option, task manager, registry editor, cmd, run, control panel and other windows components can’t be run perfectly ( appear message ‘task manager has been disable by administrator)
10. Microsoft internet explorer freeze or functionally erratically e.g you can’t close windows or appear nonsense text or name like ‘Virus mawar mengganas!!!’
Sometimes these situations effect because of hardware or software problems and only 20% effect by virus infection. But if you sure your computer are safe from hardware and software problem and I really sure your computer are infected virus.
Below this is a few step can help you to clean the virus easy. If your computers are infected virus you have to try this…..

Delete Virus Files

1. Start menu>click ‘run’> and type ‘CMD’
2. Type these codes below one by one and press Enter

del %windir%\sscviihost.exe /a /f /q
del %windir%\system32\sscviihost.exe /a /f /q
del c:\sscviihost.exe

3. Also delete the files, just replace code “sscviihost.exe” with others code below:

• SCVHSOT.exe
• hinhem.scr
• blastclnnn.exe
• autorun.ini

4. Also find these files and delete it if they are still exist

• C:\WINDOWS\SCVHSOT.exe
• C:\WINDOWS\hinhem.scr
• C:\WINDOWS\system32\SCVHSOT.exe
• C:\WINDOWS\system32\blastclnnn.exe
• C:\WINDOWS\system32\autorun.ini
• C:\Documents and Settings\All Users\Documents\SCVHSOT.exe

Caution!!!!“Do not double click these files, otherwise you have to start from the beginning”

Delete Startup Launch of Virus

Removing autostart entries from the registry prevents the malware from executing at startup.
If the registry entry below are not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.

1. Open Registry Editor. Click Startmenu> click ‘Run’, type ‘REGEDIT’, then press Enter.
2. In the left panel, double-click the following:

HKEY_CURRENT_USER>SOFTWARE>Microsoft>Windows>CurrentVersion>Run

3. In the right panel, locate and delete the entry:

Yahoo Messenger = “%Windows%\SSCVIIHOST.exe”
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Restoring Registry Entries

1. Still in the Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:

HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon

3. In the right panel, locate the entry:

Shell = “Explorer.exe SSCVIIHOST.exe”

4.Right-click on the value name and choose Modify. Change the value data of this entry to:

Explorer.exe

Removing Added Registry Entries

1. Still in the Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:

HKEY_CURRENT_USER>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>WorkgroupCrawler>Shares

3. In the right panel, locate and delete the entry:

shared = “\New Folder.exe”

Deleting the Malware File(s)

1. Click Startmenu then click Find.
2. In the Named input box, type:

*.exe (and delete all files with 245kb size and below)

Hope this will helps you.. have yet to see if the virus attacks again… be careful with registry editor (regedit) because modified or delete the entry that are not suitable can damage your windows operation.
Thank to God…..


8/21/08

How to manually remove viruses!


Have you ever been in the position that you know you have a virus but you don’t have any antivirus? It’s almost impossible to remove it manual without knowing about a few tips and tricks.
After reading this, I’m sure you will know how to manual remove most of the virus lurking around. But that doesn’t mean you shouldn’t have any antivirus on your computer.
I suppose you already know what safe mode is. Press the F8 key some times when you start your machine. You have to do this when your computer is about to start the first windows components before welcome window logo’s appeared in your screen. In windows XP i think you can press space and then F8 when it asks you if you want to go back to previous working setting.
Enough talk about how to start you computer in safe mode, but if you want to manual remove viruses you almost every time have to do this in safe mode because in safe mode most viruses’ doesn’t start and running. Only some few windows file program component is allowed to run in safe mode.
After you start your computer into safe mode, log into administrator and open windows file in local c, search for all viruses in prefetch anf sys32 if you know what the virus file name and where the virus are hiding. After you found all the viruses, delete it manually.
Open the registry editor (click run in start menu type this and ok- ‘regedit’). You must go to the code keys below and add an: in front of the value of the string that you think its the virus. Like this, if string is "virus" and its value is "c:\virus.exe" change its value to ":c:\virus.exe". The: is like commenting out the value. But if you are sure it’s the virus you can just delete the string.
Here are the keys you maybe want to look at:

CODE KEYS:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce


The virus can start itself from some other places to’ win.ini’ is the most common files that viruses can use. So you should find the files named ‘win.ini’ and ‘system.ini’ and look through them and see if you find anything. After that look through the startup folder that is normally located in your profile directory in Start Menu\Programs\Startup and also look at misconfig in control panel under startup tab’s. Other than that, try searching for the virus executable to see if it’s hiding some other place in c/windows/system32.
Finally look through the list of services that window is running. This list is often located under control panel in services of administrator tools. After all the steps above just reboot your computer in normal mode and try to figure out if the virus is still there. If not SUCCESS if yes, try to go back to safe mode and hunt some more or you can use the task manager to stop all viruses programs running example, ‘gethtis.exe, oxbvpen.exe, obex.exe and so on’. After that, search for all virus files in windows/system32 and delete it.If not succes Off course this steps will not work on every virus out there, but many of them.

WARNING: Be careful when in the registry because you can cause serious damage to your system in there.

8/15/08

Detect Hakers Attack


Most computer vulnerabilities can be exploited in a variety of ways. Hacker attacks may use a single specific exploit, several exploits at the same time, a misconfiguration in one of the system components or even a backdoor from an earlier attack.

Due to this, detecting hacker attacks is not an easy task, especially for an inexperienced user. This article gives a few basic guidelines to help you figure out either if your machine is under attack or if the security of your system has been compromised. Keep in mind just like with viruses, there is no 100% guarantee you will detect a hacker attack this way. However, there's a good chance that if your system has been hacked, it will display one or more of the following behaviours.


Windows machines:

Suspiciously high outgoing network traffic. If you are on a dial-up account or using ADSL and notice an unusually high volume of outgoing network (traffic especially when you computer is idle or not necessarily uploading data), then it is possible that your computer has been compromised. Your computer may be being used either to send spam or by a network worm which is replicating and sending copies of itself. For cable connections, this is less relevant - it is quite common to have the same amount of outgoing traffic as incoming traffic even if you are doing nothing more than browsing sites or downloading data from the Internet.

Increased disk activity or suspicious looking files in the root directories of any drives. After hacking into a system, many hackers run a massive scan for any interesting documents or files containing passwords or logins for bank or epayment accounts such as PayPal. Similarly, some worms search the disk for files containing email addresses to use for propagation. If you notice major disk activity even when the system is idle in conjunction with suspiciously named files in common folders, this may be an indication of a system hack or malware infection.

Large number of packets which come from a single address being stopped by a personal firewall. After locating a target (eg. a company's IP range or a pool of home cable users) hackers usually run automated probing tools which try to use various exploits to break into the system. If you run a personal firewall (a fundamental element in protecting against hacker attacks) and notice an unusually high number of stopped packets coming from the same address then this is a good indication that your machine is under attack. The good news is that if your personal firewall is reporting these attacks, you are probably safe. However, depending on how many services you expose to the Internet, the personal firewall may fail to protect you against an attack directed at a specific FTP service running on your system which has been made accessible to all. In this case, the solution is to block the offending IP temporarily until the connection attempts stop. Many personal firewalls and IDSs have such a feature built in.

Your resident antivirus suddenly starts reporting that backdoors or trojans have been detected, even if you have not done anything out of the ordinary. Although hacker attacks can be complex and innovative, many rely on known trojans or backdoors to gain full access to a compromised system. If the resident component of your antivirus is detecting and reporting such malware, this may be an indication that your system can be accessed from outside.

Unix machines:

Suspiciously named files in the /tmp folder. Many exploits in the Unix world rely on creating temporary files in the /tmp standard folder which are not always deleted after the system hack. The same is true for some worms known to infect Unix systems; they recompile themselves in the /tmp folder and use it as 'home'.

Modified system binaries such as 'login', 'telnet', 'ftp', 'finger' or more complex daemons, 'sshd', 'ftpd' and the like. After breaking into a system, a hacker usually attempts to secure access by planting a backdoor in one of the daemons with direct access from the Internet, or by modifying standard system utilities which are used to connect to other systems. The modified binaries are usually part of a rootkit and generally, are 'stealthed' against direct simple inspection. In all cases, it is a good idea to maintain a database of checksums for every system utility and periodically verify them with the system offline, in single user mode.

Modified /etc/passwd, /etc/shadow, or other system files in the /etc folder. Sometimes hacker attacks may add a new user in /etc/passwd which can be remotely logged in a later date. Look for any suspicious usernames in the password file and monitor all additions, especially on a multi-user system.

Suspicious services added to /etc/services. Opening a backdoor in a Unix system is sometimes a matter of adding two text lines. This is accomplished by modifying /etc/services as well as /etc/ined.conf. Closely monitor these two files for any additions which may indicate a backdoor bound to an unused or suspicious port.

Have a nice day with your computer..