Trick To Speed Up Your Boot Process

This trick is used to accelerate the booting process of your computer.

Make booting process of your computer in just 10 seconds is quite simple. For you who already feel too tired to wait in a long time to boot, so the "trick" is worth to try.
Follow the steps bellow:

1. open regedit (press "Windows + R" button on your keyboard), type "regedit" and hit enter.
2. Go to "HKEY_LOACAL_MECHINE\SYSTEM\CurrentControlSet\Control\ContentIndex" and find "Startup Delay" —> double click to change the value, the default is 4800000 (75300: hexadecimal) change to "40000" (decimal format).
3. Open sysedit.exe click on (Start Menu -> Run -> type "sysedit.exe" and click OK), navigate to C:\WINDOWS\SYSTEM.ini.
4. Add "Irq14=4096" <— case sensitive under "[386enh]".
5. Say thanks to hambyah.com

That's all, I hope usefull for you. Bravo Indonesian Bloggers

Repair Damaged NTLDR File

How to repair NTLDR file of our system?

On this opportunity, I'll try to answer thus question. The first I'll tell you what NTLDR is. NTLDR (abbreviation of NT Loader) is the boot loader for all releases of Microsoft's Windows NT operating system up to and including Windows XP and Windows Server 2003.

NTLDR is typically run from the primary hard disk drive, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

When we open our system directory, and we turn on attributes "show hidden files", we will find the NTLDR file. If the file was lost, deleted or corrupted then the computer will display the message "error NTLDR missing press a key to reboot."

To overcome this problem there are many ways, one of them is using windows xp cd. You must enter the Recovery Console by pressing R when the Windows installation screen appears. The difference is the syntax of command when we have entered the command prompt.

At the command prompt type "copy X:\i386\NTLDR C:\" [Press Enter]. The next step is to restart your PC by typing the "Exit" command. Replace "X" on the above example with the drive path of your CD room drive.
Please note, before you start the repair process, make sure you use the same windows CD version when you installed Windows OS on your computer first time.

Actaully, there is software to repair the damaged NTLDR file. I used fixntldr. This program is very easy to use. To download please click this link fixntldr

That's all, I hope it useful for you. Leave your comments please!

Backing Up Hardware Drivers

This trick is about backup, but not backup your "Windows system". Actually, we are talking about backing up hardware drivers.

We all agree that the driver is a necessary application when we install the hardware. Many users often underestimate the presence of a hardware driver because they thought the driver is already installed on their computers.

This is a wrong action. If you want to reinstall your computer operating system and you do not have drivers for your computer hardware, so this will be a complicated issue for you. I'll share you tips to overcome them.
I think you need Drivers Magician.

This application works for backup hardware drivers from your computer. When one moment you need drivers for your computer hardware, you do not have to looking for the original CD or download it from the vendor website. Just click the restore button, and then your hardware is installed properly. Interested to try it, please download here.

Gmail is Blocked? Try These Ways

Blocking email service in an office is an unwise act.

Now, in this post I will share you several tips on how to send email through gmail when the access is blocked by your office network administrator.
You can easily access all of your contact & send mail from your mail id by following tips. No need to think about proxy.

You just need to have a google account. If you didn't have it, you could easily make it by clicking here!

1. Goto this URL http://news.google.co.uk/news?ned=uk (the link beside refer to UK google)
2. You find "Email this Story" on this page. See the screenshot below!
   
   
   
3. Click on "Email this Story" link. Give email address of sender(You can choose email adress from clicking "Contact") in To & enter the message. Then just click on send.Refer to screenshot below.
   
   
   
   Type the required field & Send Mail
4. You have done it.

There is little difference against sending a standard e-mail that you do not just send messages via email, but you also send a news to your friends.

Ok, that's all my post. I hope it will be useful for you. Leave your comments are welcomed...
Bye...

Proxy Server Bypassing via Decimal IP

This trick is used to penetrate the blocked sites. Blocking site usually does by your office network administrator.
Follow the steps bellow:

1. Open command prompt.
Press Windows key + R buttons, type "cmd" and then press "enter" button.
2. Type "ping [address of a blocked site]" and press "enter" button.
Example: ping www.facebook.com. We can see the IP number of this site [facebook] is: 69.63.181.16
3. Enter the IP number to http://www.allredroster.com/iptodec.htm, just click here now.
This step to change the IP number of the object [facebook] into decimal form. [HTTP://1161803024]
4. Copy and paste the new address into your favorite browser.
5. Blocked site has been appeared
6. Thank to CyberMuttaqin.
7. Good luck

Adopted from Jasakom

Hacking Deep Freeze 6

Hacking DF.6 is easier than DF.5. I use Anti DeepFreeze and Uninstall DeepFreeze software.

These tools are used to penetrate deep freeze 6 password.
I thought this tool was better than the previous version (DF.5 crackerpassword). Okay, there are two tools that I will write down:

1. Anti DeepFreeze
Very easy to use, just select the version of Deepfreeze and click the Apply button. Then click the image icon in the taskbar (Ctrl + Shift) while you click the icon.

Keep the password box blank. You will be allowed to enter Deepfreeze configuration panel without anything password.
2. Uninstall Deepfreeze
I thought this was quiet simple tool although use Vietnamese. Click the Login button, until the Login button is not active and the Crack button become active. Then click the crack.

Sign in to DeepFreeze configuration file using Ctrl + Shift + click the icon DF and take over the configurations...
Click to Anti Deep Freeze to download
Special thanks:

1. Jasakom
2. lovepassword

Say thanks to them please,

New iPhone Virus

Sophos, a security company in the field of IT warned of new virus that attacks the iPhone. This virus is most dangerous to date, because it makes an infected iPhone becomes zombies and incorporate them into the botnet.

This virus changes Wallpaper’s victims become a pop star image in the 1980s Rick Astley. This new iPhone worm (informally called a "duh" or "Ikee.B" by Security Researchers) was reported spreading in the wild in the Netherlands, designed to upload banking information to the server in Lithuania and to follow orders from a remote hacker. The "Duh" worm hunts for the iPhone vulnerable to a broader range of IP ranges from Ikee, who only ever reported in Australia. "Duh" including IP ranges in several countries, including the Netherlands, Portugal, Australia, Austria, and Hungary.

"This latest iPhone malware is doubly criminal. Not only does it break into your iPhone without permission, but it also cedes control of your phone to a botnet command server in Lithuania," said Graham Cluley, senior technology consultant at Sophos "That means your iPhone has just been turned into a zombie, ready to download and to perform any commands the cybercriminals might want in the future. If infected, you have to consider all of the data that passes through your iPhone compromised."

Further, Sophos reports that "Duh" changes the password on your iPhone - meaning that cybercriminals know what it is but infected users don't, allowing criminals to log back into your iPhone later. However, Sophos expert Paul Ducklin managed to recover the password - revealing that infected users can login as root with the password 'ohshit'.

"Apple's default root password - 'alpine' - on the iPhone breaks two fundamental rules - it's both a dictionary word and well-known. This doesn't matter for most iPhone users, as they haven't jailbroken their iPhones and installed SSH to allow remote access - but the new worm will break in and immediately change it. This change is made by directly editing the encrypted value of the password in the master password file, so that the new password is never revealed," explained Paul Ducklin, head of technology in Sophos Asia Pacific. "This password-changing represents an additional risk, as it means that cybercriminals now know what your password is - allowing them to log back into your iPhone later - but you don't, so you cannot login and eliminate the virus."

Sophos strongly recommends that all users of jailbroken phones change their passwords from 'alpine' immediately to avoid further attacks.

Huh, be careful... an invisible activity is going to your iPhone...
Adopted from infozine

Netcut Overview

This post was adopted from "all about how to" here.
Hi guys, now I'll tell you a naughty tool which used to disconnect the computers in the network. This is a quiet outrageous but user friendly tool, even for a newbie hacker. It called NETCUT. This tool works in Wi****s OS only, like a trojan that exploiting your system. We can call it a software that might broke the computer system.
These steps will bring you to recognize this tool:

1. Download the NETCUT here
2. Install and run this tool
3. Choose your NIC
4. Scan your network and choose which one is the target
5. Select the target, and then click the "off" button.
6. Re-scan the network…what is happens? The target doesn’t appear anymore?

So, what's the important part about this post? The important part is make sure to hide your hostname and IP address while you in some unsecured connection. This just a prevention method, further you can download the "anti-NETCUT" here.
Suggestion: try to use under Linux OS

Trojan-Downloader.Win32.Agent.ahoe

This Trojan downloads another malicious program via the Internet and launches it on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 9216 bytes in size. It is packed using UPX. The unpacked file is approximately 38KB in size. It is written in C++.

The Trojan downloads files from the following URLs:

http://*****fdujt.info/?44ffa2
http://*****fdujt.info/i.php
http://*****fdujt.info/myh.php

At the time of writing, these links were not working. The files will be saved to the current user’s Windows temporary directory with random names. The Trojan then sends a request to the following address:

http://195.24.77.***/utest/?*****74&oo=2&75f2d3=33985db&ra=0

If the server does not respond, the Trojan will repeat the attempt after six minutes. The Trojan also creates a unique identifier, “S_SERV_v0.66_Beta_erf” to flag its presence in the system.

Deletion Method
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. To remove Trojan-Downloader.Win32.Agent.ahoe, you must first stop any Trojan-Downloader.Win32.Agent.ahoe processes that are running in your computer's memory. To stop all Trojan-Downloader.Win32.Agent.ahoe processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for Trojan-Downloader.Win32.Agent.ahoe, then right-click it and select "End Process" key.
2. To delete Trojan-Downloader.Win32.Agent.ahoe registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\Trojan-Downloader.Win32.Agent.ahoe." Right-click this registry key and select "Delete."
3. Finally, to completely get rid of Trojan-Downloader.Win32.Agent.ahoe, you must manually remove other Trojan-Downloader.Win32.Agent.ahoe files. These Trojan-Downloader.Win32.Agent.ahoe files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, Trojan-Downloader.Win32.Agent.ahoe might create a file like
   %PROGRAM_FILES%\Trojan-Downloader.Win32.Agent.ahoe\Trojan-Downloader.Win32.Agent.ahoe.exe. Locate and remove these files.

Original Source:

1. viruslist
2. spywareremove

Please say thanks to them

How to Kill a Process Using PsKill

pskill to terminate process

This trick is another way to terminate process on your system without TaskManager.
Follow these steps bellow:
1. Open Command Prompt window:
Press the "Start" button on your Taskbar and select the "Run" option. Type "cmd" in the field and then press the "OK" button.

2. Search the unwanted process
When the Command Prompt window is opened, type the command "pslist" and press "Enter" to search processes from the list of running programs.

3.Kill the unwanted process
Once you know the name of the process you want to kill, type the command "pskill [PROCESS_NAME]" and press "Enter" to terminate the unwanted process. For example, if you wanted to kill SpyLocked (a rogue anti-spyware program), you would type pskill spy-locked.exe.

4. Please say thanks to spywareremove

Backdoor.Win32.Clampi.a Removal Procedures

Backdoor.Win32.Clampi.a is a Trojan program created to steal confidential user data and distantly manage the victim's computer.

Backdoor.Win32.Clampi.a is a Windows PE EXE file. The size of Backdoor.Win32.Clampi.a is 470 bytes. Backdoor.Win32.Clampi.a downloads various codes from servers. These codes can be changed or replaced with other malicious codes. It is about 470 bytes in size.
When launched, the Trojan creates the following file:
%AppData%\<name>.exe

<name> is chosen at random from the list below:
dumpreport
msiexeca
svchosts
upnpsvc
service
taskmon
rundll
helper
event
logon
sound
lsas

Trojan adds a link to its executable file in the system registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
“<name2>” = %AppData%\<name>.exe
<name2> is chosen at random from the list below:
CrashDump
svchosts
EventLog
TaskMon
Windows
RunDll
System
Setup
Sound
lsass
UPNP
Init

How to remove?
Step 1 : Use Windows Task Manager to Remove Backdoor.Win32.Clampi.a Processes
Remove the "Backdoor.Win32.Clampi.a " processes files:
%AppData%\<name>.exe
Step 2 : Use Registry Editor to Remove Backdoor.Win32.Clampi.a Registry Values
Locate and delete "Backdoor.Win32.Clampi.a " registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"PID
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"KeyE"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"KeyM"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"GID"
"<name2>" = %AppData%\<name>.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run]

Step 3 : Detect and Delete Other Backdoor.Win32.Clampi.a Files using "Find" on your Windows Eplorer
Remove the "Backdoor.Win32.Clampi.a " processes files:
%AppData%\<name>.exe
That's all, I hope will be usefull for you...
Please say thanks to viruslist and spywareremove

NetWorm Win32.Kido.ih Removing Procedures

On my previous post here, I've told you the characteristic of Win32.Kido.ih. Now, I'll share you how to remove it.
Step by step to remove Win32.Kido.ih manually. Follow the instructions bellow:

1. Delete the registry key from [HKLM\SYSTEM\CurrentControlSet\Services\netsvcs].
2. Delete “%System%\<rnd>.dll” from system registry key value shown below:
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost] "netsvcs".
3. Reboot the system.
Delete the original worm file and it’s copies from the windows location show before.
Delete autorun files and .exe files located in removable storage [usb flash/pen drives].
e.g.
<f>:\autorun.inf
<f>:\RECYCLER\S-<%d%>-<%d%>-<%d%>-<%d%>-<%d%>-<%d%>-<%d%>\<rnd>.vmx

Update your current antivirus databases and perform a full scan of the computer to remove NetWorm Win32.Kido.ih

Some of preventive ways:

1. Try under Linux Operating System...
2. Get the latest update of your antivirus
3. Update your Windows regularly (just for original version)

That's all, I hope useful for you...
Please say thanks to renjusblog

Win32.Kido.ih Characteristic

This is a network worm type. It spreads via local networks and removable storage media. When it copies itself to remote computers, the worm creates a temporary file with a random extension. The program itself is a Windows PE DLL file. The worm components vary in size from 155KB to 165KB. It is packed using UPX.
Installation
The worm copies its executable file with random names as shown below:

%System%\<rnd>dir.dll
%Program Files%\Internet Explorer\<rnd>.dll
%Program Files%\Movie Maker\<rnd>.dll
%All Users Application Data%\<rnd>.dll
%Temp%\<rnd>.dll
%System%\<rnd>.tmp
%Temp%\<rnd>.tmp

<rnd> is a random string of symbols.
You can use Windows Search to find them. Remember to select "Search system folder", "Search hidden files and folders", and "Search subfolders" under More advanced options.

In order to ensure that the worm is launched next time the system is started, it creates a system service which launches the worm’s executable file each time Windows is booted. The following registry key will be created:
[HKLM\SYSTEM\CurrentControlSet\Services\netsvcs]
The worm also modifies the following system registry key value:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"netsvcs" = " %System%\<rnd>.dll"

So, how to remove it?
Just get the latest update of your antivirus...
Or you can manually remove it, see my next post here

Description to Win32/Agent.ab

Win32/TrojanDownloader.Agent.AB trojan is Downloader which is malware.

Installing it is extremely not recommended. This program designed to retrieve and install additional files, when run. Most will be configured to retrieve from a designated web or FTP sites. Ranging from downloaders that can download and run executables without the user's knowledge to simple spyware components. In some cases, for example, when an unsuspecting user enters a webpage that contains code that exploits flaws in certain browsers the malware is automatically downloaded and executed. This malware might download other malware such as spyware and drop a browser helper object. It might even hijack the users machine, interrupt online searches or send out sensitive information, for example a list of the webpages that the user has visited.
Symptoms:

1. The home page address is modified.
2. File signature: %Windows%\temp\phg16189.exe
3. Denied access or redirected when entering certain previously available webpages, usually anti-malware/security related webpages.
4. Unknown entries found in favorites.
5. Internet searches are redirected to another online search engine.

Manual Win32/TrojanDownloader.Agent.AB trojan removal:

• Kill process Windows\temp\phg16189.exe
• Delete file Windows\temp\phg16189.exe

Important notes:
Be sure you get the last update of your antivirus software.
Update your windows regularly using automatic update (just for original version) .
That's all, all of this content have been analyzed before posted. May it useful for you, leave your comments please..