Your best source of information and news about hardware, microsoft and windows vista on the internet

January 5th, 2009

You are currently browsing the articles from MS Windows Vista Compatible Software written on January 5th, 2009.

How to remove Windows 7 , Windows Vista and Windows Server 2008 Watermark from Desktop

In Windows Vista, Windows 7 and Windows Server 2008, there are several watermarks the may appear on the corners of desktop to remind what mode or state of Windows operating system is currently running in. For example, “Evaluation Copy” for unactivated Windows, “For testing purpose only” for beta or release candidate software, “Test Mode” when test signing mode is turned on, and “Safe Mode” when user presses F8 to boot into Safe Mode.

Download RemoveWatermark

Current Version: V0.3 released at 2008.12.10
Download Link 1: RemoveWatermark_20081210.zip
Download Link 2: RemoveWatermark_20081210.zip

Note that the ZIP package contains two RemoveWatermark executables, namely RemoveWatermarkX86.exe (for 32-bit x86 system) and RemoveWatermarkX64.exe (for 64-bit x64 system). Run the corresponding program as administrator. There is no need to reboot to Safe Mode as the program can operate in normal mode.

After successful patching and modification, restart the computer for the change to take effect. The original user32.dll.mui (all watermarks is stored in this file) is renamed and backed up to user32.dll.backup. Thus, in the event of any error, and when you decide to restore to original desktop, just go to \Windows\System32\[language folder] to rename back the user32.dll.backup to user32.dll.mui.[Via Digital Life]

And, there is another hack to remove Send Feedback link on window’s title bar.

Written by ShaDow on January 5th, 2009 with no comments.
Read more articles on Windows 7 Tips and otherSoftware and Windows vista tips.

Manual Removal of Win32.Agent.wvu Trojan-Dropper

Manual Removal of Win32.Agent.wvu Trojan-Dropper.
W32/Agent.WVU is a trojan. The trojan will infect Windows systems.
This trojan first appeared on January 5, 2009.
Other names of W32/Agent.WVU Trojan:
This trojan is also known as W32.Spybot.Worm, Backdoor.Win32.Agent.wvu.
Damage Level : Medium/High
Distribution Level: Unknown
No Removal Tool for Win32.Agent.wvu Trojan-Dropper
Trojan Manual Removal Instructions

Recommend Removal from Safe Mode:

How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • %Temp%\1
  • %ProgramFiles%\CNNIC
  • %ProgramFiles%\CNNIC\Cdn
  • %ProgramFiles%\CNNIC\Cdn\Images
  • %Temp%\1\cdn.dll
  • %ProgramFiles%\CNNIC\Cdn\cdnaux.dll
  • %ProgramFiles%\CNNIC\Cdn\cdnforie.dll
  • %ProgramFiles%\CNNIC\Cdn\cdnprh.dll
  • %System%\cdnprot.dat
  • %System%\drivers\cdnprot.sys
  • %ProgramFiles%\CNNIC\Cdn\cdnunins.exe
  • %ProgramFiles%\CNNIC\Cdn\cdnup.exe
  • %ProgramFiles%\CNNIC\Cdn\cdnvers.dat
  • %ProgramFiles%\CNNIC\Cdn\idnconvs.dll
  • %Temp%\1\setup.exe
  • %ProgramFiles%\CNNIC\Cdn\src.dat
    • Above Files under Programfiles also Copied to %Temp\1\

    [ FXSTALLER.EXE can also use the following File Names ] 04172258.DAT, 59465376.DAT, BBPHOTO[1].EXE, PACK.EXE, 03932762.EXE, FXSTALLER.MSNFIX, LACOSTES.EXE, ERASEME_78156.EXE, MARINA[n].COM, LACOSTES(n).EXE, LACOSTES[n].EXE, 26863612.COM, 39847305.EXE, 15451429.EXE, 76765953.EXE, HOUSEGIRL.EXE, STH4NSBA.EXE, DD1.EXE, HOUSEGIRL.COM, 39026582.EXE, 11162921.EXE, 40619004.COM, HACKEDMSN.EXE, HACKEDMSN[n].COM, BURIMI.EXE, 96195105.EXE, 60362081.DAT
    The following file size has been seen:
    37,376 bytes, 52,786 bytes
    , 39,936 bytes, 44,554 bytes, 60,938 bytes, 48,690 bytes

    • If you have any of these files in running process from task manger, end the process before removal.
    • Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
    • Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Trojan Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, and then continue with the removal.Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]

The Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\COMMAND
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\DISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\HINT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\IDN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\KW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\RIGHT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE\AUTOUPDATE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE\COLLECT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE\POPUP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CdnClient
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZSXZ
HKEY_LOCAL_MACHINE\SOFTWARE\CNNIC
HKEY_LOCAL_MACHINE\SOFTWARE\CNNIC\CdnClient
HKEY_LOCAL_MACHINE\SOFTWARE\CNNIC\CdnClient\Common
HKEY_LOCAL_MACHINE\SOFTWARE\CNNIC\CdnClient\Display
HKEY_LOCAL_MACHINE\SOFTWARE\CNNIC\CdnClient\InstallInfo
HKEY_LOCAL_MACHINE\SOFTWARE\CNNIC\CdnClient\RunAct
HKEY_LOCAL_MACHINE\SOFTWARE\CNNIC\CdnClient\Update
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cdnprot
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cdnprot\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cdnprot\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdnprot
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdnprot\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdnprot\Enum
HKEY_CURRENT_USER\Software\CNNIC
HKEY_CURRENT_USER\Software\CNNIC\CdnClient
HKEY_CURRENT_USER\Software\CNNIC\CdnClient\Restore

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}\VersionIndependentProgID
(Default) = “CdnForIE.IEHlprObj”HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}\ProgID
(Default) = “CndForIE.IEHlprObj.1″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}\InprocServer32
(Default) = “C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll”
ThreadingModel = “Apartment”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}
(Default) = “CdnForIE Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}\TypeLib
(Default) = “{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}”
Version = “1.0″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}\ProxyStubClsid32
(Default) = “{00020424-0000-0000-C000-000000000046}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}\ProxyStubClsid
(Default) = “{00020424-0000-0000-C000-000000000046}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C3853CD-C7E0-4946-B3FA-1ABDB6F48108}
(Default) = “IIEHlprObj”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0\0\win32
(Default) = “C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0\HELPDIR
(Default) = “C:\PROGRA~1\CNNIC\Cdn\”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0\FLAGS
(Default) = “0″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5C3853CE-C7E0-4946-B3FA-1ABDB6F48108}\1.0
(Default) = “CdnForIE 1.0 Type Library”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj\CurVer
(Default) = “CndForIE.IEHlprObj.1″
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj
(Default) = “CndForIE Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj.1\CLSID
(Default) = “{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}”
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CdnForIE.IEHlprObj.1
(Default) = “CndForIE Class”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\RIGHT
HKeyRoot = 0×80000001
RegPath = “Software\Microsoft\Internet Explorer\MenuExt\Access Internet Keyword”
Type = “checkbox”
CheckedValue = 0×0000007F
DefaultValue = 0×0000007F
UncheckedValue = 0×00000000
Text = “Right click add “access Internet Keyword”"
ValueName = “Contexts”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\KW
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000001
UncheckedValue = 0×00000000
Text = “Enable Internet Keyword”
ValueName = “EnableKw”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\IDN
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000001
UncheckedValue = 0×00000000
Text = “Enable Chinese Domain Name”
ValueName = “EnableIdn”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\HINT
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000000
UncheckedValue = 0×00000000
Text = “Display hints under the address bar”
ValueName = “EnableAddrHint”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\DISPLAY
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000001
UncheckedValue = 0×00000000
Text = “Display Keyword in the Address Bar Droplist”
ValueName = “EnableKwDisp”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW\COMMAND
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000000
UncheckedValue = 0×00000000
Text = “Activate Chinese Domain Name Command Line Support”
ValueName = “EnableIdnCmdEx”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE\POPUP
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000001
UncheckedValue = 0×00000000
Text = “Auto-update when new version is detected”
ValueName = “EnableTaskPopup”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE\COLLECT
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000000
UncheckedValue = 0×00000000
Text = “Permit the system to collect users’ records”
ValueName = “EnableCollect”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE\AUTOUPDATE
HKeyRoot = 0×80000001
RegPath = “SOFTWARE\CNNIC\CdnClient\Console”
Type = “checkbox”
CheckedValue = 0×00000001
DefaultValue = 0×00000001
UncheckedValue = 0×00000000
Text = “Pop up news information”
ValueName = “AutoUpdate”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\UPDATE
Bitmap = “C:\WINNT\system32\inetcpl.cpl,4497″
Text = “Update”
Type = “group”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT\IDNKW
Bitmap = “C:\WINNT\system32\inetcpl.cpl,4497″
Text = “Chinese Domain Name and Internet Keyword”
Type = “group”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CDNCLIENT]
Bitmap = “C:\WINNT\system32\inetcpl.cpl,4497″
Text = “Chinese Navigation”
Type = “group”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}
Default Visible = “Yes”

Modified Registry Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
SearchAssistant=”http://client.jogo.cn/cdn/browser/sidesearch/sidesearch-en.html”
CustomizeSearch=”http://client.jogo.cn/cdn/browser/customsearch/customsearch-en.html”

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find
, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Written by FireFly on January 5th, 2009 with 1 comment.
Read more articles on Win32.Agent.wvu Trojan-Dropper and fxstaller.exe and W32/Agent.WVU and manual removal and removal of trojan and otherSoftware.

Manual Removal of W32/Agent.WVU Trojan

Manual Removal of W32/Agent.WVU Trojan.
W32/Agent.WVU is a trojan. The trojan will infect Windows systems.
This trojan first appeared on January 5, 2009.
Other names of W32/Agent.WVU Trojan:
This trojan is also known as W32.Spybot.Worm, Backdoor.Win32.Agent.wvu.
FXSTALLER.EXE has been seen to perform the following behavior:
The Process is packed and/or encrypted using a software packing process
Automatically changes your firewall settings to allow itself or other programs to communicate over the internet
Disables the Windows Built in Firewall enabling rogue processes to access the internet without your knowledge or permission
Disables the Windows Security Center Service
Disables Windows Automatic Updates including Security Updates and Patches
Executes a Process
Writes to another Process’s Virtual Memory (Process Hijacking)
Adds a Registry Key (RUN) to auto start Programs on system start up
This Process Deletes Other Processes From Disk
This process creates other processes on disk
Creates system tray popups, messages, errors and security warnings
Opens browser pop ups
The Process is polymorphic and can change its structure
Registers a Dynamic Link Library File
Can communicate with other computer systems using HTTP protocols
Executes Processes stored in Temporary Folders

FXSTALLER.EXE has been the subject of the following behavior:
Added as a Registry auto start to load Program on Boot up
Created as a process on disk
Has code inserted into its Virtual Memory space by other programs
Executed as a Process
Terminated as a Process
Copied to multiple locations on the system
Created as a new Background Service on the machine
Deleted as a process from disk
Executed by Internet Explorer
Executed from Temporary Folders
Damage Level : Medium/High
Distribution Level: Unknown
No Removal Tool for W32/Agent.WVU Trojan
Trojan Manual Removal Instructions

Recommend Removal from Safe Mode:

How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal
  • %Windows\fxstaller.exe
  • %Temp%\ixp000.tmp\aa.exe
  • %Temp%\ixp000.tmp\buri.exe
  • %Temp%\ixp000.tmp\burimi.exe
  • %Temp%\ixp000.tmp\fapack.exe
  • %Temp%\ixp000.tmp\image.exe
  • %Temp%\ixp000.tmp\pa.exe
  • %Temp%\ixp000.tmp\pack.exe
  • %Temp%\ixp000.tmp\pr.exe
  • %Temp%\ixp000.tmp\test.exe
  • %Temp%\ixp001.tmp\burimi.exe
    [ FXSTALLER.EXE can also use the following File Names ] 04172258.DAT, 59465376.DAT, BBPHOTO[1].EXE, PACK.EXE, 03932762.EXE, FXSTALLER.MSNFIX, LACOSTES.EXE, ERASEME_78156.EXE, MARINA[n].COM, LACOSTES(n).EXE, LACOSTES[n].EXE, 26863612.COM, 39847305.EXE, 15451429.EXE, 76765953.EXE, HOUSEGIRL.EXE, STH4NSBA.EXE, DD1.EXE, HOUSEGIRL.COM, 39026582.EXE, 11162921.EXE, 40619004.COM, HACKEDMSN.EXE, HACKEDMSN[n].COM, BURIMI.EXE, 96195105.EXE, 60362081.DAT
    The following file size has been seen:
    37,376 bytes, 52,786 bytes
    , 39,936 bytes, 44,554 bytes, 60,938 bytes, 48,690 bytes

    • If you have any of these files in running process from task manger, end the process before removal.
    • Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
    • Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
Trojan Entries Manual Removal From Registry
Click Start, Run,Type regedit,Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
  • Download this UnHookExec.inf, and then continue with the removal.Save it to your Windows desktop. Do not run it at this time, download it only.
  • After booting into the Safe Mode or VGA Mode
  • Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]

The Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

W32.Spybot.Worm Entries
Delete the Following Keys
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BoolTern
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_BOOLTERN
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\rdriv
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_RDRIV
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
In the right pane, reset the original value, if known:
“EnableDCOM” = “N”
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
In the right pane, reset the original value, if known:
“DoNotAllowXPSP2″ = “1″
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\
parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
In the right pane, reset the original values, if known:
“AutoShareWks” = “0″
“AutoShareServer” = “0″

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
In the right pane, reset the original value, if known:
“restrictanonymous” = “1″
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger
In the right pane, reset the original value, if known:
“Start” = “4″

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
RunOnce
HKEY_CURRENT_USER\Software\Microsoft\OLE
In the right pane, delete any values that refer to the file names that were detected.

Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find
, enter Keyword and remove all value that find in search.

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Written by FireFly on January 5th, 2009 with no comments.
Read more articles on W32/Agent.WVU and fxstaller.exe and manual removal and removal of trojan and otherSoftware and run and Windows.

Windows 7 : Activate Windows 7 by Frakenbuild Activation Crack

Frakenbuild Activation Crack to Activate Windows 7 - Early Windows Vista adopters should still remember the native hack to activate Windows Vista by using the free product key from beta or RC phase after replacing two activation related files namely pkeyconfig.xrm-ms and tokens.dat with beta or RC editions. Microsoft then cracked down on the these frankenbuild activation crack method in new WGA update, effectively forces hackers to move to better Windows Vista crack method.

The crack works due to Microsoft allows Windows 7 Build 6801 to be activated with Windows Vista Beta or RC keys. As such, the pkenconfig.xrm-ms and tokens.dat (in Safe Mode) from Windows 7 Build 6801 are extracted and been used to replaced the original files in Windows 7 Build 7000, and then users can activate Windows 7 with J7PYM-6X6FJ-QRKYT-TW4KF-BY7H9 Vista CPP product key. Via [Digital Life]

More Info : Frakenbuild Activation Crack

Written by ShaDow on January 5th, 2009 with no comments.
Read more articles on Windows 7 Activation and otherSoftware.

Windows 7 Trials Released

In a move that has been christened to save the face of the mess that Windows Vista has left, Windows 7 has been pre-released for trial to some programmers before its actual release in the market within the year. Windows Vista has gotten nothing but negative reviews and apparently Microsoft wants to erase that notion by improving the new Windows 7 as much as possible.

The pre-release is actually a tactic to get the initial feedbacks from the computer geeks themselves. They are the best option to solicit the possible problems that Windows 7 has right now, learning their lesson well from the debacle that Vista has created.

Windows 7, which analysts say is a streamlined version of Vista, is expected to play nicely with most of the computers in the market. That should make the software an easier sell as the sour economy leaves companies and consumers less inclined to replace computers.

Indeed, if the Windows 7 lives up to the expectations and makes use of the flaws that Vista obviously showed, then perhaps consumer confidence on the new Microsoft operating software can be established. There are a lot of disappointed computer users out there and Microsoft has to start somewhere if they want to once again win their approval for the best operating software to be used today.

Source

Written by PC Freak on January 5th, 2009 with no comments.
Read more articles on windows 7 and otherSoftware and Desktops and News and Windows XP and Microsoft and Windows Vista.

What Is SMB?

Years ago, Microsoft and IBM came up with the SMB (Server Message Block) protocol to compete with Novell's IPX-based file and print sharing. Though it's hard to believe now, there was a time when pretty much all corporate networks were running IPX and Novell Netware servers. The relatively few home networks were running IPX, while military and research networks used TCP/IP. SMB was the first protocol to run over multiple network protocols: TCP/IP, NetBEUI, and IPX/SPX. In other words, an SMB server could replace a Novell server without need of changing the rest of the network infrastructure. The promise was that of an open system—one where any server that could speak SMB could serve any SMB-speaking clients, over any of several network protocols. Bear in mind, though, that this promise would go pretty much unfulfilled for quite some time. The only servers that spoke SMB were OS/2 and MS Windows. When OS/2 failed to gather much market share, Joe User was left with an "open" solution that was available from only one vendor.

Note, as well, that this "open" solution (which, to the best of my knowledge, was never marketed as such) had nothing for Unix users. SMB was strictly PC stuff, and PC stuff was shunned by Unix users as being too dinky, too underpowered, and incapable of running a "real OS." As MS Windows quickly became a de facto standard, so did the SMB protocol. Users began using MS Windows' built-in (SMB) file and print sharing to offer new levels of data sharing. When Windows 95 came along, it got even easier. Using the standard GUI approach, anyone with a mouse and a finger to click it could set up file shares, shared printers, password-protected shares, and even drive mappings. Gone was the need for the arcane batch files required by earlier versions of Windows and by contemporary versions of Novell Netware. So today, we are left with a single great divide: the Microsoft, PC, SMB world, on the one hand, and the Unix, big iron, NFS world on the other. So what are the differences? There are quite a few, and we'll start by looking at naming.

Every machine on a Windows network is identified by a NetBIOS name, which is similar to a Linux hostname. NetBIOS names are at most 15 characters and are case-insensitive. Unlike hostnames, they also contain a resource-type byte, which describes the role or roles of the machine on the network. Multiple names and multiple types can be associated with a single physical machine. As an example, here is a listing of the NetBIOS names associated with the primary Linux box on my home network:

HOMER <00> - B
HOMER <03> - B

HOMER <20> - B

__MSBROWSE__ <01> - B
WORKGROUP <00> - B
WORKGROUP <1d> - B

WORKGROUP <1e> - B

The NetBIOS names are on the left, and the hex value of the resource-type byte is shown in angle brackets. Type <00> means a standard workstation, type <03> means a WinPopup service, and type <20> means a file and print server. So my computer HOMER advertises itself as a workstation and a file server and as capable of receiving WinPopup messages.

The other name, __MSBROWSE__, is Microsoft's way of identifying a domain master browser. A master browser is responsible for periodically checking what machines and shares are available on a network and caching that information. Then when another computer wants to "explore" the network, it needs to ask only the master browser what is available instead of doing a network-intensive broadcast request.

What about the WORKGROUP entries? These describe the workgroups, or domains, to which my machine belongs. I only have one workgroup on my network, WORKGROUP, and HOMER advertises itself as a workstation (type 00) in that domain. The other two lines refer to the machine's role as a master browser.

Every machine that understands SMB advertises itself as providing certain services. These services do not have to be limited to file sharing; in a typical Windows network they include print sharing, remote administration capabilities, popup messaging, and other features. Every service has a name unique to the machine where it is offered. On a network, a service is identified with the following syntax:

\\machine-name\service-name

This notation is called the universal naming convention (though it's hardly universal!). Since backslashes are shell metacharacters under Linux, most of the Samba utilities will conveniently accept UNCs using forward slashes and automatically convert them to backslashes as necessary.

On a Windows file server, any directory can be defined as the root of a file-sharing service. There is no dependence on the physical layout of the file system, and the directory being shared can itself be connected to a file share on a third machine. All subdirectories of the file-sharing root are accessible through a share. Access to a share is controlled both by the permissions on the share and by the permission on the underlying file system, if applicable.

A Windows print share allows network access to a locally connected printer. The service does not provide drivers for a printer, only the ability to send a pre formatted print job from a remote machine. As a result, if you intend to use a Windows printer from a Linux machine, you must have Linux drivers available to generate the appropriate control language for the printer. The Ghostscript package is included with most Linux distributions, and it provides a wide variety of filters to convert PostScript to proprietary printer-control languages. A list of directly supported printers and third-party-supported printers are available at the Ghostscript Web site.

On my machine KEARNEY, for example, the following services are available. We'll see how to list these services in the next section.

\\KEARNEY\CDROM maps to E:\
\\KEARNEY\ZIPLIB maps to D:Ziplib\
\\KEARNEY\CANON print service for a Canon BJ-200
\\KEARNEY\IPC$ special OS service

Source of information : Addison Wesley - Multitool Linux - Practical Uses for Open Source Software

Written by magakos on January 5th, 2009 with no comments.
Read more articles on otherSoftware and Linux.

« Older articles

No newer articles