Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

IIM Ranchi website ( www.iimranchi.in ) hacked or not ?

Lot of tweets saying that IIM Ranchi website is hacked. But when i checked the ower of this site, its showing a name Ashish Kumar. i have attached some print screens of my findings. Go through that. Who is the real owner ?

Who is info for
www.iimranchi.in
Domain ID:D4062215-AFIN
Domain Name:IIMRANCHI.IN
Created On:26-Feb-2010 05:32:28 UTC

Last Updated On:27-Feb-2010 05:20:57 UTC
Expiration Date:26-Feb-2011 05:32:28 UTC

Sponsoring Registrar:101domain, Inc. (R115-AFIN)
Status:TRANSFER PROHIBITED
Registrant ID:RWG00000000069ED
Registrant Name:Ashish Kumar
Registrant Organization:n/a
Registrant Street1:G-2, Block 1
Registrant Street2:Express garden
Registrant Street3:
Registrant City:Ghaziabad
Registrant State/Province:
Registrant Postal Code:201301

Registrant Country:IN
Registrant Phone:+91.9958018000

Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email: gudda64@gmail.com

Source : who.is




GA tracking code Details of www.iimranchi.in



_______________________________________


GA tracking code Details of www.manishwebsite.com







Net-Worm.Win32.Kido virus Remover

If you are connected with a network and if any PC in the network attacked with Win32.Kido virus, sometimes your Kaspersky Internet security notifies you this message, “Intrusion.Win.NETAPI.buffer-overflow.exploit! Attacker IP address: xxx.xxx.xxx.xxx. Protocol/service: TCP on local port 445.” and access to that computer is blocked.

The name of this virus is “Net-Worm.Win32.Kido” virus. When a PC attacked with this virus, it tries to access other PCs through network at port 445.

Methods of disinfection:

To remove this virus from the attacked PC, just follow the following steps:

* Download and install the patch from Microsoft that covers the vulnerability

http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx
http://www.microsoft.com/technet/security/bulletin/ms08-068.mspx
http://www.microsoft.com/technet/security/bulletin/ms09-001.mspx

* Restart the PC.

* Download the archive KK_v3.4.6.zip and extract the contents into a folder on the infected PC.
Download : http://data2.kaspersky.com:8080/special/KK_v3.4.6.zip


* Then run KK.exe.

* Wait until the scan is complete.

* At last restart the PC.

Remember that, showing the message “Intrusion.Win.NETAPI.buffer-overflow.exploit” is not the problem of that PC, rather it is the problem of another PC on the network.

Recent Security Updates - Microsoft Office 2007

Security Update for Microsoft PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for the 2007 Microsoft Office System (KB969559)
Security Update for the 2007 Microsoft Office System (KB969613)
Security Update for the 2007 Microsoft Office System (KB974234)
Security Update for the 2007 Microsoft Office System (KB972581)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for the 2007 Microsoft Office System (KB973704)
Update for Microsoft Office InfoPath 2007 (KB976416)
Security Update for Microsoft Office Outlook 2007 (KB972363)

How to delete autorun.inf virus from usb



If your computer infected with autorun virus, you will get an open with wizard when you double click on a drive. you can manually delete the autorun.inf file using following steps
Microsoft released patch to prevent Autorun Virus


First you Restart your computer to safe mode !

Open command prompt ( Go to Start >> RUN and type CMD)

Go to the drive. ("cd e:" - use your drive letter )

Go to the root directory (cd \ )

then change the attributes of the autorun file

attrib -h -r -s autorun.inf

-h = remove Hidden property
-r = remove Read only property
-s = remove System file property

Now you delete the file

del -h -r -s autorun.inf

Only open that drive after the restart.

Thats it ....


list of free online Anti virus scanners

Unwise.exe Virus Removal Tool

Unwise_.exe Virus affected in internet browsing. That virus blocked all sites and Run that Virus in computer running process. Below are manual removal instructions for unwise.exe so you can remove the unwanted file from your PC. Always be sure to back up your PC before you modify anything.

Use Windows Task Manager to Remove unwise.exe Processes

  1. To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
  2. Click on the “Image Name” button to search for ” unwise.exe” process by name.
  3. Select the ” unwise.exe” process and click on the “End Process” button to kill it.

Use Windows File Search Tool to Find unwise.exe Path

  1. Go to Start > Search > All Files or Folders.
  2. In the “All or part of the the file name” section, type in ” unwise.exe” file name(s).
  3. To get better results, select “Look in: Local Hard Drives” or “Look in: My Computer” and then click “Search” button.
  4. When Windows finishes your search, hover over the “In Folder” of ” unwise.exe”, highlight the file and copy/paste the path into the address bar. Save the file’s path on your clipboard because you’ll need the file path to delete unwise.exe in the following manual removal steps.

Registry Clearing

Take START then Command Prompt–>Type regedit then Click OK.After one window open .Click on Ctrl+F and type umwise_.exe.Click Search Button and all (unwise_.exe)entries deleted.

Detect and Delete Other unwise.exe Files

  1. To open the Windows Command Prompt, go to Start > Run > cmd and then press the “OK” button.
  2. Type in “dir /A name_of_the_folder” (for example, C:\Spyware-folder), which will display the folder’s content even the hidden files.
  3. To change directory, type in “cd name_of_the_folder”.
  4. Once you have the file you’re looking for type in del “name_of_the_file”.
  5. To delete a file in folder, type in “del name_of_the_file”.
  6. To delete the entire folder, type in “rmdir /S name_of_the_folder”.
  7. Select the ” unwise.exe” process and click on the “End Process” button to kill it.
Prevent Virus infections through removable medias

cannot login to Linksys WAP54G with Google Chrome

 

WAP54G

I just tried to configure My Linksys WAP54G Wi-Fi,
As per the documentation the
Default ip address is 192.168.1.245 and the
Default password is "admin"
Remember there is no user name

I gave 192.168.1.1 to my Pc. Its started pinging 192.168.1.245, also getting the authentication window in the browser 

I tried to login with password "admin", but it is not login , Many times i tried to login. but failed. I was using Google Chrome. at last i tried with Firefox browser and its login successfully.

So peoples who use Google chrome, please don't panic in this type of scenarios. just try with other browser.

For your information ……

How to disable admin shares ? c$ d$

Do you know your drive is shared by default. this sharing will not show the sharing icon in the drive. this sharing is known as  administrative shares.

you can access the shares them with a $ sigh.

for example

path to access the C drive of  a pc with ip 192.168.0.1 is as follows

\\192.168.0.1\c$

If you are running pc with a blank password. anyone can access your drive.

Permanently disable the the admin shares by editing the registry. check the following values

 

Windows NT 4  Server, 2000 Server, Windows Server 2003

Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareServer
Data Type: REG_DWORD
Value: 0




Windows NT 4 Workstation, 2000 Professional, Windows XP


Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareWks
Data Type: REG_DWORD
Value: 0

Tor allow Access to blocked sites anonymously

Tor logo

Tor is a free application which is using for anonymous communication on the internet. Tor stands for The Onion Router. Tor Working with Onion routing technology. Onion routing is a technology for anonymous communication.

In this network all the users will work as a router. when you send a request to a server the Tor will encrypt the packet with many layers. Each Onion Routers removes a layer of encryption and send to another Onion Router. Tor also protect its users against traffic analysis attacks
So you can use Tor as a Anonymous Proxy, You can bypass firewall / proxy with Tor. Surf restricted sites with Tor just like Ultrasurf. go to www.torproject.org for more details.

how tor

If you are a proxy user you have to give the details in setting tab

tor application

Download Tor


Also Try Ultrasurf as a proxy

Steps to Prevent from Fake antivirus software scams

10 Steps to prevent Fake antivirus

1. Use Firefox as your browser rather than Internet Explorer.

2. Keep your computer updated with the latest anti-virus and anti-spyware software, and be sure to use a good firewall.

3. Never open an email attachment unless you are POSITIVE about the source.

4. Do NOT click on any pop-up that advertises anti-virus or anti-spyware software, especially a program promising to provide every feature known to mankind. (Also remember: the fakes often mimic well-known brands such as Grisoft AVG, Norton and McAfee.)

5. If a virus alert appears on your screen, do NOT touch it. Don't use your mouse to eliminate or scan for viruses, and DON'T use your mouse to close the window. Instead, hit control + alt + delete to view a list of programs currently running. Delete the "rogue" from the list of running programs, and call your computer maker's phone or online tech support service to learn if you can safely use your computer.

6. Do not download freeware or shareware unless you know it's from a reputable source.

7. Avoid questionable websites. Some sites may automatically download malicious software onto your computer.

8. Reset your current security settings to a higher level.

9. Although fake software may closely resemble the real thing, it's rarely an exact match. Look for suspicious discrepancies.

10. Check out this list of rogue/fake anti-virus and anti-spyware products.


List of rogue / fake antivirus / anti spyware products


Advanced Cleaner[3]
AlfaCleaner
AntiSpyCheck 2.1
AntiSpyStorm
AntiSpywareBot [4]
AntiSpywareExpert
AntiSpywareMaster
AntiSpywareSuite
AntiSpyware 2008 XP
Antivermins
Antivirgear
Antivirus 2008
Antivirus 2009
AntiVirus Gold [5]
Antivirus Master
Antivirus XP 2008 [6]
Awola 6.0
Brave Sentry
BestsellerAntivirus
Cleanator
ContraVirus
Doctor Antivirus
DriveCleaner [7]
Disk Knight
EasySpywareCleaner
Errorsafe
free-viruscan.com
IE Antivirus
IEDefender
InfeStop
KVMSecure
MacSweeper
MalCrush 3.7
MalwareCore
MalwareAlarm
Malware Bell 3.2
Microsoft AntiVirus
PCSecureSystem [8]
PC Antispy [9]
PC Clean Pro [10]
PC SpeedScan Pro
PestTrap [11]
Perfect Cleaner
PAL Spyware Remover
PCPrivacytool
PC-Antispyware
PSGuard
SecurePCCleaner
Security toolbar 7.1
SpyAxe [12]
Spy Away
SpyCrush
Spydawn [13]
SpyGuarder
SpyHeal
Spylocked [14]
SpySheriff [15]
SpySpotter
Spyware Cleaner
Spyware Quake [16]
Spyware Stormer
SpywareStrike
Spy-Rid
SpyWiper
System Live Protect [17]
SystemDoctor
TrustedAntivirus
TheSpyBot
UltimateCleaner
VirusHeat
Virus Isolator
VirusProtectPro
VirusRanger
Vista Antivirus 2008
WinAntiVirus Pro 2006
WinFixer [18]
WinSpywareProtect
WorldAntiSpy
XP Antivirus
XoftSpySE
Zinaps 2008


Prevent from rogue Fake antivirus software scams

Antivirus2008 removal instructions - fake antivirus

Antivirus2008 removal instructions - fake antivirus

Antivirus 2008 is not an Antivirus software. It is a malware . Its attacking computers via internet. Antivirus2008 is distributed through malicious websites that sell other fake anti spyware tools as well.

Antivirus2008 is an unreliable program that displays exaggerated scan results in order to gain a purchase. See above image, DO NOT trust this scan result. Remove immediately if you've been infected. And install a best Anti virus.


Related files

AntiVirus2008.exe AntvrsInstall.exe AntvrsInstall[1].exe Antvrs.exe, xpa_2008.exe Antivirus-2008.exe, av2008xp.exe, Win Antivirus 2008.exe AntvrsInstall.exe shlwapi.dll, wininet.dll, shlwapi.dll, wininet.dll, AntiVirus2008.exe, Uninstall Antivirus.lnk, AntiVirus 2008.lnk, AntvrsInstall.exe, AntvrsInstall[1].exe, AntiVirus 2008.lic, Antvrs.exe, xpa_2008.exe, Antivirus-2008.exe, av2008xp.exe, Win Antivirus 2008.exe, AntvrsInstall.exe


How to remove / uninstall Antivirus 2008 ?

Do it in safe mode


  1. Uninstall: Uninstall Antivirus 2008 by using the "Add/Remove Programs" utility.
  2. Kill processes : Kill all the .exe files specified in the above list
  3. Unregister DLLs: Unregister specified in the above list ( command : regsvr32 /u filename.dll)
  4. Delete files : Search for the files listed above and delete them
  5. Delete directories: "%ProgramFiles%\ANTIVIRUS 2008"

Godzilla virus removal MS32DLL.dll.vbs

This virus is spreading through the pen drive / external HDDs. They use the autorun function of windows to run this. Its create files in windows folder in the name of MS32DLL.dll.vbs. and create file named autorun.inf in the root directory of each drive. So whenever we double click on the drive, the script will run from c:\windows\MS32DLL.dll.vbs


After infection

We can not Double Click to open any Drive on our computer. But we can Right Click to Open or Explore.


There is a text “Hacked By Godzilla” on Title Bar of Internet Explorer.


It will effect regedit, task manager, hidden folders/ files etc …

Related files
MS32DLL.dll.vbs
Autorun.inf
Flashy.exe


How to remove -
Download Removal tool Or do the following

Open task manager and end following process
1. wscript.exe
2. mslogon.exe
3. systemnt.exe
4. wscript.exe
5. flashy.exe
6. sondmsg.exe

Open command prompt and do the following
Change attributes of the file
Attrib –s –r –h autorun.inf
Remove autorun.inf from root directory.
Del autorun.inf
Delete MS32DLL.dll.vbs from windows directory
Delete c:\windows\MS32DLL.dll.vbs
Open registry editor
Delete following values
HKLM\Software\Microsoft\Windows\CurrentVersion\Run - MS32DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Run - flashy.exe
HKU\Software\Microsoft\InternetExplorer\Main - "window Title"
HKU\Software\Microsoft\Windows\CurrentVersion\Policies\system - disabletaskmgr
HKU\Software\Microsoft\Windows\CurrentVersion\Policies\system - disableregistrytools
HKU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - NoFolderOptions
Now restart the PC

How to avoid spreading
To avoid spreading this, disable autorun in windows.
And there is a small tric

Just create a folder named autorun.inf in all the root directory. And change the all the atribs to “+” so that they can’t chant put the files to root direct easly
Eg :
MD autorun.inf & Attrib +h +s +r autorun.inf

Calculate the strength of your password

I think you read an article about How to Create and manage a strong password. Here I introduce a site to calculate the strength of a password. Try this free web service http://www.passwordmeter.com/.

It is calculating with following factors
1. Number of Characters
2. Uppercase Letters
3. Lowercase Letters
4. Numbers
5. Symbols
6. Middle Numbers or Symbols
7. Requirements

Remove amvo.exe Trojan.AutoRun.A virus

This virus is also spreading through autorun of pen drive (AUTORUN.INF )

content of the autorun file
[AutoRun]
open=nideiect.com
;shell\open=Open(&O)
shell\open\Command=nideiect.com
shell\open\Default=1
;shell\explore=Manager(&X)
shell\explore\Command=nideiect.com

This will affect yahoo messenger login

How To remove it manually ?

Do it in safe mode

1, Plug your pen drive and start working.
2, search for autorun.inf and delete the filr if you found in root of your partitions and pendrive
3, search for following file and remove them

xn1i9x.com
n1deiect.com
ntde1ect.com
nudeiect.com
ntdelect.com
nideiect.com
ek.com
d.com
usdeiect.com
80avp08.com
dosocom.com
xfoolavp.com
uxdeiect.com
avpo.exe
amvo.exe
kavo.exe
amvo.exe
amvo0.dll
ampo.exe
amvol.dll
xfoolavp.com

4, open registry and take a backup of registry
5, search for “amvo.exe” and delete all the entry related to that file
6, Open “MSconfig” and remove startup entry of “amvo.exe”
7, update and scan with your antivirus

8,Restart Your PC

The exception breakpoint Yahoo messenger login error

When Sign In into yahoo messengers it just flash and automatically closing.

Also getting following error.

yahoo

The exception breakpoint
A breakpoint has been reached
(0x80000003) occurred in the application at location 0x1001c3a7

Reinstall or upgraded to a latest versions is not a solution for this case (I tried up to version 9 )

To solve the Problem

Right click on the shortcut of yahoo messenger

Click on Properties > Advanced > Check the box ' Run with different credentials '

yahoo2
Click on Compatibility > Check the box ' Turn off advanced text services for this program’

yahoo3

Now Run Yahoo messenger

Now you will get a “Run as” window

yahoo4

Click on “The following user” and login as administrator

Now you can login to yahoo messenger.

Next time you login, remove tick from

“Click on Properties > Advanced > Check the box ' Run with different credentials '”

For Permenent solution Remove amvo.exe Trojan.AutoRun.A virus

Enjoy Yahoo Chatting

Please give a feedback.

Create and manage a strong password

Key The days of using simple words or single character or a blank as a password are gone. Today, easy passwords can be cracked or guessed within minutes. Since the information on your computer is precious, you need to protect it as much as you can. This guide is to help you create solid passwords that will be a roadblock for intruders who are trying to break-into your computer.

Length – The number of characters for your password is very important. The recommended number of characters is at least 7 characters. The reason is that a 3 character password such as fgy can easily be guessed by an intruder faster than a 7 character password.

Strength – The strength of a password refers to the complexity of the password. In another words, can any one guess what your password is. For example, if your computer account is Krishnakumar and your password is krishnakumar or KrishnaKumar, an intruder can easily try and succeed in logging into your computer. To strengthen your password, the recommendation is to use a mix of special characters, numbers, and the alphabet. Special characters are !@#$%^&*()_+{}. Here are a few examples of stronger passwords

Eg: 0!Mygod , H31pme

Do NOT use Common name with numbers and symbols merely substituting for

Similar looking alphabetic characters.LK

Eg : R@mesh, P@ssw0rd, R3liance,

But you can use like this in sentences

Eg: Ilike5* = “I like Five Star”

Do NOT make your password a dictionary word

Keywords – Most people are familiar with creating simple temporary passwords for new employees or for other trusted people with the intent on allowing them to change the password at a later time. Passwords like abc123 and 567fgh were commonly used. Now, you should break this habit. These passwords are almost like not having a password because intruders have programmed these words into their software to guess your password. The recommended practice is to assign a strong password from the beginning so that the new employee or trusted colleague will also follow your lead.

Do NOT use 123, 456, 555, 007, ABC. XYZ, XXX ,ASDF, Year of birth, phone number with your name /username

Eg: Ramesh007

Ramesh1980

IMPORTANT - The above password has only been shared as a technique for crafting a strong but easy to remember password. You should NOT use Ilike5* as your own password nor should you use any sample password shared in any other password guide. Prospective intruders often review password guides when compiling their lists of passwords to try.



Hide a file behind an image

This is a small trick to hide a file behind an image. Its doing with the help of Copy command
/B syntax ( Indicates a binary file ) is used here. We need a compressing tool like winzip, winrar, 7zip etc .. im not explaining about how to do ..... Video is more than enough ...


Just watch the video…..

Please comment…

Download Single Click Restore Point – SCRP

11

Single Click Restore Point (SCRP) is a tool for creating a restore point in single click. It will help you create a restore point without go through the System restore Utility. Better to run this tool before a magor change in your computer.

You can distribute this tool with a link back to this Blog ...

How to use this ?

Simple Just Run the file. You will get a message box. that's all

22

Download SCRP

How to Check it With System restore Utility ?

1

2

3

4

Download - This Software is listed in following sites.

http://download.cnet.com/Single-Click-Restre-Point/3000-2094_4-10806051.html

http://www.forest.impress.co.jp/article/2008/02/07/scrp.html

Please Post Your Comments here ..

UltraSurf v8.8 0 - Bypass All Internet Blocking Systems

UltraSurf is a proxy application. It will Bypass All Internet Blocking Systems. By using this software you can access all the sites blocked by national / corporate firewalls. It is a free application. It brake all the access list. This application is nothing but just searching the proxy list which is fast and available. It will automatically change our IE’s proxy server to local proxy. That means this application will work as a web proxy server. Most of the schools and co-operates are blocking dating sites like orkut , myspace. And some sites like YouTube ( for bandwidth ). Most of them depending web proxys to bypass them. But they won’t get the full feeling of a normal browsing , because the sites are with banners.







It is a small EXE. There is no need to install the application. Just run in ..


Features

1, 100% freedom to have 100% information in most secure way.

2, It means no matter where you are you can access 100% of internet I mean no firewalls no restriction nothing….

3. Almost all schools, universities and corporate offices raise firewalls to filter out not work related sites, now those firewalls will be of no use or they have to change their plans.

4. Everybody can access various social networks like Orkut, Youtube, Myspace, Hi5, Facebook, Linkedin etc. which are blocked almost in 99% schools and offices.

5. 100% real time and it’s encryption is better then any online banking system.


If you are using browsers other than IE, You have to manually change the proxy settings .
Proxy settings as follows..

HTTP Proxy : 127.0.0.1 Port : 9666


Similar application : Tor (
The Onion Router)


Download Links
.

Lock your folder with Microsoft Private Folder





Microsoft Private Folder created a single folder on the user's desktop which, when opened for the first time, prompted the user to assign it a password. the user had to re-enter the same password to re access the folder . Microsoft Private Folder is a useful tool for you to protect your private data when your administrator or other people share your PC or account. It is assumed that Private Folder used strong encryption with a key based solely on this password to secure the data contained in the folder. This is in contrast to Microsoft's Encrypting File System, where encryption is tied to a keypair which can be made accessible to IT staff.
Private Folder used a system service called prfldrsvc (display name: Private Folder Service), the function of which is not yet publicly known.




Download Now :





Remember don't forget the password :-)

New Folder.exe Virus Removal Tool

Virus also known as- IT University Sohanad W32.HLLW.Ssdx newfolder.exe

If this virus infected in you computer, It will Disable the following …

Task Manager, Registry Editor, Folder Options, Run in start menu

And it will create exes like the icon of folders. If this virus is running it will use more than 50 % of your processor

Download following tools to remove new folder.exe virus

Download Tool 1 Download Tool 2 ( run tools In safe mode )


Manually remove it (new folder.exe Fix)

Delete File named svichossst.exe

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
“@”=[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Yahoo Messengger”=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Shell”=”Explorer.exe “


list of free online Anti virus scanners

Microsoft patch to prevent spreading Virus through removable medias : KB971029

list of windows updates since sp3 KB936929


Get updates via Email :