killr0ylive - Is About live that i take..

Full Speed v3.3

2009-08-26T11:19:00.003+08:00

Full Speed v3.3
High Speed Internet Performance Booster and Speed Tests.
(Win 2000, XP and Vista)

What's in Full Speed software?

1. 'One click and you're done' Internet Booster. With one click Full Speed software will optimize and safely boost Windows, Internet Explorer and Mozilla Firefox for a guaranteed faster Internet experience.
2. Excellent Web browsing and Data speed tests and 3rd party independent speed tests. See improvements instantly.
3. Undo option to go back to original settings; if you really want to!
4. Print and/or save to file test results for before and after speed comparisons.
5. Pro Booster button.
6. Help Tips and Live Help.
7. Very easy to understand and use. Nothing to learn or read.
8. No technical knowledge needed, no questions, no contracts, no memberships, no subscriptions, no ads, no spy-ware, no viruses...

Instantly Get:

1. Overall faster high speed Internet
2. Faster download speeds
3. Faster web site browsing
4. Improve Internet and Intranet performance
5. Quicker download times
6. Smoother streaming music and movies
7. Faster download for songs and video
8. Faster performance with email
9. Faster loading Web graphics
10. Faster loading Web pages
11. Faster Internet Explorer
12. Speed test for Web site browsing
13. Speed test for general data transfer
14. Works for businesses or home users
15. Improved VPN and WAN performance
16. Increased peak download speed
17. More consistent data transfer
18. Better data flow efficiency
19. Fewer corrupt downloads
20. Works over networks
21. Works with all ADSL/DSL modems and routers
22. Works over wireless
23. Smoother surfing

Beware Facebook and MySpace user

2009-08-20T10:02:00.000+08:00

New worms target both MySpace and Facebook users

Kaspersky Lab, a leading developer of secure content management systems, has detected two variants of a new worm, Net-Worm.Win32.Koobface.a. and Net-Worm.Win32.Koobface.b, which attack MySpace and Facebook respectively. As part of their malicious payload, the worms transform victim machines into zombie computers to form botnets.

Even though the worms are currently only infecting MySpace and Facebook users, Kaspersky Lab analysts are warning users that the worms are designed to upload additional malicious modules with other functionality via the Internet. It is highly probable that victim machines will not only be used for spreading links via these social networking sites, but the botnets will also be used for other malicious purposes.

Net-Worm.Win32.Koobface.a spreads when a user accesses his/her MySpace account. The worm creates a range of commentaries to friends' accounts. Net-Worm.Win32.Koobface.b, which targets Facebook users, creates spam messages and sends them to the infected users' friends via the Facebook site. The messages and comments include texts such as Paris Hilton Tosses Dwarf On The Street; Examiners Caught Downloading Grades From The Internet; Hello; You must see it!!! LOL. My friend catched you on hidden cam; Is it really celebrity? Funny Moments and many others.

Messages and comments on MySpace and Facebook include links to http://youtube.[skip].pl. If the user clicks on this link, s/he is redirected to http://youtube.[skip].ru, a site which purportedly contains a video clip. If the user tries to watch it, a message appears saying that s/he needs the latest version of Flash Player in order to watch the clip. However, instead of the latest version of Flash Player, a file called codecsetup.exe is downloaded to the victim machine; this file is also a network worm. The result is that users who have come to the site via Facebook will have the MySpace worm downloaded to their machines, and vice versa.

“Unfortunately, users are very trusting of messages left by 'friends' on social networking sites. So the likelihood of a user clicking on a link like this is very high”, says Alexander Gostev, Senior Virus Analyst at Kaspersky Lab. “At the beginning of 2008 we predicted that we'd see an increase in cybercriminals exploiting MySpace, Facebook and similar sites, and we're now seeing evidence of this. I'm sure that this is simply the first step, and that virus writers will continue to target these resources with increased intensity”.

Kaspersky Internet Security detected these threats proactively and signatures were added to the database on July 31, 2008.

Lama tidak menjengah..

2009-08-16T01:06:00.003+08:00

Assalamualaimkum,
rasanya lama sungguh aku xupdate blog nie, dengan kesibukan dan pertukaran department banyak menggurangkan kelancaran aku untuk berblog..rasa byk cerita nk letak dlm ni..
Tapi sekarang aku rasa sudah tiba masa utnuk aku kembali...rindu utk berblog..

Aku sekarang agak sibuk dengan kerja baru, agak pelik pada mulanya, mengkaji sesuatu produk hanya berpandukan nota..huh..memang agak sukar pada mulanya..seperti mula-mula study diploma dahulu...

Aku harap Allah memudahkan aku untuk berpikir, yela dah lama xmembaca.agak slow juga enjin aku nk mula..harap aku akan menjadi suka dgn kerja2 aku ini..rasanya aku dah mula suka.....hehe..

Pada hari rabu lalu aku terima panggilan dari sepupu aku mengatakan rakan sepermainan kami meninngal dunia...mmg ngeri aku mendengarnya..jatuh dari bot dan digilis enjin bot...sedih aku mendengarnya, hanya al-fatihah sja dpt di beri dari jauh... Moga-moga rohnya dicucuri rahmat..amen...

Aku berharap hidupku di permudahkan perjalannya..

Wassalam...

Ku cintaimu tak berarti bahwa ku harus milikimu slamanya

2009-07-06T11:33:00.006+08:00

Ku akui ku sangat sangat menginginkanmu

Tapi kini ku sadar ku diantara kalian

Aku tak mengerti ini semua harus terjadi

Ku akui ku sangat sangat mengharapkan mu

Tapi kini ku sadar ku tak akan bisa

Aku tak mengerti ini semua harus terjadi

Lupakan aku kembali padanya

Aku bukan siapa siapa untukmu

Ku cintaimu tak berarti bahwa ku harus milikimu slamanya

Ku akui ku sangat menginginkan mu

Tapi ku sadari ku diantara kalian

Aku tak mengerti ini semua harus terjadi

D'Masiv - Diantara Kalian

How to change the product key for Office XP, for Office 2003, and for the 2007 Office system

2009-06-29T14:25:00.005+08:00

SYMPTOMS

You cannot change the product key for Microsoft Office XP, for Microsoft Office 2003, or for the 2007 Microsoft Office system without first removing and then reinstalling Microsoft Office.

RESOLUTION

To resolve this issue, follow the steps in this section.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

Note If you try to open any Office programs after you complete the steps, you receive a message that prompts you for a valid product key. Make sure that you have a valid product key before you start these steps.

1. Close all Office programs.
2. Click Start, click Run, type regedit, and then click OK.
3. Locate and then click the following subkey, depending on your version of Windows and of Office:

32-bit versions
2007 Office system
HKEY_LOCAL_MACHINE \Software\Microsoft\Office\12.0\Registration

Office 2003
HKEY_LOCAL_MACHINE \Software\Microsoft\Office\11.0\Registration

Office XP
HKEY_LOCAL_MACHINE \Software\Microsoft\Office\10.0\Registration
64-bit versions
2007 Office system
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\Registration

Office 2003
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\11.0\Registration

Office XP
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\10.0\Registration
4. Export the Registration subkey.

You can make a backup of the values under the Registration subkey if the new product key does not work. To do this, follow these steps:
1. Right-click the Registration subkey, and then click Export.
2. In the Save in list, select a location to save the registration entries.
3. In the File name box, type a name for the .reg file that you want to export, and then click Save.

Note In steps 4a through 4c, you created a backup of the Registration subkey. You can restore the Registry settings of the Registration subkey by double-clicking the .reg file that you saved in step 4c. The contents of the .reg file are automatically exported to the Registry.
5. Under the Registration subkey, there may be several Globally Unique Identifiers (GUID) that contain a combination of alphanumeric characters. Each GUID is specific to a program that is installed on your computer.

Click a GUID. Then, view the version of Office that is listed in the right pane for the Productname registry entry. After you find the GUID that contains the version of your Office program, follow these steps:
1. Right-click the DigitalProductID registry entry, click Delete, and then click Yes.
2. Right-click the ProductID registry entry, click Delete, and then click Yes.

For more information about how to identify the correct GUID for the version of the Office suite or program that you have installed on your computer, click the following article numbers to view the articles in the Microsoft Knowledge Base:
928516 (http://support.microsoft.com/kb/928516/ ) Description of the numbering scheme for product code GUIDs in 2007 Office suites and programs
832672 (http://support.microsoft.com/kb/832672/ ) Description of numbering scheme for product code GUIDs in Office 2003
302663 (http://support.microsoft.com/kb/302663/ ) Description of the numbering scheme for product code GUIDs for Office XP programs
6. Close Registry Editor.
7. Open an Office program, such as Microsoft Word. When you receive a message that prompts you for the product key, type the correct product key, and then click OK.

APPLIES TO

Microsoft Office Basic 2007
Microsoft Office Enterprise 2007
Microsoft Office Home and Student 2007
Microsoft Office Professional 2007
Microsoft Office Professional Plus 2007
Microsoft Office Standard 2007
Microsoft Office Ultimate 2007
Microsoft Office Basic Edition 2003
Microsoft Office Small Business Edition 2003
Microsoft Office Professional Edition 2003
Microsoft Office Standard Edition 2003
Microsoft Office XP Developer Edition
Microsoft Office XP Professional Edition
Microsoft Office XP Small Business Edition
Microsoft Office XP Standard Edition
Microsoft Office Access 2007
Microsoft Office Access 2003
Microsoft Access 2002 Standard Edition
Microsoft Office Excel 2007
Microsoft Excel 2002 Standard Edition
Microsoft FrontPage 2002 Standard Edition
Microsoft Office InfoPath 2007
Microsoft Office OneNote 2007
Microsoft Office Outlook 2007
Microsoft Outlook 2002 Standard Edition
Microsoft Office PowerPoint 2007
Microsoft Office PowerPoint 2003
Microsoft PowerPoint 2002 Standard Edition
Microsoft Office Project Professional 2007
Microsoft Office Project Standard 2007
Microsoft Office Publisher 2007
Microsoft Office Publisher 2003
Microsoft Publisher 2002 Standard Edition
Microsoft Office SharePoint Designer 2007
Microsoft Office Visio Professional 2007
Microsoft Office Visio Standard 2007
Microsoft Office Word 2007
Microsoft Word 2002

Selamat Berbahagia..

2009-06-05T16:49:00.003+08:00

Esok merupakan hari perkhawinan sahabat baik aku,
aku ucapkn moga beliau kekal bahagia ke anak cucu,
maafkan aku xdapat datang atas sebab-sebab yang xdapat dielakkan..
hanya ucapan yang dapat aku hadirkan...

semoga selamat hingga keakhirnya..

Apakah Salah...

2009-06-05T11:35:00.006+08:00

Pertama jumpa kau tersenyum pada ku
Di ikuti gemetar nya dua hati
Di balik wajah mu ku lihat terang
Dua insan telah jatuh cinta

Kata hati kau ucapkan angin lalu
Lembut sepoi menyentuh hati ku
Angan angan berlayar di laut hayal
Dua insan sedang jatuh cinta

Laut tenang segera berganti alun
Kau putuskan tali jembatan hati mu
Mahkota cinta kini tenggelam
Masuk jauh ke dasar seggara

Ku bertanya pada diri ku sendiri
Apa kah gerangan ada salah beta
Sebuah hati yang duka kerana luka
Ku coba menutup dengan doa

Apakah Salah Beta - Imran Ajmain

Resolve Illegal System DLL Relocation

2009-06-05T10:43:00.004+08:00

SYMPTOMS

Certain programs may not start after you install security update 925902 (MS07-017) and security update 928843 (MS07-008) on a computer that is running Microsoft Windows XP with Service Pack 2 (SP2). Additionally, you may receive an error message that resembles the following:

"application_executable_name - Illegal System DLL Relocation"
"The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C:\Windows\System32\Hhctrl.ocx occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL."

Resolution

To resolve this problem, follow these steps:

Step1:Install all important updates from the following Microsoft Web site:

http://update.microsoft.com/microsoftupdate

Step2:Try to run the program that did not start again. If the program starts and if you do not receive the error message in the "Symptoms of the problem" section, you are finished. If the error continues, follow steps 3 through 5.

Step3:Visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en

Step4:Click Download, and then click Run. If the Download button is not available, you must first click Validate to validate your copy of Windows.

Step5:Follow the instructions that appear on the screen to install update 935448.

How to disinfect my computer from Virus.Win32.Sality?

2009-05-26T14:58:00.005+08:00

The recommendations given concerning disinfection of a computer from Virus.Win32.Sality should be applied only if NO Kaspersky Lab’s product is installed on an infected computer, and/ or if the computer is already infected and a Kaspersky Lab’s product cannot be installed by regular means. Kaspersky Lab’s experts also recommend using Rescue Disk to disinfect an infected computer.

The Sality_Off.exe utility given in this article allows detecting and disinfecting only the following Sality modifications:

Virus.Win32.Sality.y
Virus.Win32.Sality.z
Virus.Win32.Sality.aa

In order to disinfect a computer from Virus.Win32.Sality (y/z/aa), do the following:

If infected computers are in the local network under domain control:

Step 1. Preparation to disinfection:

Download the file Sality_off.rar
Unpack the file Sality_off.rar
Run the file Sality_off.exe with the key -m on each computer in turn (for example, through Kaspersky Administration Kit, or the server group policy).

on all computers on which the domain administrator can register and work

While disinfecting this group of the computers do not log on under domain administrator on any other computers to prevent further spread of the infection in the network.

on all other computers

Do not stop or terminate work of the utility until all computers in the network have been disinfected.

Step 2. Algorithm of computer disinfection.

Computers on which you log on under a domain administrator rights should be disinfected first. Once these computers are disinfected, start disinfecting other computers in the network.

Run the utility sality_off.exe on the infected computers once again (no additional commands to run the utility are needed).
Make sure the anti-virus icon in the tray has turned red thus indicating the anti-virus software is fully functional. If otherwise, reinstall the anti-virus via Kaspersky Administration Kit.
Update the anti-virus databases (signature threats) for the Kaspersky Lab’s product installed on your PC. If you cannot download the updates from the Internet, update from the zip-archives.

set the full scan options to their maximum scan level
run full computer scan

Step 3. Signs of a disinfected/ clean computer

when restarted, the utility sality_off.exe –m does not detect any signs of infection (the line "infected thread terminated" is missing)
Kaspersky Anti-Virus is running and works in normal mode
full computer scan does not detect infected objects on the computer

Step 4. Cleaning the registry of infected computers in the domain network:

download the file Sality_RegKeys.zip
unpack the file Sality_RegKeys.zip
run the file Disable_autorun.reg from the archive Sality_RegKeys.zip
Click Yes to confirm adding the information to the registry

once the scan is over, from the archive Sality_RegKeys.zip run the file of the registry key:

under Windows 2000 run the registry file SafeBootWin200.reg
under Windows XP run the registry file SafeBootWinXP.reg
under Windows 2003 run the registry file SafeBootWinServer2003.reg
under Windows Vista run the registry file SafebootVista.reg

If infected computer are not in the network

Disable the technologies iSwift and iChecker, if one of the following products is installed and running on your PC:

Kaspersky Anti-Virus 7.0
Kaspersky Internet Security 7.0
Kaspersky Anti-Virus 6.0
Kaspersky Internet Security 6.0
Kaspersky Anti-Virus 6.0 for Windows Workstations
Kaspersky Anti-Virus 6.0 SOS
Kaspersky Anti-Virus 6.0 for Windows Servers

Download and unpack the file Sality_off.rar
Run the file Sality_off.exe

With an installed Kaspersky Lab’s product you might be prompted to allow any activity to the process Sality_off.exe

Go to Start > All programs > right-click Startup > select Open

Right-click any place in the Startup folder
In the menu select New > Shortcut
In the Create Shortcut window click Browse
Browse the folder into which the file Sality_off.exe was unpacked
Highlight the file Sality_off.exe
Click the OK button
In the Type a name for this shortcut field add the –m symbols. As a result the name will be following C:\Sality_off.exe -m
Click Next
Click OK

Download the file Sality_RegKeys.zip
Unpack the file Sality_RegKeys.zip
Run the file Disable_autorun.reg from the archive Sality_RegKeys.zip
Click Yes to confirm adding the information to the registry

Update the anti-virus databases (threat signatures) for the installed Kaspersky Lab’s product. If you cannot download the necessary databases (threat signatures) form the Internet, update the databases from the zip archives:

set the full scan options to their maximum scan level
run full computer scan
once the scan is over, from the archive Sality_RegKeys.zip run the file of the registry key:

under Windows 2000 run the registry file SafeBootWin200.reg
under Windows XP run the registry file SafeBootWinXP.reg
under Windows 2003 run the registry file SafeBootWinServer2003.reg
under Windows Vista run the registry file SafebootVista.reg

How to Flush and Reset DNS Cache

2009-05-21T09:20:00.004+08:00

DNS (Domain Name System) is a resolution mechanism to translate, resolve and return real IP address of the serving machine against the fully qualified domain name of the URL (Uniform Resource Locator), aka link location. Whenever a domain has been resolved, the DNS resolution is stored and cached locally for future use.

The caching of DNS on local system ensure the fastest speed to resolve any domain name, and reducing hits, and directly load and burn of DNS name servers. However, it may cause some issues such as some website and web pages not loading or cannot be contacted and connected when browsing, causing by changing of IP address or nameservers that hasn’t been reflected and refreshed on local copy. The symptom is more obvious when user set web browser to use proxy to surf the Internet, and these sites now can be loaded properly.

When encountering any inaccessible or unable to load web page issue, one possible resolution is to try to flush (empty and reset) the DNS cache on the system. To flush the DNS on Windows system (Windows XP and Vista inclusive), follow these steps:

Click on Start button and then click on Run (alternatively just hit Windows + R keys) to open Run command dialog. Type Cmd into the Run box, and hit Enter. In Windows Vista, open an elevated command prompt.
A command prompt DOS window will open. Type ipconfig /flushdns and then press Enter to purge the DNS resolver cache.

Mz Cpu Accelerator 3.1

2009-05-19T11:03:00.002+08:00

A small utility that will allow you to run applications much faster than the original speed

Mz Cpu Accelerator is an application that automatically changes the priority of the foreground window, by allocating more Cpu power to the currently active application (program-game).

Mz Cpu Accelerator automatically de-allocates cpu priority when a new active application is used. All this procedure, can lead to an enormous performance gain!

Requirements:

· Net Framework 2.0

Website kurang ajar dari sweden!!

2009-05-11T17:17:00.001+08:00

http://www.mohammedt-shirt.com/index.html

TeamViewer

2009-05-11T12:27:00.004+08:00

Overview:
TeamViewer is the fast, simple and friendly solution for remote access over the Internet - all applications in one single, very affordable module.

Description:
TeamViewer establishes connections to any PC or server all around the world within just a few seconds. You can remote control your partner's PC as if you were sitting right in front of it. Find out why more than 15,000,000 users trust TeamViewer!

Remote access to PCs and servers via Internet
Instantly take control over a computer anywhere on the Internet, even through firewalls. No installation required, just use it fast and secure.

Training, sales and teamwork
TeamViewer can also be used to present your desktop to a partner on the Internet - great for team collaboration, trainings and sales presentations.

File transfer, chat and more
Share your files, chat, switch the direction during a teamwork session, and a lot more is included in TeamViewer.

Kuhanya abang..

2009-05-11T09:40:00.006+08:00

Aku bukan perwira,
Ku tak berkuasa
Untuk menyelamatkan dunia
Dari ancaman yang sedia ada
Tapi ku bercita-cita
Aku dulu pernah mengalami usia remaja
Aku juga pernah jatuh cinta dan terluka
Jadi janganlah bersedih abang selalu disisi
Ku hanya abang
Tapi kasih sayangku tak berbatas
Darah dan daging hadirmu kurniaan dari Atas
Kuingin berikan yang terbaik padamu sayang
Dan perananku pegang hanya abang
Ku bukan idola
Dan ku tak pernah terima anugerah
Pengorbanan ku ikhlas
dan ku tak minta sekali pun di balas
Aku dulu pernah gagal dan aku kecewa
Aku juga pernah jatuh dan bangun semula
Jadi janganlah bersedih
Abang selalu disisi
Kuhanya abang tapi kasih sayangku tak berbatas
Darah dan daging hadirmu kurniaan dari Atas,
Ooooooooohh..
Ku ingin berikan yang terbaik padamu sayang
dan perananku pegang hanya abang
Jadi janganlah kau lupa
Lima waktu sehari
Jadi janganlah kau lupa hormat menghormati
Jadi jika abang yang lupa
Engkau akan menjadi
Seseorang bertanggung jawab untuk mengingati
Ku hanya abg…
Darah dan daging…
Kuingin berikan yang terbaik padamu syg
dan perananku pegang hanya abang..
Engkaulah yang abang sayang..

imran ajmain - abang

Sekian Lama Tidak Menyambut Bersama..

2009-05-11T09:00:00.004+08:00

Rasanya bertahun aku xsambut bersama-sama ibu ku... Tahun ini aku amat bernasib baik dapat menyambutnya..Selamat hari ibu mak..aku sayang sgt padamu..Tahun ini sgt bermakna bagi ku..Aku harap semasa hari bapa juga aku dapat menyambut dgn abahku..

Kaspersky Virus Removal Tool

2009-05-07T12:08:00.006+08:00

Another virus scanner and detection software from Kaspersky.

The Kaspersky Virus Removal Tool application was designed to be another virus scanner and detection software from Kaspersky. The produst will scan the specified locations for any virus threats and remove them or send to Quarantine folder

Manual Removal of W32.Sality.aa Trojan

2009-05-06T15:57:00.002+08:00

W32/Sality-AA is a virus that also acts as a keylogger.

The virus logs keystrokes to certain windows, as well as information about the infected computer. This logged data is periodically submitted to a remote website.
W32/Sality-AA has been seen spreading itself via email by piggy-backing on W32/Netsky-T. W32/Sality-AA is a virus that also acts as a keylogger.
The virus logs keystrokes to certain windows, as well as information about the infected computer. This logged data is periodically submitted to a remote website.
W32/Sality-AA has been seen spreading itself via email by piggy-backing on W32/Netsky-T.
Aliases: Virus.Win32.Sality.aa (Kaspersky), Virus:Win32/Sality.AM (Microsoft), W32/Sality.ah (McAfee)
Type of infiltration: Virus
Size: Variable
Affected platforms: Windows
Signature database version: 3267 (20080714)
Short description: Win32/Sality.NAR is a polymorphic file infector.

Damage Level : Highly Dangerous
Distribution Level: High/Medium
There is NO Auto Removal Tool for W32.Sality.aa Trojan

Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.

The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

%System%\amvo.exe
%System%\blastclnnn.exe
%System%\scvhsot.exe
%Temp%\00055a0e_rar\scvhsot.exe
%Temp%\000592b2_rar\scvhsot.exe
%Temp%\0005934e_rar\hinhem.scr
%Temp%\0005938d_rar\blastclnnn.exe
%Windir%\hinhem.scr
%Windir%\scvhsot.exe
c:\rdsfk.com
%System%\drivers\.sys
%temp%\win%name%.exe
%temp%\%name%.exe

Kill the following processes and delete the appropriate files:
antzom.exe, ax.exe, bomryuc.dll, drlbqse.dll, egjjen.sys, fmgonn.sys, hehmu.sys, hsgfrn.sys, idlrrh.sys, impnn.sys, jnjpvn.sys, loader174.exe, mAO3q2B7r6.exe, mm2emt.exe, ogmkmn.sys, omdftn.sys, vwservice.exe, vwsrv.exe, vwsrv[1].exe, win13652.dll, win21309.dll, win25709.dll, win27388.dll, win28610.dll, win29788.dll, win3096.dll, win31324.dll, win33848.dll, win35482.dll, win36587.dll, win37763.dll, win40320.dll, win40346.dll, win44025.dll, win46721.dll, win48684.dll, win63279.dll, win7320.dll, windjnvr.exe, winibqs.exe, winjepm.exe, winkrqpx.exe, winkxggjh.exe, winnmswkj.exe, winrlwmt.exe, winxotbiy.exe, wmdrtc32.dll, wmdrtc32.dl_, x1001[1].exe, x2000[1].exe, x2007.exe, x2011.exe, x2011[1].exe, x3000[1].exe, ywsnkhb.dll

Spreading on removable media
The virus copies itself into the root folders of removable drives using a random filename. The filename has one of the following extensions:
.exe
.pif
.cmd
The following file is dropped in the same folder:
autorun.inf
Thus, the virus ensures it is started each time infected media is inserted into the computer.

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg

Manually Remove From Registry
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
“GlobalUserOffline” = 0
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system
“EnableLUA” = 0
The following Registry entries are deleted:
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aouei
Key: CLSID\{1CE21416-0B8D-8CF6-1FCB-099B30C628BB}\InprocServer32
Value: ThreadingModel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_VWSERVICE
Value: NextInstance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: Class
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000\Control
Value: ActiveService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwservice
Value: DisplayName
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwservice\Enum
Value: Count
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwservice\Security
Value: Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: Type
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: Start
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32
Value: DisplayName
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisFileServices32\Security
Value: Security
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32
Value: NextInstance
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000\Control
Value: *NewlyCreated*
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: Service
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: Legacy
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: ConfigFlags
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: Class
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: ClassGUID
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NDISFILESERVICES32\0000
Value: DeviceDesc
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NdisFileServices32\Enum
Value: 0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NdisFileServices32\Enum
Value: Count
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\NdisFileServices32\Enum
Value: NextInstance
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\Root\LEGACY_NDISFILESERVICES32\0000\Control
Value: ActiveService

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: d
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
Value: {06DB7430-7430-6DB1-306D-430DB4306DB1}
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\NdisFileServices32
Value: ImagePath
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\NdisFileServices32
Value: DeleteFlag
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\NdisFileServices32
Value: ImagePath
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: ClassGUID
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: DeviceDesc
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: Service
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: ConfigFlag
HKEY_CURRENT_USER\Software\CurrentControlSet\Enum\Root\Legacy_VWSERVICE\0000
Value: Legacy
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: ImagePath
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: ObjectName
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: ErrorControl
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: Start
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: Type
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice
Value: FailureActions
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice\Enum
Value: NextInstance
HKEY_CURRENT_USER\Software\CurrentControlSet\Services\vwservice\Enum
Value: 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: s
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: f
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: d
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: f
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: d
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Value: s
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Value: Start Page

_+ Any of the Above Listed Files +_
Search Registry For Virus File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.
Exit the Registry Editor,
Restart your Computer.
Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Remove virus AMBURADUL (all varian)

2009-05-05T13:11:00.002+08:00

They never been stop spreading their knowledge…. and we also never let them alive forever. This is the article how to remove amburadul virus for all varian no need for antivirus program you can simply clean it using manual technique.

The simple way to know if your computer infected by this virus is you will see JPEG files with aplication extension. Now let’s start to remove it!

1. Unplug your infected computer from your network to stop this virus spreading.
2. Disable “System Restore” when in cleaning process.
3. Kill the virus process using power tools “currprocess” kill all process with icon JPG.
4. Repair your registry that already changed by the virus using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\comfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\exefile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\piffile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, Software\CLASSES\scrfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, UncheckedValue,0×00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,CheckedValue,0×00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,DefaultValue,0×00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0×00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, CheckedValue,0×00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, DefaultValue,0×00010001,0
HKCU, Software\Microsoft\Internet Explorer\Main, Start Page,0, “about:blank”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, type,0, “checkbox”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, type,0, “checkbox”
HKCU, Control Panel\International, s1159,0, “AM”
HKCU, Control Panel\International, s2359,0, “PM”
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, SuperHidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt,0×00010001,0

[del]
HKCU, Software\Microsoft\Internet Explorer\Main, Window Title,
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableConfig
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableSR
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-CLN.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-RTP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe, debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, DisableMSI
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, LimitSystemRestoreCheckpointing
HKCR, exefile, NeverShowExt
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, PaRaY_VM
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, ConfigVir
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NviDiaGT
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NarmonVirusAnti
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, AVManager
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, EnableLUA

5. Delete the master virus in %systemroot%\system32\~A~m~B~u~R~a~D~u~L~ before you do this you have to make hiden files become visible.
Then deleted this file list:

csrcc.exe
smss.exe
lsass.exe
services.exe
winlogon.exe
Paraysutki_VM_Community.sys
msvbvm60.dll
Drive:\Autorun.inf
Drive:\FoToKu xx-x-*.exe, where x show the date when virus active
Drive:\Friendster Community.exe
Drive:\J3MbataN K4HaYan.exe
Drive:\MyImages.exe
Drive:\PaLMa.exe
Drive:\Images

Cabaran

2009-04-23T18:33:00.005+08:00

Seronok pulak rasanya tgk table EPL ni..aku harap MU trus diatas persada liga..
Semalam menang, harap prestasi mcmni akan terus ditunjukkan apabila bertemu
Totteham..keputusan pasukan lain pn byk membantu mu kekal no 1 dalam liga...hehe..
aku harap sgt MU menang EPL lagi musim nie glory-glory manutd..