Getting Rid from Adwares and Spywares

Do you consider yourself a smart Web Surfer or downloader? Do you consider yourself immune to threat from spywares, known for tracking and monitoring you silently. Then I must say you are not. To support this, let me figure out some points-

1.   Most commonly they are installed on our system as a hidden program, behind something legitimate which you had given permission. They may be in form of installation programs, or drive by downloads, i.e. asking you for a plugin in order to view a page.

2.   Unlike other programs, these spywares always work in stealth mode so that you can never got to know about the program. You would not even see them in task manager, in add/remove programs, etc.

3.   Popups, unwanted websites, unknown errors, slower pc, are very clear indication of spywares.

Guess why someone would create adware or spywares? A simple thought, they can send you unwanted ads for which they can be paid by the companies thy advertise for, or they can report your name, email address, and other information to a survey company. 

Now lets talk about the removal of adware. The methodology which most of the adware/spyware removal tools use is similar to antiviruses. They also maintain a library of spyware filenames and registry keys and then searching and removing them from systems. 

However the first thing I would suggest you to install is a firewall so that no one can get access to your system. This would even work in the case when your system is already infected.  In fact most of the operating systems nowadays comes with default firewalls within them. Some other firewalls that may of your interest are :

a.     Zone Alarm [http://www.zonealarm.com]

b.     Sygate Personal Pro [http://www.tucows.com/thankyou.html?swid=213160]

c.      Kerio Personal Firewall

d.     AVG Internet Security Firewall [http://www.avg.com/us-en/home-small-office-security]

But again I would say that getting a good firewall do not ends the story. Its just a part of solution. Besides frewalls, you must also use one or more anti-spywares to check your system for current infections. As an add-on safety, I would recommend you o use spyware removal tools to make your system more infection free. These all are useful for this task:

a.     Spybot [http://spybot-virus-scan.com]

b.     Webroot Spy Sweeper [http://webroot.com/wb/products/spysweeper]

c.     Spyware Doctor [http://pctools.com/spyware-doctor]

d.     Bazooka [http://www.kephyr.com/spywarescanner]

e.     Hijack This [http://spychecker.com/program/hijackthis.html] [Advanced Users]

Some of them can even deal with the things in which antiviruses do not takes interest. These things include ad-ware, Trojans, key loggers, track wares, etc. Along with scanning part, they would tell you how to uninstall them these potentially unwanted apps, and that’s too with step by step instructions.

 

I assures you going ahead with this procedure will simply make you immune to spyware and ad wares, apart from your expertise in web surfing.

12:52 PM by Shubham Mittal · 0

General Advice For Improving RAM performance

So, guys going a l'l bit away frm leak, this time related to system performance rather than some hacking stuff :)

As far as performance of RAM is concerned, here are some of the additional tips for making better
use of your existing RAM:

Remove DLLs from cache memory
If you notice your system running slowly after Windows has been running for some time, or if your
RAM seems to be getting low for some reason, the culprit might be left-behind DLLs from programs
that are no longer running, but that Windows still keeps in memory. Sometimes Windows keeps
DLLs in cache memory even when the program that required them is no longer running, and this
cuts down on the memory available to other applications.

You can use a simple Registry hack to have Windows automatically remove from cache memory
DLLs that are no longer needed by programs. Run the Registry Editor [Hack #183] and go to HKEY_
LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer. Create a new DWORD value
named AlwaysUnloadDll, and give it a data value of 1. Exit the Registry, and reboot for the new
setting to take effect. Note that this setting might cause problems with some programs. Some
Windows programs—especially older and 16-bit programs—can issue error messages with this
setting in effect, so if that starts happening, delete the new key, or give it a value of 0.

Avoid DOS applications
DOS applications may not allow Windows to manage memory properly, and they hold on to the
memory they use, not allowing it to be swapped out for use for other programs or processes. If you
use any DOS applications, replace them with Windows versions.

Disable Aero
If you’re using Aero in Windows Vista, turn it off. Right-click the desktop, and select Personalize.
Then choose Window Color and Appearance→“Open classic appearance properties” for more color
options. Select a non-Aero theme, and click OK.

Reduce the applications and services running in the background
You might have many programs and services running in the background, without realizing it. Look at
your Notifi cation area, and see if there are any programs running that you don’t require. Shut them
down, and go into their confi guration settings to make sure they don’t load at startup.

9:14 AM by Shubham Mittal · 0

USB Scripting Tutorial

Hey guys, back after a long time. This time a simple trick for playing with your USB drives on your computers (Hackers cn think the same for others computers as well) .

The autorun.inf file is the key to getting your USB drive (or CD-ROM drive, for that matter) to perform certain actions automatically and customize it’s look in My Computer. The purpose of this article is to shed some light on how this can be done.

Autorun.inf Structure

The autorun.inf file is a simple text file that can be opened up in any text editor (e.g. notepad). It always starts with a section header of:
[autorun]
Below this header is a list of different options. Each of these options is in the following format:
option=value where option is the option that you want to set and value is the value that you are setting for that option. So, if you had an option foo and you wanted to be set to bar, then you would enter:
foo=bar
(Do not use foo=bar in your autorun.inf file as it is only an example, not a real option setting.)
That is all there really is to understand about the structure of an autorun.inf file. On to doing some actual cool stuff with it!

Setting a Custom Icon

To create a custom icon for your USB drive, use the icon option. Set it to the name of the icon file.

Note: Since drive letters can change for USB drives, the file path is relative to the root of the drive. This means that if your USB drive is presently mounted on U: and your icon is located at U:\Icons\MyIcon.ico, then you would enter \Icons\MyIcon.ico for the value of this option.

For example, if you had an icon on the root of the USB drive called coffeecup.ico and you wanted this to be the icon that showed up for the USB drive, you would enter:

icon=coffeecup.ico

You are not limited to .ico files. If, for example, you have an executable with a nice icon, you can specify it as the icon file. For example:

icon=DCoTopen.exe

This is valid as long as DCoTopen.exe is available on the root of the USB drive.
Some files have more than one icon embedded in them. If this is the case, you can select which icon to use by specifing the index number after the file name. For example:

icon=iconlib.dll,2

This will use the second icon in the iconlib.dll file.

Naming Your USB Drive

If you would like your USB drive to display a specific name othr than the drive label created when it is formatted, use the label option. For example, if I wanted to call my drive DCoT Drive, I would add this to my autorun.inf file:

label=DCoT Drive

Now, when you look at your USB drive in My Computer, it will say DCoT Drive by the drive letter.

Setting AutoPlay Options

AutoPlay is a relatively new function of Windows XP. It allows you to set up what file is run when the USB drive is plugged into the computer and the message that you are prompted with. There are two options that work in conjunction with AutoPlay. The first is open. It specifies the program that you can run automatically with AutoPlay. So, if we wanted to run a program called DCoTopen.exe, you would add the this to your autorun.inf file:

open=DCoTopen.exe

The second option that we add is the message the user is prompted with. To set this, we use the action option. If we want the message to say DCoT Open Program, add the following to autorun.inf:
action=DCoT Open Program

Once you have added this information, AutoPlay should look something like this:

Adding Context Menu Items

There are certain basic options such as Open and Explore that are available when you right click on a USB drive. But, wouldn’t it be cool to add your own? You can using a couple of lines in the autorun.inf file.
The first thing that we need to do is create an action, give it a name, and a message. We do all of this using the shell\verb option. For example, let’s say that we would like to create an action called lost. It does not matter what the actin is called. It can be anything you want. We would also like to show the message Help! I’m Lost! in the context menu. We would simply add this line to autorun.inf:

shell\lost=Help! I'm Lost!

This will display Help! I’m Lost! in the context menu so that you can click on it. But, it doesn’t know what to do when you click on it. Tell the system by using shell\verb\command option. In our example, we want to run the Lost.exe application. Adding this line will do the trick:

shell\lost\command=Lost.exe

You can add as many of these line pairs as you want to make the context menu as custom as you want.

Changing Default Action

When you double click on your USB drive, by default it will open up the drive so that you can browse through the files. Often, it is advantageous to perform some other action when the user double clicks the USB drive icon. You do this with the shell option. If we wanted to run the Lost.exe program from the previous section automatically when we double clicked on the USB drive, we would add this line:

shell=lost

because lost is the name of the action that was specified in the earlier lines.

Viewing a File

If you wanted to view a file on your USB drive in the default application instead of running a program on the drive, you can substitute the open option for the shellexecute option. For example, if you wanted to open up a website called, oh, I don’t know, say http://www.hackplanet.in in the default web browser, you could user the following:

shellexecute=http://www.hackplanet.in

 
This will work for any file. This is the equivalent of using Start - Run… and then typing in a file name and clicking OK.

I hope you get the tutorial.. give it a hand.. u wud find it damn useful. Do ask if any prob comes :)

Enjoy Hacking, Enjoy Hackton.

10:38 AM by Shubham Mittal · 1

Creating A Huge File

So guys here i m gonna give u a tut for Creating a huge file.

Tut - By upgoingstar.


You can create a file of any size using nothing more than what's supplied with Windows. 
Start by converting the desired file size into hexadecimal notation. 
You can use the Windows Calculator in Scientific mode do to this. 
Suppose you want a file of 1 million bytes. 
Enter 1000000 in the calculator and click on the Hex option to convert it (1 million in hex is F4240.) 
Pad the result with zeroes at the left until the file size reaches eight digits—000F4240.

Now open a command prompt window. 
In Windows 95, 98, or Me, you can do this by entering COMMAND in the Start menu's Run dialog; in Windows NT 4.0, 2000, or XP enter CMD instead. 
Enter the command DEBUG BIGFILE.DAT and ignore the File not found message. 
Type RCX and press Enter. 
Debug will display a colon prompt. 
Enter the last four digits of the hexadecimal number you calculated (4240, in our example). 
Type RBX and press Enter, then enter the first four digits of the hexadecimal size (000F, in our example).
Enter W for Write and Q for Quit. 
You've just created a 1-million-byte file using Debug. 
Of course you can create a file of any desired size using the same technique. 

Hope u enjoyed the tut, Dn frgt to pay regards..

any query or suggestiong, do mail me at upgoingstaar@gmail.com


Enjoy Hacking, Enjoy Hackton

11:46 AM by Shubham Mittal · 2

How To make An Autorun File For USB Drives

When you plug a  USB drive in, you might be interested in making a program, or other things happen as soon as you plug in. The way you accomplish this is through the Autorun.inf file. The autorun.inf file is located in the root of the usb drive and tells Windows what to do automatically.
This autorun can be used to make good, or bad USB’s depending on what you like.

This tutorial covers:

Creating a USB Autorun.inf
Changing label\icon of thumbdrive
Making a new option appear in the autorun menu
Making programs automatically run when plugged in

So Read On...


Creating a USB Autorun.inf :

To create an autorun file, open Notepad and save ‘autorun.inf’’ (with quotes) and save it to the root of the drive. All it needs to have is in the first line;


[autorun]

Done!

Changing label\icon of thumbdrive:

Follow the steps in Creating a USB Autorun.inf. Before you save it, type this in in this order!

[autorun]

icon=myicon.ico

label=MyLabel

And save. Make sure the icon file is in the root of your drive.

Making a new option appear in the autorun menu:

Right, so make your autorun file and type this into Notepad:


[autorun]
icon=default
label=[yourlabelhere]
action=programname.exe

Open Program

Save it and exit. Once again, the program has to be in the root. Now, when you plug it in, the option should appear in the menu.

Making programs automatically run when the USB is plugged in:

Follow the same instructions, blah blah blah;


[autorun]
Icon=default
label=YourLabelHere
open=programname.exe

And that’s it for this tutorial!
 
You can also follow these instructions when making a CD. You just have to burn it on the cd.
 
Any questions, please ask,a nd I’ll try to answer it as quickly as possible.

7:32 AM by Shubham Mittal · 1

How To Byepass BIOS Passwords : The Smart Way

Introduction to BIOS Passwords

The best method to reset a BIOS password depends on what BIOS the computer has. Common BIOS's include AMI, Award, IBM and Phoenix. Numerous other BIOS's do exist, but these are the most common.
Some BIOS's allow you to require a password be entered before the system will boot. Some BIOS's allow you to require a password to be entered before the BIOS setup may be accessed.
The general categories of solutions to reset a BIOS password are:

• Using a Backdoor BIOS Password
• Resetting the BIOS Password using Software
• Resetting the BIOS Password using Hardware
• Vendor Specific Solutions for resetting the BIOS Password

Using a Backdoor BIOS Password

Some BIOS manufacturers implement a backdoor password. The backdoor password is a BIOS password that works, no matter what the user sets the BIOS password to. These passwords are typically used for testing and maintenance. Manufacturers typically change the backdoor BIOS passwords from time to time.

AMI Backdoor BIOS Passwords

Reported AMI backdoor BIOS passwords include A.M.I., AAAMMMIII, AMI?SW , AMI_SW, BIOS, CONDO, HEWITT RAND, LKWPETER, MI, and PASSWORD.

Award Backdoor BIOS Passwords

One reported Award backdoor BIOS password is eight spaces. Other reported Award backdoor BIOS passwords include 01322222, 589589, 589721, 595595, 598598 , ALFAROME, ALLY, ALLy, aLLY, aLLy, aPAf, award, AWARD PW, AWARD SW, AWARD?SW, AWARD_PW, AWARD_SW, AWKWARD, awkward, BIOSTAR, CONCAT, CONDO, Condo, condo, d8on, djonet, HLT, J256, J262, j262, j322, j332, J64, KDD, LKWPETER, Lkwpeter, PINT, pint, SER, SKY_FOX, SYXZ, syxz, TTPTHA, ZAAAADA, ZAAADA, ZBAAACA, and ZJAAADC.

Phoenix Backdoor BIOS Passwords

Reported Phoenix BIOS backdoor passwords include BIOS, CMOS, phoenix, and PHOENIX.

Backdoor BIOS Passwords from Other Manufacturers

Reported BIOS backdoor passwords for other manufacturers include:

Manufacturer	BIOS Password
VOBIS & IBM	merlin
Dell	Dell
Biostar	Biostar
Compaq	Compaq
Enox	xo11nE
Epox	central
Freetech	Posterie
IWill	iwill
Jetway	spooml
Packard Bell	bell9
QDI	QDI
Siemens	SKY_FOX
SOYO	SY_MB
TMC	BIGO
Toshiba	Toshiba

Remember that what you see listed may not be the actual backdoor BIOS password, this BIOS password may simply have the same checksum as the real backdoor BIOS password. For Award BIOS, this checksum is stored at F000:EC60.

Resetting the BIOS Password using Software

Every system must store the BIOS password information somewhere. If you are able to access the machine after it has been booted successfully, you may be able to view the BIOS password. You must know the memory address where the BIOS password is stored, and the format in which the BIOS password is stored. Or, you must have a program that knows these things.
You can write your own program to read the BIOS password from the CMOS memory on a PC by writing the address of the byte of CMOS memory that you wish to read in port 0x370, and then reading the contents of port 0x371.
!BIOS will recover the BIOS password for most common BIOS versions, including IBM, American Megatrends Inc, Award and Phoenix.
CmosPwd will recover the BIOS password for the following BIOS versions:

• ACER/IBM BIOS
• AMI BIOS
• AMI WinBIOS 2.5
• Award 4.5x/4.6x/6.0
• Compaq (1992)
• Compaq (New version)
• IBM (PS/2, Activa, Thinkpad)
• Packard Bell
• Phoenix 1.00.09.AC0 (1994), a486 1.03, 1.04, 1.10 A03, 4.05 rev 1.02.943, 4.06 rev 1.13.1107
• Phoenix 4 release 6 (User)
• Gateway Solo - Phoenix 4.0 release 6
• Toshiba
• Zenith AMI

Resetting the BIOS Password using Hardware

If you cannot access the machine after if has been powered up, it is still possible to get past the BIOS password. The BIOS password is stored in CMOS memory that is maintained while the PC is powered off by a small battery, which is attached to the motherboard. If you remove this battery, all CMOS information (including the BIOS password) will be lost. You will need to re-enter the correct CMOS setup information to use the machine. The machines owner or user will most likely be alarmed when it is discovered that the BIOS password has been deleted.
On some motherboards, the battery is soldered to the motherboard, making it difficult to remove. If this is the case, you have another alternative. Somewhere on the motherboard you should find a jumper that will clear the BIOS password. If you have the motherboard documentation, you will know where that jumper is. If not, the jumper may be labeled on the motherboard. If you are not fortunate enough for either of these to be the case, you may be able to guess which jumper is the correct jumper. This jumper is usually standing alone near the battery. If you cannot locate this jumper, you might short both of the points where the battery connects to the motherboard.
If all else fails, you may have to clear the BIOS password by resetting the RTC (Real Time Clock) IC (Integrated Circuit) on your motherboard.
Many RTC's require an external battery. If your RTC is one of this type, you can clear the BIOS password just by unsocketing the RTC and reseating it.
RTC's which require external batteries include:

• Dallas Semiconductor DS12885S
• TI benchmarq bq3258S
• Motorola MC146818AP
• Hitachi HD146818AP
• Samsung KS82C6818A

Most RTC chips with integrated batteries can be reset to clear the BIOS password by shorting two pins together for a few seconds.
You will see more than one option for some chips due to testing by various people in the field. Remember to remove power from the system before shorting these pins.

RTC Chip	Pins
Dallas DS1287ATI benchmarq bp3287AMT	3 (N.C.) and 21 (NC/RCL)
Chips & Technologies P82C206	12 (GND) and 32 (5V)-or-74 (GND) and 75 (5V)
OPTi F82C206	3 and 26
Dallas Semiconductor DS12887A	3 (N.C.) and 21 (RCLR)

You should be able to discover how to reset the BIOS password stored in most RTC (Real Time Clock) chips by reading the manufacturers data sheet for that RTC. Some RTC's, like the Dallas DS1287 and TI benchmarq bq3287mt cannot be cleared. The solution to resetting the BIOS password on systems with those RTC's is to purchase a replacement RTC chip. How inconvenient!

i Hope You guys enjoyed the Article, Enjoy Hacking, Enjoy Hackplanet.

12:23 PM by Shubham Mittal · 0

Remotely Shutdown A PC : Childrens Trick

XP PRO has a lot of fun utilities. One of the most useful ones I have found to date is the ability to remotely reboot a PC. There are 2 ways of doing this. You will need to have admin access to the PC to preform these actions. That being said, here is the first way to do it:

Right click my computer, choose manage.
Highlight the Computer Management (Local) then click on Action, choose connect to another computer.
In the window that opens fill in the machine name of the PC (remember that, u have to put the Name, not the ip. For that i cn give u sum tools for revealing the names of any computer being connected, just do ask me.) you want to connect to and click ok.
Once connected right click on Computer Management (Remote machine name) and choose properties.
Go to the "Advanced" tab and click the Settings button under Start up and recovery.
Click on the Shutdown button.
Under action choose what you want to do (you can log off current user, shut down, restart, or power down. you can also choose if you want to force all applications to close, close hung apps, or wait for all apps to close by themselves).

The second way... Remember dos... that good old thing. Open up a command prompt and enter in the following:

%windir%\System32\shutdown.exe -r -m \\Machinename. The command prompt has more switches and options. I highly suggest using shutdown.exe /? to see all the posibilities.

6:31 AM by Shubham Mittal · 1

How To Run a Nessus Server

First of Al U need A Knoppix Distro. More U just have to follow The Steps:-

Boot up Knoppix STD. The install files can be found on the enclosed CD or can be downloaded from www.knoppix-std.org.

Open a terminal window and make sure that you are running as root. If not, type su.

You will need to add a user to the Nessus server. This can be accomplished by typing Nessus-adduser from the prompt.

After a user is added, you will want to start the Nessus server daemon by typing in the following: /etc/init.d/nessusd start.

Once the daemon is started, you can type nessus at the command line to start the Nessus client. You will now be prompted to log in to Nessus. Enter the username and password you created in step 3.

Click OK on the warning page that warns about dangerous plugins. This message basically states that some plugins can cause some servers to crash or hang. If you were to run this tool on a production network, this is something you would want to discuss with management before making a decision on how to proceed.

Browse through the parameters available on each tab. These include: Plugins, Prefs, Scan Options, Target Selection, and User.

Under the Network tab, enter the target device you would like to scan. Make sure that this is a system you have permission to perform a scan on. Start the assessment by clicking on Start the Scan.

On the Get Updates Setup Files page, select Yes, download the updated Setup files (Recommended), and then click Next. You'll need to register to get updates. Updates are seven days behind for non-paying customers.

After the scan is finished, review the results. This information could be added to your test report had this been an actual test.

The next step of a real assessment would be to patch, harden, and update the systems that were found to be vulnerable.

Hope U Found it Useful.

Enjoy Hacking Enjoy Hackton