New basket ball game

New basket ball game 'frost'

noreply@blogger.com (Surya Prakash Garg) — Thu, 18 Feb 2021 07:08:00 +0000

hello friends bored playing poison so there is a new basket ball game 'frost' (advanced poison ) how to play In starting or after outing somone the person will do from the outer place of D in this basketball game. Don't catch directly catch it in one tip. 2 basket you can do from anywhere do the 3 basket from 2 pointer and say frost. rest is like poison

Green Certification for Websites

noreply@blogger.com (Surya Prakash Garg) — Wed, 03 Feb 2010 15:36:00 +0000

Many innovative ways are introduced everyday to control carbon footprint, specially after The Copnehagen summit. Seems every individual arround has started discovering ways to give his contribution to this noble cause.

Green initiatives are not only eco friendly but also they are considered as potential business opportunities. One such intiative is "Green Certified Site".

What is a Green Certified Site?

A website with a Green Certified Icon. THis Certifies that website owner has taken steps to make his website environment friendly. Every website has a carbon footprint and for this reason, it contributes to climate change. It has a carbon footprint because electricity is required to power the servers that hostthe website, the computers used to view it, and the global networks that connect them. Much of that electricity is created from the burning of fossil fuels, like coal, oil and natural gas, all of which emit carbon dioxide and other greenhouse gases. While many people may assume that websites have negligible carbon footprints, that is not the case. According to studies, the global carbon emissions due to information and communications technology are greater than those of the entire aviation industry. In fact, studies suggest that infotech as a whole may contribute 2% of the world's carbon emissions, and many expect it to grow significantly in the next decade. Websites contribute to massive global footprint.

How does it work?

Green certification providers and green consultants have various ways to measure and manage Carbon Emission of a particular website.

Typically there is a three step methodology:

1. Monitor Energy Usage

2. Energy management tips and plan

3. Purchases the appropriate amount of audited renewable energy from wind and solar farms

Mostly a software suite is used to do the monitoring work.

Benefits:

1. Improved performance

2. Reduced energy usage and increased energy effiicency.

3. Improved visitor engagements

4. Carbon footprint neutralization.

References:

http://www.co2stats.com/

http://www.co2neutralwebsite.com/

Customized Virus solution

noreply@blogger.com (Surya Prakash Garg) — Sun, 07 Dec 2008 12:41:00 +0000

Hi All,

Many of us have viruses in their system but they are not sure which virus is this? and how to conquer it? I have come up with a new idea in which i can provide you all a manual virus solution according to the nature of virus attack.

If you wish to seek the solution follow these simple steps

Download Latest version of hijackthis
Run it and save hijackthis log on your hard drive.
List down all the PC related problems you are facing.
Attach the hijackthis log and mail me all your PC related problems to my email id spgarg04@gmail.com
I would try to resolve your problem.

Note: Hijackthis software doesn't steal any secret information of your PC, it just list out the processes.

Regards.

Virus Removal : Kamsoft.exe, ckvo.exe, autorun.inf : Folder within folder

noreply@blogger.com (Surya Prakash Garg) — Fri, 28 Nov 2008 08:30:00 +0000

Hi All,

Its being a long time since i have written anything.

Today i have come up with a solution to a new virus problem. This is called Kamsoft.exe :)

Most of the PCs may be infected by this new virus, and the channel for this virus is our all time favourite USB drive.

High Level Symptoms:

1. It creates within a folder which is of approx. 603 KB in size.
2. It disables regedit
3. You can't see hidden files and folders i.e it disables hidden files and folder options in Control Panel.
4. It may disable msconfig.
5. It makes your PC very slow.
6. Attacks all drives and modifies mount points key in registry so that when you double click on drives they open in new window instead of opening in same window

Action performed by the Virus:

1. This malware creates the following entry in the registry :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Kamsoft"=C:\windows\system32\ckvo.exe

2. It creates or may create following files in Root and other drives. C:\, D:\ etc.

uuuq.exe
whi.com
39lpji.com
ktnquo.exe
vxl.exe
oq.cmd
fe.bat
kk3.bat
rs.cmd
autorun.inf

3. Following files may be found in System32 folder:

ckvo.exe
ckvo0.exe
ckvo1.exe
kamsoft.exe

Vius Removal

1. Start the computer in safe mode by pressing F8 during booting

2. Open Registry Editor (if Registry Editor is disabled Goto step no. 3 else goto 4)

3.

Hit Windows+R to bring up Run (Start>Run)

Type in gpedit.msc and click OK
For regedit : In the Group Policy window, browse to User Configuration>Administrative Templates>System, you will see a small entry named “Prevent access to registry editing tools“. Double click that entry. Check the Disabled option, and click OK. Your regedit.exe has just been enabled.

4. Search for (Ctrl+F) ckvo.exe, delete all entries (Repeat same for Kamsoft.exe, atuorun.inf)

5. Goto HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\

delete all the keys starting with {........}

For Example:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{05ef6149-5e60-11dd-8a88-0003254ecf1b}

In the above key delete {05ef6149-5e60-11dd-8a88-0003254ecf1b}

6. Open the command prompt go to C:\>

7. type attrib so you can see the hidden files in root drive

8. To clear the attributes of malware files type

attrib -s -h -r filename
e.g. attrib -s -h -r autorun.inf

9. Delete the filename by typing

del filename
e.g. del autorun.inf

10. repeat steps 8 and 9 for all files of malware.

(Note don't delete the system files)

ntdtect.com
ntldr
hiberfil.sys
io.sys
pagefile.sys
autoexec.bat
boot.ini
config.sys
msdos.sys
etc.

11. look for the files of malware in all other partitions and delete them using steps 7-10.

12. go to c:\windows\system32>
13. type

attrib -s -h -r kamsoft.exe
attrib -s -h -r ckvo.exe
attrib -s -h -r ckvo.dll
attrib -s -h -r ckvo0.dll
attrib -s -h -r ckvo1.dll
del kamsoft.exe
del ckvo.exe
del ckvo0.dll
del ckvo1.dll
del ckvo.dll

14. Some files in system32 may not delete then you should logoff once and logon to delete any files associated with this malware

15. Now open Registry editor go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL

Change the DWORD value of Checked Value from 0 to 1.

16. Now go to folder options and change the hidden file attributes and show system files options. You should be able to see all hidden files.

17. Turnoff the system restore and turn it on again so the previous restore points will be deleted

18. Delete all files which are of 603 kb in size after searching them.

Comments are welcome. You may seek help or reply me @ spgarg04@gmail.com

Music folder virus in your pen drive

noreply@blogger.com (Surya Prakash Garg) — Fri, 18 Jan 2008 10:49:00 +0000

Hello,

These USB drives are driving me crazy. Most of the times they carry unwanted guests (Virus files). Earlier it was Brontok (remember that 44 KB file, a folder with .exe extension). Now we can see Music folder in almost every pen drive.
What is it exactly?

hmmmmmm

I am not sure about what it is exactly, but few things i can tell you about it.

If it is executed or if it has a presence in your system then it will do the followings:

It will create a 232 KB folder in your hard drive.
It will start a fake lsass.exe process, the origin of this process is C:\windows\system.
The original shell extension file exists in C:\windows\system32 folder.
You can delete the Music folder if this process is running but it will come back.

Now simply do the following to kill this

Kill the process lsass.exe in task manager which has user name as "Administrator" or "Your name"
Delete file lsass.exe from C:\Windows\system.
Now remove registry entry:

If you are running Windows 95/98/ME, this startup entry is being started via the Shell= line in the Windows\system.ini file.
If you are running Windows NT/XP/Vista/2000/2003, this startup entry is being started via the Shell= line in the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Once you do these steps. You can delete the Music folder and it won't come back.

Comments are welcome. You may seek help or reply me @ spgarg04@gmail.com

Can't view hidden files and folders?

noreply@blogger.com (Surya Prakash Garg) — Tue, 08 Jan 2008 17:59:00 +0000

I spent almost 4-5 hours struggling this problem, but finally figured it out.

Symptoms

You can't see hidden files and folders, even if you try modifying registry.
Whenever you double click on drive icon on My Computer, it takes some time to open and always opens in new window.
Your PC becomes a little slower.
The Process is packed and/or encrypted using a software packing process
This Process Creates Other Processes On Disk
This Process Deletes Other Processes From Disk
Loads and Executes a System Driver File
Writes to another Process's Virtual Memory (Process Hijacking)
Registers a Dynamic Link Library File
The Process is polymorphic and can change its structure
Violates Prevx File Security Settings
Executes a Process
Adds a Registry Key (RUN) to auto start Programs on system start up
The process hooks code into all running processes which could allow it to take control of the system or record keyboard input, mouse activity and screen contents
Modifies Windows Initialization And System Settings Used On Start up

Causes

This problem can be a caused by a backdoor/Trojan amvo.exe.
amvo.exe is bundled with several other worms/files some of them are

80avp08.com
dosocom.com
usdeiect.com
xfoolavp.com
autorun.inf
Nideiect.com
u.bat etc.. (a list of files is available here )

These files are stored on the directories i.e. C:\, D:\ etc. and also on C:\windows\system32\amvo.exe
You wouldn't be able to delete any of these files. Not even in Safe mode because it adds a autorun registry which loads amvo on boot.

Solution

KILL all the processes like AMVO.exe or AVPO.exe
Type "msconfig" without quote in run and press Enter.

Go to startup tab and uncheck any entry on amvo.

Type "cmd" without quote in run

type "d:" and then press Enter
type autorun.inf and then press Enter
a file will open in notepad. this would have the name of the .exe/.bat/.com file in it, which is mounted at the boot time.

Type "regedit" without quote in run and press Enter.

Press Ctrl+F and type amvo, do the search again and again and delete all the related entries.
Press Ctrl+F and type u.bat, do the search again and again and delete all the related entries.
Press Ctrl+F and type amva, do the search again and again and delete all the related entries. Generally it should be HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\amva
search for the registry of file name which was entered in autorun.inf and delete all entries.

Now restart the computer. and do the followings

Go to regedit and then HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL
Double click on the entry called CheckedValue and replace the 0 with 1.

Now Close all the windows and Press Ctrl+E to open the explorer.
Enable the hidden option from the folder options.
Delete all the malicious files as mentioned above.
Your computer is now trojan free.
Find all the amvo related files and delete them. (some of them are amvo0.dll, amvo1.dll etc.)

Prevention

Generally this Trojan travels through a USB drive. so better explorer USB drive rather than opening it.

Comments are welcome. You may seek help or reply me @ spgarg04@gmail.com

Microsoft Excel Bug

noreply@blogger.com (Surya Prakash Garg) — Sat, 29 Sep 2007 19:20:00 +0000

In a blog post, Microsoft employee David Gainer said that when computer users tried to get Excel 2007 to multiply some pairs of numbers and the result was 65,535, Excel would incorrectly display 100,000 as the answer.

Gainer said Excel makes mistakes multiplying 77.1 by 850, 10.2 by 6,425 and 20.4 by 3,212.5, but the program appears to be able to handle 16,383.75 times 4.

''Further testing showed a similar phenomenon with 65,536 as well,'' Gainer wrote Tuesday.

He said Excel was actually performing the calculations correctly, but when it comes time to show the answer on the screen, it messes up.

Gainer said the bug is limited to six numbers from 65,534.99999999995 to 65,535, and six numbers from 65,535.99999999995 to 65,536, and that Microsoft is working hard to fix the problem.

Break the chain (Olympic Torch Virus)

noreply@blogger.com (Surya Prakash Garg) — Sat, 15 Sep 2007 08:18:00 +0000

Virus warning e-mails harken from the Internet's infancy, when the only reliable defense against the malicious programs was vigilance and knowledge. Viruses have become more sophisticated, and so have the defenses against them. Since most e-mailed virus warnings today, like this one, are bogus, relying on these through-the-grapevine defenses is both unnecessary and unadvisable.

SAMPLE CHAIN LETTER TEXT

Please read the attached warning issued today .

PLEASE FORWARD THIS WARNING AMONG FRIENDS, FAMILY AND CONTACTS:

You should be alert during the next days:

Do not open any message with an attached filed called "Invitation" regardless of who sent it. It is a virus that opens an Olympic Torch which "burns" the whole hard disc C of your computer. This virus will be received from someone who has your e-mail address in his/her contact list, that is why you should send this e-mail to all your contacts. It is better to receive this message 25 times than to receive the virus and open it. If you receive a mail called "invitation", though sent by a friend, do not open it and shut down your computer immediately. This is the worst virus announced by CNN, it has been classified by Microsoft as the most destructive virus ever. This virus was discovered by McAfee yesterday, and there is no repair yet for this kind of virus. This virus simply destroys the Zero Sector of the Hard Disc, where the vital information is kept.

FORWARD THIS E-MAIL TO EVERYONE YOU KNOW . . . REMEMBER: IF YOU SEND IT TO THEM, YOU WILL BENEFIT ALL OF US.

END CHAIN LETTER TEXT

The text above first surfaced in February, 2006, just days before the opening ceremonies of the XX Olympic Winter Games in Turin, Italy. It is a reworking of early hoaxes around since 2002 that warned against opening e-mails titled A Card For You and WTC Survivor, and is no more true.

Virus warnings play on common societal fears that something we do, such as unknowingly opening an infected file, will cause us a great deal of heartache and not just a little embarrassment, since your infection will undoubtedly spread to others. Just as many legitimate viruses key in on current events to coax their victims into unleashing their bugs, so do hoax creators use newsworthy names and events in increase the 'fear factor' and perceived timeliness of the tome. Then, they tell you that you could be key not only into protecting your own, but also that you have a responsibility to your friends and family to share the information with them - that you are their only defense against malicious hackers.

Yet, in the 'real world,' relying on e-mailed virus warnings to ensure the safety of your computer and the data it contains is foolhardy at best and suicidal - technologically speaking - at worst. The so-called advisories are almost always false. Even when they do have an ounce of truth to them, they are either blown out of proportion (such as in the case of the Osama Bin Laden virus warning) or devoid of any real information or advice that would truly help you avoid or clean an infection. They serve only to make us paranoid and, in some cases, can do more harm than good (e.g., forwarding them increases your exposure to spam and scams).

True protection from unwanted intrusions on your data and hardware comes from active, up-to-date, real-time antivirus software. These programs are inexpensive, effective and easy to install. If you are currently browsing the internet without current antivirus protection, you are asking for trouble - trouble that all the forwarded e-mail warnings in the world won't prevent. For more that you can do to make sure your computer is as safe as it can be, please read Protecting Your PC in the Chain-Breaker's Library. Then, never forward another virus warning. Break this chain.

Removing Orkut\Mozilla Virus

noreply@blogger.com (Surya Prakash Garg) — Fri, 14 Sep 2007 20:26:00 +0000

Run the task manager,in processes tab you'll see two processes svchost.exe running under your user name, end them.
then go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\Explorer\Run
delete winlogon key

then go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
here set the checked value to 1

AND IF you are not administrator, the virus couldnt access the registry, so you'll see an invisible icon in the startup menu of start menu, delete it

DO ALL THIS AFTER YOU END THE TWO PROCESSES otherwise they'll be RESTORED every 10 seconds

After all this go to folder options uncheck hide protected files
you'll see C:\heap41a folder, delete it and you'll see microsoftpowerpoint.exe in your pen drives along with autorun.inf , delete them

Removing Fake microsoftpowerpoint.exe virus from your computer

noreply@blogger.com (Surya Prakash Garg) — Fri, 14 Sep 2007 20:08:00 +0000

Hello friends,

From today onwards i ll be continuously posting all my experiences here. I found the ways to remove orkut/mozilla virus on net (though i wasn't infected by this). But i had a little problem in my PC. I trust on sysinternals, believe me guys if you download process explorer from there then you can fight with any virus with applying some logic. My process explorer was showing a dirty entry of svchost.exe, here i ll tell what does this dirty entry mean. It means this svchost.exe was not generic, i.e. doesn't have a Microsoft signature. So then process explorer told me the path of this svchost.exe. I traced the path and found that this file was stored in

c:\Documents and Settings\Administrator\Local Settings\Temp\MsData\

after unhiding i found that there are some more files like microsoftpowerpoint.exe etc. which were the root cause for the problem.

so .. here you go..

Kill the process svchost.exe(not the generic one) with the help of task manager, or the same with the help of process explorer. http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx
Delete folder c:\Documents and Settings\Administrator\Local Settings\Temp\MsData
Delete file c:\windows\system32\Winlogons.exe (remeber its winlogons.exe, not winlogon.exe)
Reboot your system, and you are done.

Please comment on the post...

thanks and regards,

Surya Prakash Garg