Computing Tips and Tricks

Filename: kouana.exe kouanax.exe

2011-09-17T19:06:00.000+08:00

I found kouana.exe and kouanax.exe and a lot of shortcut links to forders in my pendrive. All the link is set to run "koana.exe ".

I uploaded the file to virussan.jotti.org.. and result as follow.

	2011-09-17 Found nothing		2011-09-17 Win32.Virtob.Gen.12
	2011-09-16 Win32:Vitro		2011-09-17 Win32.Virtob.Gen.12
	2011-09-16 Worm/VB.13.AR		2011-09-17 Trojan.Win32.VBKrypt
	2011-09-16 W32/Virut.Gen		2011-09-17 Virus.Win32.Virut.ce
	2011-09-17 Win32.Virtob.Gen.12		2011-09-16 Win32/AutoRun.VB.YU worm
	2011-09-17 Found nothing		2011-09-16 W32/Sality.AO
	2011-09-17 Found nothing		2011-09-16 W32.Virut.G
	2011-09-17 Win32.Virut.56		2011-09-17 W32/Scribble-B
	2011-09-17 Trojan.Win32.VBKrypt!IK		2011-09-15 BScope.Trojan.Agent.01502
	2011-09-16 W32/Vobfus.O.gen!Eldorado		2011-09-16 Win32.Virut.AB.Gen

All the original folders is set to super-hidden (Hidden + System) attribute.

"Missing" -- Superhidden files and folders

2011-08-18T17:41:00.002+08:00

Missing folders or files may caused by spyware / malware or even virus like activity. Your files and folders still exist but their attribute is set to Hidden, and Hidden option is grayed out. So, you cannot unchecked them.

What is SuperHidden? Superhidden is file which it attribute set to Hidden and System.

All or most of the attributes, file / folder is set as a Super Hidden causes you can not remove the Hidden status normally.

Here I describe methods to recover the file / folder.

Tool / Utility needed:

1. Any Anti-Virus Software
2. Attribute Changer (ac.exe)

Measures

Scan your USB Pen Drive

Scan pendrive (or media) with anti-virus software. After you complete AV scan and clean the pendrive. Unplug and plug back the pendrive.
Attribute Changer download and install it.

Attribute Changer Muatturn from here.
Open (open) your pendrive and delete all the shortcuts file (. Lnk)
Press Ctrl + A to highlight all the files and folders in your pendrive.
Right-Click on any file or folder selected in step 4
Select the menu 'Attribute Changer ... " in the context menu that appears
In the Folder Properties tab, uncheck all options, system, hidden, archive etc.. and the bottom bit before the OK button, tick recurse folder .. (Meaning all the folders in this folder)
Click on the File Properties tab, remove all signs of it as in 7 above. so check the recurse folders.
Click on OK, and all your files will be processed.

To view the process is running .. click on the Reporting tab and click on the More ..

This is all ... hope may help you.

Test your server from outside

2011-07-29T04:01:00.002+08:00

You're setting up webserver or any server at all, but you have only one WAN access, so how to test it from outside world, which is from internet. I, myself, found three method that work perfectly.

Proxy website ( http://www.proxy.org)
using online network tools ( eg: just-ping.com)
Call/chat/email your friend to log to your server

1. Proxy.org

On Proxy.org, the list hundred of proxy website that you can use for free. I use http://www.sitegetter.net.

SiteGetter start page

Type your address, and click Go,

Website sufted using proxy.
Notice the upper frame, showing proxy site options

2. Online Network Tools

By using online network tools, we cannot see the actual pages, but we can get some idea or information about out configuration whether it is work or not. I use just-ping.com to ping my server from various part of this world just with one click.

just-ping.com screen capture

The other tool I use is network-tools.com. They have ping, trace, lookup, express (multiple test in one click), DNS record and others.

3. Call your friends

I just chat / call a couple of my friend to log to my server and ask them for their opinion/finding. They help alot. Thanks.

Ever wonder how I capture those screenshot, read here

VirtualBox OSE with Ubuntu 11.04 as Host

2011-07-26T13:15:00.001+08:00

Ubuntu has given me great computing experiences, and a couple months back I have decided to totally remove other OS from my machine and leave Linux Ubuntu 11.04 alone. But, as my nature to help a lot of my Windows users, espeacilly user whose machine has been affected with viruses/malware/worm.

The problem I faced is how to look at pendrive as I saw it on Windows. I googleing but did not find any good solution so I have decided to install back Windows on my machine but as Guest OS. After searching in Ubuntu Software package, I found VirtualBox OSE and install it then install Windows XP Pro SP3 on it, and work fine.

BUT, really big BUT, I cannot access USB drive. All USB filter founded are grey-out and can not be selected. I already installed VirtualBOX OSE Addition. Everything works but still pendrive did not work on Guest OS. So "google" again and found that OSE didnot support USB due to licensing, may be.

I found a trick tried by other user how to overcome this problem with "Shared Folders" Here is what I got from ubuntuforum (http://ubuntuforums.org/showthread.php?t=1557646) ..

Morbius1 says:

Actually there is a way to access USB using the OSE version if the host is linux and the only thing you need is access to a USB storage device:

(1) On the Linux host: Use the VirtualBox > Settings > Shared Folders to create a shared folder to /media

(2) Start the VBox WinXP then open Computer > Tools > Map Network Drive > Folder > VirtualBox Shared Folders > \\VBOXSVR\media

Make sure "reconnect at logon" is checked

Every time you boot into WinXP you will have a drive letter that points to /media and within that will be any usb ( or cd / dvd ) device that is mountable by the linux host. It won't work like inserting some usb device and having WinXP launch an application but if it's just an external hard drive then it'll work.

I will try it out soon, and will post back my success here soon.

My Computer shows AllMounted on 'vboxsrv'

Content of /media mounted as AllMounted on Windows XP

ddclient: Install and Configure to update Dynamic IP Change

2011-07-24T16:43:00.005+08:00

STEP 1:
Download latest ddclient from sourceforge.net



$ wget http://download.sourceforge.net/ddclient/ddclient-3.8.1.tar.gz

STEP 2:
Expand the tarball

$ tar zxvf ddclient-3.8.1.tar.gz

STEP 3:
You will have ddclient-3.8.1 directory in you current directory. You have to copy ddclient to /usr/sbin directory.

$ cp ddclient /usr/sbin

STEP 4:
Create a directory for ddclient configuration file under /etc

$ mkdir /etc/ddclient

STEP 5:
Now, we have to create a configuration file for ddclient.

$ nano /etc/ddclient/ddclient.conf

and, put configuration as shown below.

# Configuration file for ddclient generated

#

# /etc/ddclient.conf



daemon=300

pid=/var/run/ddclient.pid

ssl=yes

protocol=zoneedit1

use=if, if=ppp1

server=dynamic.zoneedit.com

login=your-zoneedit-login-name

password='your-password'

www.domain.com

subdomain.domain.com

mail.domain.com



### EOF: ddclient.conf

My configuration file using ppp1 as reference for IP number changes, use=if, if=ppp1

STEP 6:
Follow this commands to test, start and set ddclient in daemon mode.



$ ddclient -daemon=0 -query

$ cp sample-etc_rc.d_init.d_ddclient /etc/rc.d/init.d/ddclient

$ /sbin/chkconfig --add ddclient

STEP 6:
Create ddclient cache directory

$ mkdir /var/cache/ddclient

ddclient will log cache in the directory under ddclient.cache filename.

STEP 7:
Test your config

$ ddclient -daemon=0 -debug -verbose -noquiet

All done...

Lenovo 3000 G430 Wireless not working

2011-07-23T16:48:00.003+08:00

My friend bring me that laptop saying that did not using the laptop for almost a year because he cannot make the WIFI adapter works. I do some checkup and found out that all required software driver is install, and there is no problem what so ever stated anywhere in the system.

Levono Wireless Device Setting

I then, search thru Lenovo website, and found some utility software that did not exist in the laptop. One of is is Lenovo Power Management (LPM) . Install LPM then the wireless button will work. To download the driver, got to http://support.lenovo.com, or you might try this LN1EGC3WW1.exe ( Lenovo Energy Management for XP)

Compaq Presario CQ40 Blinking LED

2011-07-23T16:39:00.003+08:00

Compaq Presario CQ40 come in several model which is I divided into to chipset class which is Intel and ATI. Model with Intel chipset did not having much problem since I start servicing this model but ATI is in contrast. The most common problem is for ATI chipset model is POWERED ON with NO POST but with CAPS/NUM Lock blinking.

Before you do any servicing or taking your CQ40 apart, do visit the HP page on details about CQ40 blinking code -- link at bottom of this page. Here is the list of the blinking code (taken from HP.com). I suggest you do hard reset and re-seat RAM module. On two occasions, on two units of this model, I just re-seat RAM module, and it works fine. So, sometime, 4x blinking not actually cause by graphic controller problem.

Blinking Code Translation Table

Number of Blinks or Beeps	Location of Blinking LEDs	Component Being Checked	Error Condition
Continuous glow	Battery power LED	Battery	The AC adapter is attached and the battery is charging, but does not yet have sufficient charge to power the notebook.
1	Caps Lock/Num Lock	CPU	CPU not functional
2	Caps Lock/Num Lock	BIOS	BIOS corruption failure
3	Caps Lock/Num Lock	Memory	Module error not functional
4	Caps Lock/Num Lock	Graphics	Graphics controller not functional
5	Caps Lock/Num Lock	System board	General system board failure
6	Caps Lock/Num Lock	BIOS	BIOS authentication failure
Continuous blink	AC power adapter LED	Power adapter	Insufficient power

For more details, please visit this page.

HP Deskjet F2480 Troubleshoot

2011-07-20T16:54:00.002+08:00

If your HP Deskjet F2480 having trouble like mine, which is all LED blinking fast, you can still using the printer.

[for further information about F2480 Blinking lights, please visit this page.]

After testing my printer for various option including power adaptor, paper jam, and logic board swapping, I concluded that I having problem with scanner module.

So, what I do is pull the scanner ribbon cable out of the logic board and test again, then when I powered on the printer, only POWER and ATTENTION LEAD are blinking.

And, printer status on my computer said, "Scanner Failure" and ask user to do power cycle. I do a printer test, and it work fine. Now, my All-in-One works only as printer.

Posibble Problem in Future

If I not mistaken, when you change cartridges, this printer will print a pattern page that you have to put it on scanner for cartridge alignment, printer will fail again. But, I believed that you can cancel this procedure. How? I do not know yet.

* the end *

Oh Crap! YM Bot.

2011-04-30T23:57:00.002+08:00

When I do work in my pc, suddenly there was news of my brother through YM. Treat wince, but continue to have noticed that a brother was not really me, but it was just a bot (robot script) that has infected his computer .

Chat script:

Mohammad.wariszan 4/19/2011 8:27:13 PM
hey you there?

ketuketeh 4/19/2011 8:47:18 PM
ADO ..

Mohammad Wariszan 04/19/2011 8:47:43 PM
will u do me a quick favor and take an IQ quiz for a project I am doing?

ketuketeh 4/19/2011 8:48:05 PM
ok

Mohammad Wariszan 04/19/2011 8:48:17 PM
I need to see how many people get out of my friends over a 115

ketuketeh 4/19/2011 8:49:52 PM
ok

Mohammad Wariszan 04/19/2011 8:50:05 PM
just go to http://www.iqtest0989.com/?invitecode=1p61lng0501 and take the test .. if you do ill owe you big time

ketuketeh 4/19/2011 8:50:47 PM
awk ni Warizan properly, speak Malay skit .. kalu x Maleh well in. ..

Mohammad Wariszan 04/19/2011 8:50:55 PM
please let me know what score you get. thanks so much

ketuketeh 4/19/2011 8:51:17 PM
ok .. im sure this is not you ..

Mohammad Wariszan 04/19/2011 8:51:23 PM
im going to go cook while you do it

ketuketeh 4/19/2011 8:51:25 PM
so .. no go!

Mohammad Wariszan 04/19/2011 8:51:32 PM
BRB, let me know your score When im back!

ketuketeh 4/19/2011 8:51:51 PM
r bot u!
right

If you come to things like this, do not be entertained. It brought many problems to you and your pc. These boats may be trying to get your personal information such as email address, address, password and username (as possible), etc..

Therefore, do not easily believe. Ask! or "Google" first ... get more information before making any action.

Discussions / Further information can be found here, here, and some other places.

Howto: Installing LAMP on Ubuntu 10.10

2011-04-16T04:04:00.003+08:00

LAMP server in Ubuntu
(This tutorial is based on Ubuntu Linux 10.10)

Since seeing 'people at home' is struggling to sell shirts and "drop shipping" in the up (Facebook), moved the hearts want to help (cheewah!). So expect to setup web server in my linux pc. After finding some, found a way to make it.

Installing LAMP on Ubuntu Linux

LAMP stands for Linux, Apache, MySQL and PHP. The combination of these four web servers to create a stable and fast, and FREE.

The easiest way to install LAMP server is to use tasksel command in Terminal.

$ Sudo tasksel 

If your state is shown to have no such instructions, you do not yet have Linux tasksel. Please install tasksel in advance using the following command;

$ sudo apt-get install tasksel

Okay, after tasksel install, run the command again;

$ sudo tasksel

Select [ ] LAMP server, with the mark * in the box [ ] by pressing the spacebar. Then press Tab, and Enter.

LAMP server during installation, you will be asked for a password for user 'root' in MySQL. Wait until the installation is complete, and tasksel will return to the command prompt.

Exit the terminal, and open the web browser to see whether your installation is successful or not by typing the following URL address;

http://your-pc-ip-no (eg: http://192.168.1.45)

later you will be displayed with the text "It Works" if you managed to install LAMP.

Congratulations .. again a full Linux steps into the world.

(haha, totally google translate from my Malay version)

Howto: Converting JPEG to PDF using Image Magick

2011-04-16T00:59:00.001+08:00

(This tutorial is based on Linux Ubuntu 10.10)

Before we can convert JPEG (or any supported files format) to PDF, we have to install Image Magick software package. Ubuntu have several ways to install sofware packages, ie, using Ubuntu Software Center, or apt-get at Terminal.

If your system yet did not have Image Magick, please install it first. I prefer to use command-line apt-get. Here is how to install it via apt-get.

$ sudo apt-get install imagemagick

After finish the installation, use convert command to convert image files to PDF.

$ convert name-of-jpg-file.jpg name-of-new-pdf-file.pdf

convert command have compress option if our PDF output is to large.

$ convert -compress jpeg name-of-jpg-file.jpg name-of-new-pdf-file.pdf

convert command has many other options other than compress, but we do not need the other options to change the JPEG format to PDF.

Enabling All Windows 7 Setting in One Place

2011-04-03T17:47:00.003+08:00

Step-by-Step How To Enable Windows 7 "God" Mode Control Panel

(Note: This only a special folder shortcut to Registry GUID.)
(Warning: May cause system problem. Use with care)

Step 1:

Create a new folder on Windows 7 Desktop

Step 2:

Copy the red colored text below;

GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

Step 3:

Right-Click on "New Folder" and pick Properties from the popup menu

Step 4:

On the General Tab, you will see "New Folder" Text, select all the text, and then paste (Control V or Right-Click -> Paste) the code you copied earlier.

Step 5:

Click OK button.
You will notice that the new folder icon has changed to Control Panel Icon with GodMode caption.

Step 6:

Double-Click on the GodMode icon to open "God" Mode Control Panel.

u r done.

For more details, visit http://en.wikipedia.org/wiki/Windows_Master_Control_Panel_shortcut

Netbook Problem: Need More Resources?

2011-04-02T13:42:00.003+08:00

Samsung Netbook Model N148Plus
29/03/2011

12:19am
Starting Diagnostic Phase
Start Task Manager = CPU Usage 45% up to 100%
Waiting until CPU usage at 10% or less.

12:23am
CPU usage under 10%. System seem working properly.

12:27am
CPU usage increased. PC Tools processes is to be blamed.
It's take a lot of system resource.
Physical memory = 90+ %
- Macam xde pagefile.
Pagefile size is below recommended :1024mb
Recommended size 1519mb
Manually setup to 2048mb on drive C:

12:46am
Restart.. not much improved.
RAM usage above 90%. Suggesting RAM Upgrade.

01:03am
Pagefile revert back to default setting bcz no significant changes
in perfomance.

01:15am
Running Full scan..
Leaving system to complete scanning.

06:14am
Taking 4hrs ++ to complete
PC Tools smart update done.

By Markzhue.

0x000000F4 BSOD Windows 7

2011-03-04T15:18:00.005+08:00

Lots of Windows user face 0xF4 BSOD on many version of Windows, ie XP, Vista and even Windows 7. It has been reported over the internet that the main cause for this problem as follow;

file corruption
SecuROM related
Hardware Error (HDD is the biggest blame)

I've try to find the solution on internet but did not found any easy solution. Even Microsoft Knowledge Base did not help much.

What we can try is ..

Remove any Add-On Card, then Re-insert one card at a time.
Check Memory for defect
Check HDD for any files corruption, bad sector, so on

Repairing network after virus attack

2010-12-14T12:38:00.003+08:00

How to reset TCP/IP for Windows XP

1. Launch Command Prompt as administrator

2. type:

a. netsh int ip reset then press [ENTER]
b. netsh winsock reset then [ENTER]
c. netsh interface reset all then press [ENTER]

Heat IS your computer WORST enemy

2010-06-13T20:31:00.003+08:00

Yesterday I solved notebook with auto shutoff problem. It is a Acer. I believed it is a heat problem. So, I disassemble the unit and found out that the base of the heatsink screw has broken. It is loose from the mainboard.

I place the had modified the screw base, and screwed back the heatsink. I tested the notebook and it work perfectly event after 24 hours of burn-in test.

It save the notebook owner a lot of money (if I didnot modified the base, he may be need to change the mobo).

Next time if I encounter the same problem, I will take some photos.

ECS P4M800-M7 Motherboard SATA Problem.

2010-06-13T20:12:00.005+08:00

If anybody encounter problem with SATA interface on ECS P4M800-M7 motherboard, you should upgrade the bios and limit the transfer rate of the drive.

My situation:

My mobo cannot detect my 500gb WD HDD. So, I suspected the bios problem because, bios didnot display any SATA interface. After I upgrade the bios, SATA Interface appeared but still not detect the hdd. BIOS take about 3 minutes to finish POST. Still, no hdd detected.

Then, I suspected the hdd is using new SATA technology but mobo still using first SATA technology. So, I set hdd jumper to limit the transfer rate. Then mobo could detect the hdd.

Mobo manufacturer: EliteGroup (ECS)
Model: P4M800-M7 Ver 3.1

Steps:

(1)
Upgrade BIOS
Download Latest BIOS file from here
(2)
Setting HDD jumper to limit to 150mb transfer rate
Read this document on how to set the jumper

* beware - you may trash you mobo

Windows Utitlities

2009-12-15T14:20:00.006+08:00

Greetings to all, It has been long time since my last post (almost a year), that I do not have the opportunity to write in this blog. Today I feeling like to post about a little utility program or application that I use.

Defragmentation

After several years use, I was very satisfied with the result, so I want to share with you all. Utilities are JkDefrag. JkDefrag has been written by Jeroen Kessels. It was released under the GNU license, which gives us the freedom to use free of charge. JkDefrag version released until 3:36 and then converted to MyDefrag starting with version 4.0

For more information please visit http://kessels.bz/jkdefrag
Viruses and Spyware

If your OS has been infected with viruses and spyware and difficult to cure, try ComboFix, please use with caution. Read the instructions from ComboFix properly.

Please visit http://www.bleepingcomputer.com/combofix/how-to-use-combofix

BSOD: 0x0000007B Error while installing WinXP on Acer Aspire M1640

2008-12-17T06:28:00.010+08:00

While installing Windows XP SP2 on Acer Aspire M1640, I got a error message 0x0000007B. I do some search on the net and found this http://support.microsoft.com/kb/316401. I suggest that your all read this knowledge base.

On this M1640, Setup found the SATA drive, but cannot access it correctly. You have to use F6 to supply Setup the NVIDIA® MCP73U Chipset SATA driver. You can choose either to use floppy disk or use slipstream to inject the driver into WinXP Setup CD.

If you need the driver, please download it here. [nvidia_mcp73_sataraid_floppy_xp32_mb.zip]

THE END

AVG8: Invalid Update Control CTF File

2008-11-12T23:10:00.008+08:00

Today, about an hour ago, I received an error message while updating AVG 8 Free Version, the error says:

Invalid Update Control CTF file

After 10 to 15 minutes searching my computer for the CTF file, I found it at

C:\Documents and Settings\All Users\Application Data\avg8\update\download.

In the folder, I saw two .ctf file, which is avginfoavi.ctf and avginfowin.ctf, I delete both files and try to run update again, and it was successful.

The above folder is valid for Windows XP. For Windows Vista user, try locate .CTF file folder C:\Users\All Users\avg8\update\download.

THE END

IBM ThinkPad R40 Supervisor Password Recovery

2008-11-04T15:32:00.014+08:00

NOTICE:
I did not take responsibility for any loses due to the usage of the information from this blog post. Please take extreme precaution while following this procedure. Thank You.

[Lihat Bahasa Melayu]

IBM / Lenovo save password (POP and Supervisor Password) in a EEPROM Chip call ATMEL 24RF08. These password couldn't be remove simply by resetting any jumper or unplugging any battery or backup battery. The only way is to read the password stored in the chip. To achieve this, you have to send in the laptop to the manufacturer together with prove of ownership.

But, we can hack this (by reading the EEPROM chip using homebrew EEPROM Reader and reader software from ALLservice.ro.

Thing we need:

EEPROM Reader (homebrew)

Parts:
1. D-Sub 9pin female COM header,
2. 2 units 5.1v Zener Diod
3. 2 units 2.2 Kilo Ohm Resistor

Software
Get the software from http://www.allservice.ro/ iaitu r24rf08_setup.zip and setup_ibmpass21.zip

details as follow:
http://www.allservice.ro/forum/viewtopic.php?t=61 – r24rf08 - Reader http://www.allservice.ro/forum/viewtopic.php?t=56 – IBMpass 2.1 Lite

Build the EEPROM Reader

EEPROM Reader schematic.

Figure 1: EEPROM ATMEL 24RF08 Reader Diagram.

Attach the Reader to ATMEL 24RF08 EEPROM

From the site where I first get the information about hacking this BIOS password, it is suggested that we solder two wire to EEPROM pins to connect the reader. I thought it will be disasterous and would void the warranty.

Photo #1: EEPROM Reader,
all component soldered to d-sub female connector

I soldered a needle to the wire from the reader, one for SDA and one for SCL. For the GND wire, I suggest you attach a aligator clip to clip the GND wire to any GND point on the mainboard. For my case, I clip the GND to the jacket of USB port near the EEPROM.

With this method, you need to have a very steady finger to hold the needdle in place. I used both hand to hold the needdle. One needdle in one hand. You have no more hand to operate the PC. Get your buddy's help. I ask my wife to press ENTER.

The Location of AMTEL 24RF08CN on R40

EEPROM Chip AMTEL 24RF08 is located beneath the plastic protective sheet under the harddrive compartment.

Photo #2: Harddrive compartment

Remove the aluminum cover. You have to remove two screws. One in the small hole at the bottom of the picture and the other one is on the bottom right side of the cover.

Photo #3: Plastic Protective Sheet

You have to peel the plastic sheet to uncover the EEPROM. Be very careful not to tear off the sheet. We need to replace is later on the board. The sheet is fastened with double sided tape on the audio jack. Peel it from there.

Photo #4: ATMEL location and pin connections

I've mark the SDA and SCL pin in Photo #4. Look where I slip in my GND wire. "Saya klip GND kat kulit port USB ini" meaning "I have clip my GND wire at this USB port sleeve."

Figure #2: ATMEL 24RF08 Pinouts
(In direction match the Photo #4)

Photo #5: Protective Sheet peeled.

The attached PCMCIA removed and the protective sheet has been peeled to give us a clear view to the EEPROM.

EEPROM Reading Procedures

To complete this procedure, you need to have another pc (secondary pc) with spared COM Port.

Step 1:

Attach EEPROM Reader to COM Port (other pc or laptop with COM Port), then open up Command Prompt. (Under Windows XP, Click on Start-->Run then type in CMD then press ENTER. Go to the folder where r24rf08 is installed.

C:\>cd C:\ALLservice\24RF08 then ENTER

type at the command prompt

C:\ALLservice\24RF08>r24rf08.exe r40dump.bin

Don't hit ENTER yet. (C:\ALLservice\24RF08 is where your r24rf08.exe located)

Step 2:

Turn on your ThinkPad (Please be really careful). Wait until your ThinkPad is prompt you to enter password (when big padlock icon appear).

Step 3:

With precaution (be really careful, bro), attach GND wire to any GND on the board then attach or touch the two needdles which connect to SDA and SCL on the ATMEL 24RF08CN EEPROM.

Step 4:

Now, press ENTER (my wife did -- both my hand holding the needle), wait for a moment until reading finish (appox. 10 to 20 seconds). In the same folder as r24rf08.exe, a new file named r40dump.bin has been created. Now you can power off the ThinkPad and reassemble the unit.

Langkah 5:

Run IBMpass 2.1 Lite that you have installed earlier. Click Start --> ALLservice --> IBMpass 2.1 Lite. Open the file r40dump.bin from the C:\ALLservice\24RF08. Scroll down to address 0x330, you could read the password right there. If you can not read the password (or files did not show anything), make sure you click on the icon "AA off" to "AA on". That's all.

Photo #6: IBMpass 2.1 Lite Screen Shoot

Type in the password at ThinkPad, in my case, the password is KHALIF. I have succesfully boot this ThinkPad. KHALIF is a person name -- We believed he (a teacher) is the previous user of this laptop, and before he relocated to another school. he didnot reset or tell anyone the password, but return the laptop to school administration.

p/s: Sorry for the bad quality of the images. Those images taken using Nokia 6600 camera phone. To seek more help from me, please send short text message to +6o-12-96o82o8 and email me at spokdogol AT gmail DOT com

References:

http://sodoityourself.com/hacking-ibm-thinkpad-bios-password

http://www.allservice.ro/

Further Readings:
1. ATMEL 24RF08 datasheet

NOTICE: I did not take responsibility for any loses due to the usage of the information from this blog post. Please take extreme precaution while following this procedure. Thank You.

Internet Explorer title bar changed to selamat_berposo_dari_umt

2008-10-14T15:37:00.006+08:00

Since I have posted my chatting transcript with Mr Lee (via Skype) titled PC kena attack oleh Trojan, Satu transkrip , only today I manage to get some time to write how to solve the problem regarding the AutoRun.inf and the "selamat_berposa_dari_umt.js" script.

Autorun.inf often cause problems to pendrive or flash drive user who always used public access computer or a computer that used by many users. Autorun.inf facilitate all kinds of trojans, malware and other infectious or reproduce from one system to a system other. Once this script is scrutinized, it is actually Haha.js scripts that have been modified slightly, and the name was changed to another name.

"selamat_berposa_dari_umt" effect

What will you see if your computer has been infected by "selamat_berposa..." is;

Internet Explorer Title changed from "Windows Internet Explorer" to "selamat_berposa_dari_umt"

Context menu on the disk drives you will have options such as "Scan For Viruses", "Scan with Norton AntiVirus", and "Scan with AVG

"Open" and "Explore" will be taken over by this script also.

If you double click on the drive, it takes quite some time from the appropriate period.

Reproduction Method

This script is spread through the implementation of autorun.inf in every drive. Once it is active, it will copy itself into;

each root directory of all drives either fixed or removable drive.

Windows and System32 folder

Once it is copied, it will change the attribute to the Archive, Readonly, Hidden, System. This causes it can not be seen and removed easily with.

How to Delete?

This script depends on wscript.exe to operate. When it is active, wscript.exe process can be seen in Task Manager. Do this step,

Terminate wscript.exe process using Task Manager, by right-click on the wscript.exe and select "End process".

delete the autorun.inf and selamat_berposa_dari_umt.js files from disk drives, including removable drives (both files are hidden, so you must show this file using "Folder Options".).

To restore the title of Internet Explorer, use Regedit, go to HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Main and delete directly "Window title" in the right pane.

Restart your computer.

That's it. good luck.

p/s: be very careful while editing the registy ... I do not take responsibility if other problems arise on your PC.

Installing Windows XP on Toshiba Satellite L40

2008-01-30T12:05:00.002+08:00

[Lihat Versi Bahasa Melayu]

Serial ATA has become common bus on all new computer system, like the Toshiba Satellite L40 notebook machine has using the "Intel(R) 82801HEM SATA RAID Controller" chipset.

To install Windows XP on this system, you have to press F6 to supply the SATA driver to windows XP setup. I manage to get the driver by searching the net and put in on floppy disk. Then I start to install Windows XP onto this L40, with USB Floppy Drive and NO LUCK, the installation was failed.

During the installation, pressing F6 will instruct Windows XP setup to read additional driver from floppy disk. Setup will ask to select the correct driver by pressing 'S'. Setup will display the list below;

Intel(R) ICH9 SATA AHCI Controller (Desktop/Server/Workstation)
Intel(R) 82801HEM SATA RAID Controller(Mobile ICH8M-E)
Intel(R) 82801HEM/HBM SATA AHCI Controller (Mobile ICH8M-E/M)
Intel(R) ICH8R/ICH9R SATA RAID Controller (Desktop/Server/Workstation)
Intel(R) 82801HR/HH/HO SATA AHCI Controller (Desktop/Server/Workstation)
Intel(R) 631xESB/632xESB SATA RAID Controller (Server/Workstation ESB2)
Intel(R) 631xESB/632xESB SATA AHCI Controller (Server/Workstation ESB2
Intel(R) 82801GHM SATA RAID Controller (Mobile ICH7MDH)
Intel(R) 82801GR/GH SATA RAID Controller (Desktop ICH7R/DH)
Intel(R) 82801GR/GH SATA AHCI Controller (Desktop ICH7R/DH)
Intel(R) 82801GBM SATA AHCI Controller (Mobile ICH7M/DH)
Intel(R) 82801FBM SATA AHCI Controller (Mobile ICH6M)

Then, I choose

Intel(R) 82801HEM/HBM SATA AHCI Controller (Mobile ICH8M-E/M)

from the list. Windows Setup can detect SATA harddrive and can continue to create partition and formatting until to state where Windows Setup 'forgot' the USB floppy disk and keep asking you to insert the Intel Matrix Storage Manager driver diskette into floppy A:, (the disk still in the drive, but Windows setup could not recognise the drive)

INSTALLATION must be abort, failed!

Then, I try other method, which is required me to put the SATA driver to the Windows XP Installation Disk. It is called Setup Disk Streamlining. I'm using nLite to do the job and toast a installation cd.

Steps of nLite process;

run nLite, Welcome Screen appear, click Next.

Locating the Windows installation .. insert you original Windows XP Installation CD (which I use OEM version of Windows XP Home with Service Pack 2) to you optical drive, and click Browse.

Pick a location on your harddrive (or make a new folder) to store your Windows XP Installation files befoe making ISO file. Click Next.

Preset. delete all preset (if exist).. click Next

Task Selection, Only select to options, Driver and Bootable ISO, then press Next

Drivers. click Insert, Single Driver, then Choose any INF file... appear, choose iastor.inf from folder where you extract the Intel SATA driver. click Open...

Storage Device Textmode Driver, click on Textmode Driver and, while pressing CTRL button, click all the driver from the list with the word 'mobile' There is 5 of it. Click OK

then click Next

Apply Changes? click Yes. nLite now preparing files to make the bootable ISO image file. When this process is done, press Next.

Bootable ISO, in General, Mode section, choose appopriate format that suite you, either make a CD or ISO image. I suggest you make ISO image.

Create a CD from the ISO, using your favorite ISO software.

I use the CD created in step 11 to install the Toshiba Satellite L40 with success.
good luck...
download Serial ATA di sini (Intel Matrik Storage Driver)

Stubborn "Show hidden files and folders"

2008-01-30T01:35:00.001+08:00

[Lihat versi Bahasa Melayu]
Sometime, when your Windows system attacked by malware or trojan and sometime a virus attacked, has completely disable your "Show hidden filed and folders" option in your Tools -> Folder Options. You may also recieved the error message below.

"Registry editing has been disable by your administrator"

The affected system may also encounter Command Prompt (CMD), Task Manager, Folder Options dan Registry Editor deactivation. To reactivate, download this INF file, repair4karo.inf to your desktop. Right-click the file, select Install then restart your system.

After your Folder Option reactivation, you may or may not set your "Hidden files and folders" to "Show hidden files and folders". If you cannot set to "Show hidden files or folders", please follow the steps below.

There is two options you may choose;

Reformat your Windows drive and reinstall

Agree? Naaaah.. i don't....

This step could eliminate all treat and INLUDING your work.
Windows Registy editing.

All "Hidden files and folders" setting were put under "Advanced key" in Explorer branch;

\HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

and here;

\HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

What you can do is to export both key from other Windows XP pc, then import to your registry.

REMEMBER, do not use Right-Click then Merge or Double-Click the exported regisry file, because the is an error (file not found) may occured. The right way to do is, run your Regedit then drag both file to Regedit window.

If you do not have any other Windows XP system you can access you can download the registry key, hklm.reg and hkcu.reg.

Good luck.

Installing Windows XP on Acer Aspire 4920

2007-12-14T16:15:00.002+08:00

Lihat Versi Bahasa Melayu

The easiest way to install Acer Aspire 4920 with Winodws XP is to setting the SATA Mode to IDE Mode rather then AHCI Mode. Here is how to set the bios.

1. To enter the BIOS, press F2 as stated in the Acer welcome screen.

2. Use your Arrow Key to move the screen to Main section. At the bottom, the is a option to set the SATA Mode. Press key, the select IDE Mode

3. Save you setting by pressing F10. Exit the BIOS, system will reboot.

Now, you're ready to install Windows XP without any SATA driver.

Hope this info will help.