Portable Antivirus & Security Blog

Redirect to Data0.Net ...

2010-09-20T08:44:00.000+08:00

This blog will be automatically redirect to www.data0.net.

Move to Visual Basic 2008

2010-03-09T18:04:00.000+08:00

Microsoft Visual Basic and C++ 2008 is very powerful IDE for VB fans. After developing a few tools, I decided to change my Portable Antivirus code to VB2008 make it much stable and powerful. 50% of the code has been converted so far. No more VB6, its too old and almost 12 years already.

Unpacking AutoIt Script

2010-01-08T11:30:00.000+08:00

AutoIt is a known BASIC-like scripting and self-contained into UPX packed executable file. AutoIt also has been known to be used by virus author to create malicious program and spread it through all over network or media storages.

Here it is I show a sample that I've got from somebody who sent it to me. Most antivirus is already detected as W32/Almanahe.B. It seem this virus is still in the wild on some country. Ok, let focus on the topics. On this tutorial, let assume that you already have a sample of application or malware sample that compiled with AutoIt.

How do we know that it is an AutoIt file?
Its pretty simple to detect this kind of file. For me, just load up your sample with Notepad.exe. and search for 'AU3!EA' keyword. It will jump to the bottom of the file and there is some 'garbage' thing started with 'AU3!EA' character. And that was and encrypted AutoIt script that we want to decrypt. Lame way but fast to detect it.

The tools that we need for this dynamic analysis/reverse:
1. PEiD
2. myAutToExe.exe

All you need to do, download the tools above. Run PEiD and load-up your AutoIt sample file into it. You will see something similar with the picture below:

I use the sample malware from the people sent it to me. The PEiD will look show you some basic information and said it was compiled with Microsoft Visual C++ 7.0.

Next, run your myAutToExe.exe and drag and drop your sample AutoIt file into the top textbox. It will automatically start analyzing the file and extracting the script.

After the process it will look like this (picture above). All processing data will be saved as log, source code and resources file.

There it is, a sort file with the source code of the malware (or program). The source code file will be saved as .au3 extension file and can be viewed with any text editor. Starting from this point we can analize this piece of malware easily without needed to using complicated way (static analysis).

Here it is a screen shot of the source code that we already have. Seem like this people trying to expose itself by inserting their information into the source code. LoL.

Since this AutoIt script can be readable by any one, there is a few AutoIt script malware that I found that already obfuscated to prevent analyzer from easily trace their code. I'll explain this type on next blogpost...

Malware Playground

2009-11-29T22:34:00.010+08:00

Around 3 month ago, I was starting developing a sandbox tool for easy to analyst any of malware sample that can generate at least basic information from the sample. I just named it Malware Playground as its work to 'play' with almost all Windows programs within it. Sound funny like a kids playing with knife but wearing a shield. The program itself has been developed using Microsoft Visual Basic 6 and working with more than 20 other programs.

At this moment, this program includes all required features for doing malware analyst. Here it is some features:
+ Save report as text and HTML format.
+ Analysis can be started at your own choice such as you can dump process memory instead of analyst all of the function (Registry, Dump, Handle, String, Port, Files and Folders, AV alias and so on).
+ Work with Windows platform (on VMWare or VirPC).
+ Work together with Sandboxie.
+ Drag and drop and warn before start analyzing it.

Malware Playground is still in development and some advanced features still remains in progress. Here it is list of features that currently in development:
+ Network activities
+ Process activities
+ Smart suggestion and recommendation technologies.
+ Add more AV alias detection
+ Security Risk Level perimeter.
+ Provide an official website for useful information and services.
+ Integrates with web interfaces that allowed user uploading their malware sample.
+ Save all known threat object into database.
+ Mapping all origin location for the malware and visualize on global map.

While this useful tools is still in progress, I was unable to provide a fully compiled program to give a test but you can leave a comment and suggest for more features.

iPhone Worm - Ikee

2009-11-11T11:55:00.003+08:00

While surfing on the internet at Bayu Beach Resort, Port Dickson, found something interesting on the internet. It is iPhoneOS.Ikee worm. This kind of virus is rarely found especially on Apple iPhone. The worm do some basic function such as spreading via SSH and changing wallpaper as their payload.

During infection, this little worm will change victim wallpaper to Rick Astley image (80's singer). The worm has been written by Ashley Town a 21 years old unemployed programmer from Wollogong, Australia.

Upon executing the virus code, the worm will scan an IP address using default SSH configurations. IP range may be vary at random pool as well as copying it self to the startup folder and do some payload by changing default wallpaper. The worm source code also has been reveal as the picture below show some function that change the wallpaper and various commented code.

More detail report can be found here.

New Portable Antivirus on few final stage!

2009-10-15T21:49:00.000+08:00

This week I was updating new Portable Antivirus code with some user friendly features. This is one of the most advanced anti virus made by my self. Here it is a few change I have made this week for Portable Antivirus project:

+ New name; now it is Data0.Net Portable Antivirus.
+ Better system tray icon & pop up message.
+ Support multi language including Bahasa Melayu.
+ Speed up database reading for fast scanning.

Those code make me sleepless but its worth it. I'm happy to finish it but still got few more step. I need to finish up my beta sandbox tools called 'Malware Playground'. Sound funny but it could be an advanced sandbox soon.

Cyber-Communalism

2009-10-02T11:20:00.000+08:00

Since a few years ago, Malaysia, Indonesia and other south east Asian country have make some mistake that generating communalism or in easy word 'big misunderstanding' whether about culture, political, terrorism or religious. In cyber world also get the impact of this misunderstanding. Indonesian could call Malaysia as 'Malingsia' while Malaysian people could call them as 'Indonesial'.

communalism art 

Internet alone we can find so many articles, libel, forum, blog and many more about this issue (Example 1). Wikipedia also has been describe details about Communalism. This will give impact to all Asian country especially between Malaysia and Indonesia. As an example below show you many website from Malaysia has been defaced because of this issue:

Most of this issue produced by local/foreign media making the conflict more complicated and people will think different and negative perception each other by just read or hearing rumors. As I wrote this topic, there was the latest hot issue such as Pendet dance and Island. While the real thing is, there is none of this issue are truth.

Interesting about W32.Virut variant

2009-09-09T20:46:00.007+08:00

Within last 2 month, I continuously reading and made some RCE for well known viruses call W32.Virut or other malware analyst named it as W32.Sality. This is not a new virus. It is already detected around 2006. Since last 2 month I received more than 20 report from my friend around Malaysian about this virus that already infecting their labs and PCs.

W32.Virut is a parasitic file infector, polymorphic and backdoor capabilities. Once it has been executed it will inject its code into winlogon.exe process and create a new thread in that process. But its depend on version of the variant. Other variant injecting their code onto smss.exe and csrss.exe process. It infects all EXE and SCR file type by appending to the last section of the host file and set it entry point to point to viral code. So, any execution from the infected file will run the viral code first before passing to host code. W32.Virut prevent its execution from running on Virtual Machine such as VMWare or Virtual PC and make it difficult to trace its presence, thread and processes. Also, its polymorhic making my sandbox generate inaccurate result and need manually analyst.

From Picture 1, it is clearly shown that the string inside the W32.Virut is working its jobs such as adding its process list to the Windows Firewall, Disabling System File Protection, Modify HOSTS file, contacting external server address and as well as Windows API pointing to Windows DLL files.

W32.Virut has already generate a few hundred variant generated from its polymorphic technique. Making it hard to detect with a simple static Hash detection.

Solution: Repair & Cleaning
There is many tools out there for quick repair your infected file. One of the best tools is AVG Win32/Virut Removal. It free to download & use.

RCE - W32/Autorun.82944

2009-06-06T16:34:00.006+08:00

A few days ago I have discover a virus that spread using common known media, USB Flash disk. This virus seem to be the same as other malware and it was compressed with PECompact utilities. The worm itself has been written using Microsoft Visual Basic 6.0. This worm is commonly known as W32/Autorun.worm!n (McAfee), TR/Crypt.PEPM.Gen (Avira), Win32.Worm.VB.NXY (BitDefender).

File Information

File Name: various
Size: 82,944 Bytes
Type: Trojan
Static File: Yes
MD5 Checksum: 22b52c23e6dd2809733e011a8eedab03

File Name / Process File Name

This virus commonly use several file name to spoof it self as a folder. Here it is some sort of file name has been use by this malware:

1. romantic.exe
2. forever.exe
3. System Volume Information.exe
4. love.exe
5. task.exe
6. userinit.exe
7. system.exe
. autorun.inf

There is 2 common process file name used by this worm:
1. userinit.exe
2. system.exe

Startup / Registry Alteration

The worm altering Windows registry as a startup point everytime Windows load.

Key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit=c:\windows\userinit.exe

Other modified registry key is:
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
"NoDriveTypeAutoRun"
"NoDriveAutoRun"

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
"HideFileExt"
"ShowSuperHidden"
"Hidden"

Payload

The worm seem to overwrite a %systemroot%\system32\drivers\etc\hosts file and set every unwanted domain name to pointing to localhost (127.0.0.1) IP. Most of the listing are computer security website including antivirus, firewall and download site.

The worm also contain some DDoS attack code which will send a random packet to the target.

Programming

This virus has been created by people who was new to the programming especially Visual Basic 6. Take a look some of their codes, it uses many timer to use their malicious function thus, making this worm unstable and taking alot of CPU usages.

Other Analysis:

Here it is some extracted string from the compiled Executable file.
Download here

Other analysis:
Analysis from Virus Total

VDEF updates for Portable Antivirus is available to download.

New Microsoft Windows 7 RC Launch!

2009-05-06T23:57:00.005+08:00

Just a few minutes ago, I've read google news that Microsoft is already launch a new Microsoft Windows 7 Release Candidate (RC). Well, I'm still not finish yet exploring Windows 7 Beta Build 7000 but this is the chance to get free and unlimited licenses number from Microsoft product. Gotta get it now.

To download Microsoft Windows 7 RC click here!

Are you with Windows 7?

2009-05-03T00:33:00.005+08:00

After 4 month of using Microsoft Windows 7 Ultimate, I think there is much more improvement compared with Windows Vista Ultimate. Only a few minor bugs I found on Start Menu and visual effect thing. Well, as I read a news from ComputerWorld, Windows 7 could be lunch this August but still no specific date. Hope it much better after the first release.

Windows 7 taskbar have totally different compare with other Windows version. When many Windows opened, taskbar will appear only an icon with a great stable thumbnail preview. Also, when user try to open many Windows Explorer, all the Windows will be grouped into one icon on the taskbar until user over their mouse cursor on it to choose which Window they want to use.

Well, here it is a few minor uncomfortable thing/bugs I found my self on Windows 7 Ultimate Beta Build 7000:

1. Start menu scroll bar some time cannot be scroll or dragged by mouse.
2. In some cases, the wallpaper disappear and leave only plain color.
3. When I lock the Windows and the logged in back, the screen resolution reset to the recommended setting (another rarely situation).
4. Some old application (mine was Macromedia Fireworks 8) still can't totally support Aero/transparent window effect.

Data0.Net Temporary down!

2009-04-18T21:31:00.002+08:00

This week Data0.Net and several website has temporary down due to the change of new server from Germany to Malaysia. This may take a week to transfer all the data. Hopefully, it work better than before.

You together with Conflicker!

2009-04-01T22:52:00.002+08:00

Mmm... I have already monitoring this worm since it it was first version... I think around the end of last year. This worm have some unique technique to spread itself along with their payload. After I discover this worm hiding itself on 'recycler' folder on somebody USB flash drive. On some version this worm cannot be just delete to remove it. It will need special permission in order to remove it completely. But, once its running on your PCs with network. Your network could be clogged because this worm has an abilities to generate about 500 domain name by itself. The worm is not designed by non-professional programming. This 'guy' have a programming skill and the worm was designed to create a huge network clog. Quite interesting to me.

The complete and detailed analysis can be found from the link below:

http://mtc.sri.com/Conficker/addendumC/index.html

What is Heuristic?

2009-03-29T18:13:00.005+08:00

Many people ever heard about Heuristic detection or in other name some security product called it TruPrevent, AHeAD as well as Portable Antivirus called it Alternator Heuristic Technology (AHT). In simple word, Heuristic technology is a method to determine if the program is similar to the previous detection of common viruses.

Here it is a good explanation about Heuristic taken from Wikipedia:

Heuristic (/hjuːˈrɪs.tɪk/) is an adjective for methods that help in problem solving, in turn leading to learning and discovery. These methods in most cases employ experimentation and trial-and-error techniques. A heuristic method is particularly used to rapidly come to a solution that is reasonably close to the best possible answer, or 'optimal solution'. Heuristics are "rules of thumb", educated guesses, intuitive judgments or simply common sense. Heuristics (hyu-ˈris-tiks) as a noun is another name for heuristic methods.

In more precise terms, heuristics stand for strategies using readily accessible, though loosely applicable, information to control problem solving in human beings and machines.^[1] Forensic engineering is an important tool in tracing defects in products and processes. The Heuristic Model or commonly referred to as the (gut-level approach) is a simplified method of decision making that put emphasis on internal personality attributes of the decision maker.

There is several way for making Heuristic detection:

Detecting double extension file
Detecting based on PE-Section hash
Detecting based on Resource Section
Detecting based on Compression method
Detecting based on String
Detecting based on API

and many more...

Data0.Net Problem?

2009-03-20T20:59:00.004+08:00

Well, there was almost 2 weeks already that my data0.net domain went down. But this is not affected to all country and area. I was informed that TMNet was trying to do something with undersea cable that connected to the Europe. Data0.Net was currently hosted at Datacenter located in Frankfurt, Germany.

I was reported that a few major domain also affected such as www.syok.org, www.asiahoster.com, www.lombongit.net and so on.

AsiaHoster.com Web Hoster!

2009-03-06T09:58:00.003+08:00

Well, after a few weeks i'm keep monitoring this web hoster. It seem that this provider should take care very much about their server since there is many domain shared into one server. This because the server always down 3-4 times a weeks and sometime 1 time a day. It may take around 1-3 hours downtime.

As we can see below, the picture that cause of server down.

It seem someone from the shared hosting use lot of memory that may cause of the server down and all people on the shared domain loose their advantaged with unfair usage. AND, its keep low. I don't know how much domain name parked on this server.

Little detailed:

The main datacenter seem located at Frankfurt, Germany.

Here it is a few domain name list known shared with ns1.asiahoster.com and ns2.asiahoster.com:

http://ahmadfaidhi.com/

http://blog.ahmadfaidhi.com/

http://fairuji.nasz.my/

http://hujan.org/

http://image.syok.org/

http://rekreasikota.summitmy.com/

http://rocker.smktip.com/

http://savoc-nru.syok.org/

http://syok.org/

http://torrent.syok.org/

http://www.ahmadfaidhi.com/

http://www.asiahoster.com/

http://www.fairuji.nasz.my/

http://www.hujan.org/

http://www.indiefanzine.com/

http://www.jejakpuncak.summitmy.com/

http://www.limemyth.com/

http://www.mykjkk.com/

http://www.nasz.my/

http://www.penfluid.com/

http://www.summitmy.com/

http://www.syok.org/

Some of the website listed above is already change their server due to the lack of server response.

Google Problem? Turn all result to "This site may harm your computer"

2009-01-31T22:52:00.010+08:00

Today and a few minutes ago, i'm trying to search some plugin for my Wordpress pages on Google Search but suddenly all search result turn into "This site may harm your computer". As you can see below is an images from the result.

Then, if you click on one of those link it will turn result that says "Warning - Visiting the website may harm your computer!". See the images below.

If we click to all link came from the result it will give a warning of a fake malware. This also include search on images. All the link will return result from the following URL example.

http://www.google.com.my/interstitial?url=http://wordpress.org/

and another error images a few minutes ago...

I guess maybe Google people are trying to test something on the server in real situation...

"Downadup" worm infections skyrocket

2009-01-24T22:16:00.000+08:00

The number of desktops and servers infected by the "downadup" worm has skyrocketed to nearly nine million, according to security firm F-Secure.

That is an increase of more than six million since Thursday last week, when F-Secure warned that the worm was affecting corporate networks and spreading rapidly.

The worm, also known as "conficker", is a large family of network that causes various problems, including locking network users out of their accounts.

F-Secure said in a blog that the spread of the worm was "amazing" and that the situation was not getting better.

The firm ascribes the rapid infection rate to the fact that there are several different variants of the worm.

The most common variant F-Secure has been tracking is creating 250 possible domains each day, the firm said.

ComputerWeekly.com

What is a computer virus?

2009-01-05T23:29:00.004+08:00

To put it simply, a computer virus is just a small computer program that can replicate itself and place itself on a computer without the computer user knowing it. They typically come attached to other files. These files are typically executable files with a (.exe) file extension. People often use the term virus to mistakenly label other troublesome programs that are really malware or adware. There is a difference. Most malware and adware do not replicate themselves and therefore are not technically considered viruses. However, these days, malware is a far more common type of infection. Other things that can infect a computer but aren't really viruses are things like computer worms and Trojan horses.
Trojan horses are very common these days. As their name implies, they often sneak into a person's computer because they come packaged as a useful program like a screensaver or something. Then, once they are installed on the computer, they open up ports (like a secret door to the internet) on your computer and allow other types of infections to sneak in. These other infections come in totally unannounced. You won't realize they are there until your antivirus program happens to detect them. By then, it is possible that their intended damage has already occurred.
This is why it is important to have a firewall on your computer. The firewall increases the computer's security by closing all of these doors and locking them. The firewall only allows doors to open that are used by common programs like web browsers and email. For another port (door) to be opened, the firewall program usually asks for permission from the computer user. That's why you get the messages popping up in the lower right hand corner of your computer asking if it is okay for something to happen.
Another type of infection is the computer worm. Computer worms are like viruses except they do not come attached to any other files. These worms can move from computer to computer across a network. They move from computer to computer by going through open ports. This is the biggest benefit of having a firewall to keep those ports closed and locked. The internet is one giant network. So, just by being connected to the internet, your computer is exposed to this type of infection.
Adware is another type of program all together. Typically, these program come bundled with other software as well. When downloading some music sharing software, if you read all the fine print you would see that the reason that software is free is because it comes bundled with an adware program. The adware program will make pop ups come up on your computer. It might also modify your internet browser so that your search results are influenced in some way that benefits the author of the program.
I can honestly say from experience that you can guarantee getting an infection by using your Windows based computer to browse the internet regularly if you do not have an adequate firewall on your computer. The firewall is far more important than your antivirus software itself. This is one of the most misunderstood computer security issues among the general public.

Download Portable Antivirus

2009-01-04T08:44:00.003+08:00

[ Download Section temporary not available ]

Windefender2009 – not an Antivirus

2008-12-19T15:16:00.007+08:00

The WinDefender2009 infection starts any of three ways. You can go to a corrupt porn web page, a corrupt website that promotes gambling, or you can open an attachment in a spam email. Any of those three ways will get you infected with WinDefender2009. On the porn and gambling related sites, WinDefender2009 will pretend to be a video codec or an ActiveX control.

WinDefender2009 is new on the wild web. It is almost a funny thought that a fake antivirus has upgraded itself, but that is the alarming reality. Once WinDefender2009 has its hooks into your computer you start getting alarming pop-ups tell you that your computer is infected. These pop-ups make the claim that only WinDefender2009 will remove your infection. We have seen WinDefender2009 before. WinDefender2009 is a clone. The names WinDefender2009 has been known as in the past are TotalSecure2009, TotalSecure 2009 and Total Secure 2009.

Once you click on the pop-ups your computer goes to a website with a fake scan. This fake scan will tell you files, which are really part of your operating system, are your infection. Sometimes the scan can name hundreds of files. This can be alarming for the uninformed computer user. We all want our computer to be healthy and work properly. So when faced with the possibility of such a large infection, the uninformed computer user can fall for the scam and purchase the full version of the software when suggested after the scan.

When WinDefender2009 is “purchased” you have traded your credit card information in exchange for a bundle of spyware, malware and adware. So you have paid for an infection. No just an infection though--you have paid for an infection that is difficult to remove. The spyware will monitor your behavior for personal information, log ins and passwords, which it will send to the original programmers. The adware will monitor your browsing behavior and present you with pop-up ads for products and services it deems relative to your interests and browsing habits. Your pop-up blocker will be useless against these pop-ups. In addition, the malware will run in the background and affect your computer’s performance, making it slow to start up or shut down. Your system tray icons, background and screensaver will be changed. Legitimate system files, registry keys, and DLL files will go missing, causing you to get the “Blue Screen of Death.”

WinDefender2009 is difficult to remove manually. If you miss any file, WinDefender2009 will reinstall itself on system startup. To deal with WinDefender2009 you need an antispyware program, not an antivirus. If you already have one, but you still have WinDefender2009, you should contact the makers of your program. In most cases the software companies will make a fix for any new threats their users have found. If your program claims to have removed WinDefender2009, yet it fails to do so, look for an antispyware program with a 100% removal guarantee. With new threats it can take months for all antispyware companies to come up with effective removal tools.

7 Steps to Get the Best Online Internet Security

2008-12-18T14:38:00.003+08:00

The concerns of Internet Security have grown today like never before. Despite the continuous attempts of Internet community, the threats are increasing and getting more and more vicious by each passing day.

There are many Internet Security tools available in the market. Some of them are outstanding. But still, none of them is perfect. It can't be. The best protection is in your own hands. Follow a disciplined approach while using Internet services.

1. Be careful about using MS Outlook. Outlook is more susceptible to worms than other e-mail programs, unless you have efficient Anti-Virus programs running. Use Pegasus or Thunderbird (by Mozilla), or a web-based program such as Hotmail or Yahoo.

2. Take special precaution while dealing with email attachments. Be cautious about attachments with a double extension, such as .txt.vb or .jpg.exe, as the system will only recognize the extension to the extreme right, and run the file as such. Double extensions are often a good indicator that the file is malicious.

3. Do not use disks that other people gave you, even from work. The disk could be infected with a virus. Of course, you can run a virus scan on it first to check it out, but AV programs are not 100% effective.

4. Do not download software from just any website. If it is a reputable site that you trust, you are probably safe. The threat is not only from software; even other file types like .txt, .doc, .xml can have infections.

5. Be careful when surfing. You might get a malicious script from a webpage without even getting a warning. Tweak your Browser settings for maximum safety.

6. Try to balance paranoia with common sense. Some people get really weird about viruses, spyware, etc. It's just a computer! Back up your data and follow these steps, and it shouldn't be a big problem.

7. Setup your download manager to scan a download first before you open it. When you click to download a file from Internet, generally browser gives two options. To save it on the Disk or To Open the file with the default program. Always choose the first option, because, it ensures that the download is first scanned with your antivirus, before saving it on the disk.

10 Tips to Make your Windows Computer Faster

2008-12-16T15:09:00.004+08:00

Your computer running Windows isn’t running in the same speed that it used to run when you first used it. It’s slower, crappy, takes a while to start and tests your patience like anything. There are many reasons for this, let’s try fixing up a few things on your slow Windows PC:

Slow Start Up
There can be a variety of reasons to Windows loading slow during start up. Go to Run, type msconfig and hit enter. Under the ‘Start Up’ tab, uncheck the unwanted programs and press OK. Things should be a bit fine the next time Windows boots.

Another program worth mentioning here is StartUp Delayer which will help in setting after how much time programs should be loaded after Windows boots. For instance, you could set your instant messenger program to load 50 seconds after Windows starts up.

Slow Loading Start Menu
If the Start Menu items are loading slowly, you can open the Registry Editor by typing in the Run menu ‘regedit.exe’ and pressing Enter. Go to HKEY_CURRENT_USER\Control Panel\Desktop. Look for MenuShowDelay, and double click to edit the value. The lower the number specified, the faster the Start Menu will load.

Slow Right Click Context Menu
Probably the Windows Right Click menu on your computer is loading slow because too many programs added unwanted entries there. Just download this program called Mmm, install it and then modify your context menu to remove unwanted items to speed it up.

'Send To' Menu Slow Send To Menu
If the Send To menu loads slowly, you can type ’sendto’ in the Run Dialog, and remove unwanted items in the Explorer Window that appears. This should add some speed to it.

Slow Defragmentation
The Windows Defragmenter can’t get any slower. You need to have an alternative to the Windows Defragmenter, and Defraggler is just one of the best ones available in the market. It’s free, and works like a charm and can speed up defragmentation manifold. For some alternatives, see Five Free Programs to Defragment your PC.

Slow loading My Computer Window
my-computer.jpg If the My Computer Window loads slowly, in the Explorer Window, go to Tools>> Folder Options>> View and uncheck ‘Automatically search for network folders and printers”

Slow loading Add or Remove Programs Applet
This is one of the most annoying piece of programs present in Windows, it takes ages to load if you have a considerable number of programs installed on your computer. You can either use the all-in-one CCleaner for this purpose, or get MyUninstaller that comes as a speedy replacement for Add or Remove Programs.

Slow Ending of Unresponsive Programs
If you’ve clicked on ‘End Task’ if any program is running unresponsive, you might have noticed that the program is not terminated immediately. You can alter this by going to Run>> regedit.exe>> HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ and change this value to 1000.

Disable Animations and Appearance Overhauls to maximize performance
If you’re a serious performance junkie, you probably won’t bother about eyecandy. Go to System Properties in the Control Panel. Click ‘Advanced’, then ‘Performance’ and click ‘Adjust for best performance’. This might boost your PC’s performance up a bit.

Additional Tips:

- Always keep your computer clean. Remove Junk and Unnecessary registry entries. Use CCleaner for this purpose, one excellent tool that just does what it says.

- Don’t keep installing software. Install a program only if it really serves you a purpose.

- Keep as less programs as possible running on the System Tray. This essentially means reducing the number of programs that start during Windows start up.

10 Tips: Prevent from Viruses

2008-12-14T22:01:00.001+08:00

1. Regularly install updates for your anti-virus software.
New viruses are constantly appearing - unless you have updated your software, it may not have the necessary information for handling new virus types and variants. When you install an update, new entries are added to the software's virus definitions database so that suspect files can be recognised and dealt with. F-Secure issues a new anti-virus update daily, and unless you change the settings, will remind you every seven days that you should update.- normally, every couple of weeks should be considered the longest you should leave it. Make a special effort to update when a new virus "hits the headlines".

2. Think twice about using Outlook Express for your e-mail.
Outlook Express is too closely bound up in its workings with Internet Explorer and your access to the World Wide Web to maintain adequate security. Using more self-contained e-mail client* software, it's pretty well impossible for a virus to enter your computer except through your opening an infected attachment. With Outlook Express, simply through an e-mail being displayed in the Preview Pane you can be taken straight to a website from which infected script is loaded up on your computer. A patch has been issued by Microsoft to deal with this glaring security hole, but this has been severely criticised by independent evaluators. For more information, click here. It's much better to use fully-fledged e-mail client software, such as plain Outlook, First Class Conference etc. for handling your e-mail.

* The client-server relationship is something which you'll keep coming up against when you use Internet services - your computer needs the appropriate client software installed so you can use the services of particular types of server - e-mail, ftp (file transfer protocol), web. A server is just a "dedicated" computer - one which serves a specific purpose in a network.

3. Don't open e-mail attachments unless you know who's sent them and what they are. Change your view settings so you can see file extensions.
This is much more important with some types of file than with others - you can recognise different file types by the extensions they have. .EXE, .COM, .PIF, .JS, .VBS, .SHS, .SCR, .DOT are some of the most notably dangerous. Double file extensions - for example "readme.txt.vbs" - should always be treated with suspicion.
Look out also for oddities in the header information of e-mail messages - a sender you've never heard with a subject such as "sorry about yesterday"; a blank subject header.

On many computers, the default setting means that you see file names without their extensions. So, suspect attachments won't be immediately evident. To set your computer so that you see file extensions:open My Computer or Windows Explorer. From the View menu, select Options, then click the View tab. Make sure that "Hide file extensions for known file types" isn't checked.

4. Never leave a floppy disk in the drive when you start up or restart your computer.
This is the standard, old-fashioned pre-Internet way of passing on viruses. By default, your computer looks first for its operating system to the floppy disk drive, and only then to the hard disk. So, if an infected diskette is on the drive, off goes the virus when you boot up. Always reformat old disks before you reuse them. A virus may have been lurking on it for years. If you have the confidence to change your computer's BIOS settings, it's a good idea to alter the boot sequence to C: A: This will set your computer so that it refers first to the hard disk instead of the floppy drive when it boots up.

5. CDs and Zip disks can carry viruses too.
Now that Internet-transmitted viruses are far more popular than disk-transmitted ones, this isn't all that common. But it remains a possibility! You can run an anti-virus scan on any kind of diskette - this never does any harm.

6. If your anti-virus software reports a suspect file, take all possible action before you close down your computer.
Familiarise yourself in advance with your anti-virus software so that you know what decisions to make in an emergency. It's at the stage of booting up again that a virus file can pass all of its nastinesses into your operating system, and into your system registry.

Whatever anti-virus software you're using, you're likely to run into situations where a file is recognised as suspect, but contains a new or unusual virus which isn't included in the software's virus definitions database. If this happens you will be told that the suspect file can't be disinfected, and offered the choice to rename or delete it. Delete unless you have very good reasons for thinking it could be a wanted and important file.

F-Secure users in this situation may find it something other than intuitive that you must press the Back button to return to the screen where, when disinfect has failed, you can choose the delete or rename alternative. Don't press the Finish button!!

7. Make sure you have a system start-up disk to use in emergencies.
If a virus does manage to infect your system, it could mean that you can't load Windows. Without a start-up disk, which will be different for different computer models and operating systems, you - or anybody you call on for help - will have a much harder time rescuing your system in the event of failure. This applies whether or not failure is due to a virus infection. If a start-up disk wasn't supplied with your computer, follow the appropriate link (Internet connection required) to Microsoft's instructions for making one: Windows 95/98 ;Windows ME; Windows 2000; Windows XP.

8. When using Microsoft software, always make sure that you keep macro virus protection enabled.
Macros are stored sets of instructions which are used within Microsoft Office applications to automate complex or repetitive tasks. Unfortunately macros can also be used to introduce viruses. Macro virus protection is set from within each of the Office software applications:
Office 97: from the Tools menu, select Options, then General. By default protection is enabled - don't switch it off!
Office 2000/XP: go to Tools | Options | Security. With Macro security set to medium, Word warns of macros in a file and prompts whether you want to disable them. High security automatically disables all "unsigned" macros.

If you receive a macro warning when you open a Microsoft Office file, always select the "disable macros" option unless you expect the file to contain a macro and know that you can trust it.

9. Only download files from trustworthy websites.
Always avoid downloading files from bulletin boards or public newsgroups - these are particularly likely to be used by virus writers to distribute their new viruses. When downloading software updates (for instance drivers, multimedia players etc.), go to the manufacturer's official website. Be watchful!

10. Never pass on a virus warning without checking first yourself that it isn't a hoax.
Hoax virus warnings can be more than just a nuisance - they may be almost as dangerous as viruses themselves. For example, you may be instructed to delete a file from your computer in order to prevent a virus infection, when in fact the file is an essential system file. Before passing on any virus warning message, check on the specific virus you're being warned about at the F-secure website, or the website of any other producer of reputable anti-virus software.

U3 - Portable USB Apps Platform; Secure your USB Drive

2008-12-13T17:26:00.005+08:00

It's official, the floppy drive is dead. Indeed, Dell and a plethora of other PC manufacturers have simply stopped including the decades-old drive, thanks in no small part to the smaller, lighter, and faster USB flash drive that can carry over 1,000 times the standard 3.5" floppy. We've watched the evolution of the portable data disk, but now it's time to take that evolution a step further.

Enter the U3 smart drive. Co-developed by SanDisk and M-Systems, the open-standard U3 platform allows users to take their applications, not just data, with them to any USB-equipped Windows PC and to launch them with as little as two clicks. True, while applications have been tweaked by users to run directly off a flash drive, applications written for U3 smart drives don't require a geek to set up, and are 100% legal to operate.

Two Letters for the Price of One
The first time we plugged our retail Geek Squad U3 Smart Drive into the computer, Windows automatically recognized the drive and set the Add New Hardware wizard to work, identifying not one but two drives taking up two drive letters.
A small, 4MB read-only system partition of the U3 drive pretends to be a CD-ROM drive, while the data partition shows up as a regular flash drive. Because Windows is led to believe that the system partition is a CD, U3 takes advantage of the AutoPlay feature in windows to automatically run the U3 LaunchPad and unlock the data partition of the drive. It should be noted that U3 will run on any Windows 2000/XP system, regardless if the user has administrative rights or not.

After the LaunchPad's animated splash screen disappeared, we were greeted by an Oddcast talking presentation of the U3 platform's features and a quick intro of how to use the LaunchPad and download additional applications. Kudos goes to whoever thought of using the Oddcast system for a quick intro of how to use the drive, as it provides a user-friendly way for new users and computer-illiterate types to quickly jump into using the drive.

Apps Ahoy!
The LaunchPad is the heart of the U3 smart drive, and bears a striking resemblance to the Windows XP start menu. Accessed from a U3 icon in the system tray, it provides quick access to applications and documents installed on the U3 smart drive, as well as mean to manage them.

The left side of the LaunchPad lists the installed applications and next to their icons, with a convenient Download Programs link underneath that links to the U3 software catalog. The right side of the LaunchPad contains links to open the data partition in an explorer window, manage installed apps and the drive itself, and get help.

Programs can be either downloaded via the built-in web browser (barebones Internet Explorer), or installed from a file on the local computer. In the case of the Geek Squad drive, we are given a third option to download software from the Geek Squad's software catalog (actually hosted by M-Systems, one of the U3 co-founders), which is just the three applications and intro that came preloaded. Not that it matters to most users, but there are two file-types associated with the U3 platform. *.u3i is an XML-based text file that defines the application's version, download path and working parameters, whereas *.u3p is a zip file containing everything needed to run an application.

Most users will find themselves downloading new programs from software.u3.com. While somewhat quirky in design, the site organizes the various applications into 9 different overlapping categories that can then be sorted by name, price, or download availability. Quick links to download freeware or trialware allow users to quickly try software before making a purchase decision. A Top-5 Downloads and Coming Soon section also help to see what new applications everyone's raving about.

While some of our favorite applications like Dmailer, Thunderbird, Trillian, Winamp and McAfee AV are already out for download, it's quite interesting to see what's headed to the platform. Skype's PC to Phone VoIP service, Firefox's superior web browser, PocketSearch's file content search, and PocketCache's snapshot-based backup system are sure to make a splash when they become available, and there's even a DVD authoring program headed for the drive. What strikes us as odd however is that we couldn't find any word processing applications mentioned yet, so for now we'll just have to fill the gap with Portable OpenOffice.

Once a U3 application is installed on the drive, you can specify the order in which it appears in the LaunchPad, and tell it to start every time the drive is plugged into a computer. Detailed statistics on the version, footprint of the program, last run time, and vendor are also available.

For Your Eyes Only
It's possible to lock down the U3 smart drive's data partition with a password so that files will remain secure from prying eyes, complete with password hint. When security is enabled, the CD-ROM partition will load first, and will only enable the data partition after authentication. A password hint can be specified for those with bad memories, and in a worst case scenario the entire data partition can be erased if the password is truly forgotten.

Enabling security comes at the expense of backwards compatibility however. Because U3 is only compatible with Windows 2000 and XP, any Mac, Linux, or Windows 98/ME users will not be able to authenticate themselves to see the partition. When plugged into a Mac running OS X 10.3, we didn't see the data partition at all until security was disabled. Users working in a cross-platform environment may wish to look into an alternative security application to secure their documents. Also, it is unclear if files stored on the drive are encrypted or not, but most likely they are not because it takes mere seconds to enable security for a near-full 512MB drive.

One curious discovery we made was mention of a self-destruct feature in the U3 help files, stating that after a certain amount of invalid password attempts, the drive would lock itself permanently requiring a total reformat. We tested this on the Geek Squad drive, but after 100 invalid password attempts our data was still accessible. Only time can tell how secure the U3 platform really is.

The Bottom Line
U3 is an important step in the evolution of how we get our work done. User-friendly and well documented, U3 smart drives are something that we could actually give to our grandparents without worrying about how many times they'll be calling us for tech support.

In the future when office applications are released, parents can send their U3-equipped kids off to college knowing that they can get their work done on any of the school computers without having to buy an expensive laptop. Perhaps most importantly, people with multiple computers will actually be legal and don't have to deal with paying over $300 on products like Office thanks to End User License Agreements (EULAs) being written per flash drive instead of per computer.

About the only thing we can see wrong with the U3 platform is the lack of cross-platform compatibility, but that might change later on now that Macs are going x86.

By Scott Clark, Consumer Technology Editor
Edited by Alternator