New spamming campaign has been reported by Trend micro. This type of malware is spreading through Facebook.  The downloaded malware is another type of Zbot, also called Zeus a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet.
Malware spreads by sending messages to victims that includes Facebook friend request notification. When user clicks to approve the friend request link opens a page that invites him to install the latest version of Adobe Flash Player. But here the link takes user to install TSPY_ZBOT.FAZ instead of Adobe Flash Player.


This spyware adds registry entries to enable its automatic execution at every system startup. It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.
Generally Trojan.Zbot files are used to compromise computers is generated using a special toolkit that is available in marketplaces for online criminals. Toolkit allows an attacker a high degree of control over the functionality of the final executable that is distributed to targeted computers.
The Trojan itself is primarily distributed through spam campaigns and drive-by downloads, though given its versatility, other vectors may also be utilized. The user may receive an email message purporting to be from organizations such as the FDIC, IRS, MySpace, Facebook, or Microsoft.

According to Cyberoam an IT firm, which recently published a survey report, online scammers are targeting Facebook members by sending them several "friend request" messages for defrauding them into taking down one banker Trojan, published The Times of India on October 19, 2011.
The survey, which Cyberoam conducted, reportedly involved Commtouch another IT security software firm as a partner.
Senior Vice-President of Product Management Abhilash Sonwane at Cyberoam stated that modern scammers along with malware creators knew very well Facebook users' behavioral psychology. They knew that, although intelligent, many users of the social-networking website didn't think again prior to accepting an unknown stranger's 'friend request' e-mail, alternatively answering random such e-mails, hoping they would get gifts and free devices. Online-crooks would constantly tweak their assaults against websites for social-networking exploiting the public's frailties, Sonwane explained. IndiaPRwire reported this on October 19, 2011.
Moreover, Cyberoam as well noticed how free offers through Facebook enticed users that prompted them for disseminating junk e-mails within their friends circle. In addition, the survey discovered an omnipresent "like" button on Facebook that advertising-fraudsters harnessed for enticing end-users into supposedly getting an iPhone 4 for free.
Evidently, the fraudsters gained much out of effective 'free' publicity because of Facebook users' trustworthiness, in addition to potentially acquire their other details from personal profiles to commit ID-theft.
Moreover, spam attachments crafted with "right-to-left" override, deceived people who didn't bother about file extensions on computers running Windows.
In the meantime, the report further revealed that India kept on being on No.1 among the globe's major 'compromised PC' or technically, 'zombie' destinations, while Brazil fell to No.3 rank.
Additionally, according to the report, e-mail-borne viruses revived during Q3-2011 when numerous attacks occurred during August-September 2011. At the peak, however, 25bn malware-laced e-mails were distributed per day.
Meanwhile, users wishing for getting the free iPhone 4 had the message directing them for 'liking' many web-pages, supplying their postal add as well as passing on the 'friend request' e-mail to at least 100 others, thereby making sure the scam proliferated,
Hence, according to the security specialists, social networking members require staying vigilant about these scams.

Thе Google security team hаѕ enabled forward secrecy іn іtѕ HTTPS services bу default, ѕο thаt captured messages саn’t bе decrypted retroactively. Even though Gmail wеnt tο a secure HTTPS connection bу default last year, encrypted files сουƖԁ still bе captured іn thеіr unreadable form аnԁ broken years later, whеn computers аrе much fаѕtеr.

Othеr HTTPS Google services include Docs аnԁ Google+, аѕ well аѕ SSL Web search. AƖƖ thеѕе services аrе now forward secret whеn HTTPS іѕ turned οn. Initially, οnƖу Chrome аnԁ Firefox wіƖƖ υѕе forward secrecy bу default wіth Google services, bесаυѕе Internet Explorer doesn’t support Google’s combination οf thе RC4 authentication аnԁ ECDHE key exchange mechanisms. “Wе hope tο support IE іn thе future,” thе security team ѕауѕ.
Thе forward secrecy enabled today requires thаt thе private keys thаt maintain thе connection tο thе service аrе nοt held іn persistent storage. Thаt means a wουƖԁ-bе attacker саn’t reverse-decrypt past connections. Nοt even thе server operator саn decrypt thеѕе sessions retroactively. Thе team hаѕ released іtѕ work οn thе open-source OpenSSL library thаt enabled thіѕ security.
Yου саn see whether уουr connection іѕ secure bу clicking thе green padlock іn уουr browser’s address bar whеn οn аn HTTPS site.



Google’s Progress οn Security
Google mаԁе encrypted Web search available іn 2010, bυt іt ԁіԁ nοt anticipate thаt thе secure domain wουƖԁ conflict wіth thе Children’s Internet Protection Act, whісh requires schools tο monitor аnԁ block сеrtаіn websites. Sіnсе secure search prevented schools frοm logging, filtering οr blocking search results, schools wеrе caught іn thе lurch. Google resolved thе problem bу giving secure search іtѕ οwn encrypted.google.com domain.

What is Steganography?

What are the Applications of Steganography?

How do Steganography Tools Work?

The zip file contains two versions of Stego Magic: One for encrypting the text messages and the other for encrypting binary files. StegoMagic_TXT can be used to hide text messages in other files such as an image or a sound file. StegoMagic_BIN can be used to hide one binary file in another such as an executable file inside an image or an image inside a video file.
With Stego Magic, there is no limitation on the size and type of the file that you are intending to hide. For example, you can hide a video of size 1 GB in an image of size 1 MB or hide an executable file inside a WORD document. The tool is pretty straightforward to use and requires no special understanding of the concept.
At the end of the encryption process, a secret decryption key will be generated and the same is required during the decryption process.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:
1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe
2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.
3. Note down the secret decryption key.
Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

Posted By :- |-|A|_F B|_00d Pr|nCe 

Post your queries in our blog or in our facebook page.

For more queries contact:

RAGHAV PANDE(8769233563)

AKASH KUMAR SINGH(9636899541)

VIVEK PARIKH(9784814888)

Visit our blog for regular updates: http://teamhackaholic.blogspot.com/

Follow us at:

Facebook: http://facebook.com/hackaholic.jecrc

Twitter: http://twitter.com/hackaholic.jecrc

Programming never hurts here or there!

Facebook made major changes to its user interface last month, and most of the users found it annoying. They are not just annoyed, but also confused on how the new features function. Users were pretty happy and adapted to the previous UI, which was user friendly and easy to use. However, the new changes to the UI has drawn confusions and put things upside down.
Along with the UI changes, came the real-time updates feature called Ticker. The Ticker basically updates every second with new comments, “likes” and tags made by friends. It is annoying because users don’t really want to know what exactly is happening over Facebook. For instance, Suppose I have 600+ friends on Facebook, and I’m not concerned about who my friend adds or whose comment he/she likes.
According to Facebook, “the Ticker, on the right-hand side of your account, lets you see all your friends’ activity in real-time. When you hover over an item on ticker, you can see the full story and join the conversation as it happens. Ticker updates itself as stories happen. This gives you a more complete picture of what your friends are doing, right now.”
Real-time updates work great with Twitter, but not with Facebook, and I think Facebook should probably stop “copying” features from other social networking sites. Although the new features are annoying, there are ways to revert back to the old Facebook UI, and disable the Ticker as well.
You might have come across blogs indicating the trick to get back the old Facebook UI by changing the preferred language to English (UK), and indeed the trick stopped working as Facebook fixed the issue. However, there is still a way to get back the old UI, and interestingly it works in a similar fashion by changing the preferred language.

How to you get back to the old  lovely Facebook interface & Get rid of this new one?
Change the preferred language to a foreign language other than English (US and UK). For instance, I have changed the language to German. If you’re a Google Chrome user, you will immediately be prompted to “translate” the page into English.
Before you click on the translate button, click on the “Options” button and select “Always translate German to English”. Now refresh or open Facebook in a new tab, and you will notice that every time you open Facebook, the page will be automatically translated to English. That way you will see the old Facebook interface and the Ticker disabled.


If you’re a Firefox user, try using the Facebook Translate add-on. However, I’ll definitely update this post if I find an alternate solution for Firefox users.

People still ask me how to download YouTube videos. I usually point them to www.keepvid.com. I’m sure there are tons of similar video downloading sites but that’s the only name I can remember. Others who use Firefox or Chrome I try to explain extensions but eventually end up on keepvid again. The next time somebody asks me how to download videos, I’m going to point them to Freemake Video Downloader.
I have used one other software by Freemake – their Video Converter and I loved it. With Freemake Video Converter, the developers have once again showed how to blend usability and aesthetics into one impressive little package.


The software is a no-brainer – just copy the URL of the video page, click on the Paste URL button and then choose the video quality and resolution you want to download. You can even extract only the audio tracks from online videos, and optionally convert the audio and videos formats into those supported by handheld devices - AVI, MKV, MP3, iPod, iPhone, iPad, PSP, Android – in one swoop.

You can enter your YouTube or Facebook account login credentials and automatically download privately shared videos from Facebook friends and YouTube pages that require user login. Have multiple accounts? No problem. Create accounts on Freemake Video Downloader for all of them.

Apart from the two most popular video downloading sites – YouTube and Facebook - Freemake Video Downloader allows you to download videos from over 40 different websites including Vevo, MTV, Dailymotion, Megavideo, Vimeo, Metacafe, ComedyCentral, TheDailyShow, Vh1, Veoh, Break, LiveLeak, Photobucket and a host of adult sites.

To prevent toddlers from downloading videos from the adult sites, parents can put a password into the program. Without the correct password, the software refuses to download videos from adult sites. Downloading videos from other sites are not impaired.

If you are running Windows XP Professional on your computer you can install Microsoft's web server, Internet Information Server 5.1 (IIS) for free from the Windows XP Pro installation CD and configure it to run on your system by following the instructions below: -

1. Place the Windows XP Professional CD into your CD-Rom Drive.

2. Open 'Add/Remove Windows Components' found in 'Add/Remove Programs' in the 'Control Panel'.

3. Place a tick in the check box for 'Internet Information Services (IIS)' leaving all the default installation settings intact.

4. Once IIS is installed on your machine you can view your home page in a web browser by typing 'http://localhost' (you can substitute 'localhost' for the name of your computer) into the address bar of your web browser. If you have not placed your web site into the default directory you should now be looking at the IIS documentation.

5. If you are not sure of the name of your computer right-click on the 'My Computer' icon on your desktop, select 'Properties' from the shortcut menu, and click on the 'Computer Name' tab.

6. Your default web directory to place your web site in is 'C:\Inetpub\wwwroot', but if you don't want to over write the IIS documentation found in this directory you can set up your own virtual directory through the 'Internet Information Services' console.

7. The 'Internet Information Services' console can be found in the 'Administration Tools' in the 'Control Panel' under 'Performance and Maintenance', if you do not have the control panel in Classic View.

8. Double-click on the 'Internet Information Services' icon.

9. Once the 'Internet Information Services' console is open you will see any IIS web services you have running on your machine including the SMTP server and FTP server, if you chose to install them with IIS.

9. To add a new virtual directory right click on 'Default Web Site' and select 'New', followed by 'Virtual Directory', from the drop down list.

10. Next you will see the 'Virtual Directory Creation Wizard' from the first screen click the 'next' button.

11. You will then be asked to type in an 'Alias' by which you will access the virtual directory from your web browser (this is the name you will type into your web browser after 'localhost' to view any web pages you place in the directory).

12. Next you will see a 'Browse...' button, click on this to select the directory your web site pages are in on your computer, after which click on the 'next' button to continue.

13. On the final part of the wizard you will see a series of boxes, if you are not worried about security then select them all, if you are and want to run ASP scripts then check the first two, followed by the 'next' button.

14. Once the virtual directory is created you can view the web pages in the folder by typing 'http://localhost/aliasName' (where 'aliasName' is, place the alias you called the virtual directory) into the address bar of your web browser (you can substitute 'localhost' for the name of your computer if you wish).

!!!! You are Done !!!! Enjoy Running your Websites over it ;) :)

I can see you hiding in the shadows over there and so can the logs of all the web sites, FTP servers and other nooks and crannies you visit on the web. The sort of information gathered by these logs and which is available to the webmasters of the sites you visit include the address of the previous site you visited, your IP address, your computer's ID name, your physical location and the name of your ISP along with less personal details such as the operating system you're using and your screen resolution. If someone was snooping through your dustbin to gather information on consumer trends or tracking your every move to see where it is you go everyday you wouldn't be too chuffed would you. Well the web is no different, it's still an invasion of privacy and a threat to security and you don't have to put up with it.


Proxy servers:
Every time you visit a web site, detailed information about your system is automatically provided to the webmaster. This information can be used by hackers to exploit your computer or can be forwarded to the market research departments of consumer corporations who by tracking your activities on the internet are better equipped to direct more relevant spam at you. Your best defence against this is to use what is known as a proxy server, which will hide revealing information from the web sites you visit, allowing you to surf the web anonymously. These work by altering the way in which your browser retrieves web pages or connects to remote servers. With a proxy server set up, whenever you 'ask' IE or Netscape to look at a web page, the request is first sent through an external server which is completely independent of your ISP's servers. This third party server then does the requesting on your behalf so that it appears that the request came from them rather than you and your real IP address is never disclosed to the sites you visit. There is nothing to download and the whole process takes less than a minute.

There are two different ways to use proxy servers and both have their advantages and disadvantages. The first method is to use a web based service. What this involves is visiting the proxy's home page each time you want to browse a web site anonymously. The core component of such a system is the dialog box where you enter the address of the web site you want to visit. Each time you enter the URL of the site you want to browse via the proxy into this box, your personal information, IP address and so on is first encrypted before being sent to the site allowing you to maintain your anonymity. Two of the best examples of this type of web based proxy service are Code:
http://www.rewebber.com/
and http://www.anonymizer.com/.

Obviously one disadvantage of using a web based service like Rewebber or Anonymizer, however, is that you have to visit the proxies home page each time you want to surf anonymously. You could choose to select this page as your default home page, but it's still quite awkward if you're forever site hopping at the speed of light. The second main 'con' is that you often have to put up with extra adverts on the pages you visit. These are automatically inserted into the pages by the proxy - they have to pay for service somehow. More sophisticated and convenient solutions are also on offer yet they come with a price tag.

The second method you can use to protect your privacy via a proxy server involves adjusting the settings of your web browser so that you can surf anonymously without having to visit the home page of your proxy each time. To do this you will first need to know the name of your proxy server and the port number it uses. This information can be gleaned from either a public proxy server list or the FAQ referring to a private subscription based service. Once you have the name of the proxy server you wish to use, select 'Internet Options' from the 'Tools' menu of your browser. Now select 'Connections' followed by 'Settings' and tick the 'use a proxy server' check box. To finish the job all you have to do now is enter the name of the server in the 'address' box, the port which it uses in the 'port' box and go forth and surf anonymously.

Free, manual proxy servers as advertised on anonymity sites, if you can find one at all, are likely to be highly oversubscribed, and as a result the speed at which they retrieve web pages can deteriorate. In which case you can go in pursuit of a public proxy server list and select an alternative from it, which can then be set up manually. To locate such a list you can investigate sites such as Code:
http://www.proxys4all.com/

However, this method isn't problem free either, so before you get too carried away and go jumping on the anonymity bandwagon there are a few things you should be aware of. It's very easy to use proxies to protect your privacy, but often the disadvantages of using them far out weigh the benefits. You see, the problem is that, like the proxy servers provided Rewebber et al, free, public proxies are nearly all over subscribed and so they can slow down web browsing considerably. Digging out fast reliable proxy servers is an art form in itself and is a skill which takes considerable practice. You could find a list of public proxy servers and then experiment with each one until you find one that runs at a reasonable speed, but this can be very time consuming and frustrating. Instead, your search would be much more efficient if you got a dedicated program to carry out this task for you. There are literally dozens of proxy seeking programs around which can do just that, and many of them are available as freeware. What these do is scan the internet for public proxy servers. These servers are then tested for speed and anonymity (not all of them are truly anonymous, even if they claim to be!) and once you find one which suits your requirements you can select it as your default proxy with the click of a button.

One of the most significant advantages of using an automated tool to locate proxy servers is that you do not have to keep editing your proxy settings manually each time you wish to try out a new one. Instead, what you do is enter 'localhost' or '127.0.0.1' into the 'address' box and '8088' into the 'port' box of your browser's proxy settings menu and then forget about it. All future proxy switching is then orchestrated from within your proxy seeking software, which subsequently relays the information to your browser or whatever type of application you are attempting to make anonymous. For those of you who are curious 'localhost' and the IP address '127.0.0.1' are the names by which every computer on the internet refers to itself.
Here's a good selection of links, which should help you to get started - Code:
http://www.a4proxy.com/ Anonymity 4 Proxy
http://www.helgasoft.com/hiproxy/ Hi Proxy
http://www.proxy-verifier.com/ Proxy Verifier
http://www.photono-software.de/ Stealther.

You may find that even when using these programs you have difficulty finding good proxy servers. It is for this reason that many people choose only to use proxy servers temporarily whilst doing something which may land them in trouble with their ISP, or in a worst case scenario with the law. The most obvious example of a situation in which you would want to cover your tracks is when scanning for public FTP servers and subsequently uploading to them. Most other net activities are unlikely to incur serious consequences so under these circumstances you can safely surf the web without a proxy. If you're really serious about protecting your privacy, however, your best bet is probably to invest in a dedicated, stable proxy such as the ones offered by Code:
http://www.ultimate-anonymity.com/ Ultimate Anonymity


These aren't free, but may be worth the expense if you aren't keen on continuously switching proxy servers.

Before splashing out though it may be worth checking if your current ISP has a proxy server of its own which you can use. These aren't there to help you to commit cyber crimes and get away with it, they actually have a legitimate purpose as well - otherwise they wouldn't exist. You see, proxy servers were originally designed to help speed up web page loading times. Proxy servers contain a cache of all the web pages which have been requested via the browsers of the people using the proxy. When someone surfs the web using a proxy, the proxy first checks to see if it already has a copy of the web page stored in its cache. If this version of the page is bang up to date, it is sent to your computer and appears in your browser. If the page found in the cache of the proxy server is older than the one stored on the server hosting the page, a new request to the web server is made and the page is updated in the cache of the proxy before being sent to you. Because these servers use very fast internet connections they can retrieve web pages at much greater speeds than you can via your modest home setup. If these servers are located physically nearer to your home than the web host servers you wish to retrieve web pages from, the speed at which you browse the web will be accelerated.


Anonymity - Cookies
One last important point you need to be aware of before jumping in with both feet is that different programs have to be setup in different ways before being able to make external connections via a proxy server. For example, you can surf the web anonymously by modifying the settings in Internet Explorer or Netscape Navigator as explained earlier in this tutorial, but this will only affect your browser. If you then used Flash FXP to copy a batch of 0-day releases from one FTP server to another, this isn't going to protect you in the slightest. What you have to do is enter the name of the proxy server into each application you wish to make anonymous before making any external connections. This can usually be done by browsing through the preferences of your program to see if there is a 'use proxy server' option available. If there is, make sure you use it!

Cookies:
You have little to fear from the edible variety, but the digital ones can be a major threat to your security and privacy. A cookie is a tiny text file (usually less than 1kb in size), which is created and stored on your hard drive whenever you visit a dynamic (or an interactive if you like) web site. These are used to log your personal details so that you can access members only areas of web sites without having to type in a password every time, or to retain your customised settings so that they are available the next time you visit. If you're using a shared computer, anyone who visits the same site that you have previously logged in to can access your accounts. This is particularly worrying if you have entered your credit card details into a form on an e-commerce site. If your browser is set to automatically fill in these details whenever you
return to a previously visited site, this information could be clearly visible - you don't need me to explain the problems this could entail.

The solution to this problem is to delete any cookies which contain sensitive data once you have completed your transactions. Your cookies will be stored in a different place depending on which operating system you are using so you will have to use your detective skills to find them. As an example, in Windows XP they are located in your 'c:\Documents and Settings\Kylie Minogue\Cookies' directory (that is if your name is Kylie Minogue. Mine isn't in case you're wondering!). If you look in this directory, in some cases it is easy to identify which cookie is associated with which web site, but in other cases it's not so obvious. The cookie which was created when you visited Yahoo.com to check your email may be called kylie minogue@yahoo.txt for example. Unfortunately some cookies refer to the IP address of the site you visited and so look more like kylie minogue@145.147.25.21. These cookies can be selectively deleted one at a time if it's obvious which ones are causing a threat to your security, or you can just wipe out the whole lot in one fell swoop and have them recreated as and when they are required. However, if
you're really struggling to find your cookie jar, you could delete your cookies via your browser's tool bar instead. In Internet Explorer this can be done through the 'Tools' > 'Internet Options' menu items.

If all this sounds like too much hassle, you can always find a labour saving program which will be happy to take the job off your hands. These 'cookie crunching' programs allow you to be more selective when editing, viewing and deleting cookies from your system, and some of them will even prevent cookies from being created in the first place. Yes, I know you're hungry for links so I won't deprive you. Have a look here - Code:
http://www.rbaworld.com/Programs/CookieCruncher/ Cookie Cruncher
http://www.thelimitsoft.com/ Cookie Crusher
http://www.angove.com/ Cookie Killer
http://www.kburra.com/ Cookie Pal
http://www.cookiecentral.com/ Cookie Web Kit.

Here is the List of Commands which are used in mIRC :

/ Recalls the previous command entered in the current window.
/! Recalls the last command typed in any window.
/action {action text} Sends the specified action to the active channel or query window.
/add [-apuce] {filename.ini} Loads aliases, popups, users, commands, and events.
/ame {action text} Sends the specified action to all channels which you are currently on.
/amsg {text} Sends the specified message to all channels which you are currently on.
/auser {level} {nick|address} Adds a user with the specified access level to the remote users
list.
/auto [on|off|nickname|address] Toggles auto-popping of a nick or address or sets it on or off
totally.
/away {away message} Sets you away leave a message explaining that you are not currently paying
attention to IRC.
/away Sets you being back.
/ban [#channel] {nickname} [type] Bans the specified nick from the current or given channel.
/beep {number} {delay} Locally beeps 'number' times with 'delay' in between the beeps. /channel
Pops up the channel central window (only works in a channel).
/clear Clears the entire scroll back buffer of the current window.
/ctcp {nickname} {ping|finger|version|time|userinfo|clientinfo} Does the given ctcp request on
nickname.
/closemsg {nickname} Closes the query window you have open to the specified nick.
/creq [ask | auto | ignore] Sets your DCC 'On Chat request' settings in DCC/Options.
/dcc send {nickname} {file1} {file2} {file3} ... {fileN} Sends the specified files to nick.
/dcc chat {nickname} Opens a dcc window and sends a dcc chat request to nickname.
/describe {#channel} {action text} Sends the specified action to the specified channel window.
/dde [-r] {service} {topic} {item} [data] Allows DDE control between mIRC and other
applications.
/ddeserver [on [service name] | off] To turn on the DDE server mode, eventually with a given
service name.
/disable {#groupname} De-activates a group of commands or events.
/disconnect Forces a hard and immediate disconnect from your IRC server. Use it with care.
/dlevel {level} Changes the default user level in the remote section.
/dns {nickname | IP address | IP name} Uses your providers DNS to resolve an IP address.
/echo [nickname|#channel|status] {text} Displays the given text only to YOU on the given place
in color N.
/enable {#groupname} Activates a group of commands or events.
/events [on|off] Shows the remote events status or sets it to listening or not.
/exit Forces mIRC to closedown and exit.
/finger Does a finger on a users address.
/flood [{numberoflines} {seconds} {pausetime}] Sets a crude flood control method.
/fsend [on|off] Shows fsends status and allows you to turn dcc fast send on or off.
/fserve {nickname} {maxgets} {homedirectory} [welcome text file] Opens a fileserver.
/guser {level} {nick} [type] Adds the user to the user list with the specified level and
address type.
/help {keyword} Brings up the Basic IRC Commands section in the mIRC help file.
/ignore [on|off|nickname|address] Toggles ignoring of a nick or address or sets it on or off
totally.
/invite {nickname} {#channel} Invites another user to a channel.
/join {#channel} Makes you join the specified channel.
/kick {#channel} {nickname} Kicks nickname off a given channel.
/list [#string] [-min #] [-max #] Lists all currently available channels, evt. filtering for
parameters.
/log [on|off] Shows the logging status or sets it on or off for the current window.
/me {action text} Sends the specified action to the active channel or query window.
/mode {#channel|nickname} [[+|-]modechars [parameters]] Sets channel or user modes.
/msg {nickname} {message} Send a private message to this user without opening a query window.
/names {#channel} Shows the nicks of all people on the given channel.
/nick {new nickname} Changes your nickname to whatever you like.
/notice {nick} {message} Send the specified notice message to the nick.
/notify [on|off|nickname] Toggles notifying you of a nick on IRC or sets it on or off totally.
/onotice [#channel] {message} Send the specified notice message to all channel ops.
/omsg [#channel] {message} Send the specified message to all ops on a channel.
/part {#channel} Makes you leave the specified channel.
/partall Makes you leave all channels you are on.
/ping {server address} Pings the given server. NOT a nickname.
/play [-c] {filename} [delay] Allows you to send text files to a window.
/pop {delay} [#channel] {nickname} Performs a randomly delayed +o on a not already popped nick.
/protect [on|off|nickname|address] Toggles protection of a nick or address or sets it on or off
totally.
/query {nickname} {message} Open a query window to this user and send them the private message.
/quit [reason] Disconnect you from IRC with the optional byebye message.
/raw {raw command} Sends any raw command you supply directly to the server. Use it with care!!
/remote [on|off] Shows the remote commands status or sets it to listening or not.
/rlevel {access level} Removes all users from the remote users list with the specified access
level.
/run {c:\path\program.exe} [parameters] Runs the specified program, evt. with parameters.
/ruser {nick[!]|address} [type] Removes the user from the remote users list.
/save {filename.ini} Saves remote sections into a specified INI file.
/say {text} Says whatever you want to the active window.
/server [server address [port] [password]] Reconnects to the previous server or a newly
specified one.
/sound [nickname|#channel] {filename.wav} {action text} Sends an action and a fitting sound.
/speak {text} Uses the external text to speech program Monologue to speak up the text.
/sreq [ask | auto | ignore] Sets your DCC 'On Send request' settings in DCC/Options.
/time Tells you the time on the server you use.
/timer[N] {repetitions} {interval in seconds} {command} [| {more commands}] Activates a timer.
/topic {#channel} {newtopic} Changes the topic for the specified channel.
/ulist [{|}]{level} Lists all users in the remote list with the specified access levels.
/url [-d] Opens the URL windows that allows you to surf the www parallel to IRC.
/uwho [nick] Pops up the user central with information about the specified user.
/who {#channel} Shows the nicks of all people on the given channel.
/who {*address.string*} Shows all people on IRC with a matching address.
/whois {nickname} Shows information about someone in the status window.
/whowas {nickname} Shows information about someone who -just- left IRC.
/wavplay {c:\path\sound.wav} Locally plays the specified wave file.
/write [-cidl] {filename} [text] To write the specified text to a .txt file.

MoViEBoT #xdcc-help /server irc.atomic-irc.net

We strive to make IRC easier for you !!!!

Over the past few years TCP sequence number prediction attacks have become a real threat against unprotected networks, taking advantage of the inherent trust relationships present in many network installations.  TCP sequence number prediction attacks have most commonly been implemented by opening a
series of connections to the target host, and attempting to predict the sequence number which will be used next.  Many operating systems have therefore attempted to solve this problem by implementing a method of generating sequence numbers in unpredictable fashions.  This method does not solve the problem.

This advisory introduces an alternative method of obtaining the initial sequence number from some common trusted services.  The attack presented here does not require the attacker to open multiple connections, or flood a port on the trusted host to complete the attack.  The only requirement is that source routed packets can be injected into the target network with fake source addresses.

This advisory assumes that the reader already has an understanding of how TCP sequence number prediction attacks are implemented.

The impact of this advisory is greatly diminished due to the large number of organizations which block source routed packets and packets with addresses inside of their networks.  Therefore we present the information as more of a 'heads up' message for the technically inclined, and to re-iterate that the randomization of TCP sequence numbers is not an effective solution against this attack.


Technical Details
~~~~~~~~~~~~~~~~~

The problem occurs when particular network daemons accept connections with source routing enabled, and proceed to disable any source routing options on the connection.  The connection is allowed to continue, however the reverse route is no longer used.  An example attack can launched against the in.rshd daemon, which on most systems will retrieve the socket options via getsockopt() and then turn off any dangerous options via setsockopt().

An example attack follows.

Host A is the trusted host
Host B is the target host
Host C is the attacker

Host C initiates a source routed connection to in.rshd on host B, pretending
to be host A.

Host C spoofing Host A             -->  Host B in.rshd

Host B receives the initial SYN packet, creates a new PCB (protocol
control block) and associates the route with the PCB.  Host B responds,
using the reverse route, sending back a SYN/ACK with the sequence number.

Host C spoofing Host A  <--         Host B in.rshd

Host C responds, still spoofing host A, acknowledging the sequence number.
Source routing options are not required on this packet.

Host C spoofing Host A             -->  Host B in.rshd

We now have an established connection, the accept() call completes, and control is now passed to the in.rshd daemon.  The daemon now does IP options checking and determines that we have initiated a source routed
connection.  The daemon now turns off this option, and any packets sent thereafter will be sent to the real host A, no longer using the reverse route which we have specified.  Normally this would be safe, however the
attacking host now knows what the next sequence number will be.  Knowing this sequence number, we can now send a spoofed packet without the source routing options enabled, pretending to originate from Host A, and our command will be executed.

In some conditions the flooding of a port on the real host A is required if larger ammounts of data are sent, to prevent the real host A from responding with an RST.  This is not required in most cases when performing
this attack against in.rshd due to the small ammount of data transmitted.

It should be noted that the sequence number is obtained before accept() has returned and that this cannot be prevented without turning off source routing in the kernel.

As a side note, we're very lucky that TCP only associates a source route with a PCB when the initial SYN is received.  If it accepted and changed the ip options at any point during a connection, more exotic attacks may be possible. These could include hijacking connections across the internet without playing a man in the middle attack and being able to bypass IP options checking imposed by daemons using getsockopt().  Luckily *BSD based TCP/IP stacks will not do this, however it would be interesting to examine other implementations.

Impact
~~~~~~

The impact of this attack is similar to the more complex TCP sequence number prediction attack, yet it involves fewer steps, and does not require us to 'guess' the sequence number.  This allows an attacker to execute arbitrary commands as root, depending on the configuration of the target system.  It is required that trust is present here, as an example, the use of .rhosts or hosts.equiv files.


Solutions
~~~~~~~~~

The ideal solution to this problem is to have any services which rely on IP based authentication drop the connection completely when initially detecting that source routed options are present.  Network administrators
and users can take precautions to prevent users outside of their network from taking advantage of this problem.  The solutions are hopefully already either implemented or being implemented.

1. Block any source routed connections into your networks
2. Block any packets with internal based address from entering your network.

Network administrators should be aware that these attacks can easily be launched from behind filtering routers and firewalls.  Internet service providers and corporations should ensure that internal users cannot launch the described attacks.  The precautions suggested above should be implemented to protect internal networks.

Example code to correctly process source routed packets is presented here as an example.  Please let us know if there are any problems with it. This code has been tested on BSD based operating systems.

        u_char optbuf[BUFSIZ/3];
        int optsize = sizeof(optbuf), ipproto, i;
        struct protoent *ip;

        if ((ip = getprotobyname("ip")) != NULL)
                ipproto = ip->p_proto;
        else
                ipproto = IPPROTO_IP;
        if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) &&
            optsize != 0) {
                for (i = 0; i < optsize; ) {
                        u_char c = optbuf[i];
                        if (c == IPOPT_LSRR || c == IPOPT_SSRR)
                                exit(1);
                        if (c == IPOPT_EOL)
                                break;
                        i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
                }
        }


One critical concern is in the case where TCP wrappers are being used.  If a user is relying on TCP wrappers, the above fix should be incorporated into fix_options.c.  The problem being that TCP wrappers itself does not close the connection, however removes the options via setsockopt().  In this case when control is passed to in.rshd, it will never see any options present, and the connection will remain open (even if in.rshd has the above patch incorporated).  An option to completely drop source routed connections will hopefully be provided in the next release of TCP wrappers.  The other option is to undefine KILL_IP_OPTIONS, which appears to be undefined by default. This passes through IP options and allows the called daemon to handle them accordingly.


Disabling Source Routing
~~~~~~~~~~~~~~~~~~~~~~~~

We believe the following information to be accurate, however it is not guaranteed.

--- Cisco

To have the router discard any datagram containing an IP source route option issue the following command:

no ip source-route

This is a global configuration option.


--- NetBSD

Versions of NetBSD prior to 1.2 did not provide the capability for disabling source routing.  Other versions ship with source routing ENABLED by default. We do not know of a way to prevent NetBSD from accepting source routed packets. NetBSD systems, however, can be configured to prevent the forwarding of packets when acting as a gateway.

To determine whether forwarding of source routed packets is enabled, issue the following command:

# sysctl net.inet.ip.forwarding
# sysctl net.inet.ip.forwsrcrt

The response will be either 0 or 1, 0 meaning off, and 1 meaning it is on.

Forwarding of source routed packets can be turned off via:

# sysctl -w net.inet.ip.forwsrcrt=0

Forwarding of all packets in general can turned off via:

# sysctl -w net.inet.ip.forwarding=0


--- BSD/OS

BSDI has made a patch availible for rshd, rlogind, tcpd and nfsd.  This patch is availible at:

ftp://ftp.bsdi.com/bsdi/patches/patches-2.1

OR via their patches email server

The patch number is
U210-037 (normal version)
D210-037 (domestic version for sites running kerberized version)


BSD/OS 2.1 has source routing disabled by default

Previous versions ship with source routing ENABLED by default.  As far as we know, BSD/OS cannot be configured to drop source routed packets destined for itself, however can be configured to prevent the forwarding of such packets when acting as a gateway.

To determine whether forwarding of source routed packets is enabled, issue the following command:

# sysctl net.inet.ip.forwarding
# sysctl net.inet.ip.forwsrcrt

The response will be either 0 or 1, 0 meaning off, and 1 meaning it is on.

Forwarding of source routed packets can be turned off via:

# sysctl -w net.inet.ip.forwsrcrt=0

Forwarding of all packets in general can turned off via:

# sysctl -w net.inet.ip.forwarding=0


--- OpenBSD

Ships with source routing turned off by default.  To determine whether source routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off, and 1 meaning it is on.  If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0

This will prevent OpenBSD from forwarding and accepting any source routed packets.


--- FreeBSD

Ships with source routing turned off by default.  To determine whether source routing is enabled, the following command can be issued:

# sysctl net.inet.ip.sourceroute

The response will be either 0 or 1, 0 meaning that source routing is off, and 1 meaning it is on.  If source routing has been turned on, turn off via:

# sysctl -w net.inet.ip.sourceroute=0


--- Linux

Linux by default has source routing disabled in the kernel.


--- Solaris 2.x

Ships with source routing enabled by default.  Solaris 2.5.1 is one of the few commercial operating systems that does have unpredictable sequence numbers, which does not help in this attack.

We know of no method to prevent Solaris from accepting source routed connections, however, Solaris systems acting as gateways can be prevented from forwarding any source routed packets via the following commands:

# ndd -set /dev/ip ip_forward_src_routed 0

You can prevent forwarding of all packets via:

# ndd -set /dev/ip ip_forwarding 0

These commands can be added to /etc/rc2.d/S69inet to take effect at bootup.


--- SunOS 4.x

We know of no method to prevent SunOS from accepting source routed connections, however a patch is availible to prevent SunOS systems from forwarding source routed packets.

This patch is availible at:

ftp://ftp.secnet.com/pub/patches/source-routing-patch.tar.gz

To configure SunOS to prevent forwarding of all packets, the following command can be issued:

# echo "ip_forwarding/w 0" | adb -k -w /vmunix /dev/mem
# echo "ip_forwarding?w 0" | adb -k -w /vmunix /dev/mem

The first command turns off packet forwarding in /dev/mem, the second in /vmunix.


--- HP-UX

HP-UX does not appear to have options for configuring an HP-UX system to prevent accepting or forwarding of source routed packets.  HP-UX has IP forwarding turned on by default and should be turned off if acting as a firewall.  To determine whether IP forwarding is currently on, the following command can be issued:

# adb /hp-ux
ipforwarding?X      <- user input
ipforwarding:
ipforwarding: 1
#

A response of 1 indicates IP forwarding is ON, 0 indicates off.  HP-UX can be configured to prevent the forwarding of any packets via the following commands:

# adb -w /hp-ux /dev/kmem
ipforwarding/W 0
ipforwarding?W 0
^D
#

--- AIX

AIX cannot be configured to discard source routed packets destined for itself, however can be configured to prevent the forwarding of source routed packets. IP forwarding and forwarding of source routed packets specifically can be turned off under AIX via the following commands:

To turn off forwarding of all packets:

# /usr/sbin/no -o ipforwarding=0

To turn off forwarding of source routed packets:

# /usr/sbin/no -o nonlocsrcroute=0

Note that these commands should be added to /etc/rc.net



If shutting off source routing is not possible and you are still using services which rely on IP address authentication, they should be disabled immediately (in.rshd, in.rlogind).  in.rlogind is safe if .rhosts and /etc/hosts.equiv are not used.


Attributions
~~~~~~~~~~~~

Thanks to Niels Provos for providing the information and details of this attack.  You can view his web site at http://www.physnet.uni-hamburg.de/provos

Thanks to Theo de Raadt, the maintainer of OpenBSD for forwarding this information to us.  More information on OpenBSD can be found at http://www.openbsd.org

Thanks to Keith Bostic for discussion and a quick solution for BSD/OS.

Thanks to Brad Powell for providing information for Solaris 2.x and SunOS 4.x operating systems.

Thanks go to CERT and AUSCERT for recommendations in this advisory.

You can contact the author of this advisory at oliver@secnet.com



-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3ia

mQCNAzJATn0AAAEEAJeGbZyoCw14fCoAMeBRKiZ3L6JMbd9f4BtwdtYTwD42/Uz1
A/4UiRJzRLGhARpt1J06NVQEKXQDbejxGIGzAGTcyqUCKH6yNAncqoep3+PKIQJd
Kd23buvbk7yUgyVlqQHDDsW0zMKdlSO7rYByT6zsW0Rv5JmHJh/bLKAOe7p9AAUR
tCVPbGl2ZXIgRnJpZWRyaWNocyA8b2xpdmVyQHNlY25ldC5jb20+iQCVAwUQMkBO
fR/bLKAOe7p9AQEBOAQAkTXiBzf4a31cYYDFmiLWgXq0amQ2lsamdrQohIMEDXe8
45SoGwBzXHVh+gnXCQF2zLxaucKLG3SXPIg+nJWhFczX2Fo97HqdtFmx0Y5IyMgU
qRgK/j8KyJRdVliM1IkX8rf3Bn+ha3xn0yrWlTZMF9nL7iVPBsmgyMOuXwZ7ZB8=
=xq4f
-----END PGP PUBLIC KEY BLOCK-----

Copyright Notice
~~~~~~~~~~~~~~~~
The contents of this advisory are Copyright (C) 1997 Secure Networks Inc, and may be distributed freely provided that no fee is charged for distribution, and that proper credit is given.

 You can find Secure Networks papers at ftp://ftp.secnet.com/pub/papers and advisories at ftp://ftp.secnet.com/advisories

 You can browse our web site at http://www.secnet.com

 You can subscribe to our security advisory mailing list by sending mail to majordomo@secnet.com with the line "subscribe sni-advisories"

I assume that most of you use pirated software. Not everyone can afford buying a program like Photoshop, which costs $699. In this case you can use alternative, free software or you can download a pirated, cracked version of the program. There is a vast number of websites out there, where you can find serial numbers and cracks for any program, but most of them aren't safe to use. Actually most of them are spam sites that “bombard” you with full-screen popup ads, or commandeer your computer into a spam-loving Kraken  or Srizbi Botnet army. In this post I will show you the most efficient way of downloading cracks and serial numbers without any risk to your pc. This is the part of Hacking/Cracking using "Google hacking".

Google Hacking :Google hacking in layman's language means how you can search all desired information in direct way,using some google searching tricks.

Now in this article i am going to explain all possible ways to Find the serial Key
a.) Using Google
b.) Using Craagle Software
c.) Using serials search websites.

Finding Serial Key using Google :
 
To Get the serial number from google you have to just follow these steps :


* Go to Google.
* In the search field type : "Software name" 94FBR
* Where, "Software Name" is the name of the item you want to find the serial number for.
* And in google search Results you will get the list of all those websites where the serial key of the required software is available.That's it !!  :-)

HOW DOES THIS WORK ?

Quite simple really. 94FBR is part of a Office 2000 Pro CD key that is widely distributed as it bypasses the activation requirements of Office 2K Pro. By searching for the product name and 94fbr, you guarantee two things.

Fatal Error: the system has become unstable or is busy," it says. "Enter to return to Windows or press Control-Alt-Delete to restart your computer. If you do this you will lose any unsaved information in all open applications."

You have just been struck by the Blue Screen of Death. Anyone who uses Mcft Windows will be familiar with this. What can you do? More importantly, how can you prevent it happening?

1. Hardware Conflict

The number one reason why Windows crashes is hardware conflict. Each hardware device communicates to other devices through an interrupt request channel (IRQ). These are supposed to be unique for each device.

For example, a printer usually connects internally on IRQ 7. The keyboard usually uses IRQ 1 and the floppy disk drive IRQ 6. Each device will try to hog a single IRQ for itself.

If there are a lot of devices, or if they are not installed properly, two of them may end up sharing the same IRQ number. When the user tries to use both devices at the same time, a crash can happen. The way to check if your computer has a hardware conflict is through the following route:

* Start-Settings-Control Panel-System-Device Manager.

Often if a device has a problem a yellow '!' appears next to its description in the Device Manager. Highlight Computer (in the Device Manager) and press Properties to see the IRQ numbers used by your computer. If the IRQ number appears twice, two devices may be using it.

Sometimes a device might share an IRQ with something described as 'IRQ holder for PCI steering'. This can be ignored. The best way to fix this problem is to remove the problem device and reinstall it.

Sometimes you may have to find more recent drivers on the internet to make the device function properly. A good resource is www.driverguide.com. If the device is a soundcard, or a modem, it can often be fixed by moving it to a different slot on the motherboard (be careful about opening your computer, as you may void the warranty).

When working inside a computer you should switch it off, unplug the mains lead and touch an unpainted metal surface to discharge any static electricity.

To be fair to Mcft, the problem with IRQ numbers is not of its making. It is a legacy problem going back to the first PC designs using the IBM 8086 chip. Initially there were only eight IRQs. Today there are 16 IRQs in a PC. It is easy to run out of them. There are plans to increase the number of IRQs in future designs.

2. Bad Ram

Ram (random-access memory) problems might bring on the blue screen of death with a message saying Fatal Exception Error. A fatal error indicates a serious hardware problem. Sometimes it may mean a part is damaged and will need replacing.

But a fatal error caused by Ram might be caused by a mismatch of chips. For example, mixing 70-nanosecond (70ns) Ram with 60ns Ram will usually force the computer to run all the Ram at the slower speed. This will often crash the machine if the Ram is overworked.

One way around this problem is to enter the BIOS settings and increase the wait state of the Ram. This can make it more stable. Another way to troubleshoot a suspected Ram problem is to rearrange the Ram chips on the motherboard, or take some of them out. Then try to repeat the circumstances that caused the crash. When handling Ram try not to touch the gold connections, as they can be easily damaged.

Parity error messages also refer to Ram. Modern Ram chips are either parity (ECC) or non parity (non-ECC). It is best not to mix the two types, as this can be a cause of trouble.

EMM386 error messages refer to memory problems but may not be connected to bad Ram. This may be due to free memory problems often linked to old Dos-based programmes.

3. BIOS Settings

Every motherboard is supplied with a range of chipset settings that are decided in the factory. A common way to access these settings is to press the F2 or delete button during the first few seconds of a boot-up.

Once inside the BIOS, great care should be taken. It is a good idea to write down on a piece of paper all the settings that appear on the screen. That way, if you change something and the computer becomes more unstable, you will know what settings to revert to.

A common BIOS error concerns the CAS latency. This refers to the Ram. Older EDO (extended data out) Ram has a CAS latency of 3. Newer SDRam has a CAS latency of 2. Setting the wrong figure can cause the Ram to lock up and freeze the computer's display.

Mcft Windows is better at allocating IRQ numbers than any BIOS. If possible set the IRQ numbers to Auto in the BIOS. This will allow Windows to allocate the IRQ numbers (make sure the BIOS setting for Plug and Play OS is switched to 'yes' to allow Windows to do this.).

4. Hard Disk Drives

After a few weeks, the information on a hard disk drive starts to become piecemeal or fragmented. It is a good idea to defragment the hard disk every week or so, to prevent the disk from causing a screen freeze. Go to

* Start-Programs-Accessories-System Tools-Disk Defragmenter

This will start the procedure. You will be unable to write data to the hard drive (to save it) while the disk is defragmenting, so it is a good idea to schedule the procedure for a period of inactivity using the Task Scheduler.

The Task Scheduler should be one of the small icons on the bottom right of the Windows opening page (the desktop).

Some lockups and screen freezes caused by hard disk problems can be solved by reducing the read-ahead optimisation. This can be adjusted by going to

* Start-Settings-Control Panel-System Icon-Performance-File System-Hard Disk.

Hard disks will slow down and crash if they are too full. Do some housekeeping on your hard drive every few months and free some space on it. Open the Windows folder on the C drive and find the Temporary Internet Files folder. Deleting the contents (not the folder) can free a lot of space.

Empty the Recycle Bin every week to free more space. Hard disk drives should be scanned every week for errors or bad sectors. Go to

* Start-Programs-Accessories-System Tools-ScanDisk

Otherwise assign the Task Scheduler to perform this operation at night when the computer is not in use.

5. Fatal OE Exceptions and VXD Errors

Fatal OE exception errors and VXD errors are often caused by video card problems.

These can often be resolved easily by reducing the resolution of the video display. Go to

* Start-Settings-Control Panel-Display-Settings

Here you should slide the screen area bar to the left. Take a look at the colour settings on the left of that window. For most desktops, high colour 16-bit depth is adequate.

If the screen freezes or you experience system lockups it might be due to the video card. Make sure it does not have a hardware conflict. Go to

* Start-Settings-Control Panel-System-Device Manager

Here, select the + beside Display Adapter. A line of text describing your video card should appear. Select it (make it blue) and press properties. Then select Resources and select each line in the window. Look for a message that says No Conflicts.

If you have video card hardware conflict, you will see it here. Be careful at this point and make a note of everything you do in case you make things worse.

The way to resolve a hardware conflict is to uncheck the Use Automatic Settings box and hit the Change Settings button. You are searching for a setting that will display a No Conflicts message.

Another useful way to resolve video problems is to go to

* Start-Settings-Control Panel-System-Performance-Graphics

Here you should move the Hardware Acceleration slider to the left. As ever, the most common cause of problems relating to graphics cards is old or faulty drivers (a driver is a small piece of software used by a computer to communicate with a device).

Look up your video card's manufacturer on the internet and search for the most recent drivers for it.

6. Viruses

Often the first sign of a virus infection is instability. Some viruses erase the boot sector of a hard drive, making it impossible to start. This is why it is a good idea to create a Windows start-up disk. Go to

* Start-Settings-Control Panel-Add/Remove Programs

Here, look for the Start Up Disk tab. Virus protection requires constant vigilance.

A virus scanner requires a list of virus signatures in order to be able to identify viruses. These signatures are stored in a DAT file. DAT files should be updated weekly from the website of your antivirus software manufacturer.

An excellent antivirus programme is McAfee VirusScan by Network Associates ( www.nai.com). Another is Norton AntiVirus 2000, made by Symantec ( www.symantec.com).

7. Printers

The action of sending a document to print creates a bigger file, often called a postscript file.

Printers have only a small amount of memory, called a buffer. This can be easily overloaded. Printing a document also uses a considerable amount of CPU power. This will also slow down the computer's performance.

If the printer is trying to print unusual characters, these might not be recognised, and can crash the computer. Sometimes printers will not recover from a crash because of confusion in the buffer. A good way to clear the buffer is to unplug the printer for ten seconds. Booting up from a powerless state, also called a cold boot, will restore the printer's default settings and you may be able to carry on.

8. Software

A common cause of computer crash is faulty or badly-installed software. Often the problem can be cured by uninstalling the software and then reinstalling it. Use Norton Uninstall or Uninstall Shield to remove an application from your system properly. This will also remove references to the programme in the System Registry and leaves the way clear for a completely fresh copy.

The System Registry can be corrupted by old references to obsolete software that you thought was uninstalled. Use Reg Cleaner by Jouni Vuorio to clean up the System Registry and remove obsolete entries. It works on Windows 95, Windows 98, Windows 98 SE (Second Edition), Windows Millennium Edition (ME), NT4 and Windows 2000.

Read the instructions and use it carefully so you don't do permanent damage to the Registry. If the Registry is damaged you will have to reinstall your operating system. Reg Cleaner can be obtained from www.jv16.org

Often a Windows problem can be resolved by entering Safe Mode. This can be done during start-up. When you see the message "Starting Windows" press F4. This should take you into Safe Mode.

Safe Mode loads a minimum of drivers. It allows you to find and fix problems that prevent Windows from loading properly.

Sometimes installing Windows is difficult because of unsuitable BIOS settings. If you keep getting SUWIN error messages (Windows setup) during the Windows installation, then try entering the BIOS and disabling the CPU internal cache. Try to disable the Level 2 (L2) cache if that doesn't work.

Remember to restore all the BIOS settings back to their former settings following installation.

9. Overheating

Central processing units (CPUs) are usually equipped with fans to keep them cool. If the fan fails or if the CPU gets old it may start to overheat and generate a particular kind of error called a kernel error. This is a common problem in chips that have been overclocked to operate at higher speeds than they are supposed to.

One remedy is to get a bigger better fan and install it on top of the CPU. Specialist cooling fans/heatsinks are available from www.computernerd.com or www.coolit.com

CPU problems can often be fixed by disabling the CPU internal cache in the BIOS. This will make the machine run more slowly, but it should also be more stable.

10. Power Supply Problems

With all the new construction going on around the country the steady supply of electricity has become disrupted. A power surge or spike can crash a computer as easily as a power cut.

If this has become a nuisance for you then consider buying a uninterrupted power supply (UPS). This will give you a clean power supply when there is electricity, and it will give you a few minutes to perform a controlled shutdown in case of a power cut.

It is a good investment if your data are critical, because a power cut will cause any unsaved data to be lost.