THE INTERNET SECURITY

New Malware That Empty Your Bank Account

2012-01-12T21:27:00.000+05:30

New Malware That Empty Your Bank Account

New Malware has been created by the hackers that can steal usernames and passwords and defeat common methods of user authentication employed by financial institutions. The important point is that it updates the bank account transaction virtually and it becomes really impossible for the account holder to know if the account has been hacked or not, as it doesn't show any changes in the transaction.

How it Works:
Through the fake mail like for job email, free game download or get unsolicited e-mail from NACHA, the Federal Reserve, or the FDIC telling him or her that there is a problem with his or her bank account or a recent ACH (Automated Clearing House) transaction. The message includes a link in the e-mail that will supposedly help resolve whatever the issue is."Unfortunately, the link goes to a phony website, and once you’re there, you inadvertently download the Gameover malware, which promptly infects your computer and steals your banking information," the FBI said.

Prevent:
The best way to prevent this fraud way of money laundering is to keep your eyes open. Don't ever clicked on any email link from unknown source or if it is asking for bank information. Verify before clicking the link. Don't disclose your Bank related Information on the internet.
Have A Happy Internet Banking :)

Java Unsupported Class Version Error-II

2012-01-08T13:43:00.000+05:30

Java Unsupported Class Version Error - II

In the last post we have seen about the Java Unsupported Class Version. In this post we will see more on that.

What is UnSupportedClassVersionError in Java?

Java.lang.UnsupportedClassVersionError is a subclass of java.lang.ClassFormatError. This is a kind of linking error which occurs during linking phase accordingly java.lang.ClassFormatError has also derived from java.lang.LinkageError. As the name suggests "UnSupportedClassVersionError" so it’s related to unsupported class version, now questions comes what is class version in Java? Well every source file is compiled into class file and each class file has two versions associated with it, major version and minor version. Version of class file is represented as major_version.minor_version. This version is used to determine format of class file in Java.
According to Java Virtual Machine specification, “A JVM implementation can support a class file format of version v if and only if v lies in some contiguous range Mi.0 v Mj.m. Only Sun can specify what range of versions a JVM implementation conforming to a certain release level of the Java platform may support.” For example: JDK 1.2 supports class file formats from version 45.0 to version 46.0 inclusive. So if a class file has version 48.0 it means that major version of class file is "48" and minor version is "0", which tells us that JDK 1.4 has been used to compile and generate that class file

How to fix UnSupportedClassVersionError

Now we know the root cause of UnSupportedClassVersionError that we are using a lower JVM for running the program. But major problem is that stack trace of UnSupportedClassVersionError will not tell you for which class it’s coming. So if you are using multiple third party jars in your application you find that it comes at a particular part when JVM tries to load a class from a particular jar. anyway we all know that latest version of JDK is 1.6 so maximum version of class file could be generated by JDK 6, so by using JDK 6 we can solve UnSupportedClassVersionError, but many times its not easy to just move to higher JDK version. So I would suggest:
1) Find out due to which jar or class file this UnSupportedClassVersionError is coming?
2) Try to compile source code of that jar with the JDK version you are using to run your program, if source is available.
3) If you don't have source try to find the compatible version of that library.
4) Increase the JRE version you are using to run your program.

When UnSupportedClassVersionError in Java comes:

So now we got the theory behind class file format and major and minor version of class file in Java. Now a million dollar question is when UnSupportedClassVersionError in Java does occur? precise answer of this is "When JVM tries to load a class and found that class file version is not supported it throws UnSupportedClassVersionError and it generally occurs if a higher JDK version is used to compile the source file and a lower JDK version is used to run the program. for example if you compile your java source file in JDK 1.5 and you will try to run it on JDK 1.4 you will get error "java.lang.UnsupportedClassVersionError: Bad version number in .class file [at java.lang.ClassLoader.defineClass1(Native Method)]".
But its important to note is that vice-versa is not true "you can compile your program in J2SE 1.4 and run on J2SE 1.5 and you will not get any UnSupportedClassVersionError". When a higher JDK is used for compilation it creates class file with higher version and when a lower JDK is used to run the program it found that higher version of class file not supported at JVM level and results in java.lang.UnsupportedClassVersionError

Major Class Versions of Various JDK
Following are the major version of class file format in standard JDK environment.
JDK 1.1 = 45
JDK 1.2 = 46
JDK 1.3 = 47
JDK 1.4 = 48
JDK 1.5 = 49
JDK 1.6 = 50

Java Unsupported Class Version Error

2012-01-05T20:43:00.008+05:30

Java Unsupported Class Version Error

Java Unsupported Class Version Error occurs when we try to compile the class which has a jar file attached in its classpath and that jar file has been compiled with higher version of java then the one with which  we are trying to compile the class.

This error comes on using different java versions for compilation and execution of java program. Therefore set the path of one java version and use it for compilation and execution.

java.lang.UnsupportedClassVersionError: XXXX (Unsupported major.minor version 49.0)

        at java.lang.ClassLoader.defineClass0(Native Method)
        at java.lang.ClassLoader.defineClass(ClassLoader.java:539)
        at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:123)
        at java.net.URLClassLoader.defineClass(URLClassLoader.java:251)
        at java.net.URLClassLoader.access$100(URLClassLoader.java:55)
        at java.net.URLClassLoader$1.run(URLClassLoader.java:194)
        at java.security.AccessController.doPrivileged(Native Method)
        at java.net.URLClassLoader.findClass(URLClassLoader.java:187)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:289)
        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:274)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:235)
        at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:302)

If you get the above errors, do the following:
       1) Check the jar file attached in the classpath.
       2) Use the higher version (or equal but not lesser) of java for compiling the class then used for creating the jar.
      3) Set the path of one java version and use it for compilation and execution.

Speed Up The File Search Indexing

2011-12-27T20:39:00.000+05:30

Speed Up The File Search Indexing

We can configure the indexing of windows to make the search fast. We can exclude the zip file while searching. We can do this in following ways:

From the Start menu's Run dialog, enter this command:

regsvr32 /u zipfldr.dll.
then enter
regsvr32 /u cabview.dll.
Then restart the windows.

Completely Disable Indexing

If you’d prefer to completely disable the indexing service, you can disable it entirely by turning off the service.

Open up Services through control panel, or by typing services.msc into the start menu search box. Find “Windows Search” in the list of services and double-click on it to open it.Change the Startup type of the service to Disabled, and then click the Stop button to stop the service.

Transfer File Using Remote Desktop

2011-02-21T14:04:00.000+05:30

Transfer File Using Remote Desktop

We can share our local disk and make the local disk available on the remote desktop for file transferring and some other purposes. To make the local disk available/share for remote desktop, do the following.

1) Type mstsc in command prompt.
2) A Remote Desktop Connection Pop up will appear. Click on the options button of that pop up.
3) Click on Local Resources tab and select the Disk Drives check box and then click on connect.

After this we will be able to see the our ( local )drives on the remote desktop, and can copy the files as per need.

How to print on both side of page in printer

2010-11-18T17:29:00.000+05:30

How to print on both side of page in printer

1) Click ctrl+P o bring the print interface.

2) Click on the Properties or the Preferences button in that print page which comes after first steps.

3) Go on to the Finishing Tab.

4) There is a header 'Print Style' and below that is a drop down box.There are three options in that dropdown:-

1) 1-sided Printing :- To print on one sode of page

2) 2-sided Printing :- To print on both side of page.

3) Booklet Printing :- To print in the book Style.

Using Filters to Sort Incoming Email In YAHOO

2010-10-15T16:58:00.000+05:30

Using Filters to Sort Incoming Email

Yahoo! Mail lets you create personal folders in which to organize your messages .You can create a filter—a set of rules and a destination—that instructs Yahoo! Mail to automatically deliver incoming messages to the folder of your choice. Each filter has one or more rules and a destination folder. When an email message satisfies the rules, the filter delivers the message into the destination folder.

Follow the below steps:
1) In the upper-right corner of your Yahoo! Mail page, click the Options link, then select Mail Options / More Options from the menu.
2) On the left side of the page, click the Filters link.
3) On the top of the Filters page, click the Add Filter button.
4) A page appears where you can define the rule and the destination for the new filter.
5) Fill the form.
6) Save the changes.

See Cricket live score in Office

2010-08-25T15:39:00.000+05:30

See Cricket live score in Office:

Unable to open the cricinfo.com to view the live scorecard. Try the following links:

http://scores.sify.com/index.shtml
http://in.wap.yahoo.com/p/cricket-india/LiveScore?match=1

Even these sites are not opening then try igoogle.
Still u r not able to view the score then only option is to try search cricket online/live score on google.

Getting Java Compilation Error

2010-08-19T15:26:00.000+05:30

Getting Java Compilation Error When Compiling JDBC with java 1.5

When we try to compile some java project with Java 1.5 compiler, we get the error

[javac] Please remove or make sure it appears in the correct subdirectory of the classpath.
[javac] import oracle.sql.ARRAY;
[javac] ^
[javac] 1 error

This is because java 1.5 compiler doesn't support oracle.sql.ARRAY, so to remove this compilation error we need to upgrade the java compiler from 1.5 to java 1.6. The Java compiler 1.6 support all this classes as well as the old classes of java 1.5. Java 1.6 can be downloaded from Java Sun website.

How To Find HostName Of Computer

2010-08-18T19:11:00.000+05:30

How To Find HostName Of Computer

The Hostname of the computer is the name of the computer. To find the hostname of the computer follows

the given steps:

1) Right Click on 'My Computer'
2) Open the properties
3) Click on the 'Computer Name' tab
4) You can find the Hostname of computer there by the tag name 'Full Computer Name'

BlackBerry 3G Mobiles

2010-03-24T18:04:00.001+05:30

BlackBerry 3G Mobiles

These are the different Blackberry Phone which support 3G.

blackberry-curve-8900

blackberry-bold-9000

blackberry-storm-9500

blackberry-tour-9630

Google Chrome Link Broken Error

2010-03-16T13:25:00.000+05:30

Oops! This link appears to be broken

Sometimes google Chrome throws the DNS Server error message,saying "DNS Error-cannot find server" when we try to open some sites.But using the different browser we can open the site without showing any errror.Google Chrome browser use its own algorithm to read the web pages.When you visit a webpage (like a search results page), Google Chrome will pre-fetch the IP addresses of all websites that are listed on that page. Since the browser has the IP addresses of all the links in advance, DNS pre-fetching ensures that any links that may you click on that webpage will load faster. However, when pre-fetching fails, something that’s not very uncommon, you may get the “link broken” error.

How To Tackle This Error?

The fix is simple – go to Tools > Options (or Preferences on a Mac) > Under the Hood and uncheck the setting that says “Use DNS pre-fetching to improve page load performance.” This might increase the loading time of certain pages by a few microseconds but you won’t at least see that misleading error message.

Enable Page Rank Button In IE8

2010-03-12T17:30:00.001+05:30

Enable Page Rank Button In IE8

To add page rank button in your explorer, you need to install the toolbar,google toolbar is the best one.
If you installed new Internet Explorer 8 or upgraded to IE8 from IE7,Google toolbar does not came enabled by default with pagerank button.But we can manually enable PageRank button for Google Toolbar very easily.
Enabling PageRank button for Google Toolbar in Internet Explorer

1. Click the Wrench icon on the Google Toolbar>select Tools>check or enable pagerank and save.

2.You can now see the PageRank button appearing for web pages you visit in Internet Explorer.

Virus vs. Worm - What's the Difference?

2010-03-08T15:31:00.000+05:30

Virus vs. Worm – What’s the Difference?

Below you will find information gathered from several resources on the Internet regarding the differences between viruses and worms.
A computer virus is delivered by e-mail messages, according to most definitions.
But a computer worm spreads through the internet.

Viruses are computer programs that are designed to spread themselves from one file to another on a single computer. A virus might rapidly infect every application file on an individual computer, or slowly infect the documents on that computer, but it does not intentionally try to spread itself from that computer to other computers. In most cases, that’s where humans come in. We send email document attachments, trade programs on diskettes, or copy files to file servers. When the next unsuspecting user receives the infected file or disk, they spread the virus to their computer and so on.

Worms, on the other hand, are insidious because they rely less (or not at all) on human behavior in order to spread themselves from one computer to another. The worm is a program that is designed to copy itself from one computer to another over a network (e.g., by use email). The worm spreads itself to many computers over a network, and doesn’t wait for a human being to help. This means that computer worms spread much more rapidly than computer viruses.

“Malware” is the term used to describe any and all malicious software, including viruses, Trojan horse programs, and worms.

Even though "virus" has become a generic term to refer to all types of computer malware, it actually only applies to one specific type of malicious code/file. A computer virus does the same thing a biological virus does, for the most part. It infects a “host” (a file, boot sector, etc.) and then looks for ways to spread. The major things setting it apart from other malware are that it (1) replicates itself and (2) infects other files instead of existing as a standalone file. Viruses can be very harmful (e.g., erasing or damaging files) or they can be relatively benign (e.g., displaying an obscene message to the user on a given date).

Worms do not attach themselves to a host program or file the way a virus does; worms reside in active memory and stand alone with no need for a host. A worm does replicate itself like a virus, but it doesn’t do so by altering files. Instead, it replicates over computer networks.

A Trojan horse program does not replicate itself, and it does not infect other files. A Trojan horse program (or, simply, “trojan” or “Trojan program”) is a malicious program that is contained within, or masquerades as, an innocent and useful program. The most widespread type of Trojan program is the type that installs “backdoor” access to a computer, through which a malicious person is allowed to remotely take control of the infected computer. The next most popular type is designed simply to steal passwords, credit card numbers, online banking data, or other personal information and send that information back to the malicious party. Often, a Trojan program arrives, unknown to the victim, along with a screensaver or game. When the screensaver or game is run, it is designed to then install the Trojan program that is included with it.

How to make a backup copy of a .pst file

2010-02-26T17:01:00.002+05:30

How to make a backup copy of a .pst file

Follow these steps to back up the whole .pst file:

   1. Close any messaging programs such as Outlook, Microsoft Exchange, or Microsoft Windows     Messaging.
   2. Click Start, and then click Run. Copy and paste (or type) the following command in the Open box, and then press ENTER:
      control panel
      Control Panel opens.
      Note If you see the Pick a category screen, click User Accounts, and then go to step 3.
   3. Double-click the Mail icon.
   4. Click Show Profiles.
   5. Click the appropriate profile, and then click Properties.
   6. Click Data Files.
   7. Under Name, click the Personal Folders Service that you want to back up. By default, this service is called Personal Folders. However, it may be named something else.
      Note If you have more than one Personal Folders Service in your profile, you must back up each set of .pst files separately.
      If there are no entries called Personal Folders and you have not yet stored any information such as messages, contacts, or appointments in Outlook, you probably have not yet enabled the Personal Folders Service. Go to the "References" section for information about how to create a .pst file.
      If you have no Personal Folders Services in your profile and you can store information such as messages, contacts, or appointments in Outlook, your information is probably being stored in a mailbox on an Exchange Server. Try using the instructions in the "How to back up .pst file data that is located on a Microsoft Exchange Server" section.
   8. Click Settings, and then note the path and file name that appears.
      Note Because the .pst file contains all data that is stored in the MAPI folders that Outlook uses, the file can be very large. To reduce the size of the .pst file, click Compact Now in the Settings window.
   9. Close all the Properties windows.
10. Use Windows Explorer or My Computer to copy the file that you noted in step 8. You can copy the file to another location on the hard disk drive or to any kind of removable storage media, such as a floppy disk, a CD-ROM, a portable hard disk drive, a magnetic tape cassette, or any other storage device.

What Is A IMEI Number

2010-02-11T18:17:00.000+05:30

What Is A IMEI Number

IMEI=International Mobile Equipment Identification
IMEI is a 15-digit code assigned to a mobile handset. It helps to identify a stolen handset and also helps the security agencies to track the users. No two mobile phones have same IMEI number, since it’s a unique number.

How To Check Your Mobile Phone’s IMEI Validity
1. On your mobile’s home screen, type in the following code ” *#06# ” (Without quotes). Otherwise check the compliance plate under the battery.

2. Type an SMS “IMEI {followed by your} (15 digit IMEI No.) and send it to 53232.
For example, type IMEI 123456789012345 and send it to 53232. and Rs.3/- charge for each SMS.
‘Success’, is displayed, if your IMEI number is Valid.
‘Invalid IMEI’, is displayed for incorrect IMEI.

3. You can also check your IMEI number validity online. For that, you have to go to those sites that provide this facility and put your IMEI number in the given box. Within few minutes after verifying, you will be intimated whether your IMEI number is legitimate or not.

The IMEI Number has the following structure.
NN-XXXXXX-ZZZZZZ-A
The first two digits indicated by NN is the code of the reporting body such as MSAI. The next six digits indicated by XXXXXX is the type identifier defined by MSAI. These numbers are assigned by MSAI but is given to the mobile equipment manufacturers for identifying different handsets uniquely. The last digit denoted by A is a check digit that is a function of the previous 14 digits and is used to check that none of the digits are entered incorrectly.

If you know your IMEI number you can check your device status by visiting TrackIMEI.com and entering the IMEI number. You’ll get the information about the handset you are using and also you’ll know if there is any theft record of the phone.

Remotely Enabled Remote Desktop

2010-01-12T19:17:00.000+05:30

Remotely Enabled Remote Desktop
If there is a computer in your network and you are not able to make a remote connection with it because remote connectivity has been disabled. To connect that computer remotely do the following:
1) Start Registry Editor by Start -- Run -- regedit -- OK. Then select the Connect Network    Registry option under the File menu.
2) This opens the Select Computer search box. Either browse Active Directory to locate the remote server, or type its name in the textbox.
3) Click OK and a node will be displayed in Registry Editor for the remote machine.
4) Now browse HKLM on SRV to find the following Registry key.
    HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
5) Under the Terminal Server key, you'll find a REG_DWORD value named fDenyTSConnection. Double- click on that value to open the Edit DWORD Value box and change the value data from 1 (Remote Desktop disabled) to 0 (Remote Desktop enabled),
6) The remote machine needs to be rebooted for the change to take effect, so open a command prompt and type the following command:
             shutdown -m \\computer name -r
7) After the remote machine reboots, Remote Desktop should be enabled on it. Connect remotely..

Restart Oracle Server On Linux

2010-01-11T17:16:00.000+05:30

Restart Oracle Server On Linux

The oracle server get closed when the machine on which oracle has been installed get turnoff or shutdown.The Oracle server doesn't start of its own when the m/c is restarted.So,Follow the given below steps to start the oracle server when it get closed due to shutdown of the computer:

Steps to start Oracle Listener :-

1. Login as oracle/oracle

2. sqlplus /nolog

3. connect /as sysdba

4. startup

Customize Internet Explorer

2010-01-07T15:27:00.004+05:30

Customize Internet Explorer

Open Internet Explorer to a Blank Page

Create a new Desktop shortcut

In the command line, (highlight and paste the below)
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome

Name the shortcut: (example) IE Blank
From now on you can paste a saved URL without loading your ISP software, etc.

You can also drag this shortcut into your Quick Launch area.
Note: this is the same as setting your Home Page to: "about:blank"
Ad-Aware users, setting your page to "About:Blank" causes a false CWS detection.

SendTo Tip

Add Internet Explorer to your SendTo folder

Start - Run (type) "sendto" (no quotes) File - New - Shortcut (XP only)

In the command line, (highlight and paste the below - including quotes)
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

Note: IE supports opening: .gif, jpg, htm, html, .txt, ico, etc.
Windows Vista users will need to navigate to the following location:
Users\\AppData\Roaming\Microsoft\Windows\SendTo
[or]
Start | Run (type) shell:sendto (click Ok)
Right-click in the right pane and select: New > Shortcut
In the command line, (highlight and paste the below - including quotes)
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

Fast Printing web pages without images

Create a one line .css file [example] "NoImages.css", copy the below line to Notepad and Save As: NoImages.css. Open Internet Options | General tab | Accessibility button, place a check in "Format documents using my style sheet", click OK.

Code:
IMG { display: none !important;}

The next time you want to print the contents of a web page but don't want to waste the time and ink printing all the ads, banners, etc. just Toggle the above option on\off.

Note: there is no need to restart IE as this trick works on the fly.

Protecting Your Internet Explorer
Lately there has been a rash of incidents where either a web site or email spam has contained a hidden javascript that changes your Home Page entry, then disables the users ability to change it back. To prevent this from happening ... be one step ahead of these characters. Set your Home Page then disable the ability to change it via a Registry restriction. It is also recommended you use a Startup Monitor. Be aware that in some cases this method does not work as some of these parasites will re-write the registry entries on each restart. However a "Startup Manager" will prompt you if your setting are being changed.

HKCU_Hide_HomePage.reg (Current User)
HKCU_Undo_HomePage.reg (Current User)

To download: Right-click the above link(s) and select: "Save Target As".
To use: right-click and select: Merge (to view: open in Notepad)

Note: this restriction can apply in 2 locations, the Registry checks the HKLM location first, then the HKCU location. The HKLM takes precedence and applies to all users. The HKCU applies to just the "Current User".

If your HomePage gets hijacked, you may need to "undo" both locations.
Note: XP Pro already has the ability to make these changes via the Group Policy Editor. If the HomePage restriction has been applied by an Administrator, "Limited Users" can not make this change. Start | Run (type) gpedit.msc

Resize your IE Cache size (XP)

By default IE reserves 10% of your drive space for the Temporary Internet Files. This was fine several years ago but since then the hard drive capacities have increased dramatically. If you happen to have one of these large disks the 10% is truly unnecessary and wasteful.

Close all instances of Internet Explorer and Outlook Express
Control Panel | Internet Options | General tab
Click Settings and move the slider to 50 mb, click Ok
Click Delete Files and also select: "Delete all offline files", click Ok
Click Clear History, click Ok, Apply/Ok

Note: While viewing Newsgroup messages Outlook Express dumps a series of zero-byte files into the browser cache. When Outlook Express is closed it fails to cleanup these files. To delete these zero-byte files you must select the above option "Delete all offline files".

TIFF Image Viewer

AlternaTIFF is a web browser add-on (ActiveX control or plug-in) that displays most of the common types of TIFF files.

Spell Checker for Internet Explorer

Editors Note: has an option to integrate the database from other spell checkers.

Agent Ransack (freeware) File searching software (XP only)
This is not a replacement to Microsoft's built-in Search Utility, it's just much faster!

Recover Deleted Outlook Items Manually

2009-10-09T16:17:00.002+05:30

Recover Deleted Outlook Items Manually Using REGEDIT

Using the registry editing you can recover the deleted emails or other items which has been deleted permanently,ie by using SHIFT+DELETE or SHIFT+ . If you use the registry editor incorrectly, you might cause serious problems that might require you to reinstall your operating system. Use the registry editor at your own risk.

Exit Outlook.
Open the Windows registry editor.
Browse to My Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Options.
On the Edit menu, point to New, and then click DWORD Value.
Type the name DumpsterAlwaysOn.
Note Do not type any spaces in the name.
Set the DWORD value to 1.
Restart Outlook.

The Tools menu now has the Recover Deleted Items command for every Outlook folder.Enjoy. :)

Transfer Mail From One Account To Another

2009-10-06T14:16:00.002+05:30

Transfer Mail From One Account To Another

It is possible to transfer emails from one account to another email account like Yahoo (only if you are a Yahoo! Mail Plus subscriber), Hotmail etc. to your new Gmail account then Gmail has the easiest option for you.

In your new Gmail account

Click Settings
Go to the Accounts tab
Click on Add another mail account link found at Get mail from other accounts
In the pop up – enter your old email address and click Next Step
Enter your username and password and click Add Account
You can set your old email address as a custom email address if you wish

Once you are done with the above steps, Gmail will start retrieving mails from your old account and transfer them to the new account. This may take several minutes so have some patience and take a walk around till its done.

As you can see, you do not really have to go to the trouble of using an email client like Outlook or Thunderbird to transfer your mails to a new Gmail account.

Basic Linux VI Command

2009-10-01T19:17:00.002+05:30

Basic Linux VI Command

Moving the Cursor

*	`j` or [or down-arrow]	move cursor down one line
*	`k` [or up-arrow]	move cursor up one line
*	`h` or [or left-arrow]	move cursor left one character
*	`l` or [or right-arrow]	move cursor right one character
*	`0` (zero)	move cursor to start of current line (the one with the cursor)
*	`$`	move cursor to end of current line
	`w`	move cursor to beginning of next word
	`b`	move cursor back to beginning of preceding word
	`:0` `or 1G`	move cursor to first line in file
	`:n` `or nG`	move cursor to line `n`
	`:$` `or G`	move cursor to last line in file

Adding, Changing, and Deleting Text

*u UNDO WHATEVER YOU JUST DID;
* i insert text before cursor, until hit
I insert text at beginning of current line, until hit
* a append text after cursor, until hit
A append text to end of current line, until hit
* o open and put text in a new line below current line, until hit
* O open and put text in a new line above current line, until hit
* r replace single character under cursor (no needed)
R replace characters, starting with current cursor position, until hit
cw change the current word with new text,
starting with the character under cursor, until hit
cNw change N words beginning with character under cursor, until hit;
e.g., c5w changes 5 words
C change (replace) the characters in the current line, until hit
cc change (replace) the entire current line, stopping when is hit
Ncc or cNc change (replace) the next N lines, starting with the current line,
stopping when is hit
* x delete single character under cursor
Nx delete N characters, starting with character under cursor
dw delete the single word beginning with character under cursor
dNw delete N words beginning with character under cursor;
e.g., d5w deletes 5 words
D delete the remainder of the line, starting with current cursor position
* dd delete entire current line
Ndd or dNd delete N lines, beginning with the current line;
e.g., 5dd deletes 5 lines
yy copy (yank, cut) the current line into the buffer
Nyy or yNy copy (yank, cut) the next N lines, including the current line, into the buffer
p put (paste) the line(s) in the buffer into the text after the current line

*	`i`	insert text before cursor, until hit
	`I`	insert text at beginning of current line, until hit
*	`a`	append text after cursor, until hit
	`A`	append text to end of current line, until hit
*	`o`	open and put text in a new line below current line, until hit
*	`O`	open and put text in a new line above current line, until hit

*	`r`	replace single character under cursor (no needed)
	`R`	replace characters, starting with current cursor position, until hit
	`cw`	change the current word with new text, starting with the character under cursor, until hit
	`cNw`	change `N` words beginning with character under cursor, until hit; e.g., `c5w` changes 5 words
	`C`	change (replace) the characters in the current line, until hit
	`cc`	change (replace) the entire current line, stopping when is hit
	`Ncc` or `cNc`	change (replace) the next N lines, starting with the current line, stopping when is hit

*	`x`	delete single character under cursor
	`Nx`	delete N characters, starting with character under cursor
	`dw`	delete the single word beginning with character under cursor
	`dNw`	delete `N` words beginning with character under cursor; e.g., `d5w` deletes 5 words
	`D`	delete the remainder of the line, starting with current cursor position
*	`dd`	delete entire current line
	`Ndd` or `dNd`	delete `N` lines, beginning with the current line; e.g., `5dd` deletes 5 lines

	`yy`	copy (yank, cut) the current line into the buffer
	`Nyy` or `yNy`	copy (yank, cut) the next N lines, including the current line, into the buffer
	`p`	put (paste) the line(s) in the buffer into the text after the current line

How to Configure User Rights

2009-09-10T14:08:00.000+05:30

How to Configure User Rights

If the right to log on as a service is revoked for the specified user account, restore the right by performing the following steps:

Domain Controller

If the user is in an Active Directory domain:

Start the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in.
Right-click the Organizational Unit (OU) in which the user right to log on as a service was granted. By default, this is in the Domain Controllers OU.
Right-click the container, and then click Properties.
On the Group Policy tab, click Default Domain Controllers Policy, and then clickEdit. This starts Group Policy Manager.
Expand the Computer Configuration object by clicking the plus sign (+) next to the policy object. Under the Computer Configuration object, expand Windows Settings, and then expand Security Settings.
Expand Local Policies, and then click User Rights Assignment.
In the right pane, right-click Log on as a service, and then click Security.
Add the user to the policy, and then click OK.
Quit Group Policy Manager, close Group Policy properties, and then close the Active Directory Users and Computers MMC snap-in.

Difference between Cohesion & Coupling

2009-09-09T14:19:00.002+05:30

Difference between Cohesion & Coupling

A first-order principle of software architecture is to increase cohesion and reduce coupling.

Cohesion (interdependency within module) strength/level names : (from worse to better, high cohesion is good)

Coincidental Cohesion : (Worst) Module elements are unrelated
Logical Cohesion : Elements perform similar activities as selected from outside module, i.e. by a flag that selects operation to perform (see also CommandObject).
- i.e. body of function is one huge if-else/switch on operation flag
Temporal Cohesion : operations related only by general time performed (i.e. initialization() or FatalErrorShutdown?())
Procedural Cohesion : Elements involved in different but sequential activities, each on different data (usually could be trivially split into multiple modules along linear sequence boundaries)
Communicational Cohesion : unrelated operations except need same data or input
Sequential Cohesion : operations on same data in significant order; output from one function is input to next (pipeline)
Informational Cohesion: a module performs a number of actions, each with its own entry point, with independent code for each action, all performed on the same data structure. Essentially an implementation of an abstract data type.
- i.e. define structure of sales_region_table and its operators: init_table(), update_table(), print_table()
Functional Cohesion : all elements contribute to a single, well-defined task, i.e. a function that performs exactly one operation
- get_engine_temperature(), add_sales_tax()

Coupling (interdependence between modules) level names: (from worse to better, high coupling is bad)

Content/Pathological Coupling : (worst) When a module uses/alters data in another
Control Coupling : 2 modules communicating with a control flag (first tells second what to do via flag)
Common/Global-data Coupling : 2 modules communicating via global data
Stamp/Data-structure Coupling : Communicating via a data structure passed as a parameter. The data structure holds more information than the recipient needs.
Data Coupling : (best) Communicating via parameter passing. The parameters passed are only those that the recipient needs.
No data coupling : independent modules.

How to Find the Broadcast Address of a Subnetted Network

2009-09-08T17:59:00.003+05:30

How to Find the Broadcast Address of a Subnetted

We need two things to find the broadcast address of a subnetted network: an IP address, and the subnet mask. The process is simple: find the inverse of the subnet mask. Then take the result, and logically OR it with the IP address to get the broadcast address.

Of course, we can convert the above binary result to decimal and get the broadcast address of 192.168.16.31. If you aren’t familiar with the OR process, it’s rather simple. If there is a 1 in either the IP or subnet field, then the result will always be a 1. (Otherwise, the result is 0)

Now we know how to find the broadcast address and how it works- but what is it used for?

What are private IP addresses

2009-09-08T10:39:00.002+05:30

What are private IP addresses?

The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets (local networks):

10.0.0.0 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

Also, IP addresses in the range of 169.254.0.0 -169.254.255.255 are reserved for Automatic Private IP Addressing.

These IP's should not be used on the Internet.

I usually use 192.168.0.1, 192.168.0.2, etc. and a subnet mask of 255.255.255.0 when assigning static IP addresses to computers on a small Local Area Networks (LANs). If a DHCP server is also on the LAN it's scope (range of IP addresses that it can assign to computers on the LAN set to obtain their IP addresses automatically) should be adjusted so it does not interfere with locally assigned static IP addresses.

How to remove stored passwords in Internet Explorer

2009-08-15T22:27:00.004+05:30

Instructions to remove stored passwords in Internet Explorer
Instructions:
Step 1: From the Tools menu, select Internet Options.
Step 2: Click the Content tab, and then click the AutoComplete (button)
Step 3:To remove stored passwords, click Clear Passwords.To clear stored data that you have entered into forms, click Clear Forms.
Step 4: Click OK

Find Stored Password In Chrome

2009-08-15T22:07:00.003+05:30

Google chrome stores the password saved by the user in its cookies.We can see this password as follows.

1) Click on tools button.

2) Click on options.

3) Click on tab 'MinorTweaks '.

4) Click the button 'Show saved Passwords'.

Hacking USB Flash Drive

2009-07-01T20:55:00.003+05:30

Hacking USB Flash Drive
Well, ThinkGeek.com brings you one more gadget, that will definitely add fun to your day.USB flash drive can be cleverly used to hack into the computers.This flash drive of 2 GB capacity is compatible with all the popular operating systems, Mac, Windows and Linux. All you have to do is use it to freak people out.

This USB flash drive is disguised as a USB cable cut off at the end, which will definitely make people wonder what you are up to, while all you are doing is innocently going about your own business. It gives a very literal wireless gadget look, so you use to play pranks on people and convince them that is a wireless cable of sorts.The scariest would be, that it loads viruses onto the computer via a wireless mode, or hacks into computers and drains it of everything, the OS and the data, and even you do not know where all of it goes! All in all, a clever disguise for a simple USB flash drive, and a definite wanna have gadget.

Hackers Declared Britney Dead

2009-07-01T20:44:00.003+05:30

Hackers said Britney as Dead
The Hackers used the third-party Twitter plug-in to incorrectly announce that Spears had died. Twitpic issued a statement telling readers to disregard the message. Since last few weekend two high-profile celebrities--Britney Spears and Ellen DeGeneres--had their Twitpic accounts hacked.
Now Twitter Verified Account feature is all well and good, but it doesn't do much to protect celebrities from seemingly inevitable account hacking

Live Demo Of Bluetooth Hacking

2009-06-21T13:44:00.000+05:30

Thierry Zoller and Kevin Finistere @ 23C3 In Berlin (Germany). Remote Root Exploit over Bluetooth on MacOSX

Operation WhiteBerry

2009-04-11T13:25:00.003+05:30

Operation WhiteBerry
Operation Whiteberry was developed in response to solve multiple problems
found within the wireless data transfer systems of Wireless Application Protocol
(WAP) and Blackberry Mobile Messaging system. Due to the security issues
surrounding these protocols, Operation Whiteberry is built upon to compete
against those industries that promote closed and proprietary solutions such as
RIM’s Blackberry. Instead of reviewing the complete project, the issue of security
that Operation Whiteberry promotes should better help to see the problems that
Blackberry faces.
It would be wise to understand the concept of end-to-end in RIM’s definition
instead of the logical definition. Operation W hiteberry is a project that defines
end-to-end as messaging from the point of origin to the point of destination or
from the blackberry to the intended email address. It is an important “point of
view” difference when related to security. RIM’s definition of end-to-end is
defined as messaging from the point of origin to the point of corporate email
redirection or from the blackberry device to the corporate mail system. Operation
Whiteberry also takes into account the proprietary or closed nature of its
messaging architecture, as this prevents the use of other independent or third
party security mechanisms.
All of these are important points. If the user or customer thinks that the
Blackberry wireless device provides security from the handheld to the receiver of
the email, they are only partially correct. Blackberry was built to be used by other
email servers, thus the security Blackberry provides is from handheld to the point
of decryption at the corporate mail system. After that, the email is sent using the
corporate mail system to the intended receiver, without any encryption, through the
Internet.
Last, Blackberry users have the ability to send electronic messages to other
blackberry users without connecting to the email system. This “direct-connect”
feature does not support full encryption and thus the information being sent and
received wirelessly is more easily accessible. It is important to remove this ability
or add a statement to your wireless policy revealing this information, and that no
confidential or corporate information be passed in this fashion.

During the terrorist attacks of September 11, 2001, while other lines of
communication failed, cell phones, pagers, telephones and such, Blackberry
didn’t. In fact, it has been getting rave reviews for its performance during those
horrible times. Remarkable stories have poured out from Blackberry users that
used the technology to stay in touch of loved ones, evacuate employees, or save
informational assets when no other source of communication was available.
On the day of those attacks, Congressman Robert Ney, R-Ohio used his
Blackberry to communicate with his assistants and family. As a result, he
ordered 435 Blackberry devices for each member of the House so those
representatives could communicate to their assistants and families during
emergencies. As an indirect result reports Congressman Ney, they have become
more productive throughout their normal workload.
If it’s good enough for the government, is it good enough for you? The answer
may be yes, if the correct policies and procedures are in place to maximize the
security benefits that Blackberry provides. The key to any secure environment,
wireless devices included, is to maximize the security features that each device
has available. Following these procedures and policies, as well as auditing users
to make sure these practices are followed should mitigate the risk that wireless
devices apply. Of course, not having these at all would be the optimal choice for
security, but that is not always possible. Wireless devices have an extremely far
distance to travel to be considered secure, but at least The Blackberry by
Research in Motion has been shown to be more secure than most wireless
devices currently in production.

BlackBerry Security

2009-04-11T13:05:00.003+05:30

BlackBerry Security
Top 5 Blackberry Security Recommendations
1. Disable pin-to-pin messaging
2. Enable password-protection on the device (strong passwords, expiration)
3. Disable the installation of 3rd party applications
4. Make user aware that data on the device is at risk (awareness)
5. Communicate the procedure for loss of device and emergency shutdown of
service.

Blackberry mobile units are wireless email devices designed and produced by
Research in Motion Ltd (RIM).

Blackberry uses multiple different backbones to deliver the required information
packets over the wireless network. These backbones include, Microsoft’s
Exchange Server, Lotus Notes Domino as well as Internet Only Email systems.
Microsoft Exchange Server

At the center of the backbone is RIM’s proprietary Desktop Manager. This
software package stores the configuration information and synchronizes the
handheld to a docking station connected through a serial connection to the users
main desktop computer. The synchronization process includes tasks, contacts,
calendar, email, time, as well as the initial encryption key that will be detailed out
later in this report. After the initial synchronization, the Blackberry will link up to
the Blackberry Enterprise server to monitor the user’s inbox for new mail,
compress and encrypt the message to deliver them to the Blackberry handheld
or decompress and decrypt messages originating from the handheld. These two
software packages then integrate into the Microsoft’s Exchange Server and
Outlook for email delivery to the recipient. The figure 1 illustration shows the
path that the information moves through the computer network for the Microsoft
Exchange Server backbone. Please keep in mind that this is a two way diagram,
the email starts at the mobile unit, moves through network to the blackberry
desktop and out again to the recipient.

Blackberry also uses two other server:
1)Lotus Domino Server
2)Internet Only Architecture Overview
Both of this architecture are similar to that of microsoft.

III. Blackberry Security Features
Wireless devices have now become an essential component to a corporate
executives or technical workers arsenal. Due to the information that is now being
transmitted and literally falling out of the sky, the term end-to-end security is no
longer a selling point, rather a requirement. Because of this increased security,
Research in Motion developed the Blackberry architecture to ensure multiple
different security objectives. These objectives include:
1. Protecting data on the handheld
2. Securing the wireless link
3. Minimal user impact
Information Security individuals have been inundated with wireless devices that
promise security outwardly, but have little to show for it. Security Issues that
surround the wireless device include eavesdropping, physical theft of equipment
and information, viruses, DoS attacks, and spoofing and hijacking. The following
list of security features will be sorted by RIM’s stated objectives and compared to
the issues and vulnerabilities surrounding wireless networks.

Passwords Targeted By Conficker

2009-04-07T21:00:00.001+05:30

Passwords Targeted By Conficker

Acquiring the list of usernames from the targeted computer using NetUserEnum API, then attempting to log on to the targeted computer using the existing user accounts and one of the following passwords:

• [username]

• [username][username]

• [reverse_of_username]

• 00000

• 0000000

• 00000000

• 0987654321

• 11111

• 111111

• 1111111

• 11111111

• 123123

• 12321

• 123321

• 12345

• 123456

• 1234567

• 12345678

• 123456789

• 1234567890

• 1234abcd

• 1234qwer

• 123abc

• 123asd

• 123qwe

• 1q2w3e

• 22222

• 222222

• 2222222

• 22222222

• 33333

• 333333

• 3333333

• 33333333

• 44444

• 444444

• 4444444

• 44444444

• 54321

• 55555

• 555555

• 5555555

• 55555555

• 654321

• 66666

• 666666

• 6666666

• 66666666

• 7654321

• 77777

• 777777

• 7777777

• 77777777

• 87654321

• 88888

• 888888

• 8888888

• 88888888

• 987654321

• 99999

• 999999

• 9999999

• 99999999

• a1b2c3

• aaaaa

• abc123

• academia

• access

• account

• Admin

• admin

• admin1

• admin12

• admin123

• adminadmin

• administrator

• anything

• asddsa

• asdfgh

• asdsa

• asdzxc

• backup

• boss123

• business

• campus

• changeme

• cluster

• codename

• codeword

• coffee

• computer

• controller

• cookie

• customer

• database

• default

• desktop

• domain

• example

• exchange

• explorer

• files

• foobar

• foofoo

• forever

• freedom

• games

• home123

• ihavenopass

• Internet

• internet

• intranet

• killer

• letitbe

• letmein

• Login

• login

• lotus

• love123

• manager

• market

• money

• monitor

• mypass

• mypassword

• mypc123

• nimda

• nobody

• nopass

• nopassword

• nothing

• office

• oracle

• owner

• pass1

• pass12

• pass123

• passwd

• Password

• password

• password1

• password12

• password123

• private

• public

• pw123

• q1w2e3

• qazwsx

• qazwsxedc

• qqqqq

• qwe123

• qweasd

• qweasdzxc

• qweewq

• qwerty

• qwewq

• root123

• rootroot

• sample

• secret

• secure

• security

• server

• shadow

• share

• student

• super

• superuser

• supervisor

• system

• temp123

• temporary

• temptemp

• test123

• testtest

• unknown

• windows

• work123

• xxxxx

• zxccxz

• zxcvb

• zxcvbn

• zxcxz

• zzzzz

So if you have any one of the above password change it and choose some strong password.

Removal Tools For Conficker

2009-04-07T20:54:00.002+05:30

Removal Tools For Conficker

Download the tools from following sites listed below for this virus removal:

F-Downadup
Specific tool with heuristics for Downadup worm variants:

• ftp://ftp.f-secure.com/anti-virus/tools/beta/f-downadup.zip

FSMRT
Non-specific detection tool, larger file size:

• ftp://ftp.f-secure.com/anti-virus/tools/beta/fsmrt.zip

Note: these are command line tools, please read the text file included in the ZIP for additional details.

Updates

These are beta tools. Use the following FTP location to determine the file dates:

• ftp://ftp.f-secure.com/anti-virus/tools/beta/

Scanning Options

Downadup makes use of random extension names in order to avoid detection.

During disinfection scanning options should be set to:

• Scan all files

Upon execution, the Downadup (Kido, Conflicker) worm creates copies of itself in:

• %System%\[Random].dll

• %Program Files%\Internet Explorer\[Random].dll

• %Program Files%\Movie Maker\[Random].dll

• %All Users Application Data%\[Random].dll

• %Temp%\[Random].dll

• %System%\[Random].tmp

• %Temp%\[Random].tmp

* Note: [Random] represents a randomly generated name.

Each file's timestamp is amended to match the timestamp of the %System%\kernel32.dll file. The worm then creates autorun entries in the registry, which ensure that a copy of the worm is executed at every system startup.

The worm may create the following files on removable and mapped drives:

• %DriveLetter%\RECYCLER\S-%d-%d-%d-%d%d%d-%d%d%d-%d%d%d-%d\[...].[3 random characters]

• %DriveLetter%\autorun.inf

See the description for Worm:W32/Downaduprun.A for additional details on the autorun.inf file.

And attach itself to the following processes:

• svchost.exe

• explorer.exe

• services.exe

The worm disables a number of system features, in order to facilitate its activities. It disables the following Windows services:

• Windows Automatic Update Service (wuauserv)

• Background Intelligent Transfer Service (BITS)

• Windows Security Center Service (wscsvc)

• Windows Defender Service (WinDefend)

• Windows Error Reporting Service (ERSvc)

• Windows Error Reporting Service (WerSvc)

In addition to disabling these services, it checks to see whether it is running on a Windows Vista machine; if so, it also runs the following command to disable Windows Vista TCP/IP auto-tuning:

• netsh interface tcp set global autotuning=disabled

The worm also hooks the following API's in order to block access when the user attempts to access a long list of domains:

• DNS_Query_A

• DNS_Query_UTF8

• DNS_Query_W

• Query_Main

• sendto

If the user attempts to access the following, primarily security-related domains, their access is blocked:

• virus

• spyware

• malware

• rootkit

• defender

• microsoft

• symantec

• norton

• mcafee

• trendmicro

• sophos

• panda

• etrust

• networkassociates

• computerassociates

• f-secure

• kaspersky

• jotti

• f-prot

• nod32

• eset

• grisoft

• drweb

• centralcommand

• ahnlab

• esafe

• avast

• avira

• quickheal

• comodo

• clamav

• ewido

• fortinet

• gdata

• hacksoft

• hauri

• ikarus

• k7computing

• norman

• pctools

• prevx

• rising

• securecomputing

• sunbelt

• emsisoft

• arcabit

• cpsecure

• spamhaus

• castlecops

• threatexpert

• wilderssecurity

• windowsupdate

• nai

• ca

• avp

• avg

• vet

• bit9

• sans

• cert

Propagation

To propagate itself, the worm first modifies the following registry entry so that it can spread more rapidly across a network:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"TcpNumConnections" = dword:0x00FFFFFE

The worm uses this driver to speed up its propagation capability, as it modifies the number of half-open connections to a 0x10000000(268435456) in memory, a function implemented in %System%\drivers\tcpip.sys.

It checks for a suitable computer around the network using NetServerEnum, then attempts to log on to any found computer with one of the following login credentials:

• Using the existing credentials of the infected user account; if this account does not have admin privileges on the target machine, this operation will not succeed.

If the worm successfully accesses the network share, it will create a copy of itself to the "ADMIN$" share as the following:

• \\[Server Host Name]\ADMIN$\System32\[random filename].[random extension]

It then creates a scheduled daily job on the remote server, in order to execute the following command:

• rundll32.exe [random filename].[random extension], [random]

The worm is also able to propagate by downloading a copy of itself onto other machines vulnerable to an exploit of the critical MS08-067 vulnerability. To do so, the worm first connects to the following sites to retrieve the system's %ExternalIPAddress%:

• http://checkip.dyndns.org

• http://getmyip.co.uk

• http://www.getmyip.org

• http://www.whatsmyipaddress.com

Next, the worm creates a HTTP server on a random port:

• http://%ExternalIPAddress%:%RandomPort%

Creating the HTTP server allows the malware to send out specially crafted packets (exploit code) from the infected machine to other machines. If the exploit is successful, the targeted machine is forced to download a copy of the malware from the first infected machine.

The downloaded malware has one of the following extensions:

• bmp

• gif

• jpeg

• png

It then hooks NetpwPathCanonicalize API in order to avoid exploiting the vulnerability further.

Downloads

Downadup is capable of downloading files onto the infected system. First, the worm connects to one of the following domains to obtain the current system date:

• ask.com

• baidu.com

• google.com

• w3.org

• yahoo.com

The obtained system date is used to generate a list of domains where the malware can download additional files.

It then verifies whether the current date is at least 1 January 2009. If so, it downloads and execute files from:

• http://%PredictableDomainsIPAddress%/search?q=%d

Note: %PredictableDomainsIPAddress% is the domain generated based on the system date.

The downloaded file has the format:

• [random].tmp

Registry

The worm deletes a number of keys from the registry, in order to deactivate the Security Center Notifications and prevent Windows Defender from starting. It also bypasses the Windows Firewall by creating the following registry entry, so that the system can download a copy of the worm:

• HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List, [PortNumber]:TCP = "[PortNumber]:TCP:*Enabled:[random]"

To hide its presence in the system, the worm deletes any System Restore points created by the user, then modifies the following registry keys:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHO WALLCheckedValue = dword:00000000

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, netsvcs = %Previous data% and %Random%

During infection, the worm may create a temporary (TMP) file in the the System or Temp folders. The TMP file created is registered as a service kernel driver using the following registry entry:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]
Type = dword:00000001
Start = dword:00000003
ErrorControl = dword:00000000
ImagePath = "\...\%MalwarePath%\[random].tmp"
DisplayName = [Random]

Once the key is created, the file %MalwarePath%\[random].tmp is deleted.

An interesting change the worm makes to the registry involves the following registry entries:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
DisplayName = %ServiceName%
Type = dword:00000020
Start = dword:00000002
ErrorControl = dword:00000000
ImagePath = "%SystemRoot%\system32\svchost.exe -k netsvcs"
ObjectName = "LocalSystem"
Description = %description%

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]\Parameters
ServiceDll = %MalwarePath%