Trend Micro HijackThis – Hijack detection tool for Windows

HijackThis from Trend Micro is a free hijack detection tool that scans your Windows PC for Browser Helper Objects (BHOs), autorun programs, Windows Explorer context menu objects, hosts file etc. and generates a log file.

Scan results are displayed one line per entry. 

Each entry is preceded with a checkbox and a group code. HijackThis v2.0.2 defines different sections of hijacking possibilities into following groups.

R - Registry, StartPage/SearchPage changes
    R0 - Changed registry value
    R1 - Created registry value
    R2 - Created registry key
    R3 - Created extra registry value where only one should be
F - IniFiles, autoloading entries
    F0 - Changed inifile value
    F1 - Created inifile value
    F2 - Changed inifile value, mapped to Registry
    F3 - Created inifile value, mapped to Registry
N - Netscape/Mozilla StartPage/SearchPage changes
    N1 - Change in prefs.js of Netscape 4.x
    N2 - Change in prefs.js of Netscape 6
    N3 - Change in prefs.js of Netscape 7
    N4 - Change in prefs.js of Mozilla
O - Other, several sections which represent:
    O1 - Hijack of auto.search.msn.com with Hosts file
    O2 - Enumeration of existing MSIE BHO's
    O3 - Enumeration of existing MSIE toolbars
    O4 - Enumeration of suspicious autoloading Registry entries
    O5 - Blocking of loading Internet Options in Control Panel
    O6 - Disabling of 'Internet Options' Main tab with Policies
    O7 - Disabling of Regedit with Policies
    O8 - Extra MSIE context menu items
    O9 - Extra 'Tools' menuitems and buttons
    O10 - Breaking of Internet access by New.Net or WebHancer
    O11 - Extra options in MSIE 'Advanced' settings tab
    O12 - MSIE plugins for file extensions or MIME types
    O13 - Hijack of default URL prefixes
    O14 - Changing of IERESET.INF
    O15 - Trusted Zone Autoadd
    O16 - Download Program Files item
    O17 - Domain hijack
    O18 - Enumeration of existing protocols and filters
    O19 - User stylesheet hijack
    O20 - AppInit_DLLs autorun Registry value, Winlogon Notify Registry keys
    O21 - ShellServiceObjectDelayLoad (SSODL) autorun Registry key
    O22 - SharedTaskScheduler autorun Registry key
    O23 - Enumeration of NT Services
    O24 - Enumeration of ActiveX Desktop Components

Detailed information about an entry can be obtained by selecting it from the list of found items or highlighting the relevant line, and clicking Info on selected item. You can select an entry and click on Fix checked button. Though HijackThis backups any changes made to the system and allows you to restore backup in case the things don’t work it is still advisable that before fixing any entry, make sure that you have taken backup of Windows registry. You can see the backups created by HijackThis by clicking the View the list of backups button in Main menu.

Apart from scanning of several kinds of hijacking possibilities, HijackThis also offers some useful tools. To access these tools click the Open the Misc Tools section button in Main menu.

There are following 6 useful tools:

1. Process manager
2. Hosts file manager
3. Tool to delete a file on reboot
4. Tools to delete an NT service
5. Tool to scan for alternate data stream
6. Uninstall manager

The Process manager lists all running process with their Process Identifier (PID) and full path to the corresponding file.

The hosts file which contains mapping of IP addresses to host names, is located in %systemroot%\system32\drivers\etc folder in Windows XP. The Hosts file manager open the hosts file and allows you to delete IP address mapping or open hosts file for editing in Notepad.

Uninstall manager extends functionality of standard Add or Remove Program Control Panel applet. You can delete/edit uninstall entries, however restoration of deleted entry is not possible.

Technorati Tags: Trend Micro, HijackThis, Hijack detection, freeware, Browser Helper Object, BHO, autorun, Hosts file manager, Process manager, delete file on reboot, delete an NT service, ADS spy, Uninstall manager

ERUNT - The Emergency Recovery Utility NT

ERUNT is a freeware  written by Lars Hederer for Registry backup and restore for Windows NT/2000/2003/XP.

Windows 9x/Me had option to automatically create backups of the registry at startup, with Windows 95 always backing up the registry from the previous Windows session, and Windows 98/Me maintaining up to five registry copies from the last five days where Windows was running. Unfortunately, Windows NT and 2000 do not automatically backup the registry, and in Windows XP, full backup of registry cannot be taken without using System Restore program, which cannot even be used for a "restore" in case a corrupted registry prevent Windows from booting. Further, Registry hives cannot be copied to another location because they are all in use by the Windows.

ERUNT provides the easy solution. It offers:

• Backup of Windows NT/2000/2003/XP registry to a folder of your choice.
• System and current user registries selectable.
• Command line switches for automated registry backup and restoration.
• Restoration of registry in Windows 9x/Me/NT/2000/2003/XP and MS-DOS (all-in-one restore program) or the Windows Recovery Console.

Using ERUNT command line switches, you can perform an automated registry backup, without user interaction. The syntax for the ERUNT command line is as follows:

ERUNT DestinationFolder [sysreg] [curuser] [otherusers] [/noconfirmdelete] [/noprogresswindow]

Description of the command line switches is as follows:

DestinationFolder
	The name of the folder where the registry backup should be saved. All parameters except DestinationFolder are optional. If you specify a destination folder on the command line, ERUNT automatically runs in "silent" mode and with default backup options(system and current user registry).
sysreg
	Backup the system registry.
curuser
	Backup the current user registry.
otherusers
	Backup other open user registries.
/noconfirmdelete
	Automatically deletes the contents of the destination folder if it exists, without asking the user.
/noprogresswindow
	Hides the progress window during backup.

Technorati Tags: ERUNT, Emergency Recovery Utility NT, Lars Hederer, Registry backup, Registry restore

Make any Windows application Topmost

DeskPins from Elias Fotinis is a freeware to make any Windows application always on top, i.e., to keep it above all other windows. Once launched DeskPins stays in the system notification area (systray). Just grab a pin from the DeskPins icon and click on any window to make it topmost.

DeskPins offers following features.

• Unlimited number of pins.
• Wildcard-based automatic pin support.
• Global hotkeys.

You can enter pin mode in several ways:

• by clicking on the DeskPins icon in the systray.
• by right-clicking on the DeskPins icon in the systray and selecting "Enter pin mode" from the menu.
• via a hotkey; the default assignment is Ctrl-F11

Further, you can configure DeskPins to automatically pin certain windows as soon as they are created, by adding auto-pin rules. Every time a window is created, DeskPins will check auto-pin rules which consists of two parameters: a title and a class. Both parameters, explained below, support wild-card style (* and ?).

Title

The window title is displayed on its caption. When a rule is being created based on the window title, you should try to specify the part of the title that stays the same. Suppose, we create a rule for Notepad. The window's title will be "Untitled - Notepad" if no file is open, or "filename - Notepad" otherwise. So to cover both cases rule may for title may be like "* - Notepad", where the * wildcard represents any possible combination of characters.

Class

The window class can be used to easily identify windows. It is specified when a window is created and remains unchanged until it is closed. For example, all Notepad windows have the same class name of "Notepad". So, another way to identify these windows would be to specify their class name, without worrying about the title. However, it is recommended to specify both the class name and the window title.

Technorati Tags: DeskPins, Elias Fotinis, Topmost, Always on top, systray, Ctrl-F11, Auto pin, Auto pinning

Using Fax application in Windows XP

Fax application shipped with Windows XP Professional provides you with complete fax facilities from your computer. You can configure fax settings, send and receive faxes, track and monitor fax activity, and access archived faxes. Using Fax, you can choose to send and receive faxes with a local fax modem installed on your computer, or with a remote fax device connected to fax resources located on a network.

Fax is not installed by default during Windows XP Setup, so to install the Fax component

1. Open Add or Remove Programs in Control Panel.
2. Click Add/Remove Windows Components.
3. In the Windows Components Wizard, select the Fax Services check box, and then follow the instructions on your screen.

The Fax application includes following components that are used to configure the fax devices and printers, send and receive faxes, and monitor fax activity:

• Fax Configuration Wizard, which is used to configure a local fax device and fax printer. The configuration settings can also be specified from the Printers and Faxes applet.
• Send Fax Wizard, which is used to send faxes, or print from any Windows-based application after configuring a local fax printer or connection with a remote fax printer.  The Send Fax Wizard is invoked every time you print using a fax printer.
• Fax Console, which is used to monitor fax activity - incoming and outgoing faxes. From Fax Console, you can also access Fax Monitor, a tool used to track the progress of faxes being sent and received. You can also send faxes directly from the Fax Console.
• Fax Cover Page Editor, which is used to create and edit cover pages to use when you send a fax.

To open Fax after installation, click on Start > Programs > Accessories > Communications > Fax > Fax Console. Since its the first time you are starting Fax Console, it starts the Fax Configuration Wizard, which configures your computer to send and receive faxes.

Click on Next button.

Enter sender information that will appear on fax cover pages and click on Next button.

Select the fax modem installed on your computer and select Enable Send and Enable Receive. Click on Next button.

Enter Transmitting Subscriber Identification (TSID) that is used to identify your computer to a fax recipient and click on Next button.

Enter Called Subscriber Identification (CSID) that is used to identify your computer to a fax sender and click on Next button.

Enter routing options for incoming faxes, i.e., options for fax printing and archival. Click on Next button.

Finally click on Finish button to complete Fax Configuration Wizard. Again click on Start > Programs > Accessories > Communications > Fax > Fax Console.

The right-hand panel has following information about sent/received faxes:

• Icon
• Start Time
• TSID
• Caller ID
• Pages
• Status
• Size
• CSID

If you want to know more details about the sent/received faxes, following information can also be added by View > Add/Remove columns.

• Fax Printer
• End Time
• Duration
• Device
• Routing Information
• Job ID

Click on File > Send a Fax to start Send Fax Wizard. Following screen shots shows how to create and send a fax.

To create a cover page, click on Tools > Personal Cover Pages. 

Click on New button. This starts Fax Cover Page Editor.

Fax application bundled with Windows XP relieves you from buying a expensive Facsimile machine. All you need a Fax enabled dial-up modem, and thankfully almost all dial-up modems available in the market offer Voice, Data, and Fax functionality.

Technorati Tags: Fax, Facsimile, Electronic Fax, Fax using Windows, Fax Console, Fax Configuration Wizard, Send Fax Wizard, Fax Cover Page Editor, Transmitting Subscriber Identification, TSID, Called Subscriber Identification, CSID, Fax Printer, Fax Modem

What’s new in Internet Explorer 8

Microsoft has launched new version of its trendy web browser - Internet Explorer 8 (IE 8) with some nice features. A brief introduction of this new offering is as follows.

1. Easier search for text and other information on a webpage. Now find text box appears on the tab row instead of as a separate dialog box.
2. IE 8 allows you to reopen the closed tabs or browsing session that has been closed.
3. Accelerators to find more information about certain words. Accelerators can be used to know more about the text you select on a webpage to perform tasks like searching for a dictionary definition, etc. IE 8 is pre-configured with a selection of Accelerators which can be added or removed as per your choice. Some of the Accelerators included with IE 8 are -  

   Name	Address	Category
   Blog with Windows Live	live.com	Blog
   Blogger	blogger.com	Blog
   Define with Google Dictionary	google.com	Define
   E-mail with Windows Live	live.com	Email
   Gmail	google.com	Email
   Google Finance	google.com	Finance
   Google Maps	google.com	Map
   Map with Live Search	live.com	Map
   Translate with Live Search	live.com	Translate

4. Phishing Filter has been replaced by SmartScreen Filter. SmartScreen Filter helps protect your computer from fraudulent and phishing websites, and malware distribution websites. During your web browsing, SmartScreen Filter transmits web addresses of your visiting sites in encrypted format over HTTPS to the Microsoft SmartScreen service, in the background. No personal, identifiable information is sent to the Microsoft. These web addresses are then compared against lists of known phishing and malware sites and SmartScreen Filter is informed accordingly. If SmartScreen Filter discovers a bad website, IE 8 displays a blocking webpage and the Address bar will appear in red. You can either choose to bypass the blocked website or you can continue to the blocked website at your own risk.
5. InPrivate Browsing which enables web surfing without leaving any trace in IE 8. During InPrivate Browsing, Internet Explorer stores information like cookies and temporary Internet files in the cache and discards it at the end of your InPrivate Browsing session. When InPrivate Browsing is turned on, you will the following indicator.

   

6. Favorites bar in place of Links toolbar that was in previous versions of Internet Explorer.
   1. You can drag web addresses from the Address bar to the Favorites bar.
   2. You can drag links from web pages you are viewing.
   3. You can use the Favorites bar to monitor RSS feeds you've subscribed to.
   4. You can use the Favorites bar to store your collection of Web Slices. A Web Slice is a specific portion of a webpage that you can add to your Favorites bar.
7. Developer Tools which help you to diagnose and resolve HTML, Cascading Style Sheets (CSS), and JavaScript related problems. The Developer Tools include a built-in debugger, a code rendering engine and an editor.
8. Caret Browsing which allows you to use HOME, END, PAGE UP, PAGE DOWN, and the arrow keys on your keyboard for web page navigation without using mouse.
9. IE 8 gives you better control over search provider settings. Whenever a program such as an add-on or toolbar tries to request a change to your default search provider, IE 8 prompts you to accept or reject the request.
10. IE 8 offers Compatibility View of websites, so that websites designed for earlier versions of Internet Explorer display correctly in IE 8 as though these were being viewed in earlier IE versions.
11. Suggested Sites which is an online service designed to suggest other websites you might be interested in based on the websites you visit most. When you turn on Suggested Sites, your web browsing history is sent to the Microsoft, where it is saved and compared to a frequently updated list of related websites. You can choose to stop IE 8 from sending your web browsing history to Microsoft at any time. You can also delete individual entries from your history at any time.

Technorati Tags: Internet Explorer 8, Windows Internet Explorer 8, IE, IE 8, Web browser, Accelerator, SmartScreen Filter, Phishing Filter, InPrivate Browsing, Favorites bar, Developer Tools, Caret Browsing, Suggested Sites

EASEUS Partition Master

EASEUS Partition Master from CHENGDU YIWO Tech Development Co., Ltd. is very good partition management software with easy user-interface to accomplish following main functions for x86 based computers:

• Resize/ Move partitions
• Create partitions
• Delete specified partitions or delete all partitions
• Label partitions
• Format partitions
• Check partitions
• Partition scheme
• Create bootable disks
• Copy partition
• Copy disk
• Copy dynamic volume
• Convert partition
• Explore partition

EASEUS Partition Master supports following flavours of Microsoft Windows.

• Windows 2000 Professional SP4
• Windows 2000 Server SP4
• Windows 2000 Advanced Server SP4
• Windows XP Home
• Windows XP Professional
• Windows XP x64 Professional
• Windows Server 2003 Standard
• Windows Server 2003 Enterprise
• Windows Server 2003 x64 Standard
• Windows Server 2003 x64 Enterprise
• Windows Vista
• Windows Vista x64
• Windows Server 2008
• Windows Server 2008 x64

EASEUS Partition Master supports FAT12, FAT16, FAT32 and NTFS file systems. It supports IDE, SATA, SCSI, USB removable hard disk, and Firewire hard disk of any size between 2 GB to 2 TB, with maximum 32 disks at the same time.

However, EASEUS Partition Master has its limitations. It is not designed to work on removable media and the company do not guarantee to resolve problems you encounter when partitioning removable media. Further, Windows 2000, Windows XP and Windows Vista use basic disks and dynamic disks and you cannot perform EASEUS Partition Master operations on dynamic disks.

Technorati Tags: EASEUS Partition Master, disk partitioning, create partition, delete partition, format partition, convert partition, copy disk, FAT12, FAT16, FAT32, NTFS

PDFCreator – Open source freeware for PDF file creation

PDFCreator is an open source application that can create Portable Document Format (PDF) files from just about any program that prints using windows printers. With PDFCreator you can

• Create PDF's like printing using Windows printers.
• Create documents in PDF, Postscript (PS), Encapsulated Postscript (EPS), and variety of graphic file formats.
• Combine multiple documents into single PDF.
• Protect PDF files with password and up to 128 bit encryption.
• Automatically save PDF documents with current settings.

Download a copy of PDFCreator setup from its project site and install it on your Windows machine. Setup is quite simple and is illustrated in following screen shots.

 

   Take note of above screen shot, there are two different types of installations you can use when you install PDFCreator.

• Standard Installation: A standard installation sets up a standard printer for PDFCreator and allows that computer to create PDF documents, images, and Postscript files.
• Server Installation: A server installation sets up a network printer for PDFCreator and allows computers on your network to create PDF documents, images, and Postscript files remotely. If you use a server installation on a terminal server, make sure that you do not install PDFCreator in application mode.

Both types of installations are straight-forward and it depends entirely upon your requirement whether you need a PDF printer for your local machine or for your network users. With server installation of PDFCreator, you can use Auto-Save Mode to automatically save documents to a specified directory with UNC-pathnames and/or filename tokens. So, When using a server installation, you need to create a share for the printer with user access rights belonging to yourself. Also, make sure that at least one instance of PDFCreator is open. You can install PDFCreator as a service by using "instsrv.exe" and "srvany.exe" tools from Windows Resource Kit. If you do install PDFCreator as a service, make sure to use a user account with access rights writing in a Auto-Save directory. Settings can only be changed on the server. Users cannot change any settings in PDFCreator.

Following screen shot is of PDF Print Monitor when PDFCreator is installed as a server.

If first icon shown in toolbar has green ball, it means that PDFCreator Print Monitor is started. If it is red ball, it means Print Monitor is stopped. Press F2 key to start/stop the Print Monitor.

Click on Printer menu and select Options, then click on Auto-save link in left side of Options window.

In this Auto-save mode, following tokens are available to automatically assign names to PDF files.

• <Author>
• <Computername>
• <ClientComputer>
• <DateTime>
• <Title>
• <Username>
• <Counter>
• <REDMON_DOCNAME>
• <REDMON_DOCNAME_FILE>
• <REDMON_DOCNAME_PATH>
• <REDMON_FILENAME>
• <REDMON_JOB>
• <REDMON_MACHINE>
• <REDMON_PORT>
• <REDMON_PRINTER>
• <REDMON_SESSIONID>
• <REDMON_USER>

Click on Formats drop-down menu in PDFCreator options window and you can configure file format settings for PDF, PNG, JPEG, BMP, PCX, TIFF, PS, EPS, TXT, PSD, PCL, Raw, and SVG file types.

There are five ways to create PDF in PDFCreator:

• Printing
• Drag and Drop
• Document Adding
• Command Line
• Windows Explorer

Method 1: Printing

Open the document you wish to convert into a PDF in its default application and print the document to PDFCreator printer. You can provide additional information in the next window. Save your PDF file or click on Waiting button to create the PDF at a later time.

Method 2: Drag and Drop

Open the PDFCreator Print Monitor, click and drag the document or file you wish to create into a PDF into the Print Monitor.

Method 3: Document Adding

Open the PDFCreator Print Monitor, click the Document menu and select Add. In the file type box, select the document you wish to convert to PDF.

Method 4: Command Line

Execute following command at the command prompt:

PDFCreator.exe /PF"Full path of the document"

Make sure to type full path to PDFCreator.exe without any space between /PF and the path.

Method 5: Windows Explorer

Right click on any document in Windows Explorer and select Create PDF with PDFCreator.

You can create a single PDF file from multiple files waiting to be printed in PDF Print Monitor. Click on Document menu and select Combine or Combine all to do so.