50 Essential Open Source Security Tools

http://www.linuxplanet.com/linuxplanet/roundups/6579/1
Anti-Everything, Encryption, Secure Delete, Forensics

• November 11, 2008
• By Cynthia Harvey

The area of open source security software is growing rapidly, with a cornucopia of apps for every use: anti-spam, firewalls, forensics, encryption, log monitoring, passwords – the list is growing even as you read this. In many cases, these open source security tools – many of which are free – are available for the Windows, Linux and Mac operating systems.
Let the downloading begin…
1. SpamAssassin
Winner of multiple Datamation Product of the Year awards, SpamAssassin uses header and text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases to block unwanted e-mail at the server level. It works with most mail systems and is available under the Apache license. Operating System: OS Independent.
Anti-Virus/Anti-Malware
2. ClamAV
This anti-virus toolkit is designed especially for protecting mail gateways and features a command line scanner, automatic updates, and more. Although the original ClamAV engine works only with Unix-like systems, numerous other projects (both open-source and commercial) have incorporated ClamAV. Operating System: Linux, Unix, BSD.
3. ClamWin
ClamWin provides a Windows front-end for the ClamAV antivirus toolkit. It features automatic updates, a scanning schedule, Outlook integration, and more. Operating System: Windows.
Application Firewall
4. SELinux
Developed by the NSA, Security Enhanced Linux adds mandatory access control features to the Linux OS. It enforces complete separation of information to make it more difficult to bypass application security mechanisms. Operating System: Linux, Unix.
5. AppArmor
Novell's application firewall uses policy-based profiles to control who can access various applications. It's included with openSUSE and SUSE Linux Enterprise, but is also available for download for any Linux system. Operating System: Linux.
Data Destruction
6. Darik's Boot And Nuke
Just slip a disk containing Darik's Boot and Nuke into your system, and it will automatically destroy all the data on any hard drive it can detect. It's ideal for cleaning up old computers before they are donated or recycled. Operating System: OS Independent.
7. Eraser
Eraser completely eliminates a file so that it cannot be read with digital forensic tools. It overwrites data several times with random patterns erasing all traces of sensitive information. Operating System: Windows.
Encryption
8. TrueCrypt
TruCrypt can create a virtual encrypted disk within a file or encrypt a partition or drive on a Windows system. It can also be used to encrypt a portable hard drive or USB flash drive. Operating System: Windows, Mac, Linux.
9. AxCrypt
Simply right-click any file on Windows Explorer to encrypt it with AxCrypt. AxCrypt aims to make it as easy to work with encrypted files as it is to work with unencrypted files—just a lot more secure. Operating System: Windows.
File Transfer
10. WinSCP
WinSCP is a easy-to-use, basic SFTP and FTP client for Windows only. It also supports SCP. Operating System: Windows.
Forensics
11. The Sleuth Kit
Need to recover a deleted file? The Sleuth Kit lets you read deleted data from NTFS, FAT, FFS, and EXT2FS file systems. Operating System: Windows, Mac, Linux, Unix, BSD, Solaris.
Gateway Security Appliance
12. Untangle
A great alternative to expensive commercial security appliances, Untangle combines the best of open-source Web filtering, anti-spam, anti-spyware, anti-virus, intrusion prevention, firewall, VPN, and more into one download that can be used to turn any PC into a security appliance. Commercial support and other add-ons are available for a fee. Operating System: Linux.
13. Endian Firewall Community
Similar to Untangle, Endian Firewall Community can turn an old PC into a unified threat management (UTM) appliance that provides a firewall, anti-virus, anti-spam, content filtering, and a VPN. Pre-configured appliances and support are also available for a fee. Operating System: Linux.

• 2. Anti-Everything, Encryption, Secure Delete, Forensics
• 3. Anti-Everything, Encryption, Secure Delete, Forensics
• 4. Anti-Everything, Encryption, Secure Delete, Forensics

BSoD auswerten

Nirsoft.net BlueScreenViewer !
Bluescreen!

Schau mal nach, ob bei Systemfehlern eine dump Datei (Minidump) geschrieben wird. Dies Auswertung der Minidump kann hilfreich sein, dem fehlerhaften Treiber auf die Schliche zu kommen.
Systemsteuerung - System und Sicherheit - System - erweiterte Systemeinstellungen - Starten und Wiederherstellen - Einstellungen. Im dem Fenster kannst du überprüfen, ob bei Debuginformationen speichern das "kleine Kernelspeicherabbild" eingestellt ist (unten drunter siehts du auch den Speicherpfad der Datei).
Ist dies bereits eingestellt, wurde auch eine Minidump geschrieben. Ist das "vollständige Kernelspeicherabbild" eingestellt, wird eine Memory.dmp unter C:\Windows angelegt

Diese kann ausgewertet werden. Wenn der Bluescreen von einem Treiber verursacht wurde, könnte die Auswertung evtl. hilfreich sein, um dem (fehlerhaften) Treiber auf die Schliche zu kommen.

Um die Minidump auszuwerten, brauchst du das Debugging Tool for Windows, welches im SDK Paket enthalten ist -Link zur Vista/Win7/Win8 Version-. 

Für XP diese Version. (In beiden Fällen während der Installation in der Komponentenauswahl nur die Debugging tools auswählen).



Nach der Installation findest du im Programmverzeichnis (Programme -> Windows Kits) die Debugging Tools sowohl in der 32-bit, als auch in der 64-bit Version vor. Wähle die Version, in der Windows auf deinem Rechner installiert ist. Die Datei windbg.exe, bei Win8/Win7/Vista als Administrator starten (mit der rechten Maustaste auf die windbg.exe klicken und im Kontext-Menü "...als Administrator starten auswählen).

Der Debugger muss zunächst noch verschiedene Informationen über installierte Patches, SPs, Treiber, etc., bekommen. Dies macht er eigenständig...einfach warten.

Dann auf Files - Symbol File Path und in das kleine Fenster folgenden Befehl eingeben (paste&copy):

"SRV*C:\symbols*http://msdl.microsoft.com/download/symbols" (ohne "")

und OK drücken. Jetzt können alle notwendigen Informationen zum Debuggen von MS geladen werden, das geschieht automatisch, benötigt aber eine bestehende Internet-Verbindung (alternativ können auch die kompletten Symbol-Dateien heruntergeladen werden: http://msdn.microsoft.com/en-us/wind.../gg463028.aspx

Anschließend über Files, das Speicherabbild für den Debugger öffnen: Files -> Open Crash Dump

Die Dump Datei auswählen und öffnen (Speicherpfad der dmp Datei ist C:\Windows -> "MEMORY.dmp" bzw. C:\Windows\Minidump -> "Minixxxxxx-xx.dmp- je nachdem, ob in den erweiterten Systemeinstellungen das "kleine", oder "vollständige Kernelspeicherabbild" eingestellt ist).

Im letzten Schritt in die untere Befehlszeile "!analyze –v" eingeben und Entertaste drücken.

Der Debugger werkelt dann etwas (manchmal auch etwas länger) und nach kurzer wird als Ausgabe u.a. eine Zuweisung der Datei, die den Bluescreens hervorgerufen hat, gegeben.

Den Text der Auswertung kannst du dann uns posten.

Die Microsoft eigene Übersicht über die Stopfehlercodes kann auch als erste Anlaufstelle recht hilfreich sein: http://msdn.microsoft.com/en-us/libr...(v=vs.85).aspx

----------
Sehr bequem ist auch der Dienst auf dieser Seite, auf der man seine Dump-Dateien hochladen kann und die Auswertung (analyze -v) automatisiert abläuft: http://www.osronline.com/page.cfm?name=analyze

Things to know

10-new-open-source-projects-you-may-not-know-about
10-most-successful-open-source-projects-of-2012
10-open-source-projects-that-power-the-cloud
six-freeopen-source-databases-with-commercial-quality-features
50-Open-Source-Tools-To-Replace-Popular-Security-Software
50 Essential Open Source Security Tools

Diagnostic software for hard drives

TackTech Corporation... thanks!
Download the latest diagnostic software and utilities from the manufacturer of your hard drive(s).
Hitachi [IBM]
Seagate [ Samsung,  Maxtor [Quantum],  Conner ]
Toshiba [Fujitsu]
Western Digital
-----------------------------
Hitachi, Ltd. / IBM Corporation
Hitachi | IBM
January 2003 - IBM and Hitachi's storage divisions merged to establish Hitachi Global Storage Technologies (Hitachi GST).
- Download Drive Fitness Test v4.16 b00 (10.07.2009) - CD Image (Direct Link)
- View Additional Information

Maxtor Corporation / Quantum HDD
Maxtor | Quantum

May 22, 2006 - Seagate Technology completed acquisiton of Maxtor Corporation.
April 2, 2001 - Maxtor Corporation merged with Quantum Hard drive division (Quantum HDD).
Maxtor/Quantum SCSIMax v1.21 (05.14.2003)
SCSIMax is a diagnostic utility for all Maxtor/Quantum® SCSI hard disk drives supporting Self-Monitoring, Analysis, and Reporting Technology (S.M.A.R.T). This test will determine hard drive integrity in a short period of time, with a high degree of confidence. If the program completes without error, the problem remains elsewhere in your system. Check SCSI cables, termination and operating system. Maxtor recommends you use this utility for troubleshooting potential hard drive problems. These problems include, but are not limited to: potential hard drive surface media problems (e.g., bad clusters or sectors, partitioning/formatting problems, etc.) and drive recognition problems (e.g. hard drive that is not recognized by the operating system). SCSIMax uses the SCSI controller's ASPI driver to route Int13 commands to the hard drive. The utility is not data destructive, but Maxtor recommends that you complete a full backup of your hard drive before running this utility. Note: Incompatible with Apple® systems, and SCSI Ultra320 controllers. This utility does not run from the Windows desktop.
Note: Incompatible with Apple® systems, and SCSI Ultra320 controllers. This utility does not run from the Windows desktop.
- Download SCSIMax (Direct Link | 70KB)
- View Additional Information

Samsung Samsung
Samsung Drive Manager 1.0.147 (10.28.2011)
Samsung Drive Manager is a bundled software for Samsung external drives. It comprises:
Samsung AutoBackup
Samsung SecretZone
Samsung Secure Manager - a secure external hard drive management solution
Samsung external drive management tools Note: Samsung Secure Manager cannot be used if your hard drive does not support the security function.
- Download Drive Manager (Direct Link)
- View Additional Information

ES-Tool (The Drive Diagnostic Utility) v2.12a (03.12.2009)
ES Tool (The Drive Diagnostic Utility) is made with the aim of testing a Samsung hard disk drive while it is installed inside a PC, regardless of the status of user's operating system. In fact of the drives returned to Samsung, a large percentage are NTF("No Trouble Found") after testing. So it is strongly recommended to test the drive if it is truly defective by a few fundamental troubleshooting of ES Tool first, to avoid user's unnecessary effort and inconvenience of replacing a good drive.
- Download ES-Tool for FDD (Direct Link)
- Download ES-Tool Bootable CD ISO (Direct Link)
- View Additional Information

HUTIL (Diagnostic Utility for New Drives) v2.10 (10.08.2007)
Hutil (The Drive Diagnostic Utility) is made with the aim of testing a Samsung hard disk drive while it is installed inside a PC, regardless of the status of user’s operating system. In fact of the drives returned to Samsung, a large percentage are NTF(“No Trouble Found”) after testing. So it is strongly recommended to test the drive if it is truly defective by a few fundamental troubleshooting of Hutil first, to avoid user’s unnecessary effort and inconvenience of replacing a good drive.

- Download HUTIL for FDD (Direct Link)
- Download HUTIL Bootable CD ISO (Direct Link)
- View Additional Information

SHDIAG (Diagnostic for Old Drives) v1.25 (05.27.2007)
This program is used to diagnose the disk when the SAMSUNG hard disk is suspected to have failures. It is strongly recommended to back up your data before using this program!
- Download Shdiag (Direct Link)
- View Additional Information

SUTIL (Utility for Old Drives) 1.01 (09.13.2002)
This utility will erase hard drives and set their DMA modes.
- Download SUTIL (Direct Link)
- View Additional Information

Seagate LLC Seagate [ Samsung, Maxtor [Quantum], Conner ]
1979 - Seagate Technology was founded (under the name "Shugart Technology")
1986 - Conner Peripherals founded by Seagate Technology co-founder Finis Conner.
February 5, 1996 - Seagate completed the merger with Conner Peripherals, Inc.
May 22, 2006 - Seagate Technology completed acquisiton of Maxtor Corporation.
December 12, 2006 - Al Shugart, co-founder of Seagate, died.
SeaTools for DOS v2.23 (Graphical) (02.09.2011)
SeaTools for Windows has replaced SeaTools Online and PowerMax. SeaTools for Windows is a comprehensive, easy-to-use diagnostic tool that helps you quickly determine the condition of the disc drive in your external hard drive, desktop or notebook computer. It includes several tests that will examine the physical media on your Seagate or Maxtor disc drive and any other non-Seagate disc drive.

SeaTools for Windows tests USB, 1394, ATA (PATA/IDE), SATA and SCSI drives. It installs onto your system. SeaTools for Windows is completely data safe.
- Download SeaTools for DOS (Floppy Diskette Creator)
- Download SeaTools for DOS (ISO CD-ROM Image)
- View Additional Information


SeaTools for DOS v1.10 (Text) (11.07.2007)
SeaTools for Windows has replaced SeaTools Online and PowerMax. SeaTools for Windows is a comprehensive, easy-to-use diagnostic tool that helps you quickly determine the condition of the disc drive in your external hard drive, desktop or notebook computer. It includes several tests that will examine the physical media on your Seagate or Maxtor disc drive and any other non-Seagate disc drive.

SeaTools for Windows tests USB, 1394, ATA (PATA/IDE), SATA and SCSI drives. It installs onto your system. SeaTools for Windows is completely data safe.

- Download SeaTools for DOS (Floppy Diskette Creator)
- Download SeaTools for DOS (ISO CD-ROM Image)
- View Additional Information


SeaTools for Windows v1.2.0.6 (10.15.2011)
SeaTools for Windows has replaced SeaTools Online. SeaTools for Windows is a comprehensive, easy-to-use diagnostic tool that helps you quickly determine the condition of the disc drive in your external hard drive, desktop or notebook computer. It includes several tests that will examine the physical media on your Seagate disc drive and any non-Seagate disc drive.

SeaTools for Windows tests USB, 1394, ATA (PATA/IDE), SATA and SCSI drives.
 It install onto your system. SeaTools for Windows is completely data safe.

You can run SeaTools for Windows to test your disc drive if your PC has:
Microsoft Windows 7, Vista, XP or 2000.
Microsoft .NET Framework v2.0 - Available for download (approximately 23 MB) from www.microsoft.com. Search the site for .NET 2.0 or go directly there.
VGA 1024x768 or greater graphics capability
- Download SeaTools for Windows (32-bit) Setup file
- View Additional Information


SeaTools Enterprise Edition
SeaTools Diagnostic Suite is Seagate's exclusive disc drive diagnostic software designed to troubleshoot most Seagate hard drive issues. Ideal for SCSI or Fibre Channel drives in servers and workstations. Tests multiple drives simultaneously and sequentially. This version does not test ATA or SATA.

- Download SeaTools Enterprise Edition v2.4.39 (Windows | 07.16.2003)
- Download SeaTools Enterprise Edition v2.54 (Linux Command Line | 09.21.2001)
- Download SeaTools Enterprise Edition v5.2.23-010730 (Linux Graphical)


Seagate /Acronis DiscWizard 11.0.0.8142 (06.24.2008)
Seagate DiscWizard makes it easy to work with your new Seagate disc drives. DiscWizard lets you quickly install your new disc drive, with wizards that guide you through the processes of creating and formatting partitions on your disc drive.

DiscWizard also lets you transfer your data to your new Seagate disc drive in minutes. The software migrates everything – your operating systems, applications, documents and personal setting – to your new disc drives just as you had them. After you migrate, you can keep using your PC just like before. You can then keep your old drive as a backup or use DiscWizard to store your image backups.

- Download DiscWizard
- View Additional Information


Toshiba / Fujitsu
Toshiba

On October 1st, 2009, Fujitsu Limited transferred its hard disk drive business to Toshiba Corporation.

For warranty service, contact the Toshiba SDD Repair Center.



Windows Diagnostic Tool Ver. 1.12 (For IDE/ATA/SATA Hard Drives)
This diagnostic tool is available for use by customers who feel their Fujitsu Branded Toshiba hard drive may not be operating normally. It is only designed for use with Fujitsu Branded Toshiba ATA/IDE hard drives.
There are 2 diagnostic modes:

Quick Test
About 3 minutes, does random seek/read tests.
Comprehensive Test
About 30 to 100 minutes, also performs surface scan. *Supports Windows 2000/XP/Vista

- Download and Additional Information


DOS Diagnostic Tool Ver. 7.0 (For IDE/ATA/SATA Hard Drives) (04.20.2007)
This diagnostic tool is available for use by customers who feel their Fujitsu Branded Toshiba hard drive may not be operating normally. It is only designed for use with Fujitsu Branded Toshiba ATA/IDE hard drives. There are 2 diagnostic modes:

Quick Test
About 3 minutes, does random seek/read tests.
Comprehensive Test
About 30 to 100 minutes, also performs surface scan. *Runs only under DOS from a bootdisk.

- Download and Additional Information


Diagnostic Tool Ver. 2.3 (For SCSI Hard Drives) (01.15.2004)
This diagnostic tool is available for use by customers who feel their Fujitsu Branded Toshiba SCSI hard drive may not be operating normally. It is only designed for use with Fujitsu Branded Toshiba SCSI hard drives. There are 3 test modes:

Quick Test
1 to 3 minutes, a basic operational test.
Comprehensive Test
20 to 25 minutes, also performs Read/Write tests.
Comprehensive Test
30 to 70 minutes, also verify and surface test. *Supports Windows NT/98/2000/2003/XP *Requires Adaptec's ASPI32 driver.

- Download and Additional Information


Other Toshiba/Fujitsu Hard Drive Utilities.


Fujistu
FJDT (Fujitsu ATA Diagnostic Tool) v6.90 (11.03.2006)
FJDT is diagnostic tool to help customers speedily verifiy whether their EIDE hard disk drive is operating correctly. FJDT can diagnose your suspected faulty hard drive by checking the S.M.A.R.T. data and also by scanning the entire surface of the drive, sector by sector, to verify media integrity.

- Download FJDT (Fujitsu ATA Diagnostic Tool) (Direct Link | English)
- View Additional Information

[SDIAG] SCSI Diagnostic Tool v2.7 (01.23.2006)
SDIAG is a simple and reliable SCSI diagnostic tool developed by Fujitsu verifying the condition of your Fujitsu SCSI Hard Disk Drive. A high percentage of Hard Drives returned to the manufacturer are actually diagnosed as "No Trouble Found" (NTF). There could be many circumstances that are causing the system to fail and invariably the hard drive is blamed. SDIAG can be employed without the disruptive removal of the drive from the system and its status ascertained saving both time and money.

- Download SDIAG (SCSI Diagnostic Tool) (Direct Link)
- View Additional Information


[Ultra-ATA] Change Mode Utility v1.19 (10.23.2001)
A utility to change the UltraATA capability of the drive. Three batch files allow the mode setting for UDMA100, 66, and 33.

- Download SDIAG (SCSI Diagnostic Tool) (Direct Link)
- View Additional Information

Western Digital Corporation
Western Digital
Data Lifeguard v11.2 for drives > 137GB (CD) (December 2006)
This zip file contains a bootable CD image of the Data Lifeguard v11.2 installation CD which contains both DOS and Windows versions and was written specifically for the installation of Western Digital EIDE hard drives. If your computer system already has a hard drive installed with an operating system of Windows 98SE or greater, you should use the Windows version of Data Lifeguard for best results. The DOS version is required if installing a hard drive in a new system without existing operating system support. If you plan on copying the contents of a boot drive, Western Digital recommends using the DOS version of Data Lifeguard Tools.

- Download Data Lifeguard
- View Additional Information


Data Lifeguard v11.2 for drives > 137GB (April 2006)
The downloadable Data Lifeguard Tools now comes in both DOS and Windows versions and was written specifically for the installation of Western Digital EIDE hard drives. If your computer system already has a hard drive installed with an operating system of Windows 98SE or greater, you should use the Windows version of Data Lifeguard for best results. The DOS version is required if installing a hard drive in a new system without existing operating system support. If you plan on copying the contents of a boot drive, Western Digital recommends using the DOS version of Data Lifeguard Tools.

- Download Data Lifeguard
- View Additional Information


Data Lifeguard Tools 11.0 for DOS and Windows (CD) (01.02.2007)
This zip file contains a bootable CD image of the Data Lifeguard v11.0 installation CD which contains both DOS and Windows versions and was written specifically for the installation of Western Digital EIDE hard drives. If your computer system already has a hard drive installed with an operating system of Windows 98SE or greater, you should use the Windows version of Data Lifeguard for best results. The DOS version is required if installing a hard drive in a new system without existing operating system support. If you plan on copying the contents of a boot drive, Western Digital recommends using the DOS version of Data Lifeguard Tools.

- Download Data Lifeguard Tools 11.0 for DOS (CD) (Direct Link | 27.4MB)
- View Additional Information


Data Lifeguard Tools 11.0 for DOS (05.15.2006)
This zip file contains a bootable CD image of the Data Lifeguard v11.0 installation CD which contains both DOS and Windows versions and was written specifically for the installation of Western Digital EIDE hard drives. If your computer system already has a hard drive installed with an operating system of Windows 98SE or greater, you should use the Windows version of Data Lifeguard for best results. The DOS version is required if installing a hard drive in a new system without existing operating system support. If you plan on copying the contents of a boot drive, Western Digital recommends using the DOS version of Data Lifeguard Tools.

- Download Data Lifeguard Tools 11.0 for DOS (Direct Link | ZIP | 1.56MB)
- Download Data Lifeguard Tools 11.0 for DOS (Direct Link | EXE | 1.74MB)
- View Additional Information


Data Lifeguard Diagnostic v5.19 for DOS (Floppy) (December 2010)
The Data Lifeguard Diagnostic Tools are used primarily for determining the physical condition of your hard drive. If you are having computer problems which you suspect are hard drive related, you can test your drive with this tool.

- Download DLG Diagnostic
- View Additional Information


Data Lifeguard Diagnostic v5.04f for DOS (CD) (October 31, 2008)
The Data Lifeguard Diagnostic Tools are used primarily for determining the physical condition of your hard drive. If you are having computer problems which you suspect are hard drive related, you can test your drive with this tool.

- Download DLG Diagnostic
- View Additional Information


Data Lifeguard Diagnostic for Windows v1.24 (July 2011)
This is a Windows version of the Data Lifeguard Diagnostics utility. The utility can perform drive identification, diagnostics, and repairs on a Western Digital FireWire, EIDE, or USB drive. In addition, it can provide you with the drive's serial and model numbers.

- Download DLGDIAG for Windows
- View Additional Information

Windows 7 prompt commands

pcsupport.about.com/od/commandlinereference/tp/windows-7-commands

• Assoc and Ftype
• Batch files- basics
• Batch files - branching
• Batch files- iterating
• Command Line- Introduction
• Command line list and
  reference
• Commands that
  everybody can use
• Configuring the command
  prompt window
• Disk management-Diskpart
• Doskey
• File system utility- Fsutil
• Net Services
• Netstat
• Network Services Shell
• PowerShell
• Recovery Console
• Recovery Console-
  Commands
• Registry editor console
• Scripts in the command
  line
• Server 2003 tools for XP
• Service Controller
  Command (SC)
• Shell command
• Start-Run line
• Support tools
• Tasklist
• TCP/IP networking tools
• Tips for using the command shell
• Tskill and Taskkill
• Variables and "Set"
• Vista command list
• Vista/7 command line tips
• VSSadmin
• Windows 7 command list
• Windows 7 shell folders
• Windows 8 command list
• Xcopy

Commands in Windows 7

The command prompt that has been in previous versions of Windows is still with us and is not much changed fron Windows Vista. The command line remains a powerful and much used feature by system administrators everywhere. Thus, the old command interpreter cmd.exe has been continued although in a slightly newer version. Several commands are now in the standard list that were formerly available only on servers. New commandsare indicated with an asterisk in the list below. Note that some commands may require administrator privileges. A number of commands involving specialized system or network administration have been omitted.

The commands given below remain in wide use but Microsoft has shifted its corporate emphasis to a new command shell called Powershell that is described on another page. This new command shell is included with Windows 7.

ASSOC Displays or modifies file extension associations.
ATTRIB Displays or changes file attributes.
BREAK Sets or clears extended CTRL+C checking.
BCDBOOT* Used to copy critical files to the system partition and to create a new system BCD store.
BCDEDIT Sets properties in boot database to control boot loading.
CACLS Displays or modifies access control lists (ACLs) of files.
CALL Calls one batch program from another.
CD Displays the name of or changes the current directory.
CHCP Displays or sets the active code page number.
CHDIR Displays the name of or changes the current directory.
CHKDSK Checks a disk and displays a status report.
CHKNTFS Displays or modifies the checking of disk at boot time.
CHOICE Batch file command that allows users to select from a set of options.
CIPHER Displays or alters the encryption of directories [files] on NTFS partitions.
CLIP Redirects output of another command to the Windows clipboard.
CLS Clears the screen.
CMD Starts a new instance of the Windows command interpreter.
CMDKEY Creates, lists and deletes stored user names and passwords or credentials.
COLOR Sets the default console foreground and background colors.
COMP Compares the contents of two files or sets of files byte-by-byte
COMPACT Displays or alters the compression of files on NTFS partitions.
CONVERT Converts FAT volumes to NTFS. You cannot convert the current drive.
COPY Copies one or more files to another location.
DATE Displays or sets the date.
DEFRAG Disk defragmenter accessory.
DEL Deletes one or more files.
DIR Displays a list of files and subdirectories in a directory.
DISKCOMP Compares the contents of two floppy disks.
DISKCOPY Copies the contents of one floppy disk to another.
DISKPART Displays or configures Disk Partition properties. A separte command interpreter with a sub-set of commands.
DOSKEY Edits command lines, recalls Windows commands, and creates macros.
DRIVERQUERY Displays current device driver status and properties.
ECHO Displays messages, or turns command echoing on or off.
ENDLOCAL Ends localization of environment changes in a batch file.
ERASE Deletes one or more files.
EXIT Quits and closes the command shell.
EXPAND Expands one or more compressed files.
FC Compares two files or sets of files, and displays the differences between them.
FIND Searches for a text string in a file or files.
FINDSTR Searches for strings in files.
FOR Runs a specified command for each item in a set.
FORFILES Selects files in a folder for batch processing.
FORMAT Formats a disk for use with Windows.
FSUTIL Displays or configures the file system properties.
FTYPE Displays or modifies file types used in file extension associations.
GOTO Directs the Windows command interpreter to a labeled line in a batch program.
GPRESULT Displays Group Policy information for machine or user.
GRAFTABL Enables Windows to display an extended character set in graphics mode.
HELP Provides Help information for Windows commands.
ICACLS Display, modify, backup, or restore ACLs for files and directories (more here).
IF Performs conditional processing in batch programs.
IPCONFIG Displays all current TCP/IP network configuration values
LABEL Creates, changes, or deletes the volume label of a disk.
MD Creates a directory.
MKDIR Creates a directory.
MKLINK Creates Symbolic Links and Hard Links
MODE Configures a system device.
MORE Displays output one screen at a time.
MOVE Moves one or more files from one directory to another directory.
OPENFILES Queries, displays, or disconnects open files or files opened by network users.
PATH Displays or sets a search path for executable files.
PAUSE Suspends processing of a batch file and displays a message.
POPD Restores the previous value of the current directory saved by PUSHD.
PRINT Prints a text file.
PROMPT Changes the Windows command prompt.
PUSHD Saves the current directory then changes it.
RD Removes a directory.
RECOVER Recovers readable information from a bad or defective disk.
REM Designates comments (remarks) in batch files
REN Renames a file or files.
RENAME Renames a file or files.
REPLACE Replaces files.
RMDIR Removes a directory.
ROBOCOPY Advanced utility to copy files and directory trees
SET Displays, sets, or removes environment variables for current session.
SETLOCAL Begins localization of environment changes in a batch file.
SETX Sets environment variables.
SC Displays or configures services (background processes).
SCHTASKS Schedules commands and programs to run on a computer.
SHIFT Shifts the position of replaceable parameters in batch files.
SHUTDOWN Allows proper local or remote shutdown of machine.
SORT Sorts input.
START Starts a separate window to run a specified program or command.
SUBST Associates a path with a drive letter.
SYSTEMINFO Displays machine specific properties and configuration.
TAKEOWN Allows an administrator to take ownership of a file (more here).
TASKLIST Displays all currently running tasks including services.
TASKKILL Kill or stop a running process or application.
TIME Displays or sets the system time.
TIMEOUT Pauses the command processor for the specified number of seconds.More here.
TITLE Sets the window title for a CMD.EXE session.
TREE Graphically displays the directory structure of a drive or path.
TYPE Displays the contents of a text file.
VER Displays the Windows version.
VERIFY Tells Windows whether to verify that your files are written correctly to a disk.
VOL Displays a disk volume label and serial number.
VSSADMIN Volume Shadow Copy Service administration tool
WHERE Displays the location of files that match a search pattern.
XCOPY Copies files and directory trees.
WMIC Displays WMI information inside interactive command shell.

*New to Windows 7

Introduction to PowerShell
Microsoft has developed a new command line interface (first called "Monad") and renamed "PowerShell". It was first made available as a stand-alone application for Windows XP (download here). and then for Vista ( available at this site). It is now a standard part of Windows 7. The older command interpreter cmd.exe is still present as well. The new shell is Microsoft's answer to Unix shell scripting. It is quite different from the previous command line interface and is considerably more powerful. It makes use of more sophisticated techniques and objects and requires the .NET Framework 2.0. It has new functions for systems and network administration and is aimed at IT professionals. Because the purpose of this present site is to introduce the command line to home PC users , PowerShell is somewhat beyond the intended scope (and my personal experience). Nonetheless, I believe the home user should be aware of PowerShell's potential and the more experienced may wish to explore it further. I will try to outline very briefly what PowerShell is about. PowerShell features
In the previous Windows command line described elsewhere on this site, commands consist of internal command strings that are interpreted and executed by the command interpreter or of commands that invoke separate executable files. PowerShell has a new approach that makes use of what Microsoft calls "cmdlets". Here is Microsoft's description:

A cmdlet (pronounced "command-let") is a single-feature command that manipulates objects in Windows PowerShell. You can recognize cmdlets by their name format -- a verb and noun separated by a dash (-), such as Get-Help, Get-Process, and Start-Service.

Although each cmdlet has a single function, groups of cmdlets can be strung together to carry out a complex task. Also the output of many cmdlets can be used as input (piped) to other cmdlets without additional processing. These capabilities represent a significant advance over the present command line shell.

PowerShell continues to recognize the commands from the older command shell although, in many cases, the command is an alias for a PowerShell cmdlet

List of cmdlets
At this time, PowerShell comes with 129 cmdlets. Since cmdlets are easily written, more can be expected. Table I shows the list of those presently available.

Table I. List of PowerShell cmdlets

Add-Content Add-History Add-Member Add-PSSnapin Clear-Content Clear-Item Clear-ItemProperty Clear-Variable Compare-Object ConvertFrom-SecureString Convert-Path ConvertTo-Html ConvertTo-SecureString Copy-Item Copy-ItemProperty Export-Alias Export-Clixml Export-Console Export-Csv ForEach-Object Format-Custom Format-List Format-Table Format-Wide Get-Acl Get-Alias Get-AuthenticodeSignature Get-ChildItem Get-Command Get-Content Get-Credential Get-Culture

Get-Date Get-EventLog Get-ExecutionPolicy Get-Help Get-History Get-Host Get-Item Get-ItemProperty Get-Location Get-Member Get-PfxCertificate Get-Process Get-PSDrive Get-PSProvider Get-PSSnapin Get-Service Get-TraceSource Get-UICulture Get-Unique Get-Variable Get-WmiObject Group-Object Import-Alias Import-Clixml Import-Csv Invoke-Expression Invoke-History Invoke-Item Join-Path Measure-Command Measure-Object Move-Item

Move-ItemProperty New-Alias New-Item New-ItemProperty New-Object New-PSDrive New-Service New-TimeSpan New-Variable Out-Default Out-File Out-Host Out-Null Out-Printer Out-String Pop-Location Push-Location Read-Host Remove-Item Remove-ItemProperty Remove-PSDrive Remove-PSSnapin Remove-Variable Rename-Item Rename-ItemProperty Resolve-Path Restart-Service Resume-Service Select-Object Select-String Set-Acl Set-Alias

Set-AuthenticodeSignature Set-Content Set-Date Set-ExecutionPolicy Set-Item Set-ItemProperty Set-Location Set-PSDebug Set-Service Set-TraceSource Set-Variable Sort-Object Split-Path Start-Service Start-Sleep Start-Transcript Stop-Process Stop-Service Stop-Transcript Suspend-Service Tee-Object Test-Path Trace-Command Update-FormatData Update-TypeData Where-Object Write-Debug Write-Error Write-Host Write-Output Write-Progress Write-Verbose Write-Warning

---

PowerShell Cmdlet syntax

There are a number of parameters possible for cmdlets and a detailed discussion of syntax is beyond our scope. I will try to hint at the range of possibilities by discussing one useful cmdlet that carries out the copying function. It is not limited to copying files and folders but can also copy Registry keys and entries. This one cmdlet, in fact, incorporates the functions of several older commands with greater flexibility. First, here is a simple example where a folder and all its contents are to be copiedCopy-Item C:\Logfiles -destination D:\Backup -recurse This cmdlet copies all files and sub-folders in the folder C:\Logfiles to the folder D:\Backup .The parameter "-recurse" is used when sub-folders are to be copied.

Next, here are all the parameters in their full glory: Copy-Item [-path] [[-destination] ] [-container] [-recurse] [-force]
[-include ] [-exclude ] [-filter ] [-passThru] [-credential ] [-whatIf] [-confirm] [] Naturally, the full set of parameters varies from one cmdlet to the next but one option that is common to many is the intriguing "-whatIf". This setting describes what would happen if you executed the command but without actually executing it .This allows you to see safely what would happen if you did the command. For a table describing the various parameters above, click here.

PowerShell Scripting

PowerShell is also the basis for a scripting language. This language is intended to make administrative tasks easier and seems likely to supplant VBScript in the future. The extension for PowerShell scripts is .PS1. Many security features are built into the scripting engine and the default setting is to prevent scripts from running. Permission to run scripts is controlled by a feature called "Execution Policy". Information about this feature can be obtained by the PowerShell commandGet-Help about_signing More about PowerShell scripting can be found at this Microsoft site.

More information
We can barely scratch the surface in ths very short description of PowerShell. For those who wish to explore the subject further, here are some references:

• Microsoft resources for PowerShell
• Wikipedia article

runas command

You’ll need admin privileges to stop and start a service. 

On XP, you can use a command like this:

runas /noprofile /env /user:Administrator cmd

You will be prompted for the Administrator password, and a new command window will open.

Windows konnte nicht gestartet werden,

[da ein Festplattenkonfigurationsproblem vorlag]
da die folgende Datei fehlt oder beschädigt ist

Windows root\System32\Hal.dll
or ntoskrnl.exe
Source
Ursache
Dieses Verhalten kann auftreten, wenn eine oder mehrere der folgenden Bedingungen erfüllt sind:

• Der Wert Default im Abschnitt [Boot Loader] der Datei "Boot.ini" fehlt oder ist ungültig.
• Windows XP ist nicht in dem Verzeichnis installiert, das in der Datei "Boot.ini" angegeben ist.
• Die Datei "Ntoskrnl.exe" fehlt oder ist beschädigt.
• Der Partitionspfad in der Datei "Boot.ini" ist nicht korrekt festgelegt.
• Es liegt ein allgemeiner Hardwarefehler vor.

====================================
My own Solution by cebaehren
In my case I have a mulltiboot 3 system on RAID 1 and after installing Linux and tried to start the third partition (Windows XP) I became the error of bad hal.dll
In all the possibilities I must have installed windows XP after Seven ! (to avoid the installation of data of Seven bootmanager in a boot folder in the windows XP root partition... I use grub) without creating the (second) partition on disks array
Then must be a pair of errors in the boot.ini !
Go for an admin command line in Windows 7
get in the root partition of windows XP (for me is F: and the third partition)
then be sure
attrib -s -h boot.ini
notepad boot.ini
change the lines with the partition number you have yet the root partition of windows XP

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(3)\windows
[operating systems]
multi(0)disk(0)rdisk(0)partition(3)\windows="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 
Don't be fooled!
The developers of Microsoft Windows are not congruent...They sometimes count beginning from 0 [multi(0) and rdisk(0)]
and sometimes beginning from 1 [Thats the case for the partition(1)]
also third partition for windows XP:
  ...partition(3)\windows...
Save as boot.ini (not boot.txt) I hope you know how!
then in command line
attrib +r +h boot.ini
Et voilá!

How to edit the Boot.ini file in Windows XP
Evtl. hilft auch das oder das

Bootmanager von Windows XP verwenden
Other elegant solution, in case you don't have a multiboot installation:

Dieses Problem kann auftreten, wenn die Datei "Boot.ini" fehlt, beschädigt ist oder unkorrekte Einträge enthält.
Starten Sie zum Beheben dieses Problems den Computer von der Windows XP-CD-ROM, starten Sie die Wiederherstellungskonsole und verwenden Sie anschließend das Programm "Bootcfg.exe", um die Datei "Boot.ini" zu aktualisieren:

1. Konfigurieren Sie den Computer so, dass er vom CD-ROM- oder DVD-ROM-Laufwerk startet. Weitere Informationen zur Vorgehensweise finden Sie in der Computerdokumentation, oder wenden Sie sich an den Computerhersteller.
2. Legen Sie die Windows XP-CD-ROM in das CD-ROM- oder DVD-ROM-Laufwerk ein und starten Sie den Computer anschließend neu.
3. Wenn die entsprechende Meldung angezeigt wird, drücken Sie eine beliebige Taste, um den Computer von der Windows XP-CD-ROM zu starten.
4. Wenn die Willkommensseite angezeigt wird, drücken Sie die Taste [R], um die Wiederherstellungskonsole zu starten.
5. Falls Sie über ein Dual-Boot- oder Multiple-Boot-System verfügen, wählen Sie die Installation aus, die von der Wiederherstellungskonsole aus gestartet werden soll.
6. Wenn Sie dazu aufgefordert werden, geben Sie das Administratorkennwort ein und drücken Sie anschließend die [EINGABETASTE].
7. Geben Sie an der Eingabeaufforderung bootcfg /list ein und drücken Sie anschließend die [EINGABETASTE]. Die Einträge in der aktuellen Datei "Boot.ini" erscheinen auf dem Bildschirm.
8. Geben Sie an der Eingabeaufforderung bootcfg /rebuild ein und drücken Sie anschließend die [EINGABETASTE]. Dieser Befehl überprüft die Festplatten des Computers bei Windows XP-, Microsoft Windows 2000- oder Microsoft Windows NT-Installationen und zeigt anschließend die Ergebnisse an. Gehen Sie nach den Anweisungen auf dem Bildschirm vor, um die Windows-Installationen zu der Datei "Boot.ini" hinzuzufügen. Das folgende Beispiel zeigt, wie Sie eine Windows XP-Installation zu der Datei "Boot.ini" hinzufügen:
   1. Es wird eine ähnliche Meldung wie die folgende angezeigt:
      Insgesamt gefundene Windows-Installationen: 1
      
      [1] C:\Windows
      Installation zur Startliste hinzufügen? (Ja/Nein/Alle)
   2. Wenn die Meldung in Schritt a angezeigt wird, drücken Sie [J].
   3. Es wird eine ähnliche Meldung wie die folgende angezeigt:
      Ladekennung:
      Dies ist der Name des Betriebssystems.
   4. Wenn die Meldung in Schritt c angezeigt wird, geben Sie den Namen Ihres Betriebssystems ein und drücken Sie anschließend die [EINGABETASTE]. Dies ist entweder Microsoft Windows XP Professional oder Microsoft Windows XP Home Edition.
   5. Es wird eine ähnliche Meldung wie die folgende angezeigt:
      Ladeoptionen für Betriebssystem:
      
      Die auf dem Bildschirm angezeigten Anweisungen können je nach der Konfiguration Ihres Computers unterschiedlich sein.
   6. Wenn die Meldung in Schritt e angezeigt wird, geben Sie /fastdetect ein und drücken Sie anschließend die [EINGABETASTE].
9. Geben Sie exit ein und drücken Sie anschließend die [EINGABETASTE], um die Wiederherstellungskonsole zu beenden. Der Computer wird neu gestartet, und die aktualisierte Startliste wird angezeigt, wenn die Meldung "Wählen Sie das zu startende Betriebssystem" erscheint.

Browser stop to function -Culprit: a twitter widget!

[script src="http://widgets.twimg.com/j/2/widget.js"][/script]
[more shit]

You can not close the tag with the damn widgets on the browser
Javascript must be not allowed for this witget
but you must restart the browser!
http://themecraft.net/www/twimg.com
How to get logo out of twitter widget

Suggestions on cleaning of malware

Source by suebaby41
W.A.M. (Women Against Malware) Group: Malware Response Team
Step 1
You may want to print this page. Make sure to work through the fixes in the order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
Step 2
Be sure you have the latest versions of Ad-Aware and Adobe Reader which are Ad-Aware 2008 and Adobe® Reader® 9.
Step 3
In normal mode, run an online antivirus check from at least two and preferably three of the following sites
BitDefender
Computer Associates Online Virus Scan
Panda's ActiveScan
Trend Micro Housecall
Windows Live Safety Center Free Online Scan
This scanner from Trend does not require an Active X to run.

• Detects and removes malware ( viruses, worms, trojans, etc. )
• Detects and removes grayware and spyware
• Restores damage caused by malware to your system.
• Notifies about vulnerabilities in installed programs and connected network services.
• Multi-platform support for: Windows, Linux, Solaris.
• Easy-to-use with the Microsoft Internet Explorer and Mozilla Firefox.

When you have completed the scans, if you get a report of files that can’t be cleaned / deleted, make a note of the file location of anything that cannot be deleted so you can delete it yourself. Please post that list in your next reply.
Step 4
I recommend using Spyware Blaster.
Please download SpywareBlaster. SpywareBlaster helps to:

• Prevent the installation of Active X-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
• Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
• Restrict the actions of potentially unwanted sites in Internet Explorer.

Please see Using SpywareBlaster to protect your computer from Spyware, Hijackers, and Malware for instructions on how to download, install, and use SpywareBlaster.
Step 5
Windows Defender is a free program that helps protect your computer against pop-ups, slow performance, and security threats caused by spyware and other unwanted software. It features Real-Time Protection, a monitoring system that recommends actions against spyware when it is detected and minimizes interruptions and helps you stay productive.
Please download and install Windows Defender.

• Confirm that your computer meets the minimum system requirements to install Windows Defender.
• Visit the Windows Defender page in the Microsoft Download Center. Click the Continue button and follow the directions on the succeeding pages to download the program and start the Installation Wizard.
• Follow the steps in the Installation Wizard. You will be asked if you want to participate in the Microsoft SpyNet online community. We suggest you choose the first option,
  
• Use recommended settings.
• Click Next to continue.
• Click Install to begin installing Windows Defender.
• When installation is complete, click Finish. Windows Defender will begin to scan your computer.
• For more information, See How to install and set up Windows Defender

Step 6
Malwarebytes' Anti-Malware is FREEWARE, however you may upgrade to the PRO version which contains realtime protection, scheduled scanning and updating.

• Please download Malwarebytes Anti-Malware (MBAM). Alternate download link
• Double-click on Download_mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Click Finish.
• MBAM will automatically start and you will be asked to update the program before performing scan. If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from the Malware Bytes Web site. Scroll down the page until you see Latest Database; click Download from GT500.org
• Double-click on mbam-rules.exe to install.
• On the Scanner tab, make sure the Perform Quick Scan option is selected.
• Click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and Scan in progress will show at the top. It may take some time to complete; please be patient.
• When the scan is finished, a message box will say "The scan completed successfully.
• At the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.
• Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Step 7
ATF-Cleaner features include:

• Cleaning of all user temp folders, administrator only can use this feature.
• Cleaning of the Java cache, which seems to be harboring more and more malware.
• Cleaning the cache, cookies, history, download history, visited links and saved passwords. You have the option of checking no if you want to save your passwords.

Please download the ATF-Cleaner by Atribune.
Instructions:

• Double-click ATF-Cleaner.exe to run the program.
• Check the boxes to the left of:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch (Windows XP) only
  • Java Cache
• The rest are optional - if you want to remove them all, check Select All.
• Click the Empty Selected button.
• When you get the Done Cleaning message, click OK.

If you use the Firefox browser:

• Click Firefox at the top and choose: Select All.
• Click the Empty Selected button.
• When you get the Done Cleaning message, click OK.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use the Opera browser:

• Click Opera at the top and choose: Select All.
• Click the Empty Selected button.
• When you get the Done Cleaning message, click OK.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
If needed, Tutorial on ATF Cleaner with pictures.
Do not run it yet.
Step 8
Please disconnect from the Internet. Please close ALL browser windows (including this one).
Step 9
During the process of removing malware from your computer, there are times you may need to use specialized fix tools. Certain embedded files that are part of these specialized fix tools may be detected by your antivirus or anti-malware scanner as a RiskTool, Hacking tool, Potentially unwanted tool, a virus or a Trojan when that is not the case.
These tools have been carefully created and tested by security experts so if your antivirus or anti-malware program flags them as malware, then it is a False Positive. Antivirus scanners cannot distinguish between good and malicious use of such programs; therefore, they may alert you or even automatically remove them. In these cases, the removal of these files can have unpredictable results and unintentional results.
To avoid any problems while using a specialized fix tool, it is very important that you temporarily disable your antivirus and/or anti-malware programs before using the specialized fix tool.
When your system has been cleaned, it is important that you enable your security programs to avoid reinfection.
Please disable the following program:
Spybot - Search and Destroy TeaTimer

• Please disable Spybot - Search and Destroy TeaTimer, as it will prevent HijackThis from fixing the infection. You can enable it after you're clean. To disable Spybot - Search and Destroy TeaTimer:
• Open Spybot - Search and Destroy.
• Click Mode in the toolbar.
• Select Advance Mode.
• Click Tools.
• ClickResident.
• Uncheck the box next to Resident Tea-Timer.
• Close Spybot - Search and Destroy.
• Reboot your machine.
  Don't forget to restart Spybot - Search and Destroy's Teatimer when your machine is clean and undo the changes above.
• If needed, How To Disable Spybot Search and Destroy TeaTimer.

Step 10
Uninstall the following programs (Do not worry if they are not there.)
C:\PROGRA~1\ "Symantec" which contains \LIVEUP~1\LUCOMS~1.EXE
To uninstall the C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE.

• Click Start > Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, highlight LiveUpdate, click Remove.
• Close the Add or Remove Programs and the Control Panel windows.
• Using Windows Explorer (Windows key+e), search for the C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE folder. If the program folder is still there, select/highlight the C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE. DELETE it. (File > Delete.) If Windows is not installed on the C drive, replace C:\ with the appropriate drive letter.
  
• Close Windows Explorer.

Step 11
Use ctrl + alt + del (Three keys together) to get task manager. Find these processes and end task them.
OR
Use the Process Manager in HijackThis:

• Open HijackThis.
• Click Open the Misc Tools Section
• Click Open Process manager, find these programs and kill process the following running processes (Do not worry if they are not there.)

LUCOMS~1.EXE
Step 12
Now we will address the HijackThis fixes.
Please run HijackThis and click Scan. Place checks next to the following entries (make sure not to miss any):
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
Close all browsers and other windows except for HijackThis, and click Fix Checked to have HijackThis fix the entries you checked.
Step 13
Optional Fixes is the name that we use for fixes for unnecessary programs that load during startup and run in the background. These programs are not required to start automatically as you can start them manually if you need them. You would be removing the program from your startup but you would not be removing the program itself.
Your computer may be sluggish due to the many programs loading during startup and running in the background that are not necessary. Windows has a facility for starting programs at startup time. Some of these programs are required for your computer and the applications installed on it to run correctly. A good example of such a program is a virus-checking application that must always run, constantly checking for and isolating or removing files with viruses. Other such programs are not strictly required, or are optional. In some cases, you can gain significant performance enhancements by disabling the automatic startup of these programs. In many cases, the functionality offered by the programs is still available by starting the programs manually by, for example, starting the program from the Windows Start->Programs menu. Media players and instant messaging programs often fall into this category. In fact, it is common for many modern software applications, when installed, to add programs at startup that add items to the system tray or shortcut (context) menus in Windows Explorer to provide quick access to the features and functions of these applications. While they may be useful, they do increase boot time and consume system resources. It is advised that you disable these programs so that they do not take up necessary resources or slow the boot time.
Other than ScanRegistry, SystemTray, StateMgr, antivirus program entries, and firewall program entries, very few others need to load and run.
Read the articles below to see if it applies to your computer problem with being slow to respond.
Slow_Computer_Check_here_first_it_may_not_be_malware.
Help! My computer is slow!
50 Tips for a Super Fast PC
4 Ways to Speed Up Your Computer's Performance
It's not always malware: How to fix the top 10 Internet Explorer issues
You will be removing the program from your startup but you will not be removing the program itself. Scan with HijackThis.
Please run HijackThis and click Scan. Place checks next to the following entries:
msmsgs.exe (MSN Messenger Internet chat tool) is the main process relating to the MSN Messenger Internet chat tool installed by default on most Windows computers. The Windows Messenger (IM, MSN Messenger) from Microsoft provides Online Chat and Instant Messaging. If you don't use Windows Messenger, you can

• Rename the "Messenger" folder.
• Uninstall, Stop, Disable or Remove "Windows Messenger (IM, MSN Messenger)".

A tray bar is also installed alongside this process for easy access to its features which include Internet chat, file sharing and audio/video conferencing. This is a non-essential process. Disabling or enabling it is down to user preference. process can be removed to free up resources without compromising system performance. This program is not required to start automatically as you can start it manually if you need it. It is advised that you disable this program so that it does not take up necessary resources. Many users have reported this process slows their boot time. It may be worthwhile to fix it with HijackThis. Item(s) to fix in HijackThis:
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
WebmasterWorld says:

Quote

LinkScanner was withdrawn because it was a security risk for AVG users.

I recommend that you remove AVG V8 and reload it without the website scanner or download AVG Free.
Please see this thread regarding Linkscanner Concerns AVG Stops Real-Time Scanning" Indicated in the HijackThis log by:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
ati2evxx.exe is the ATI External Event Utility for your ATI display drivers. It manages the ATI Hotkey feature. This process can be removed to free up resources without compromising system performance. ati2evxx.exe is a process which provides optional features that the majority of us really do not use. The XT's overdrive feature uses this. If you have an XT you'll probably want to leave this on. This program is not required to start automatically as you can start it manually if you need it. It is advised that you disable this program so that it does not take up necessary resources.
To change the service to Manual.

• Right-click on My Computer and choose Manage.
• Expand the Services and Applications section and click on Services.
• On the right-side of the screen, find the entry for Ati HotKey Poller and double-click on it.
• Change the Startup Type: to Manual.
• Hit the OK button and close the Computer Management screen.

Many users have reported this process slows their boot time. It may be worthwhile to fix it with HijackThis. Item(s) to fix in HijackThis:
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
IDriverT.exe (InstallDriver Table Manager) process can be removed to free up resources without compromising system performance. IDriverT.exe is a process which belongs to the InstallShield product installation service which should only appear when you are installing a new piece of software. This program is not required to start automatically as you can start it manually if you need it. To change to Manual:

• Right-click on My Computer and choose Manage.
• Expand the Services and Applications section and click on Services.
• On the right-side of the screen, find the entry for InstallDriver Table Manager and double-click on it.
• Change the Startup Type: to Manual.
• Hit the OK button and close the Computer Management screen.

Many users have reported this process slows their boot time. It may be worthwhile to fix it with HijackThis. Item(s) to fix in HijackThis:
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
Close all browsers and other windows except for HijackThis, and click Fix Checked to have HijackThis fix the entries you checked.
Step 14
Using Windows Explorer, (My Computer (Windows key+e) search for the following files/folders and DELETE the following Folders indicated in BLUE. (Do not worry if they are not there):
C:\PROGRA~1\ Symantec which contains \LIVEUP~1\LUCOMS~1.EXE
Step 15
Let’s run ATF-Cleaner to ensure no malware is hiding in temporary folders and for general computer cleanup to free space on your computer.
Step 16
Please run HijackThis in Normal Mode and post a new HijackThis log so I can make sure that all the malware was deleted according to plan.

Sugerencias

Security


Manuallly download and update Malwarebytes definitions
Download and install the Windows version
Direct Access on Seven
Printers
Force Printing Preferences to Black and White
Virtualization
Citrix XenServer 5
Smart phones
Reset a BlackBerry using JL_Cmder on Windows 64-bit editions

Preventing future infections

Source Thanks, YourHighness

Please also have a look at the following links, giving some advice and suggestions for preventing future infections:

• So How did I get infected?
• Microsoft - 'Security at home'
• Miekies' prevention suggestions

Now you should Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools cannot access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. 

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Then go to Start > Run and type: Cleanmgr
• Click "OK".
• Click the "More Options" Tab.
• Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

I recommend you regularly visit the Windows Update Site , you are lagging behind on a few of them!

• Lots of Hacking/Trojans use the methods found (plugged by the updates) that have not been stopped by people not updating.
• By updating your machine, you have one less headache! 
• Update ALL Critical updates and any other Windows updates for services/programs that you use.
• If you wish, you can also use automatic updates. This is a good thing to have if you want to be up-to-date all the time, but can also be a bit of an annoyance due to its handling and the sizes of the updates. If you wish to turn on automatic updates then you will find here is a nice little article about turning on automatic updates.
• Note that it will download them for you, but you still have to actually click install.
• If you do not want to have automatic updates turned on, or are on dial-up, you can always download updates seperately at: http://windowsupdate.microsoft.com.

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

For a nice list of freeware programmes in all categories, please have a look at this thread with freeware products that are regarded as useful by the users of this forum: Commonly Used Freeware Replacements.

Another recommendation, is to download HostMan. It safeguards you with a regularly updated Hosts-file that blocks dangerous sites from opening. This adds another bit of safety while surfing the Internet. For installlation and setting up, follow these steps:

• Double-click the Downloaded installer and install the tool to a location of your choice
• Via the Startmenu, navigate to HostsMan and run the program.
  • Click "Hosts" in the menu
  • Click "Manage Updates" in the submenu
  • Out of the three, select atl east one of them (I have MVPS Host as my main one)
  • Click "Add Update." After that you will only need to click on the following button to retrieve updates:
    
• Click the X to exit the program.
• Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:

Simple and easy ways to keep your computer safe and secure on the Internet

Glad I was able to help and if there any other problems related to your computer please feel free to post them in the appropriate forum. Though we help people with spyware and viruses here at BC, we also help people with other computer problems! Do not forget to tell your friends about us! 


catchme W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net