Conficker aka Downadup Virus

One week of HELL!!

Servers and PCs bombarded with high-bandwidth causing disconnectivity.

Restarted the File Server three times and other servers at least once.

Patched all PCs and servers with Windows updates 960714, 958687 and 958644.

Run Microsoft Malicious Software Removal Tool scan.

Ran McAfee On-Demand scans on all machines.

Citrix Error Prompt

After login thru the browser, Delphi users got this error prompt, "The remote session was disconnected because there are no Terminal Server License Servers available to provide a license. Please contact the server administrator", (which the users always do).

Restarted the server and it prompt something like "...a service was not started...". So I search high and low for which service not started, or needed a restart. No help.

Called CSC and they suggested to restart service called "Terminal Service". But the damn service is greyed off. What to do? What to do?

I looked thru all the services and found "Terminal Server Licensing" (how accurate), restarted the service and did the relogin again. Everything a OK now.

Delphi users are happy again. Sheesh!!!

That's all, folks !!

Block USB Storage

Found this blog with workable solutions. Just the things I need to keep PCs under control.

http://blog.ashfame.com

You may want to block USB mass storage device to disallow the unauthorized use of pendrives or you may want to unblock USB mass storage device to get access (most of the case in college’s net lab).

Well, this can be done by a simple registry tweak. Before doing so, I recommend taking a backup of the registry because playing with registry can be harmful for your OS. Read (How to backup your windows registry). When you have backup the key :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR proceed further.

To disable access

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR] “Start”=dword:00000004

To enable access

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR] “Start”=dword:00000003

Copy the required code to a text file and save it as *.reg file. Just open that file and information will be added to the registry.

Source : Thinkdigit Forum

How viruses spread from USB/Thumb/Pen drive?

Whenever a USB drive is plugged into a infected computer, virus copies itself to the pen drive and sets it to execute itself when pen drive is accessed by making changes in the autorun.inf. Whenever pen drive is accessed, the autorun.inf calls the executable file of the virus upon which the system gets infected.

How to save your computer from viruses from USB/Thumb/Pen drive?

The most effective method of preventing your system from getting infected is to disable autorun feature of USB devices. DJ tells us about disabling autorun feature on Sizlopedia. He tells us a method in which he uses gpedit.msc and disable autorun feature but the problem is that gpedit.msc is not available under Windows XP Home Edition.

So, I am going to explain how to disable USB autorun feature through registry editing which not only works for WInXP Home but also for any other edition of Windows.

• Browse to the following key HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Policies\Explorer
• Modify the value of NoDriveTypeAutoRun to df (hexadecimal)
  
  
  
  

Get Rid of Windows XP 3-Days Activation

I setup a LICENSED Windows XP Pro on a PC and swapped the HDD on home PC (how often do you find me doing this on own PC?). Of course, both the PCs are of the same MOBO specs, or so I thought.

The PC booted successfully, except it prompt to re-activate Windows in 3-days since it detected significant hardware changes on the PC.

After googling a bit, found tips in Youtube on how to get rid of the activation.

Just open registry> regedit

Go to;

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ WPAEvents

Modify the binary data of OOBETimer to FF D5 71 D6 6A 8D 6F D5 33 93 FD

Change the permission of folder WPAEvents of SYSTEM to DENY.

Restart PC and done !!