Lowyat.NET: Latest topics by sUBs

Do not use ComboFix

sUBs — Thu, 15 Feb 2007 13:45:01 +0800

I have just encountered a rootkit that will cause ComboFix to recursively delete all files from SystemDrive. The tool is withdrawn untill further notice.

Please DO NOT ComboFix. Who knows if that rootkit is in the machine.

Delete any existing copies of Combofix

Sempurna had an accident

sUBs — Tue, 21 Nov 2006 00:50:27 +0800

QUOTE

Hello everyone,

My name is Frank, and I'm writing on behalf of Sempurna (or my friend, Leslie).

Sempurna was involved in a terrible accident a couple of weeks ago, and he told me that I should write here to inform you of his condition.

The thing is, as he was waiting at a traffic light, he was rear-ended by a lorry, and his car was pushed into the oncoming traffic. He was sideswiped by two other cars, and has suffered injuries which preclude him from writing this to you personally.

He is currently still recuperating in the hospital. He has a broken arm, three fractured ribs, severe whiplash that necessitates a neck brace, a broken ankle, and various internal injuries to some organs. But, the worst is a severe concussion that is akin to mild axonal injury. I don't really know what that is, but is some sort of brain injury.

It appears he still has his faculties about him, although his speech is slurred and his attention span is not what it used to be. The doctors assure us that this is temporary, and that he should make a full recovery given time and therapy.

He has asked me to let you all know that he misses this site terribly, and that he has quite a number of outstanding cases. He would appreciate that someone could pick up the slack, and that he is most sorry for the inconvenience.

He is supposed to be released from hospital in a few days, most likely by the end of the week. He told me that he would try to get back as soon as he can. The doctors assure us that the physical injuries should be all healed up in a couple of months, and if he attends therapy, the brain injury should be OK by then as well.

That's all I know, and here's to a good day to you all.

Sempurna has been missing from here and other forums due to a terrible traffic accident and multiple injuries.

The doctors seem confident that with time he will recover completely, but in the interim, he'll not be posting here or any other forum.

Please keep Sempurna in your thoughts.

For the foolish

sUBs — Wed, 04 Oct 2006 14:12:03 +0800

This is for all the foolish people who visit cracksites

http://www.youtube.com/watch_fullscreen?vi...20Rubbernecking

Malware from China

sUBs — Tue, 05 Sep 2006 12:38:51 +0800

Anybody feel like helping out? I need these to be translated in English.

This is for the sticky. Too many of you guys are getting hit by these Chinese adware & the antivirus/antispyware tools arent that effective at disinfecting them.

今天早上在我不知道的情况下竟然突然看到这个程序在我打开电脑后自己安装上去了！
花费了1个小时才清理完，但还是有残留的程序文件留在C盘！郁闷死了！
声讨"流氓软件"的呼声持续高涨，"流氓软件"的恶劣行径也越来越变态。一旦被"流氓"缠上，想要摆脱十分困难。对付这样不讲道理的"流氓"，就得用点特殊方法，看我是这样对付"流氓"的。

QUOTE(haya)

(This morning, I woke up and found out that my computer suddenly was filled with some weird software. It took me 1 hour to finish getting rid of them, but my C drive is in a mess! The frustration!

As of late, spyware has been on the rise, and these spyware are becoming even more aggressive. Easy to come in, hard to get rid off. But we don't have to despair., as there are specific ways to attack these spyware.)

雅虎助手

雅虎助手经常会在后台自动运行并安装到我们的电脑上，而且会加载一些程序在注册表的启动选项中，占用一定的系统资源。由于网络实名插件使用Rundll32.exe调用链接库，因此卸载时有点困难，这也是雅虎助手的"流氓"之处。要想彻底卸载雅虎，可以按照以下步骤。

第一步：利用3721自带的卸载功能卸载3721，然后找到3721的安装目录，把可以删除的文件全部删除。注意，这里可能会有一些文件无法删除，稍后我们可以在安全式下删除。

第二步：在"运行"中输入regedit启动注册表编辑器，我们可以看到，雅虎助手安装后Run键中增加了几个选项（如图一），这就是流氓软件留下的痕迹。全部删除，可是这样并不意味着流氓软件已经彻底删除。系统重新启动后，你会发现这些键值又被重新加载。这可真是恶毒呀！没关系，我们可以进行第三步，彻底删除流氓软件。

图一

第三步：重新启动系统，按F8进入"带命令行提示的安全式"，在提示符下，进入C:\program files后找到雅虎助手的安装目录Yahoo!，删除。在图一中我们还可以看到，系统开机还调用了C:\windows\down~1目录下的 cnsmin.dll文件，那么我们在安全式下必须删除此文件，才能彻底删除雅虎助手。

文件全部删除了，注册表也要清理一下，否则我们的辛苦就会泡汤了。先删除图一中Run键值下自动加载的程序选项（注：Zcom是另外一种IE插件，不是雅虎助手生成的键值）。然后，我们使用注册表键值查找功能，查找"cnsmin"关键字，并将查找到的键值逐一删除即可

所有操作完成后重新启动计算机，你会发现讨厌的雅虎助手已经被我们彻底清除，没了踪影。

对于不太熟悉注册表操作的普通电脑玩家来说，我们可以选择"3721完全卸载工具"软件卸载雅虎助手。

推荐软件：

3721完全卸载工具

QUOTE(haya)

This part is essentially talking about the yahoo (chinese) toolbar. How to avoid using it and steps to removing it by dis-associating it with rundll32.exe with regedit. Unfortunately, my chinese can really understand all of this. The second part is the 3721 tool bar, which enables support for chinese web addresses (like instead of typing www.lenovo.com, you just type 联想，Lenovo's chinese name.), a bit like AOL's keywords.

Or you can use this:http://www.ttud.com/soft/2220.htm, called 3721完全卸载工具 0.37 as mentioned in the post to help in getting rid of 3721.

--------------------------------------------------------------------------------

淘宝广告窗口

相信很多朋友会遇到这样一种情形，正在兴致勃勃地浏览网页时机器出现假死机现象，然后弹出一大堆淘宝广告框。想要禁止弹出的淘宝广告对话框，实在找不到门路。到底应该哪里入手呢？

对于使用Windows XP SP2操作系统的用户来说，弹出淘宝广告窗口时，将其禁止就可以了。使用Maxthon、MyIE和腾讯TT的用户，可以在Maxthon浏览器的"弹出窗口过滤"和"网页内容过滤"选项中，同时添加"unionsky、allyes、taobao"等过滤条目(如图二)，这样讨厌的淘宝广告就不会弹出来了。

QUOTE(haya)

If you use XP SP2, taobaos' pop up windows are easily blocked. Use Maxthon, MyIE and Tencent Traveller (TT). In options, add "unionsky、allyes、taobao" to the blacklist(?) as shown in picture 2 (this is why I wanted the original source. WHERE ARE THE PICTURES????), to make sure those pseky taobao pop up ads dont come up again.

图二

还有一种更直接的方法，使用"世界之窗"浏览器，这样就不会再看到淘宝的广告窗口。另外，高级用户可以通过修改Hosts文件的方法过滤淘宝窗口，可是此种方法作用不大，这里就不再做详细介绍。

推荐软件：

Maxthon浏览器下载地址

腾讯TT浏览器下载地址

世界之窗浏览器下载地址

QUOTE(haya)

Another way is to use 世界之窗( TheWorld Browser http://dl.pconline.com.cn/html_2/1/104/id=9800&pn=0.html) to avoid those taobao pop-up ad's. Or you can use the hosts file to block taobao's servers, but this is a time consuming process, and I(the author of the original article) dont recomend it.

--------------------------------------------------------------------------------

Ebay易趣

对于易趣广告，我们可以使用对付淘宝的方法对付他，而易趣插件就不太好对付了。Ebay易趣插件没有提供卸载程序，使用类似优化大师此类的第三方软件无法卸载，这也示了易趣插件的"流氓"之处。

要想彻底清除易趣插件，可以借用专用工具"易趣清除程序for暴风影音"，清除Ebay插件。

推荐软件：

易趣清除程序for暴风影音

QUOTE(haya)

For ebay (china) ad's we can use the same method we employed for Taobao above. (thats all I can understand. Anyone please help?)

--------------------------------------------------------------------------------

中文上网

中文上网插件比较小，浏览网页时经常被强制安装，一些软件的安装程序也集成了中文上网插件的安装程序。

安装了中文上网插件后，系统开机会自动启动一个名字为Cdnup.exe的进程（如图三）。要想彻底删除中文上网插件，必须打开任务管理器，将Cdnup.exe进程手工结束。然后再运行中文上网插件的卸载程序。

图三

运行了卸载程序后，大家千万别得意，中文上网插件并没有完全被卸载。重新启动计算机后，Cdnup.exe进程依旧会加载在系统的进程中。执行完卸载程序后，我们重新启动计算机到带提示符的安全式下，运行注册表编辑器，查找所有的Cdnup键值并删除。清理注册表后，在"开始"菜单的"搜索"中，搜索 Cdnup文件，逐一删除。

经过以上操作，中文上网插件将被我们彻底删除。重新启动计算机后，检查一下是否完全卸载了呢。由于中文上网插件的版本更新，目前没有较好的软件可以彻底卸载中文上网插件，大家只能辛苦一下，手工清除了。

QUOTE(haya)

中文上网 installs it self discreetely, and loads everytime you start up. To remove, kill the Cdnup.exe process in the windows task manager.

After killing the process, dont rejoyce yet. If you reboot your computer, Cdnup.exe will come back to haunt you. Open the search function from "start", select "find all files"(or something like dat), and search for all files that have the filename "Cdnup"

After all that deleting, reboot your machine and check if 中文上网 is still running. Because 中文上网 is a constantly changing program(I think it means there are many diff versons), there is not a specific "one-click" software (unlike taobao at top) to remove this spyware. So you have to do it manually.

--------------------------------------------------------------------------------

DuDu下载加速器

声讨流氓软件的声音一直没有停息，不知道是流氓软件厂商悔过，还是一时疏忽，Dudu下载加速器安装后，使用自身的卸载程序，即可完全清除，而且没有发现后遗症。

曾经被冠以流氓软件的"百度搜霸"、"划词搜索"、"青娱乐聊天软件"等流氓软件，使用自身的卸载程序可以清除，这里就不在一一叙述。

总结：一些顽固的IE插件，影响了我们的正常使用。在卸载时，一定要冷静分析软件的工作原理，然后寻求合理的方法解决。"流氓"软件再流氓，始终会有相应的方法对付！（　

QUOTE(haya)

The tide of spyware is endless. But I'm not sure if the authors of spyware have got some conscience or its just an oversight on their part, but the DUDU download accelerator which has spyware is easy to get rid off. Just run the usual uninstall, and all traces of this spyware will be gone.

Same with "百度搜霸"(baidu toolbar), "划词搜索" (some toolbar), "青娱乐聊天软件". Just uninstall the offending toolbar, and it will be gone.

Final note: all these "toolbars" and "helper application" will actually cause more grief than help.

QUOTE(haya)

As the below is a very long piece, my translations will be IN the quote it self. Basically its a bat file, which you copy into a notepad session, save it as "uninstall.bat" and run it. The purpose of the bat file is to delete some of the spyware files and in some cases deregister the spyware files from system files. My translations will be in blue. when copying the long list of commands below to notepad, please delete my translations in the brackets b4 running them!

复制下列内容另存为文本文件: uninstall.bat ,执行,如果跳出选择框,选择全部卸载,如果跳出没有块,说明电脑里没有这个流氓
(When running the bat file, if you get a "specific module not found" error, it means you dun have the spyware. If it says "XXX module deregisted", it means it ws successful.)

(The code to paste in the bat file starst here.)

rem KaoKao 删除 3721 (to disable 3721)
rundll32.exe C:\PROGRA~1\3721\Assist\asbar.dll,RunSettings -uninstall
Rundll32.exe 百分号windir百分号\downlo~1\CnsMin.dll,RunSettings -uninstall
Rundll32.exe 百分号windir百分号\downlo~1\CnsMin.dll,ControlPanel
regsvr32 /u /s 百分号windir百分号\downlo~1\CnsMin.dll

regsvr32 /u /s C:\PROGRA~1\3721\Assist\asbar.dll
regsvr32 /u /s C:\PROGRA~1\3721\helper.dll
regsvr32 /u /s C:\PROGRA~1\YiSou\yisou.dll

rem 删除 yahoo (to disable yahoo toolbar)
regsvr32 /u /s C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
regsvr32 /u /s C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
regsvr32 /u /s C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
regsvr32 /u /s C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL

rem 删除CDN (to disable CDN)
rem C:\PROGRA~1\CNNIC\Cdn\cdnunins.exe
regsvr32 /u /s C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll
regsvr32 /u /s C:\PROGRA~1\CNNIC\Cdn\iesrch.dll
regsvr32 /u /s C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
regsvr32 /u /s C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
regsvr32 /u /s C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll

regsvr32 /u /s C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL

regsvr32 /u /s 百分号windir百分号\system32\cdnns.dll
regsvr32 /u /s 百分号windir百分号\System32\jklpif.dll
regsvr32 /u /s 百分号windir百分号\system32\stdup.dll
regsvr32 /u /s 百分号windir百分号\system32\STDSVER.DLL

rem 删除 baidu (to disable baidu toolbar)
rundll32.exe C:\PROGRA~1\baidu\bar\BaiduBar.dll,Uninstall
regsvr32 /u /s 百分号windir百分号\DOWNLO~1\BDSrHook.dll
regsvr32 /u /s 百分号windir百分号\DOWNLO~1\BDHelper.dll
regsvr32 /u /s 百分号windir百分号\DOWNLO~1\BDPlugin.dll
regsvr32 /u /s C:\PROGRA~1\Baidu\Bar\BaiduBar.dll

rem 删除QQ搜索 (to disable QQ search helper toolbar)
regsvr32 /u /s C:\PROGRA~1\TENCENT\AddrPlus\IEHelp.dll
regsvr32 /u /s C:\PROGRA~1\TENCENT\AddrPlus\IEHelp1.dll

rem 删除 MSN 搜索条 (to disable MSN toolbar)
regsvr32 /u /s C:\PROGRA~1\MSNToo~1\010126~1.0\zh-cn\msntb.dll

rem 删除 DUDU 搜索条 (to disable DUDU search bar)
regsvr32 /u /s C:\PROGRA~1\DuDu\DddClient\dddiemon.dll
regsvr32 /u /s C:\PROGRA~1\DuDu\DddClient\dddmext.dll

del 百分号windir百分号\DOWNLO~1\BDSrHook.dll /q
del 百分号windir百分号\DOWNLO~1\BDHelper.dll /q
del 百分号windir百分号\DOWNLO~1\BDPlugin.dll /q
del 百分号windir百分号\system32\cdnns.dll /q
del 百分号windir百分号\System32\jklpif.dll /q
del 百分号windir百分号\system32\stdup.dll /q
del 百分号windir百分号\system32\STDSVER.DLL /q
del 百分号windir百分号\downlo~1\CnsMin.dll /q

rem 删除Accoona (to disable Accoona)
regsvr32 /u /s C:\PROGRA~1\Accoona\AToolbarCN.dll
regsvr32 /u /s C:\PROGRA~1\Accoona\atoolbar.dll

rem 删除xBar (to disable the Xbar software)
regsvr32 /u /s C:\PROGRA~1\xBar\xBarHelper.dll

regsvr32 /u /s 百分号windir百分号\System32\xunleibho_v8.dll

rem 删除很棒
regsvr32 /u /s C:\PROGRA~1\HBClient\hapast.dll
rem 划词
C:\PROGRA~1\HuaCi\huaci\mUin.exe

regsvr32 /u /s C:\PROGRA~1\CoolWebsite\QuickLink.dll
regsvr32 /u /s 百分号windir百分号\system32\shwasobj.dll
regsvr32 /u /s 百分号windir百分号\system32\msibm\cfsbho.dll

rem 删除桌面传媒
Msi执行.exe /I{FE41A479-E056-40A5-982C-D149B5D6712D}
regsvr32 /u /s "C:\Program Files\Desktop Media\Cast\dmbar.dll"

C:\PROGRA~1\CoolWebsite\uninst.exe
rem 删除划词
C:\PROGRA~1\wsearch\mUnInstall.exe

regsvr32 /u /s C:\Docume~1\AllUse~1\Applic~1\Microsoft\IEHelper\IEHelper200631_8913.dll
百分号windir百分号\system32\msibm\Uninstall.exe
C:\PROGRA~1\CNNIC\Cdn\cdnunins.exe

状态在线
垃圾软件反删除注册表文件
复制下列内容存为文本文件: uninstall.reg ,执行

QUOTE(haya)

paste the below registry key lines into a text doc and save as "uninstall.reg". Run it to remove the registry keys assoicated with spyware.

» Click to show Spoiler - click again to hide... «

Note from sUBs:

Do not use the fixes offered yet. The regfix above is meant for Chinese OS only
I will fix the script later

Welcome Sempurna

sUBs — Mon, 31 Jul 2006 14:05:01 +0800

Welcome & congratulations to Sempurna for being the new moderator at Tech Support.

POSTING GUIDELINES - TECHNICAL SUPPORT

sUBs — Fri, 17 Mar 2006 15:41:21 +0800

What you should do

Thread Title - Choose your subject line with care. It's what that gets people to look at your question. The subject should be a very concise explanation of your problem. Include as much information as sensibly possible. Using huge amounts of abbreviations or writing subject lines that are so long that the board software cuts them off is deprecated, though.

If your issue is "Blue Screens" then put that in your subject header. If it's something else (like a trojan detected) then put the name of the trojan in the subject header and so on. DO NOT use something like "Help Me" and then post nothing about your issue in the post. This tells nothing of your issue and wastes both our time and yours trying to figure out what infection you have and what issues your having.
Content - Write your question in clear, grammatical and correctly spelled English. If you don't have the time to formulate your question correctly, why would you expect other people to have the time to answer it? Don't worry if English isn't your native language, though - people will cut you some extra slack for grammar mistakes.

Remember to include all the information that is relevant to your problem but do it sensibly. Just dumping the output of a random system analyzer program on the forum will only make people ignore you - besides, it will give the idea that you're not willing to go through the trouble of figuring out what things are relevant to your problem and what aren't.

Post detailed symptoms that you are experiencing e.g. system doesn't work, cannot connect to net etc. Describe the relevant parts of your system in more detail than the irrelevant ones. Describe deviations instead of expectable things. If your issues are hardware related, please specify the brand/model of your equipment. List out the specifications of your machine. The more information you can provide, the easier it will be to ascertain what's causing the problem. Let us know what you've already done to fix it (if anything).

If possible, describe the changes that you've made to your system before it broke. Do this even if it seems that there ought to be no relation between what you did and what happened. Computers are complicated things. Also describe what you've already tried to do to solve the problem.
Responses - When someone replies to your thread, please consider the proposed solution. If it does not work, reply to the thread by explaining in which manner it's not working. When you've resolved the problem, post what you did to solve your problem

What you should not do

Don't say that your problem is urgent or write your subject in ALLCAPS. It might be urgent to you, but that's irrelevant to the question itself. You aren't paying for the service so you don't get to set the priorities. Be considerate of the fact that the people helping you are not being paid for this, and in fact usually have a job, and have a limited amount of time to help, and can only do so much. so if someone doesnt answer right away, please dont get mad, simply come in once a day and Bump your post.
Do not post your problems in someone else's thread. Start a new thread by clicking on New Thread. Do not post your problems into other open threads saying "I have the same issue ...." etc. This gets really confusing for everyone involved. Also, please stay with your original topic when posting follow ups.
Do not start a new thread each time you reply, it is seriously important to see the entire progress of the help cycle, and so all replies should be in the same thread. (not only that, but it makes things more difficult for those who are kind enough to offer their help)
Post your topic only once. Duplicate posts will be closed, and just create additional work for the staff members trying to help you.

Notes

We understand many of our new members may not have used a vBulletin Board before, and therefore will not understand how they can benefit from the Message Boards Features. This is why this guide is created; to help users find their lost threads.

There are many different methods you can use to re-locate your lost thread. Here are the most practical:
- Subscribe - When you are viewing your thread, you will see a Tool Bar directly above your post. The first option is "Track this topic". Clicking it will bring you to your Control Panel's Subscription Information Menu. You will see options for topic notifications. When you registered at LYF, you supplied an Email address. You can make it so that you are notified by email when a reply has been made to your thread. A link will be provided in the email to bring you directly to your log. Each time a reply is made in the thread, you will be notified.
- Search Options - Every forum, every thread and every page has the facility to search. You can search by Thread Title, but it would be easier to search by your registered user name. If you search by user name, the results page will display a list of threads you have created and posted in. Simply choose the thread you are looking for.
- Bookmark - If you don't think you will be staying with LYF as an active member, and are just here for the free help, then you can bookmark your thread with your Internet Browser. In Internet Explorer you simply hit the [CTRL+D] keys.
  This will add the webpage to your Favourites, which is located on the Internet Explorer Toolbar.
I hope that this helps. Many of our users never seem to return, and I personally believe that losing their thread is the common problem.
Remember some common courtesy to the folks assisting you. This is YOUR issue. "Please" & "Thank You" works really well. Rude comments, personal attacks, flaming, and trolling will not be tolerated. Always remember that people are volunteering their help.
Please do not post your email address or other personal information. Spammers do lurk here and they also operate email harvester bots to scan for email addresses. If a moderator sees that you have posted an email address, it will be removed.

Forum Rules

Trolling/Flaming. Do not make posts that are inflammatory just to upset people.
Discussion, distribution or posting links to pirated software, pornography or any kind of copyrighted materials is prohibited
Offending post will be deleted and user will be warned
Political and Religious Topic, discussions are NOT WELCOMED here
Spamming - posting unconstructively, bumping topics unnecessarily, opening multiple threads are all considered as spamming.
Commercial-oriented posts, blatant commercial advertising, referral links, links in signatures for commercial purposes are not allowed
Illegal activities - Activities involving drugs, contraband materials, smuggling, evasion of law or any other activities that are against the law. Offending thread or post will be deleted without prejudice. User will be permanently banned.
Do NOT ask homework/assignment question without first attempting the question or picking out a part which you are having difficulty with.