Lowyat.NET: Latest topics by netcrusader

www.freerice.com

netcrusader — Sun, 11 Nov 2007 21:58:14 +0800

I just read about this site, http://www.freerice.com in a chinese newspaper.

All you have to do is play the vocabulary game, and for each correct answer, they will donate 10 grains of rice through United Nation to help end world hunger. Sounds too good to be true, right?

Imagine you can improve your vocabulary and at the same time help people who is starving, don't you think that this is great?

For me, I feel sad and can't stand seeing ppl starving Only with enough food, people will have enough energy to work.

So please visit the site, play the game, bookmark it, add it into your favorites site. Your little act of kindness will help a lot.

FAQ

» Click to show Spoiler - click again to hide... «

Source: http://www.freerice.com/faq.html

Where the rice goes

http://www.wfp.org/english/?n=681

How to give more rice

For less than $20, WFP can purchase a 25 kilogram sack of rice.

http://www.friendsofwfp.org/site/pp.asp?c=...OsGpF&b=4051057

Updates:

(20-10-2007) Smooth Operator promoting www.freerice.com.

» Click to show Spoiler - click again to hide... «

(28-11-2007) FreeRice increased the amount donated for each correct word from 10 grains of rice to 20 grains of rice.

(18-1-2008) FreeRice reaches Bangladesh.

» Click to show Spoiler - click again to hide... «

Total Donations By Month

Total all dates 30,638,258,030

L.E.S.I

netcrusader — Sun, 11 Nov 2007 16:18:29 +0800

Accidentally replace photos in a folder

netcrusader — Mon, 29 Oct 2007 01:41:49 +0800

Suppose I accidentally replace some files in a folder, is there any way I can recover the previous file?

Will those recovery software do the trick?

<<IT Worker>>

netcrusader — Sat, 24 Mar 2007 13:15:51 +0800

Hi all IT worker out there. Ever thought of quiting from IT line?

When you are the only IT support staff in a company, there are piles of outstanding work, user chasing you and ask why you haven't finish their job, boss giving pressure, you feel that you are going to burnt out, what will you do?

To make thing worse, a server harddisk just crash in the middle-of-the-night and no backup was made on the server, now what will you do?

Seriously, I feel frustrated and stressed. I can't sleep well at night, and I do not feel like going to work every morning when I get up. But deep down in my heart, I like doing IT jobs, I like learning new technology, and I like computer, not to mention I don't mind to hug computer/router while sleeping. I don't know how long more can I hold this enthusiasm and withstand the pressure.

Enough of my rants, anyone from IT field would like to share their story too?

All about Bro_Act

netcrusader — Sun, 18 Mar 2007 19:22:41 +0800

Here is the story. I was helping my cousin to clean this virus and thus these details written below are truly based on my experience.

From what I search in Yahoo, there is still very limited information on this virus. In fact, it is spreading like wild fire nowadays, as you can see there are quite some number of users post about it in this forum. I am writing this so that I can help those who are infected by this virus as well.

1. What is Bro_Act virus?

This is a virus which its origin is believed to be from IDO.

p/s: Symantec AV identify it as W32.sillyDC.
DrWeb CureIT identify it as Win32.HLLW.Broact.

2. How it spreads?

It spreads through USB drive. Infected thumb drive will show these files: "MySexy.exe", "User.exe" and "Sexy.Dat".

3. Any symptoms?

- When opening a folder, you see this sentence "Restrict By Bro_Act"
- When you right click on your local drive, you see "Autorun" as first option and bolded.
- When you try to open C:\Windows\System32 folder, explorer close itself.
- Right click My Computer, select Properties, select Computer, click Change button, you find that your computer name has been changed to "ReAct_User"
- Task Manager, Regedit, Msconfig are disabled.
- Antivirus might be disabled.
- System Restore gives error message when you try to turn it off.
- If you manage to open Task Manager, go to Processes. You will see that the column for "User Name" is blank for all processes. (One of the svchost.exe and winlogon.exe is launched from ReAct_user folder in System32.)
- If you manage to open Task Manager, go to Applications. You will see 2 application named "[Program Manager] Restrict By Bro_act" and "Restrict By Bro_act".

4. How do I confirm that I am infected?

Run Hijackthis. These are the entries added:
C:\WINDOWS\system32\BrO_AcT.exe
F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\default__.pif"
O4 - HKLM\..\Run: [System] C:\WINDOWS\SYSTEM32\BrO_AcT.exe
O4 - HKCU\..\Run: [svchost] C:\WINDOWS\SYSTEM32\ReAct_User\svchost.exe

5. What are the files added?

C:\WINDOWS\system32\BrO_AcT.exe
C:\WINDOWS\default__.pif
C:\WINDOWS\SYSTEM32\ReAct_User\svchost.exe
C:\WINDOWS\SYSTEM32\ReAct_User\winlogon.exe
C:\ReActLog (Something with this name)
NTDETCH.com (on all your drive, root folder)
Autorun.inf (on all your drive, root folder)
Hundreds of files in C:\System Volume Information\_restore{7C0D0734-E9F5-4A30-ABD4-977206CFACB2}\RP411 (With name like A0062080.com, A0062083.pif, A0062092.exe and etc)
C:\WINDOWS\system32\MySexy.exe
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\msconfig.com

p/s: All these files are marked as Win32.HLLW.Broact virus and deleted by drweb-cureit antivirus software.

6. How do I remove this virus?

In my case, since AVG free 7.5 in the system is disabled. I use Doctor Web CureIT free antivirus scanner. Drweb cureit able to detect bro_act virus as Win32.HLLW.Broact.

Steps: (This step is from SpywareInfo forum)

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, Click Options > Change settings
Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
Back at the main window, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:
If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:

This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.

For USB drive, I recommend you to format it.

Remeber to Turn off your system restore and Turn in on again to flush away all the files inside.

--------------------------------------------------------------------------------------------

This part shows roughly how this virus works:

7. Why can't I access Regedit from Start>Run?

The virus added one file named "Regedit.com" into C:\WINDOWS\system32\, which is the same folder as the file "Regedit.exe". Any .com file will run before .exe file. So, when you type "Regedit" on start>Run, the file you accessed is actually "Regedit.com". It will close the explorer.

8. Why can't I access Msconfig from Start>Run?

Same consep as above. A file named "Msconfig.com" is added into C:\WINDOWS\system32\, which is the same folder as the file "Msconfig.exe".

9. Why I keep on getting this virus even after I deleted the files Bro_Act.exe?

p/s: This is my belief on how the virus reinfected your computer, but not guarantee 100% correct because I don't look into the coding.

To understand this, we need to look at the HijackThis entry:
F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\default__.pif"

We use Explorer.exe to navigate the content inside a folder. Everytime, you open a folder, explorer.exe will run. The problem is now explorer.exe is link to C:\WINDOWS\default__.pif. I don't know what exactly this file does, but I believe that it will check if all the "Bro_Act.exe", "RecAct_user\svchost.exe", "msconfig.com", "regedit.com", "NTDETCH.com" and etc are still in place or not. If they are not, a copy will be fetch/restore from C:\System Volume Information\_restore folder, as you can see there are hundred of files in the folder.(Now you see why it does not allow you to turn off system restore?)

When you access your local drive, "Autorun.inf" will connect to another file named "NTDETCH.com", as you can see from the screenshot below. I don't exactly know what it does, but I believe that this is the culprit that close the explorer when you try to access C:\Windows\System32 folder.

» Click to show Spoiler - click again to hide... «

----------------------------------------------------------------------------------------------

p/s: This is definitely not a copy-and-paste work. All are based on my personal experience dealing with this virus. Some of the info is obtained from uncle google.

That's all for now. If I get more Info, I will update it accordingly.

Regards,
netcrusader.

Can't open drive with double click

netcrusader — Sun, 18 Mar 2007 04:31:01 +0800

I can't open my harddisk now by doubleclick.

Previously I was cleaning virus and deleted autorun.inf under my drive.

Since then, the default has change to "search". Can any sifu teach me to modify registry so that the default is changed to "Open"?

Put 10k into FD

netcrusader — Fri, 23 Feb 2007 19:37:25 +0800

I just started working for one year and have accumulated hard-earned 10k. Would like to all the sifu here for opinion and advice.

1. Is it a good idea to invest 10k into FD?

2. If yes, how long should I put the money inside?

3. If I take it out before one year, will I lose my money?

Let me know if there is a similiar topic created. Thanks.

Messy Lan Cable

netcrusader — Thu, 21 Dec 2006 09:30:25 +0800

I need help from all the network sifu here. The scenario is like this:

Lan cables in my company's conference room are very messy, as they scattered around the table and at the bottom of the table as well (There is one switch under the table). Now management are not happy with that.

My question is:

1. Is there any way to tidy up all the Lan cables?
2. Is there any company that provide "cable management" solution? IF yes, can you please provide me the name and link?

Thanks.

Career path - network support

netcrusader — Mon, 21 Aug 2006 01:12:29 +0800

Hi, need some advice from you guys:

1. I am working as a network support now for 2 months. I am wondering what is the career path for network support. Is this career path correct?

network support > sr. network support > network manager/network consultant > sr. network consultant > ???

2. What do I need to learn or study in order to become a sr. network consultant?

3. Before I start working, I plan to get ccna, but I am a bit lost now, as my company focus more on Windows server. Do I get MCSE instead of CCNA? Or both?

4. What are the future prospects for "networker"?

Thanks in advance.

Iperintis interview

netcrusader — Fri, 09 Jun 2006 18:28:58 +0800

They called me for an interview next week. Its a position called management trainee. Anyone went for the interview before? Mind to share a bit tips?

I heard that the benefits they provided is quite good. Anyone working there, can share some experience? Thanks for reading.

Jen Software Professional Sdn BHd

netcrusader — Wed, 24 May 2006 16:57:15 +0800

Anyone heard of this company before?