小猪秘籍

Windows 7, Windows Server 2008 R2 and Exchange Server 2010 | Microsoft

2009-12-10T09:24:00.000+08:00

Windows 7, Windows Server 2008 R2 and Exchange Server 2010 | Microsoft

Default Modem Password

2009-10-08T12:02:00.000+08:00

Default password for all TMNet Streamyx supported modem.

1. ZTE modem
* IP Address: 192.168.1.1
* Username: ADSL
Password: expert03
* Username: ZXDSL
Password: ZXDSL
* Username: admin
Password: telekomst
2. KASDA modem:
* IP Address: 192.168.1.1
* Username: admin
Password: telekomst
3. ArtNet modem:
* IP Address: 192.168.1.1
* Username: admin
Password: telekomst
* Username: admin
Password: admin
* Username: admin
Password: password
4. Triz modem:
* IP Address: 192.168.1.1
* Username: admin
Password: aaaaaaaa
5. Aztech modem:
* IP Address: 10.0.0.2 OR 192.168.1.1
* Username: admin
Password: blank
* Username: admin
Password: password
* Username: admin
Password: admin
6. Billion modem:
* IP Address: 192.168.1.254
* Username: admin
Password: password
7. Huawei modem:
* IP Address: 192.168.1.1
* Username: admin
Password: admin
8. Hyundai HSE-220 Modem:
* IP Address: 192.168.1.1
* Username: ADSL
Password: ADSL
* Username: admin
Password: ADSL
* Username: root
Password: root
9. Riger DB102:
* IP Address: 192.168.1.1
* Username: tmadmin
Password: tmadmin
10. TP-LINK MODEM / ADSL2 / ROUTER:
* IP Address: 192.168.1.1
* Username: admin
Password: admin

Sum of subreport in primary report

2009-09-02T12:10:00.002+08:00

Create a shared variable for passing data from subreport to main report

Since CR not allowed to sum (formula), e,g, sum({@mainformula), I
calcualte the grand total from subreport. detailed steps are:

1. In subreport, create formula called subformula, the shared valiable = grand total

WhilePrintingRecords;
Shared CurrencyVar myTotal :=Sum ({Command.SUM(AB.FEEAMOUNT)})

2. In main report, created a formula called mainformula

WhilePrintingRecords;
Shared CurrencyVar myTotal;
myTotal

3. Then put this mainformula on the main report underneath of subreport. Here what you want for the result.

Disable AutoRun from your Removable drive

2009-07-28T09:39:00.001+08:00

Removable USB/thumb drives use the Autorun feature to load files when the drives are plugged into the USB port. Malware exploits the Autorun feature to spread from thumb drive to PC. Disable the autorun feature to prevent malware from spreading.
Difficulty: Easy
Time Required: 2 minutes
Here's How:

1. The easiest and most effective means to truly disable autorun can be done via this simple autorun registry hack:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"
2.

To use this method, Open Notepad and copy/paste the following into a text file:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Save the file as something.reg. (You have to be sure to change the "Save File as Type" to "All Files" before saving, or Windows will try to save it as a .txt even if you typed in .reg.
3.

Locate the file you just saved and double-click the file to run it. You will receive a prompt asking if you want to add the data to the registry. Click yes to allow the modification.
4.

The above method nulls any request for autorun.inf and works on XP Home or Pro, as well as Windows Vista. Credit for this tip goes to Nick Brown.

If you opt to disable autorun using any other method, you will first need to install an autorun patch from Microsoft that allegedly resolves issues that cause autorun to run even after it's been disabled (using methods other than the above recommended method).
5. XP Pro users who have installed the appropriate Microsoft patch for your system and wish to disable autorun using a method other than described above, follow steps 3 through 8 only. XP Home users begin at step 9. Vista users, see How to Disable Autorun in Windows Vista.
6. Windows XP Pro users: Click Start and then click Run. Type gpedit.msc and click OK. The Group Policy window will open. In the left pane, double-click Administrative Templates
7. In the right pane, double-click System, scroll down the list and double-click Turn Off Autoplay
8. In the Turn Off Autoplay Properties window, select Enabled. From the dropdown next to Turn Off Autoplay on, select All drives and then click OK. Exit Group Policy by selecting File, then choosing Exit from the menu.
9. XP Home users will need to make the changes by editing the registry directly. To begin, click Start and then click Run
10. Type regedit and click OK. The Registry Editor window will open.
11. In the left pane, navigate to:
HKEY_CURRENT_USER
Software
Microsoft
Windows
CurrentVersion
Policies
Explorer.
(Note: For help navigating the registry, see the Windows Basics System Registry tutorial).
12. With Explorer highlighted, in the right-pane right click the value NoDriveTypeAutoRun and select Modify from the drop down menu. The base value will be set to Hexadecimal. If not, select Hexadecimal.
13. Type 95 and click OK.
Note that this will stop Autorun on removable/USB drives, but still allow it on CD ROM drives. If you want to disable autorun on both, substitute b5 for the 95. (Thanks to Ian L. of Manitoba for the tip).
14. Exit Registry Editor by selecting File, then choosing Exit from the menu.
15. You will now need to reboot your computer for the changes to take effect.

Delphi Error Messaga:- Records Save Error! Multiple-step operation generated errors. Check each status value.

2009-06-10T10:33:00.003+08:00

When you having this kind of error message prompt out when you are using ado components. Means this is cause by the field lenght was not compatible, please check you form input lenght and the database table field lenght. Please make sure it is same.

Disaster Recovery: What to do when the SA account password is lost in SQL Server 2005

2009-03-18T17:56:00.002+08:00

You may have faced the issue of losing the SQL Server SA password. Perhaps you followed the security best-practice of removing the builtin\Administrators from the sysadmin server role, and no one you can find is in the sysadmin role. At this point you may think that your only options are to reinstall SQL Server and attach the databases, or to directly access the master database files, which may potentially damage the data.

SQL Server 2005 provides a better disaster recovery option for this scenario that is non-intrusive for master DB and that will help you preserve any objects and data stored in master DB (such as logins, certificates, Service Master Key, etc.) intact. Members of the Windows Administrators group now have access to SQL Server when SQL Server is in started in single-user mode, also known as “maintenance mode “.

Using the single-user mode, SQL Server 2005 prevents a Windows Administrator to abuse this privilege to act on behalf of the sysadmin without being noticed. This allows Windows Administrator accounts to perform certain maintenance tasks, such as installing patches.

In order to start SQL Server in single-user mode, you can add the parameter “-m” at the command line. You can also use the SQL Server Configuration Manager tool, which provides proper controls for the file access and other privileges. To use the Configuration Manager tool to recover your system, use the following steps:

1. Open the Configuration Manager tool from the "SQL Server 2005| Configuration" menu
2. Stop the SQL Server Instance you need to recover
3. Navigate to the “Advanced” tab, and in the Properties text box add “;–m” to the end of the list in the “Startup parameters” option
4. Click the “OK” button and restart the SQL Server Instance

NOTE: make sure there is no space between “;” and “-m”, the registry parameter parser is sensitive to such typos. You should see an entry in the SQL Server ERRORLOG file that says “SQL Server started in single-user mode.”

5. After the SQL Server Instance starts in single-user mode, the Windows Administrator account is able to connect to SQL Server using the sqlcmd utility using Windows authentication. You can use Transact-SQL commands such as "sp_addsrvrolemember" to add an existing login (or a newly created one) to the sysadmin server role.

The following example adds the account "Buck" in the "CONTOSO" domain to the SQL Server "sysadmin" role:

EXEC sp_addsrvrolemember 'CONTOSO\Buck', 'sysadmin';

GO

6. Once the sysadmin access has been recovered, remove the “;-m” from the startup parameters using the Configuration Manager and restart the SQL Server Instance

Important Security Notes:

This process should only be used for disaster recovery when no other method to access the system with a privileged (i.e. sysadmin or equivalent) is available.

This process allows a Windows Administrator account to override their privileges within SQL Server. It requires explicit and intrusive actions that can be monitored and detected, including:

· Stop SQL Server and restart it in single use mode

· Connecting to SQL Server using Windows credentials

Special thanks to Buck Woody (http://blogs.msdn.com/buckwoody/) for his help in writing this article.

Get VersionInfo for Delphi 2007

2009-03-04T16:01:00.002+08:00

The VersionInfo library basically just wraps the Win32 GetFileVersionInfo (and related) API functions. The library makes it very easy to read values from the Version Info resource of Windows executables and DLLs.
Features

* Reads all integer version info values:
File version, product version, File flags, OS, file type, file sub-type and file date.
* Reads any named version info string value such as:
Product Name, Product Version, Company, Copyright, etc.
* Supports languages, character sets and translations.
* Optionally extends the TApplication class with a version info property.

The TApplicationVersion class

The TApplicationVersion class contains the core functionality of the library. The following is the public interface of the class:

TApplicationVersion = class
public
constructor Create(const Filename: string);
destructor Destroy; override;
class function VersionToString(Version: int64): string;
class function StringToVersion(const Value: string): int64;
function GetString(const Key: string; LanguageID: integer; CharsetID: integer): string; overload;
function GetString(const Key, TranslationID: string): string; overload;
function GetString(const Key: string; Index: integer = 0): string; overload;
property Valid: boolean;
property Strings[const Key: string]: string; default;
property FileVersion: int64;
property ProductVersion: int64;
property FileFlags: DWORD;
property OS: DWORD;
property FileType: DWORD;
property FileSubType: DWORD;
property FileDate: int64;
property LanguageID[Index: integer]: WORD;
property CharsetID[Index: integer]: WORD;
property LanguageNames[Index: integer]: string;
property TranslationCount: integer;
end;

The TApplicationVersionHelper class

As a bonus there’s also a class helper that extends TApplication with a version info property:

TApplicationVersionHelper = class helper for TApplication
public
property Version: TApplicationVersion;
end;

To enable the class helper you just include the ApplicationVersionHelper unit in your uses clause.
Examples
Example 1

Read the version number from a file and display it in a message box

uses
VersionInfo;
...
const
Filename = 'foobar.exe';
var
FVersionInfo: TVersionInfo;
Version: string;
begin
FVersionInfo := TVersionInfo.Create(Filename);
try
Version := TVersionInfo.VersionToString(FVersionInfo.FileVersion);
finally
FVersionInfo.Free;
end;
ShowMessage(Format('The file %s has version %s', [Filename, Version]));
end;

Example 2

Set the application title to the description value specified in the version resource

uses
Forms,
VersionInfo,
ApplicationVersionHelper; // Enable the class helper
...
begin
Application.Title := Application.Version['FileDescription'];
end;

-------------------------------------------------------------------------------------

Source Code Sample --> Download

"Windows cannot display Windows Firewall settings" error while accessing Firewall settings in Windows

2009-03-02T10:35:00.002+08:00

Symptoms

1. Windows Firewall/Internet Connection Sharing (ICS) service not listed in Services.msc Console.
2. Windows Firewall/Internet Connection Sharing (ICS) service is listed in Services Console, but you may not be able to start the service.
3. The following error occurs when accessing the firewall settings (firewall.cpl)

Due to an unidentified problem, Windows cannot display Windows Firewall settings.

Cause

Case 1: This happens due to missing or corrupt SharedAccess registry key, which represents the Windows Firewall Service. This usually occurs if your system is infested with Virus or other Malware, or in the aftermath of Virus removal. In conjunction with the solution provided in the article, it's advisable to run a thorough cleanup of the system.

Case 2: You have Windows Live OneCare installed. Windows Live OneCare has its own Firewall which monitors both inbound and outbound connections. Because two firewalls should not be turned on at the same time, Windows Live OneCare turns off Windows Firewall if the latter is running. [More info]. Therefore, Windows Live OneCare users can safely ignore the error message concerning Windows Firewall.
Resolution

Solution for Case 1:

Download sharedaccess.reg (only for Windows XP systems with Service Pack 2 or Service Pack 3 applied) and save to Desktop. Then double-click the file to merge the contents to the registry. The Services entry will be created. Restart Windows (mandatory step, otherwise the following NETSH command might display an error).

After restarting Windows, execute the following command via Start, Run dialog:

CMD /K NETSH FIREWALL RESET

Launch firewall applet from Control Panel, and see if you're able to configure the Windows Firewall settings.

If the above steps do not help, as a last resort solution (before attempting to reinstall the Service Pack), give the following commands a try:

Click Start, Run and type:

rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 %windir%\inf\netrass.inf

The above command repaired most of the Windows Firewall settings when I tested. After running the above command, restart Windows and then run the following:

CMD /K NETSH FIREWALL RESET

Attempt to start Firewall applet. Start the Windows Firewall service when prompted.

Getting Value from Windows Registry via Delphi 2006

2009-02-28T00:12:00.001+08:00

Before we even talk about Delphi programming, we'll get accustomed to Regedit, which is a tool that windows provides for searching and modifying the registry. Start up regedit either by going Start -> Run -> regedit, or going to your system32 folder and double clicking regedit.exe.

Each program installed on the computer leaves a little bit of information behind in order for it to properly load to your specifications. (Cheat Engine leaves behind quite a lot of registry keys, just btw) This is mainly stored in the Registry, which is what we're looking at in regedit. Much of the information on programs will be stored in the HKEY_LOCAL_MACHINE\SOFTWARE path. However, some will be stored in the HKEY_CURRENT_USER\SOFTWARE path (this includes Cheat Engine registry entries).

Each Registry key contains a little bit of information in the form of Strings (SZ), DWORD, and Binary. Strings, of course, store arrays of characters. DWORD is mainly used for Hexidecimal entries, but it can also be used for Decimal (base Ten) entries. Binary is used to store arrays of bytes, and that's all that matters for this tutorial.

Regedit works just like Windows Explorer, in list Details view. It shows the each Key's name, data type, and value. You can double click to change a value, but that is not recommended.

I was working with the registry in an attempt to be able to access the proper installation folder of windows no matter what platform I was on. Finding the windows file path will be the first example in this little tutorial. First, though, you need to know some delphi registry commands.

Working with the Registry in Delphi
As with any other addon to Delphi code, you'll need add something to your uses list. For this, just add registry to the list, like so:

Quote:
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, Registry;
Now, as with any windows application, you'll need to click a button or something to start your procedure(s), so let's add a button to your main form.

Now, double click that button, and we can get to working with the Registry.

In order to use Registry keys, we'll need to declare a variable with variable type TRegistry. So in your procedure, add a var section and put something like this:

Quote:
Procedure TForm1.Button1Click(Sender: TObject);
var
Reg: TRegistry;
begin

end;
In order to implement a registry key, you need to .create it so let's put:
Reg := TRegistry.Create; right after the begin.

Be sure to put a Reg.Free; after you finish... (Create and Free go hand in hand...)

Then you need to assign a root path, or it assumes it to be HKEY_CURRENT_USER (which is not as good as HKEY_LOCAL_MACHINE). So we put: Reg.Rootkey:= HKEY_LOCAL_MACHINE;

For now, i'll just list out the commands that we'll use in this tutorial:
Bold = required; Italics = not required

TRegistry:
procedure OpenKey- Moves the focus onto the registry path specified.

Syntax: TRegistry.Openkey(path: string, CreateIfNotExistant: BOOLEAN);

The path is added onto the rootkey to form the whole path such as HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows where the blue is the rootkey, and the red is the path.

The CreateIfNotExistant boolean variable indicates whether or not to create the registry path if it does not exist. Typically, this would be FALSE.

function ReadString- Reads a string from the key specified. Returns the string;

Syntax: some variable (string) := ReadString(keyname: string,MaxNumOfChar: Integer);

Keyname is the name of the key to be read from.
MaxNumOfChar is the user-specified maximum number of characters to be read

These two functions are enough for this tutorial. If you want to fool around with the registry more, you'll want to refer to Delphi help.
Finding the Windows Installation Path:
For this part, you won't need regedit, as I will provide you the path to windows. We'll start off with a skeleton of the program:

Quote:
Procedure TForm1.Button1Click(Sender: TObject);
var
Reg: TRegistry;
WindowsFilePath: String;
begin
Reg:= TRegistry.Create;
Reg.Rootkey:= HKEY_LOCAL_MACHINE;
// Code goes here
Reg.Free;
end;
Now, we'll observe that windows' registry key is in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion. So let's openkey that.

Quote:
Procedure TForm1.Button1Click(Sender: TObject);
var
Reg: TRegistry;
WindowsFilePath: String;
begin
Reg:= TRegistry.Create;
Reg.Rootkey:= HKEY_LOCAL_MACHINE;
Reg.Openkey('\SOFTWARE\Microsoft\Windows NT\CurrentVersion', FALSE);
// Code goes here
Reg.Free;
end;
This path exists, so the FALSE shouldn't matter.

Now, we'll notice that the key name is 'SystemRoot', so we'll read string from that key, and voila, we have the windows installation folder.

Quote:
Procedure TForm1.Button1Click(Sender: TObject);
var
Reg: TRegistry;
WindowsFilePath: String;
begin
Reg:= TRegistry.Create;
Reg.Rootkey:= HKEY_LOCAL_MACHINE;
Reg.Openkey('\SOFTWARE\Microsoft\Windows NT\CurrentVersion', FALSE);
WindowsFilePath:= Reg.ReadString('SystemRoot');
Reg.Free;
end;
Ok, this does BASICALLY nothing right now, so we'll just have a little fun in the windows folder, shall we?

Nah, i'm just joking. We'll just open regedit, not matter what system we're on.

Quote:
Procedure TForm1.Button1Click(Sender: TObject);
var
Reg: TRegistry;
WindowsFilePath: String;
begin
Reg:= TRegistry.Create;
Reg.Rootkey:= HKEY_LOCAL_MACHINE;
Reg.Openkey('\SOFTWARE\Microsoft\Windows NT\CurrentVersion', FALSE);
WindowsFilePath:= Reg.ReadString('SystemRoot');
Reg.Free;
ShellExecute(handle,'',PChar(Concat(WindowsFilePat h,'\system32\regedit.exe')),'','',SW_SHOW);
//If you didn't know what that meant, don't worry about it
end;
Be sure to add shellapi to your uses list if you're going to use ShellExecute.

Getting Application's File Path from Registry
This step is a little harder, because different companies put different names on their registry keys, and they put them in a lot of different places. I'm assuming we're all using Borland Delphi 7, so we'll just use that as an example.

First, let's load up regedit and try to find a path to Borland.

First, we look in Local Machine, and voila, we find it under \software\Borland.

Now we'll find Delphi's keys.

We look in Borland, and we find Delphi, however there are no keys in that folder. However, when we look under 7.0, we find a key called 'RootDir'. Even the name gives it away, so let's keep that key.

We've arrived at...

Path: HKEY_LOCAL_MACHINE\SOFTWARE\Borland\Delphi\7.0
Keyname: RootDir

So let's make a program that looks for the Root Directory.

Quote:
Procedure TForm1.Button1Click(Sender: TObject);
var
Reg: TRegistry;
DelphiPath: String;
begin
Reg:= TRegistry.Create;
Reg.Rootkey:= HKEY_LOCAL_MACHINE;
Reg.Openkey('\SOFTWARE\Borland\Delphi\7.0', FALSE);
DelphiPath:= Reg.ReadString('RootDir');
Reg.Free;
end;
That was simple enough, however we saw that the Keyname changed, so we have to be cautious.

Whenever you're looking for a directory key, look for giveaway names like 'RootDir' or 'InstDir' or something like that.

Now, to implement this into a button that loads the program, we'll have to look in that path to find where the executable is.

It just so happens that the delphi executable is not in the rootdir, but in a subfolder: \Bin\delphi32.exe

So we'll put that into one giant string by using concatenation (Concat();)

DelphiPath:= Concat(DelphiPath,'\Bin\delphi32.exe');

To execute this program, we do:

shellexecute(handle,'',PChar(DelphiPath),'','',SW_ SHOW);

Read more on shellexecute in Delphi Help.

That concludes this tutorial...

How to turn on the Terminal Services Session Directory logging service

2009-02-25T17:55:00.000+08:00

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

1. Stop the Terminal Services Session Directory service.
2. In the registry, locate the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tssdis\Parameters
3. If the Parameters key does not exist, create it.
4. Add the following DWORD value:
TraceOutputMode
5. Select the option you want:
* 0 (no output)
* 1 (output to debugger)
* 3 (output to log file)
6. Start the Terminal Services Session Directory service. If you selected option 3 in step 5, Terminal Service Session Directory places the output in a log file that is named Tssdis.log in the System32 folder.

The Terminal Services Session directory log file contains the following entries:

* Session Directory service started
* Session Directory service stopped
* Machine joins session directory
* Machine leaves session directory
* User logs in
* User disconnects
* User reconnects
* User logs out
* Session Directory-related event log messages.

Important If you stop and then restart the Terminal Services Session Directory service, you clear all Terminal Services Session Directory data. Do this only if it is not a problem to do so.

Changing IIS Regional Settings (for ASP Date, Time, Currency, etc)

2009-02-16T13:55:00.000+08:00

How to safely change the regional settings for IIS.

I recently installed a new server and ran in to a problem I've incurred before - despite me hanging the servers regional settings to use U.K. formatting for dates and numbers, all my ASP pages were defaulting to U.S. regional settings. This is because Microsoft, in all their wisdom, decided that IIS (Internet Information Services) should take its regional settings from the IUSR account (an account whose password is generated by the server and not known to the server administrator - go figure).

Now many ASP purists will say that you should always set the locale of your application (e.g. website) anyway, forcing the server to acknowledge your region of choice - I agree. The problem is however, that I host websites I haven't created myself and also that many third party solutions and dreamweaver extensions) physically format the date how they want it - making regional settings ineffective.

Although I've seen all sorts of solutions out there, from registry changes to resetting the IUSR password, I hadn't found one I was entirely comfortable with. Firstly, registry setting changes always make me twitchy and secondly, resetting the password to the IUSR account can cause windows to permanently deny access to some IUSR recources.
The Solution

I took the obvious route instead and decided to find out how to get hold of the IUSR password that generated automatically and simply use the RUN AS option when firing up the regional settings dialogue to run them as the IUSR - so, down to business:

In order to allow the password to appear as anything other than asterisks you need to update the adsutil.vbs script (found in the AdminScripts folder in the Inetpub folder (often

C:/InetPub/AdminAcripts). Open the adsutil.vbs file in Notepad and search for "IsSecureProperty =

True", replace it with "IsSecureProperty = False" and save the file (keep it open so you can easily change it back afterwards).

Open a command prompt window (START > RUN > Type 'cmD' > OK)Browse to the InetPub/AdminScripts folder, for example:

C: (press enter)

CD \ inetpub\AdminScripts

To Retrieve the IUSR Password, enter this command:

cscript adsutil.vbs get w3svc/anonymoususerpass

Should return something like: anonymoususerpass : (STRING) "/fre5hJe7x"!39I"

To Retrieve the IWAM Password, enter this command:

cscript adsutil.vbs get w3svc/wamuserpass

Should return something like: wamuserpass : (STRING) "1like808!"

Now in the Control Panel, hold down the shift key and right click on the "Regional Settings" icon

Select "Run As" from the menu that appears

Login as the IUSR_yourServerName using the password retrieved above

Change the regional settings to whatever you need them to be for IIS and your done.

You may need to restart the server for the changes to take effect.

Don't forget to change the adsutil.vbs line back to read "IsSecureProperty = False"!

Spoolsv.exe application error

2008-11-17T18:02:00.004+08:00

If you found your computer prompt our an application error call "Spoolsv.exe - Application Error" the you can try the following solution, because it help me to solve my problem.

You cannot add a printer and you receive printer spooler error messages in Windows XP
View products that this article applies to.
Article ID : 324757
Last Review : September 25, 2008
Revision : 7.1
This article was previously published under Q324757
On This Page
SYMPTOMS
CAUSE
RESOLUTION
Turn off Lexmark print service
Start computer in safe mode
Now delete spool printer and driver files
Next, edit the registry
First, remove Windows NT subkeys
Second, remove registry entries for printer drivers
Third, remove registry entries for default print monitors
Now verify that the print spooler service is running
Finally, add a printer and print a test page
NEXT STEPS
MORE INFORMATION
SYMPTOMS
You may experience any of the following symptoms on your Windows XP-based computer:
• After you start your computer, you may receive the following error message:
Spooler subsystem app has encountered a problem and needs to close.
• When you try to start the Print Spooler service, you may receive the following error message:
Spooler subsystem app has encountered a problem and needs to close.
• When you try to stop the Print Spooler service, you may receive the following error message:
Spooler subsystem app has encountered a problem and needs to close.
• When you click Start, and then click Printers and Faxes, you may receive the following error message:
Spooler subsystem app has encountered a problem and needs to close.
• When you click Start, and then click Printers and Faxes to try to view your printers, no printers appear. This issue may occur even if you have a printer installed.
• When you click Add a printer, or when you try to print, you may receive the following error message and cannot add a printer:
Operation could not be completed.

Back to the top
CAUSE
This issue may occur if a third-party printer driver or a third-party service that is installed prevents you from adding printers, or if the third-party printer driver or the third-party service affects the functionality of a newly installed printer.

For example, this issue may occur if the Lexmark print service (LexBce Server service) is installed and is running on your computer before you try to add another printer.

Back to the top
RESOLUTION
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows
If you have a Lexmark printer installed, start with the "Turn off Lexmark print service" section and then, if it is necessary, follow the remaining steps in the order presented to resolve this issue. If you do not have a Lexmark printer installed, go to the "Start computer in safe mode" section, and then follow the remaining steps in the order in which they are presented to resolve this issue. You may find it easier to follow the steps if you print this article first.

Back to the top
Turn off Lexmark print service
If the Lexmark print service is installed on your computer, turn off the LexBce Server service. To do this, follow these steps:
1. Click Start, right-click My Computer, and then click Manage.
2. Expand Services and Applications, and then click Services.
3. In the details pane, right-click LexBce Server, and then click Properties.
4. On the General tab in the Startup type list, click Disabled.
5. Under Service status, click Stop, and then click OK.
6. Right-click the Print Spooler service, and then click Start (if it is stopped).
7. Exit Computer Management.
Test whether the issue is resolved. If the issue is resolved, you do not have to follow the remaining steps. If the issue is not resolved, go to the "Start computer in safe mode" section, and then follow the remaining steps.

Back to the top
Start computer in safe mode
Start the computer in safe mode so that you can remove spool files. To do this, follow these steps:
1. Restart your computer and start pressing the F8 key on your keyboard. On a computer that is configured to start multiple operating systems, you can press the F8 key when the Boot menu appears.
2. Select Safe Mode when the Windows Advanced Options menu appears, and then press ENTER.
3. If the Boot menu appears again and you are prompted to select the operating system on the computer, use the arrow keys to select the operating system, and then press ENTER.

Note For more information about how to start your computer in safe mode, click Start, click Help and Support, type safe mode in the Search box, press the ENTER key, and then click the Start Windows in safe mode topic.

Back to the top
Now delete spool printer and driver files
In safe mode, delete the spool printer and driver files. To do this, start Microsoft Windows Explorer, and then delete all the files and the folders in the following two folders (where C: is the drive where you have Windows XP installed):
• C:\Windows\System32\Spool\Printers
• C:\Windows\System32\Spool\Drivers\w32x86

Back to the top
Next, edit the registry
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
First, remove Windows NT subkeys
Remove the potentially problematic registry entries for Windows NT x86 service subkeys. These may have been installed by third-party printer setup programs and may be interfering with the print spool service. Use the following steps to keep the drivers, print spools, and registry entries that came with Windows on your computer and remove all others that may be causing issues.
1. Start Registry Editor. To do this, click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and expand the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86
View the list of subkeys (subfolders). There should only be the following subkeys:
• Drivers
• Print Processors
3. If there are any subkeys other than the subkeys that are listed in step 2, follow these steps:
a. On the File menu, click Export.
b. In the File Name box, type the name that you want to use for this key, such as WindowsNTx86regkey, and then click Save.

NoteYou can use this backup of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86 registry key to restore the key if you experience any issues after you complete this procedure.
c. Delete all the subkeys other than the subkeys that are listed in step 2. To do this, right-click each subkey that is not on the list, and then click Delete. Click Yes when you are prompted to confirm the deletion.
Second, remove registry entries for printer drivers
Remove the potentially problematic printer driver subkeys, which may be interfering with the printer you want to use. These may have been installed by third-party printer setup programs. Use the following steps to keep the printer driver and registry entries that came with Windows on your computer and remove all others that may be causing issues.
1. Start Registry Editor if it is not open. To do this, click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then expand the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers
The registry entries for the printer drivers that are installed on the computer are stored in the Version-x subkey or subkeys, where x is a number (typically 2 or 3).
3. Export the Version-x subkey or subkeys. To do this, follow these steps:
a. On the File menu, click Export.
b. In the File Name box, type the name that you want to use for this key, such as print driver, and then click Save.
4. Expand the Version-x subkey or subkeys, and then delete the printer driver entries. To do this, right-click each printer driver subkey, and then click Delete. Click Yes when you are prompted to confirm the deletion.
Third, remove registry entries for default print monitors
Remove the potentially problematic print monitor subkeys, which may be interfering with the printer you want to use. These may have been installed by third-party printer setup programs. Use the following steps to keep the print monitors and registry entries that came with Windows and remove all others that may be causing issues.
1. Start Registry Editor if it is not open. To do this, click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then expand the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors
View the list of subkeys. There should only be the following subkeys for the default print monitors:
• BJ Language Monitor
• Local Port
• PJL Language Monitor
• Standard TCP/IP Port
• USB Monitor
3. If there are any subkeys other than the subkeys that are listed in step 1, follow these steps:
a. On the File menu, click Export.
b. In the File Name box, type the name that you want to use for this key, such as MonitorsRegkey, and then click Save.

NoteYou can use this backup of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors registry key to restore the key if you experience any issues after you complete this procedure.
c. Delete all the subkeys other than the subkeys that are listed in step 2. To do this, right-click each subkey that is not on the list, and then click Delete. Click Yes when you are prompted to confirm the deletion.
4. Exit Registry Editor.
5. If you have a printer attached to the computer, disconnect the printer cable from the computer, and then restart the computer.

Back to the top
Now verify that the print spooler service is running
Verify that the print spooler service is running. To do this, follow these steps:
1. Click Start, right-click My Computer, and then click Manage.
2. Expand Services and Applications, and then click Services.
3. In the details pane, right-click the Print Spooler service, and then click Start (if it is stopped).
4. Exit Computer Management.
If you cannot start the Print Spooler service, follow the steps in the following Microsoft Knowledge Base article to start the Print Spooler service:
919750 (http://support.microsoft.com/kb/919750/) You experience problems printing, viewing printer icons, and adding printers, the Print Spooler service does not function correctly, and you receive print-related error messages on a Windows XP-based computer

Back to the top
Finally, add a printer and print a test page
If you have a printer attached, reconnect the printer cable to the computer, install the printer by adding it to the computer through the Add Printer Wizard, and then try to print a test page. To install the printer you want, follow these steps:
1. Click Start, and then click Printers and Faxes.
2. Click Add a printer. The Add Printer Wizard starts.
3. Follow the instructions in the Add Printer Wizard to install the printer that you want.
4. Print a test page to make sure that you can print.
If you still cannot print or if you are still receiving print spool errors, go to the "Next Steps" Section.

Back to the top
NEXT STEPS
If these methods did not work for you, you can use the Microsoft Customer Support Services Web site to find other solutions to your problem. Services that the Microsoft Customer Support Services Web sites provide include the following:
• Searchable Knowledge Base (http://support.microsoft.com/search/?adv=1): Search technical support information and self-help tools for Microsoft products.
• Solution Centers (http://support.microsoft.com/select/?target=hub): View product-specific frequently asked questions and support highlights.
• Microsoft Customer Support Newsgroups (http://www.microsoft.com/communities/newsgroups/default.mspx): Contact counterparts, peers, and Microsoft Most Valuable Professionals (MVPs).
• Other Support Options (http://support.microsoft.com/default.aspx?pr=csshome): Use the Web to ask a question, contact Microsoft Customer Support Services, or provide feedback.
If you continue to have printing problems, you might want to contact Support:
http://support.microsoft.com/contactus (http://support.microsoft.com/contactus)

Back to the top
MORE INFORMATION
For more information about how to troubleshoot printing problems in Windows XP, click the following article numbers to view the articles in the Microsoft Knowledge Base:
314085 (http://support.microsoft.com/kb/314085/) Advanced troubleshooting for when you cannot print in Windows XP
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Back to the top
APPLIES TO
• Microsoft Windows XP Professional
• Microsoft Windows XP Home Edition

Back to the top
Keywords:
kbtshoot kbresolve kbregistry kb3rdparty kbenv kbprint kbdriver kberrmsg kbprb KB324757

Remove Password Protection When Uninstall Symantec Antivirus

2008-10-31T15:44:00.002+08:00

To those who have facing forgot password when you need to uninstall your Symantec AntiVirus, you just need to do the following step then the password will gone: -

1) Goto Regedit.
2) Goto the following directory: - HKEY_Local_Machine\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security
3) Looking for "UseVPUninstallPassword", this is a REG_DWORD value.
4) Just change the value from 1 to 0.
5) Close all the application and then goto uninstall again.

The password authentication is gone ..... :)

W32.Sality.AE

2008-10-22T15:43:00.001+08:00

Begin of the article W32.Sality.AE removal process

1. DownloadGoogle recommend safer browser Web browser, For more safe, Stay Secure on the Web and stay far away virus, Download URL http://www.oral8.net/firefox/firefox.htm
2. Temporarily Disable System Restore (Windows Me/XP).
3. Update the virus definitions. Reboot computer in Safe Mode
4. Run a full system scan and clean/delete all W32.Sality.AE infected files and Delete/Modify any values added to the registry.
Navigate to the sub key and delete the values as following:

When the virus is executed, it copies itself as the following file:
%System%\drivers\[RANDOM FILE NAME].sys

The virus creates the following mutex so only one instance of the virus is running:
Op1mutx9

It then creates the following registry sub keys:

HKEY_CURRENT_USER\Software\[USER NAME]914
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WMI_MFC_TPSHOKER_80
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IPFILTERDRIVER

It then creates the following registry entry so that it bypasses the Windows Firewall:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"[INFECTED FILE]" = "[INFECTED FILE]:*:Enabled:ipsec"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Setting\"GlobalUserOffline" = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\"EnableLUA" = "0"

The virus also deletes entries in the following registry sub keys:

HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

It then registers itself as a new service with the following characteristics:
Service Name: WMI_MFC_TPSHOKER_80
Display Name: WMI_MFC_TPSHOKER_80
Startup Type: Automatic

It then deletes itself.

It stops the following services:

ALG
aswUpdSv
avast! Antivirus
avast! Mail Scanner
avast! Web Scanner
BackWeb Plug-in - 4476822
bdss
BGLiveSvc
BlackICE
CAISafe
ccEvtMgr
ccProxy
ccSetMgr
F-Prot Antivirus Update Monitor
fsbwsys
FSDFWD
F-Secure Gatekeeper Handler Starter
fshttps
FSMA
InoRPC
InoRT
InoTask
ISSVC
KPF4
LavasoftFirewall
LIVESRV
McAfeeFramework
McShield
McTaskManager
navapsvc
NOD32krn
NPFMntor
NSCService
Outpost Firewall main module
OutpostFirewall
PAVFIRES
PAVFNSVR
PavProt
PavPrSrv
PAVSRV
PcCtlCom
PersonalFirewal
PREVSRV
ProtoPort Firewall service
PSIMSVC
RapApp
SmcService
SNDSrvc
SPBBCSvc
Symantec Core LC
Tmntsrv
TmPfw
tmproxy
UmxAgent
UmxCfg
UmxLU
UmxPol
vsmon
VSSERV
WebrootDesktopFirewallDataService
WebrootFirewall
XCOMM
AVP

It infects all executable files listed in the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache

It infects all .exe executable files listed in the following registry subkeys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also infects all .exe and .scr files on the C drive and on any writable network resource, except the files on any folder with the following strings:

SYSTEM
AHEAD

The infected file size will increase 57,344 bytes.

It deletes any file whose name contains any of the following strings:

.VDB
.AVC
.KEY
drw
_AVPM
A2GUARD
AAVSHIELD
AVAST
ADVCHK
AHNSD
AIRDEFENSE
ALERTSVC
ALMON
ALOGSERV
ALSVC
AMON
ANTI-TROJAN
AVZ
ANTIVIR
ANTS
APVXDWIN
ARMOR2NET
ASHAVAST
ASHDISP
ASHENHCD
ASHMAISV
ASHPOPWZ
ASHSERV
ASHSIMPL
ASHSKPCK
ASHWEBSV
ASWUPDSV
ATCON
ATUPDATER
ATWATCH
AUPDATE
AUTODOWN
AUTOTRACE
AUTOUPDATE
AVCIMAN
AVCONSOL
AVENGINE
AVGAMSVR
AVGCC
AVGCC32
AVGCTRL
AVGEMC
AVGFWSRV
AVGNT
AVGNTDD
AVGNTMGR
AVGSERV
AVGUARD
AVGUPSVC
AVINITNT
AVKSERV
AVKSERVICE
AVKWCTL
AVP
AVP32
AVPCC
AVPM
AVPUPD
AVSCHED32
AVSYNMGR
AVWUPD32
AVWUPSRV
AVXMONITOR9X
AVXMONITORNT
AVXQUAR
BACKWEB-4476822
BDMCON
BDNEWS
BDOESRV
BDSS
BDSUBMIT
BDSWITCH
BLACKD
BLACKICE
CAFIX
CCAPP
CCEVTMGR
CCPROXY
CCSETMGR
CFIAUDIT
CLAMTRAY
CLAMWIN
CLAW95
CLAW95CF
CLEANER
CLEANER3
CLISVC
CMGRDIAN
CUREIT
DEFWATCH
DOORS
DRVIRUS
DRWADINS
DRWEB32W
DRWEBSCD
DRWEBUPW
ESCANH95
ESCANHNT
EWIDOCTRL
EZANTIVIRUSREGISTRATIONCHECK
F-AGNT95
FAMEH32
FAST
FCH32
FILEMON
FIRESVC
FIRETRAY
FIREWALL
FPAVUPDM
F-PROT95
FRESHCLAM
FRW
FSAV32
FSAVGUI
FSBWSYS
F-SCHED
FSDFWD
FSGK32
FSGK32ST
FSGUIEXE
FSM32
FSMA32
FSMB32
FSPEX.
FSSM32
F-STOPW
GCASDTSERV
GCASSERV
GIANTANTISPYWAREMAIN
GIANTANTISPYWAREUPDATER
GUARDGUI
GUARDNT
HREGMON
HRRES
HSOCKPE
HUPDATE
IAMAPP
IAMSERV
ICLOAD95
ICLOADNT
ICMON
ICSSUPPNT
ICSUPP95
ICSUPPNT
IFACE
INETUPD
INOCIT
INORPC
INORT
INOTASK
INOUPTNG
IOMON98
ISAFE
ISATRAY
ISRV95
ISSVC
KAV
KAVMM
KAVPF
KAVPFW
KAVSTART
KAVSVC
KAVSVCUI
KMAILMON
KPFWSVC
KWATCH
LOCKDOWN2000
LOGWATNT
LUALL
LUCOMSERVER
LUUPDATE
MCAGENT
MCMNHDLR
MCREGWIZ
MCUPDATE
MCVSSHLD
MINILOG
MYAGTSVC
MYAGTTRY
NAVAPSVC
NAVAPW32
NAVLU32
NAVW32
NOD32
NEOWATCHLOG
NEOWATCHTRAY
NISSERV
NISUM
NMAIN
NOD32
NORMIST
NOTSTART
NPAVTRAY
NPFMNTOR
NPFMSG
NPROTECT
NSCHED32
NSMDTR
NSSSERV
NSSTRAY
NTRTSCAN
NTXCONFIG
NUPGRADE
NVC95
NVCOD
NVCTE
NVCUT
NWSERVICE
OFCPFWSVC
OUTPOST
PAV
PAVFIRES
PAVFNSVR
PAVKRE
PAVPROT
PAVPROXY
PAVPRSRV
PAVSRV51
PAVSS
PCCGUIDE
PCCIOMON
PCCNTMON
PCCPFW
PCCTLCOM
PCTAV
PERSFW
PERTSK
PERVAC
PNMSRV
POP3TRAP
POPROXY
PREVSRV
PSIMSVC
QHM32
QHONLINE
QHONSVC
QHPF
QHWSCSVC
RAVMON
RAVTIMER
REALMON
REALMON95
RFWMAIN
RTVSCAN
RTVSCN95
RULAUNCH
SAVADMINSERVICE
SAVMAIN
SAVPROGRESS
SAVSCAN
SCAN32
SCANNINGPROCESS
CUREIT
SDHELP
SHSTAT
SITECLI
SPBBCSVC
SPHINX
SPIDERML
SPIDERNT
SPIDERUI
SPYBOTSD
SPYXX
SS3EDIT
STOPSIGNAV
SWAGENT
SWDOCTOR
SWNETSUP
SYMLCSVC
SYMPROXYSVC
SYMSPORT
SYMWSC
SYNMGR
TAUMON
TBMON
TC
TCA
TCM
TDS-3
TEATIMER
TFAK
THAV
THSM
TMAS
TMLISTEN
TMNTSRV
TMPFW
TMPROXY
TNBUTIL
TRJSCAN
UP2DATE
VBA32ECM
VBA32IFS
VBA32LDR
VBA32PP3
VBSNTW
VCHK
VCRMON
VETTRAY
VIRUSKEEPER
VPTRAY
VRFWSVC
VRMONNT
VRMONSVC
VRRW32
VSECOMR
VSHWIN32
VSMON
VSSERV
VSSTAT
WATCHDOG
WEBPROXY
WEBSCANX
WEBTRAP
WGFE95
WINAW32
WINROUTE
WINSS
WINSSNOTIFY
WRADMIN
WRCTRL
XCOMMSVR
ZATUTOR
ZAUINST
ZLCLIENT
ZONEALARM

It connects to the following URLs to get instructions. The instructions contain additional URLs to possibly download other malicious files:

[http://]pedmeo222nb.info
[http://]pzrk.ru
[http://]technican.w.interia.pl
[http://]www.kjwre9fqwieluoi.info
[http://]bpowqbvcfds677.info
[http://]bmakemegood24.com
[http://]bperfectchoice1.com
[http://]bcash-ddt.net
[http://]bddr-cash.net
[http://]btrn-cash.net
[http://]bmoney-frn.net
[http://]bclr-cash.net
[http://]bxxxl-cash.net
[http://]balsfhkewo7i487fksd.info
[http://]buynvf96.info

It prevents access to various security-related domains containing any of the following strings:

Cureit
Drweb
Onlinescan
Spywareinfo
Ewido
Virusscan
Windowsecurity
Spywareguide
Bitdefender
Panda software
Agnmitum
Virustotal
Sophos
Trend Micro
Etrust.com
Symantec
McAfee
F-Secure
Eset.com
Kaspersky

It then adds following entry to %Windir%\system.ini:
[MCIDRV_VER]

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

5. Exit registry editor.
6. Delete the IE temp files or you may download ATF temp files cleaner to run a full cleaning. And restart the computer.
8. Now you may remove W32.Sality.AE successfully.

9. After remove the virus, please try to install antivirus like Avira Antivirus. And then run full scanning for your computer. It might delete a lot of application exe file, just let it delete. Once it delete done these mean your pc is clean. Then you have to reinstall the application that deleted by antivirus again to make all application functioning.

Missing Connection Tab on Internet Option

2008-09-22T11:52:00.002+08:00

For who have facing missing "Connection" tab on their "Internet Option" don't worry, just follow a few simple step then it will come back again.

Before you do the following step please make sure your computer is clean because this problem normally was cause by virus infection. Please scan your computer by trusted antivirus.

After you clean your computer lets do the following step: -

1) Goto "gpedit.msc" for restore the default setting of "Internet Control Panel".

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel
User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

If you find that the "Disable Connetion Tab" was set "disable" just change it back to "not configured".

After that goto "regedit" and the goto the following path:

User Key: [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
Control Panel]
System Key: [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\
Control Panel]
Data Type: REG_DWORD (DWORD Value)
Value Data: (0 = disable restriction, 1 = enable restriction)

If the value was set "1" please change it to "0".

Now you can check the "Connection" tab is coming back ...

Windows Folder Option: - Show Hidden Files/Folders not functioning.

2008-09-09T16:08:00.002+08:00

If you found that your windows can't view hidden files / folders even you has enable the "Show Hidden Files /Folders" option in the Folder Option.

Before you done anything please make sure your computer are clean, to make sure that please use anti-virus to scan your computer, because this problem normally was happend because your computer infected virus.

Don't worry the following are the solution for solving your problem, just follow step by step: -

1. Click “Start” -> “Run…” (or press Windows key + R)
2. Type “regedit” and click “Ok”.
3. Find the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
4. Look at the “CheckedValue” key… This should be a DWORD key. If it isn’t, delete the key.
5. Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1.
6. The “Show hidden files & folders” check box should now work normally. Enjoy!

Then your windows become normal loh ~~~

Unable open EML file from Outlook Express

2008-08-19T10:45:00.002+08:00

If you found that you can't open eml files in attachment mode from your outlook express and show that is unknown files type, that is because your windows missing recognition of eml files type so you might need to do the following steps: -

RESOLUTION

To resolve this behavior, either run the Msimn executable file with the /reg option to force Outlook Express to re-register its file types, or re-register the .eml file type in My Computer.

To run the Msimn executable file with the /reg option:

1.	Quit Outlook Express.
2.	Click Start, and then click Run.
3.	In the Open box, type msimn /reg, and then click OK.

To re-register the .eml file type in My Computer:

1.	On the desktop, double-click My Computer.
2.	On the Tools menu, click Folder Options.
3.	Click the File Types tab.
4.	Under Registered file types, click EML Outlook Express Mail Message, and then click Advanced.
5.	Click Open, and then click Edit.
6.	Type the following single line in the Application used to perform action box: "C:\Program Files\Outlook Express\MSIMN.EXE" /eml:%1
7.	Click OK, click OK again, and then click Close.

This solution has been tested and confirm it's work. TQ.

Configure Outlook to block additional attachment file name extensions.

2008-05-16T17:41:00.001+08:00

This article describes how to configure Microsoft Outlook to block attachment file name extensions that Outlook does not block by default. If you use Outlook in a Microsoft Exchange environment, you can configure the server to block certain attachment file name extensions by using the Outlook E-mail Security Administrator Package.

Additionally, this article includes information about how to customize your security settings for different Outlook configurations with and without Exchange.

Solution: -

How to customize your security settings to block additional attachment file name extensions

The following methods describe how to customize your security settings for different Outlook configurations with and without Exchange.

How to block attachment file name extensions in an Exchange environment with the Outlook Security Administrator Package

If you have an Exchange environment that uses the Outlook Security Administrator Package and you want to add more attachment file name extensions that you want to block in your Outlook configuration, you can add more attachment file name extensions to the Level 1 file list. To do this, follow these steps:

1.	Start Outlook with an account that has permissions to change the Outlook Security Form in the Outlook 10 Security Settings public folder.
2.	In the folder list pane, locate the version-specific Outlook Security Settings public folder. Note For Microsoft Outlook 2000, the name of the public folder is Outlook Security Settings. For Microsoft Outlook 2002 and Microsoft Office Outlook 2003, the name of the public folder is Outlook 10 Security Settings.
3.	Double-click Default Security Form.
4.	Under Miscellaneous Attachment Settings, click to clear the Show level 1 attachments check box.
5.	Under Level 1 File Extensions, type the attachment file name extensions that you want to block in the Add box. If you want to add more attachment file name extensions in the Add box, you can separate them with a semicolon. For example, if you want to block both the .zip and the .gif attachment file name extensions, type .zip; .gif
6.	Click Close, and then click Yes to save your changes.
7.	Repeat these steps for each Outlook Security Form that you have in the public folder for each security group that you want to add more attachment file name extensions to.

The next time that your users start Outlook, the new settings will be applied.

Note If you the Show Level 1 File Attachments check box from step 4 was already selected to allow all Level 1 attachment file name extensions types to appear in the e-mail message as an attachment, you must add the attachment file name extensions that you do not want to appear in the e-mail message as an attachment by following this one additional step:

•

Under Level 1 File Extensions, locate the Remove box. In the Remove box, type the attachment file name extensions that you do not want to appear in the e-mail message as an attachment.

If you want to add more attachment file name extensions in the Add box, you can separate them with a semicolon. For example, if you want to block both the .zip and the .gif attachment file name extensions, type .zip; .gif

For additional information about how to configure Outlook related security public folders in your Exchange environment, click the following article numbers to view the articles in the Microsoft Knowledge Base:

263297 (http://support.microsoft.com/kb/263297/) OL2000: Administrator information about the Outlook e-mail security update

290499 (http://support.microsoft.com/kb/290499/) OL2002: Administrator information about e-mail security features

Note Knowledge Base article 290499 also applies to to Outlook 2003.

How to block attachments in a non-Exchange environment

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows

Use the information that is in this section if you are running Outlook in a non-Exchange environment and you want to block more attachment file name extensions than those that Outlook already blocks.

If you are using Outlook 2000, Microsoft Office 2000 Service Pack 3 (SP3) or later must be installed on your computer so that you can configure Outlook 2000 to block certain attachment file name extensions.

To obtain the latest service pack for Microsoft Office 2000, click the following article number to view the article in the Microsoft Knowledge Base:

276367 (http://support.microsoft.com/kb/276367/) How to obtain the latest Office 2000 service pack

If you are using Outlook 2002, Microsoft Office XP Service Pack 1 (SP1) or later must be installed on your computer so that you can configure Outlook 2002 to block certain attachment file name extensions. To obtain the latest service pack for Microsoft Office XP, click the following article number to view the article in the Microsoft Knowledge Base:

307841 (http://support.microsoft.com/kb/307841/) How to obtain the latest Office XP service pack

Outlook uses the Level1Add registry key to permit you to add additional attachment file name extensions types that you want to block.

To add additional attachment file name extensions types that you want to block, you must add the Level1Add key to the registry. To do this, follow these steps.

For Outlook 2000

Follow these steps, and then quit Registry Editor:

1.	Click Start, click Run, type regedit, and then click OK.
2.	Locate and then click the following key in the registry: HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Outlook\Security
3.	On the Edit menu, point to New, and then click String Value.
4.	Type Level1Add, and then press ENTER.
5.	On the Edit menu, click Modify.
6.	Type , and then click OK.

Outlook 2002

Follow these steps, and then quit Registry Editor:

1.	Click Start, click Run, type regedit, and then click OK.
2.	Locate and then click the following key in the registry: HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security
3.	On the Edit menu, point to New, and then click String Value.
4.	Type Level1Add, and then press ENTER.
5.	On the Edit menu, click Modify.
6.	Type , and then click OK.

Notefile_name_extensions is a list of the attachment file name extensions. Each attachment file name extension is separated by a semicolon. For example, type .zip; .gif if you want to block both .zip and .gif files from appearing in the e-mail message as an attachment.

If Outlook 2002 does not behave differently after you add the Level1Add registry value, click the following article number to view the article in the Microsoft Knowledge Base:

312834 (http://support.microsoft.com/kb/312834/) The "Level1Add" registry key is missing from Outlook 2002

Additionally, you can add additional attachment file name extensions types that you want blocked by using system policies to add the following registry key for Outlook:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Outlook 2003

Follow these steps, and then quit Registry Editor:

1.	Click Start, click Run, type regedit, and then click OK.
2.	Locate and then click the following key in the registry: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Security
3.	On the Edit menu, point to New, and then click String Value.
4.	Type Level1Add, and then press ENTER.
5.	On the Edit menu, click Modify.
6.	Type , and then click OK.

Outlook blocked access to the following potentially unsafe attachment.

2008-05-16T17:31:00.001+08:00

Microsoft Outlook includes a feature that blocks attachments that are considered unsafe. If you receive an e-mail message that contains an attachment that contains one of the file types that are considered unsafe, you may receive the following message:

Outlook blocked access to the following potentially unsafe attachments: [...]

Although Outlook blocks access to the attachment, the attachment still exists in the e-mail message.

This article discusses the methods to use if you have to open an attachment that has been blocked in Outlook.

Solution: -

Exit Outlook if it is running.

Click Start, click Run, type regedit, and then click OK.

Verify that the following registry key for your version of Outlook exists. If it does, go to step 5.

Microsoft Office Outlook 2007

HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security

Microsoft Office Outlook 2003

HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Security

Microsoft Outlook 2002

HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security

Microsoft Outlook 2000

HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Outlook\Security

If the registry key does not exist, create it. To create the registry key, follow these steps:

a.	Locate and then click the following registry key: HKEY_CURRENT_USER\Software\Microsoft
b.	Click the Edit menu, click New, and then click Key.
c.	Type Office, and then press ENTER.
d.	Click the Edit menu, click New, and then click Key.
e.	For Outlook 2007, type 12.0, and then press ENTER For Outlook 2003, type 11.0, and then press ENTER For Outlook 2002, type 10.0, and then press ENTER For Outlook 2000, type 9.0, and then press ENTER
f.	Click the Edit menu, click New, and then click Key.
g.	Type Outlook, and then press ENTER.
h.	Click the Edit menu, click New, and then click Key.
i.	Type Security, and then press ENTER.

Click the Edit menu, click New, and then click String Value.

Type the following name for the new value:

Level1Remove

Press ENTER.

Right-click the new string value name, and then click Modify.

Type the file name extension of the file type that you want to open in Outlook. For example:

.exe

To specify multiple file types, use the following format:

.exe;.com

Click OK.

10.

Exit Registry Editor.

11.

Restart your computer.

When you start Outlook, you can open the file types that you specified in the registry.

Note We recommend that you enable only the file types that you need. If you rarely receive a particular file type, we recommend that you give Outlook temporary access to the file type that is in question and then reconfigure Outlook to block the file type by undoing the changes to registry.

Restrict Web Browsing by IE (Backdoor Technique).

2008-04-30T10:47:00.002+08:00

Now day everybody will go to internet for searching or browsing something, but do you known how to restrict user to access some web site, the following is the way to block it manually without install any third-party application.

Solution: -

1) Open Windows Explorer.

2) Browse to C:\WINDOWS\system32\drivers\etc

3) Find the file named "HOSTS".

4) Open the file in notepad.

5) Under "127.0.0.1 localhost" add 127.0.0.2 www.name_of_the_site_to block.com. So, if you'd like to block www.hotporn.com, the code will look like this:
127.0.0.1 localhost
127.0.0.2 www.hotporn.com
the site is now blocked.
If you want to block another site, just repeat the process with the next number in the 127.0.0 sequence. For example:
127.0.0.3 www.blocked_site.com
127.0.0.4 www.blocked_site.com

6) Please remember to restart your IE to get the result.

System Restart After Installing Windows XP Services Pack 3 RC 2.

2008-04-24T18:09:00.002+08:00

For R&D on new windows technology, user will always keep on trying the new software or the latest version update or software especially for Windows Update and also Service Pack, user are more excited to have a first view. But did you think Microsoft also will have a leg-pull on you.

It happened to me. I had downloaded Windows XP Services Pack 3 RC 2 and try to install to my computer, all running smooth. After complete the installation it will require to reboot the system, and then I just follow the instruction to reboot it. After reboot and after the windows loading page it show out “Please wait …” 1 minute later the system keep on restart and restart, I had try the following solution but fail.

Failure Solution:-

1) Reboot to Safe Mode.

2) Press F8 and the run Windows on Last Known Good Configuration.

3) Run chkdsk /r command.

I start to worry about it because worse come to worse I have to reformat my system. But luckily my colleague found a solution and this time it’s the real solution to solve it. The solution as below:

Success Solution: -

1) Insert Windows XP CD and the boot from the CD.

2) After Windows Setup loading press “R” to enter the Recovery Console.

3) When you enter the recovery console it will ask you to select the keyboard mapping, just select US and then press enter.

4) After that it will need to select which drive your need to enter, if you just have 1 HDD just press 1 and then press enter for entering.

5) In this moment it will ask you for your system administrator login password, you will have 3 chances to enter.

6) After enter the password u will see a command prompt c:\windows> then type cd servicepackfiles and then enter.

7) When you see c:\windows\servicepackfiles> type cd i386 then press enter.

8) When you see c:\windows\servicepackfiles\i386> type copy gdi32.dll c:\windows\system32\ and the press enter.

9) After press enter is will prompt out and question to ask you want to overwrite the following file or not, just press Y to allow it overwrite the file.

10) After copy completed just restart you system with normal mode. System will reload your desktop and some software but don’t worry all your files and software still there. After the loading done then your windows is fine.

Remark: We always recommend user to backup their system before run some system update, because some update will make you suffer.

Recommend to have a GHOST !!!

Disable Outlook Express Compact Count.

2008-04-22T13:39:00.000+08:00

OE has a long and troubled history with compacting folders. In the most current version, OE compacts all folders automatically after you open and close the program 100 times. Compacting folders is absolutely essential for maintaining your files in good working order. Therefore,

Do not interrupt the process once it has begun.
It is best not to use your computer at all until the process is complete, which can take a few minutes.
Under no circumstances must you ever use Task Manager to kill the msimn.exe process, or put your computer on Standby, or turn off the power, or use a memory-intensive program while compaction is occurring. Any of those can cause destruction of your files and the loss of your messages.

If you don't like waiting for that 100th closing, you can compact all folders manually at any time. For best results always use this procedure:

On the File menu, click Work Offline so that no new messages will be arriving.
In the Folder list, click on Outlook Express so that no e-mail or news folder is open.
Close the Folder list by clicking the X in the upper right-hand corner of the list panel. Alternatively you can click Layout on the View menu, and then clear the checkbox for "Folder List".
On the File menu, point to Folder, and then click Compact All Folders. Do not use your computer until the process is complete, which might take several minutes.
If an error occurs, close Outlook Express, re-open it, and begin the process again from the top. If the same error occurs again, close Outlook Express, restart your computer (or log off and then log on again), open Outlook Express and then begin the whole process again.

Unfortunately that does not reset the internal counter to zero, so OE will still compact after the 100th closing. You can edit the registry manually to reset the counter, or you can use OE Tool to compact all folders and reset the counter at the same time. To reset it manually:

Close Outlook Express and all message windows.
Click Start, click Run and type without quotes "regedit".
Navigate to this key

HKEY_CURRENT_USER\Identities\{GUID}\Software\Microsoft\Outlook Express\5.0

where GUID is the long number used for your Identity.
In the right-hand pane, double-click "Compact Check Count", then change the value to zero.

Virus W32.Fujacks.L Remove Solution

2008-04-22T12:58:00.005+08:00

SUMMARY:

Discovered: January 8, 2007

Updated: February 13, 2007 1:03:14 PM

Also Known As: W32/Fujet-A [Sophos]

Type: Worm

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

W32.Fujacks.L is a worm that spreads by copying itself to network shares protected by weak passwords. It also copies itself to the root drive of all partitions and ends some security-related processes and services.

Protection

· Initial Rapid Release version January 9, 2007

· Latest Rapid Release version March 25, 2008 revision 018

· Initial Daily Certified version January 9, 2007

· Latest Daily Certified version March 25, 2008 revision 022

· Initial Weekly Certified release date January 10, 2007

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

· Wild Level: Low

· Number of Infections: 0 - 49

· Number of Sites: 0 - 2

· Geographical Distribution: Low

· Threat Containment: Easy

· Removal: Moderate

Damage

· Damage Level: Medium

Distribution

· Distribution Level: High

Writeup By: Liam O Murchu

TECHNICAL DETAIL:

Discovered: January 8, 2007

Updated: February 13, 2007 1:03:14 PM

Also Known As: W32/Fujet-A [Sophos]

Type: Worm

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When W32.Fujacks.L is executed, it performs the following actions:

Copies itself as the following files:

[DRIVE LETTER]\setup.exe
[NETWORK DRIVE LETTER]\GameSetup.exe
%System%\spoclsv.exe

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Creates the following file to execute [DRIVE LETTER]\setup.exe:

[DRIVE LETTER]\autorun.inf
Adds the value:

"svcshare"="spoclsv.exe"

to the registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

so that it runs every time Windows starts.
May delete entries that contain the following strings:

"kav"
"KAVPersonal50"
"KvMonXP"
"McAfeeUpdaterUI"
"Network Associates Error Reporting Service"
"RavTask"
"ShStatEXE"
"yassistse"
"YLive.exe"

from the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
May modify files ending with the following extensions:

.asp
.html
.htm

Uses a series of net share commands to close any local shared folders found.
May delete files with the following extensions from the root folder of local partitions, except the C drive:

.gho
.exe
.scr
.pif
.com

Uses the following password list in attempt to copy itself to available network shares:

000000
007
110
111
1111
111111
11111111
121212
123
123123
1234
12345
123456
1234567
12345678
123456789
1234qwer
123abc
123asd
123qwe
1313
2002
2003
2112
2600
5150
520
5201314
54321
654321
6969
7777
88888888
901100
Administrator
Guest
Login
Root
aaa
abc
abc123
abcd
admin
admin
admin$
admin123
administrator
alpha
asdf
baseball
ccc
computer
database
enable
fish
foobar
god
godblessyou
golf
harley
home
ihavenopass
letmein
login
love
mustang
mypass
mypass123
mypc
mypc123
owner
pass
passwd
password
pat
patrick
pussy
pw123
pwd
qq520
qwer
qwerty
root
secret
server
sex
shadow
super
sybase
temp
temp123
test
test123
win
xxx
yxcv
zxcv

Ends all processes in windows that contain the following strings in the title:

esteem procs
IceSword
iDuba
msctls_statusbar32
pjf(ustc)
QQAV
QQKav
Symantec AntiVirus
VirusScan
Winsock Expert
Wrapped gift Killer

Ends the following processes:

CCenter.exe
FrogAgent.exe
KRegEx.exe
KVCenter.kxp
KvMonXP.kxp
KVSrvXP.exe
KVXP.kxp
Logo1_.exe
Logo_1.exe
Mcshield.exe
naPrdMgr.exe
Rav.exe
Ravmon.exe
RavmonD.exe
Ravmond.exe
RavStub.exe
RavTask.exe
Rundl123.exe
scan32.exe
TBMon.exe
TrojDie.kxp
UIHost.exe
UpdaterUI.exe
VsTskMgr.exe

May end the following services, some of which may be security-related:

AVP
ccEvtMgr
ccProxy
ccSetMgr
FireSvc
kavsvc
KPfwSvc
KVSrvXP
KVWSC
McAfeeFramework
McShield
McTaskManager
MskService
navapsvc
NPFMntor
RsCCenter
RsRavMon
Schedule
sharedaccess
SNDSrvc
SPBBCSvc
Symantec Core LC
wscsvc

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

SOLUTION 01:

Discovered: January 8, 2007

Updated: February 13, 2007 1:03:14 PM

Also Known As: W32/Fujet-A [Sophos]

Type: Worm

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan.
Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, reenable System Restore by following the instructions in the aforementioned documents.

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article: Antivirus Tools Cannot Clean Infected Files in the _Restore Folder (Article ID: Q263455).

2. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

Running LiveUpdate, which is the easiest way to obtain virus definitions:

If you use Norton AntiVirus 2006, Symantec AntiVirus Corporate Edition 10.0, or newer products, LiveUpdate definitions are updated daily. These products include newer technology.
If you use Norton AntiVirus 2005, Symantec AntiVirus Corporate Edition 9.0, or earlier products, LiveUpdate definitions are updated weekly. The exception is major outbreaks, when definitions are updated more often.

Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted daily. You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to Virus Definitions (Intelligent Updater).

The latest Intelligent Updater virus definitions can be obtained here: Intelligent Updater virus definitions. For detailed instructions read the document: How to update virus definition files using the Intelligent Updater.

3. To run a full system scan

Start your Symantec antivirus program and make sure that it is configured to scan all the files.

For Norton AntiVirus consumer products: Read the document: How to configure Norton AntiVirus to scan all files.
For Symantec AntiVirus Enterprise products: Read the document: How to verify that a Symantec Corporate antivirus product is set to scan all files.

Run a full system scan.
If any files are detected, follow the instructions displayed by your antivirus program.

Important: If you are unable to start your Symantec antivirus product or the product reports that it cannot delete a detected file, you may need to stop the risk from running in order to remove it. To do this, run the scan in Safe mode. For instructions, read the document, How to start the computer in Safe Mode. Once you have restarted in Safe mode, run the scan again.

After the files are deleted, restart the computer in Normal mode and proceed with the next section.

Warning messages may be displayed when the computer is restarted, since the threat may not be fully removed at this point. You can ignore these messages and click OK. These messages will not appear when the computer is restarted after the removal instructions have been fully completed. The messages displayed may be similar to the following:

Title: [FILE PATH]
Message body: Windows cannot find [FILE NAME]. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

4. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.

Click Start > Run.
Type regedit
Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.
Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:

"svcshare"="spoclsv.exe"

Exit the Registry Editor.

SOLUTION 02:

If the solution above also cant clean the virus, I recommend that use some third-party registry cleaner to clean your windows registry first, after cleaned / repaired your windows registry then clean up all the recycle bin , ie history, cache, cookies, and all junks. After that run a full virus scan again in safe mode, if you have spyware you can run it after your virus scanning complete.

Recommend tools: Registry Cleaner: - RegClean2007 and above version (License)
Junks Cleaning : - iSysCleaner (Free)
Antivirus : - Avira antivirus (Free)
- Symantec Antivirus (License)
- Microsoft ForeFront AntiVirus (License)
Spyware : - SuperAntiSpyWare (License)
- SpyHunter (License)

Case 03.0: Chinese PRC Simplified MsPinYin98 keyboard layout unable to load.

2008-04-01T18:44:00.005+08:00

Why I cant install Chinese PRC Simplified with MS PinYin98 on my Windows 2000 machines.

It might cause by lose some component files so we suggest installing a new component for MS-PinYin98, the component you can download it from the following link: -

Download: - MsPinYin98 Ver3.0

Case 02.0: SQL2005 Express – mscorlib.tlb could not be load.

2008-04-01T18:40:00.005+08:00

When you install Microsoft SQL Server 2005, you receive the following error message:

The file C:\Windows\Microsoft.NET\Framework\Meaningless_string\mscorlib.tlb could not be loaded. An attempt to repair this condition failed because the file could not be found. Please reinstall this program.

Note Meaningless_string is a placeholder for the meaningless characters that appear in the error message. These characters resemble the version number of the Microsoft .NET Framework, such as v1.0.3705, v1.1.4870, or v2.0.50727.

After you install SQL Server 2005, you may receive an error message that resembles this error message every time that you start Microsoft SQL Server Management Studio.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To work around this problem, you must manually specify the correct path of the Mscorlib.tlb file in the registry. To do this, follow these steps:

Click Start, click Run, type regedit, and then click OK.

Locate the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\90\Tools\Shell\TlbAutoRepair\mscorlib.tlb

Notes

•

If you install SQL Server 2005 on 64-bit operating systems, locate the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft SQL Server\90\Tools\Shell\TlbAutoRepair\mscorlib.tlb

•

If you install SQL Server 2005 Express Edition with Advanced Services, locate the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\90\Tools\ShellSEM\TlbAutoRepair\mscorlib.tlb

In the right pane, double-click the registry entry TlbPath. The Edit String dialog box appears.

In the Value data box, replace %CLRVERSION% with the following value:

v2.0.50727

Note The value v2.0.50727 indicates the version of the .NET Framework that the original release version of SQL Server 2005 uses.

Click OK, and then exit Registry Editor.

Important If you install a SQL Server 2005 service pack or hotfix, the service pack or hotfix will change the value that you replace in step 4 back to %CLRVERSION%. If the problem that is described in this article still exists after you install the service pack or the hotfix, you must following these steps again to work around this problem.

Case 01.0: Windows Error - Low on Registry Space

2008-04-01T18:29:00.007+08:00

We have several PCs within our organization which are coming up with Low on Registry space. When i check the amount been used, is less than the limit. Is there something which would cause this?
If not does anyone know how to turn the message off?

Increase the registry space and see if the message goes away. The overall space used by this feature is so small; you can double it without problem. Good luck.

Can you tell me how can we increase the registry space?

To change the maximum size of the computer’s registry:

1. Open "System" in the Control Panel.
2. On the Advanced tab, click Performance Options, and under Virtual memory, click Change.
3. Under Registry size, type a new "registry" size in megabytes in the Maximum registry size (MB) box.

To open a Control Panel item, click Start, point to Settings, Click Control Panel, and then double-click the appropriate icon.

Setting a maximum size for the registry sets an upper limit on how large the area designated for registry data can become. You might need to increase the maximum registry size if the amount of registry data produced by programs exceeds the limit you set under Registry size.

Coffee Break

小猪建议: To prevent the same error prompt out again, kindly recommend use 3^rd party software to housekeeping your computer registry.

Example: RegClean 2007