 |
Best Tips
| Computer Science and Engineering Discuss, Best Tips at Programmers Lounge forum; HOW TO DELETE STUBBORN FILES?
First, a brief explanation on why this happens. This is usually because an active process ... |
| Notices | Welcome to the Gamerz Needs forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact contact us. |  | 
01-30-2006, 03:54 PM
|  | X-Staff | | | Last Online: Yesterday 06:58 PM Join Date: Nov 2005 Location: USA , NY
Posts: 299
Thanks: 6
Thanked 124 Times in 62 Posts
Nominated 0 Times in 0 Posts TOTW/F/M Award(s): 0
Latest Blog:
Rep Power: 7 Points: 4,144.48 Bank: 0.00 Total Points: 4,144.48 | | | Best Tips HOW TO DELETE STUBBORN FILES? First, a brief explanation on why this happens. This is usually because an active process has an open handle to the file which prevents it from being deleted. Normally if you close down all running programs you'll find that most files will then be free to delete, but that's not always the case, and in some cases it may even be a trojan that's preventing itself from being deleted. BASIC REGISTRY RULE: Any changes made to the registry file are crucial to the running of Windows and if damaged or misconfigured, could cause severe problems.
Follow Microsfot's recommended instructions to "BackUP" all important data first. It's recommended to save the backup on a CD, DVD or seperate HD due to the size factor (large) Code: http://search.Mcft.com/search/results.aspx?st=b&na=88&View=en-us&qu=backup
This option is not installed in Windows XP Home Edition. To install you will need the XP Home CDRom. Navigate to %CDROM%\VALUEADD\MSFT\NTBACKUP\. Look for Ntbackup.msi and double-click it to execute the install wizard.- MoveFileEx - A Windows function that moves an existing file or directory
- WARNING: editing the registry can be dangerous if you don't know what you're doing, make sure to USE YOUR HEAD, if you removed something you didn't want to, don't worry, just use the back up in this program
- The MOVEFILE_DELAY_UNTIL_REBOOT option places an entry under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Session Manager\PendingFileRenameOperations and the file is moved or deleted (if destination NULL) when the system next reboots. Unfortunately as this is not supported under Windows95/98 an application must use entries in WININIT.ini to achieve the same effect.
- BOOL MoveFileEx (LPCTSTR pExistingFilePath, LPCTSTR pNewFilePath, DWORD dwFlags)
- TRUE if function succeeded
pExistingFilePath.......Source path to an existing file pNewFilePath............New location for the file dwFlags....................Optoions controlling the move - Move or rename a file
Move or rename a file to a new location.
Only meaningfully implemented on NT. Windows95 returns ERROR_CALL_NOT_IMPLEMENTED, use MoveFile instead.
The source and destination path should be on the same drive as the system can then just change folder entries without actually copying the file contents. If MOVEFILE_COPY_ALLOWED is supplied and the system needs to copy the file it will require the additional disk space for the temporary file, in this case the original file is deleted only after the copy is successful.
- The flags allow more control over the move, it can be zero or a combination of the following values :
MOVEFILE_REPLACE_EXISTING.......The destination can be overwritten if it exists MOVEFILE_COPY_ALLOWED.............Allow a copy if destination on a different drive to the source MOVEFILE_DELAY_UNTIL_REBOOT...The move takes place on reboot (NT only) MOVEFILE_WRITE_THROUGH...........Do not return until changes flushed to disk (NT only) OR - Using Windows InProcServer32 process
- WARNING: editing the registry can be dangerous if you don't know what you're doing, make sure to USE YOUR HEAD, if you removed something you didn't want to, don't worry, just use the back up in this program
- Open notepad, copy and paste the code below. Then save the file as "avifix.inf" without the quotes
; Windows XP explorer movie fix.
;
; WARNING - Use this file at your own risk.
;
; Executing this file will remove a registry key which makes explorer load shmedia.dll.
; Simply put, this removes the annoying "permission denied" errors when trying to
; move/copy/delete AVI files.
;
; To use this fix, right-click on the file and select install. Done.
;
; Information about the registry key from multiple sources.
; Inf-file compiled by Moo (2002-03-22).
; Idea by Duxus. Thanks to the kind people of "[BBB] Sweden #01", you know who you are!
;
[version]
signature="$Windows NT$"
[DefaultInstall]
DelReg = Reduce.Reg
[Reduce.Reg]
HKLM, "SOFTWARE\Classes\CLSID\{87D62D94-71B3-4b9a-9489-5FE6850DC73E}\InProcServer32" - Right-click "avifix.inf" and select install
OR - Delete the file in DOS mode (99.99% success ratio)
- Download & install DOS Here (197kb) - "An Explorer Shell Extension to provide easy and quick access to the DOS Prompt in the requested folder"
Code: http://user.tninet.se/~fgo483j/files/ch20.zip
- Open Explorer and go to the directory where the stubborn file resides (DO NOT HIGHLIGHT THE FILE)
- Right Click and select "CMD here"
- Close all open applications
- Open the Task Manager and click on the Processes tab, select "explorer.exe" under Image Name, click "End Process"
- You will only have the command prompt and the task manager open
- In the Command Prompt, DEL the offending files (DEL *.mpg, DEL mus*.avi, DEL test.wmv, etc.)
- The files should now delete without a problem. Now go back to the task manager and click on the Applications tab. Click the "New Task..." button. in the dialog, type explorer.exe and click OK
OR - Delete the file association first
- WARNING: editing the registry can be dangerous if you don't know what you're doing, make sure to USE YOUR HEAD, if you removed something you didn't want to, don't worry, just use the back up in this program
- Start >Run >regedit {enter}
- Navigate to this key HKEY_CLASSES_ROOT\SystemFileAssociations\.avi\shel lex\PropertyHandler
- Delete the "Default" key
- Close regedit
- Follow the above test again, is a simple del doesn't work
AND - Delete the file in DOS mode
- Start >Run >cmd {enter}
- Navigate to the folder the file is in, i.e. if its in c:\folder\anotherfolder\file, type "cd c:\folder\anotherfolder" {enter} The coomand prompt should change to let you know you are in the correct directory.
- Type "dir /x" {enter}
- The offending file will be listed like (filena~1.xxx)
- Type attrib -r -s -a -h filename.extension {enter}
- Take note of the name and type "del filena~1.xxx" {enter}
OR - Try to take ownership of the file
- Right click the file
- Select the security Tab
- Select properties
- Select Advanced
- Select Owner
- Find the User or group you wish to give ownership to and select it
- Click apply
- now try deleting it.
OR - If the file is Media (MP3, MPG, AVI, etc...)
- Remember the filename (X) and location
- Run another file (Y) with the same extension
- now Delete the file (X)
This occurs sometimes when windows thinks that the file (X) ur trying to delete is still open, eventhough u closed the app and the file. OR - Try one of these small programs
- FreeFile - "FreeFile will free a file by finding the process that holds the lock, and allow you to terminate it"
Code: http://www.skrubbeltrang.com/Tools.aspx?Tool=FreeFile
- ZAP - "deletes files that are either in use or otherwise cannot be deleted" (works with XP & 2K)
Code: http://helpdesk.kixtart.org/Download/Utils/zap.exe
- DELLATER (3kb) - "DelLater is the ideal program to use when you can't delete a file, no matter how hard you try" - This tool does the same as above in Option 1
Code: http://www.diamondcs.com.au/downloads/dellater.zip
- DeepDelete (15kb) - "DeepDelete is a file shredder designed to totally delete files on your hard drive. It works by overwriting files many times before deleting them, making them almost impossible to recover. DeepDelete uses a standard of stredding that is more powerful than the official US DoD standards." - This tool is no longer updated/developed
Code: http://www.methlabs.org/deepdelete_r3.zip
- Unblocker (143kb) - "Unlocker is an explorer extension that allows you with a simple right-click of the mouse on a file or folder to get rid of error message such as error deleting file or folder, cannot delete folder: it is used by another person or program. Ever had such an annoying message given by Windows? Cannot delete file: Access is denied There has been a sharing violation. The source or destination file may be in use. The file is in use by another program or user. Make sure the disk is not full or write-protected and that the file is not currently in use. Unlocker is the solution." - Nifty and small tool
Code: http://ccollomb.free.fr/unlocker/#download
SOURCES FOR ALL THE POSTS HERE: MSDN, .NET, Mcft, OTHER (NOTED WHERE APPLIED) and my 25 years of PC experience of which 15 years is a mix of consulting, beta, programming, R&D and advising companies and the OSs creators. RESULTS WILL VARY
No matter how good your systems may be, they're only as effective as what you put into them. ALL CREDITS TO axiom007 | 
01-30-2006, 03:54 PM
|  | X-Staff | | | Last Online: Yesterday 06:58 PM Join Date: Nov 2005 Location: USA , NY
Posts: 299
Thanks: 6
Thanked 124 Times in 62 Posts
Nominated 0 Times in 0 Posts TOTW/F/M Award(s): 0
Latest Blog:
Rep Power: 7 Points: 4,144.48 Bank: 0.00 Total Points: 4,144.48 | | HOW TO ELIMINATE BIG PROBLEMS WITH SMALL PROGRAMS?- INTERNET RELATED
- AD-AWARE (1.7mb) - "Standard Edition is THE award winning, free, multicomponent detection and removal utility that consistently leads the industry in safety, user satisfaction, support and reliability"
Code: http://lavasoft.element5.com/support/download/
- AOL HIDER (475kb) - "Excellent program that simply hides AOL into the task window in the bottom `right` corner. Makes it look like you have a real internet connection! Compatable with all versions"
Code: http://www.simbak2k.net/exes/aolhider104.zip
- FPIPE - "FPipe is a source port forwarder/redirector. It can create a TCP or UDP stream with a source port of your choice. This is useful for getting past firewalls that allow traffic with source ports of say 23, to connect with internal servers"
Code: http://www.foundstone.com/resources/proddesc/fpipe.htm
- FPORT - "Reports all open TCP/IP and UDP ports and maps them to the owning application"
Code: http://www.foundstone.com/resources/termsofuse.htm?file=fport.zip
- MAGIC MAIL MONITOR (71kb) - Tiny POP3 compliant Mail Checker: the best choice for checking one or multiple account quickly, at periodic interval. Fully configurable, nice interface
Code: http://www.geeba.org/magic/
- MAILINATOR - "Have you ever needed an email .. NOW? Have you ever gone to a website that asks for your email for no reason (other than they are going to sell your email address to the highest bidder so you get spammed forever)?"
Code: http://www.mailinator.com/mailinator/Welcome.do
- NET LIMITER [614KB) - "NetLimiter is an ultimate internet traffic control tool" *****
Code: http://www.netlimiter.com/
- NESSUS - "A security scanner which will audit remotely a given network and determine whether bad guys (aka 'crackers') may break into it, or misuse it in some way." For Linux ONLY
Code: http://www.nessus.org/download.html
- NETSCAN PRO (925kb) - "NETSCAN PRO is the real advanced TCP/IP monitoring utility which allows you to monitor all network activity at your computer. NETSCAN PRO 3.3 has a graphical and text interface which makes the program unique in its kind! It's very easy to use! All you do is run the program and see all established connections and opened ports at your computer"
Code: http://www.7forces.com/files/ns3setup.exe
- NO ADS (215kb) - "Popup killing at its best! This nifty utility is great when surfing websites. If a popup appears, open the program that is in the task tray and double click it and its gone. It will then store it and kill it in the future too. It is the first one I've seen that supports AOL! Even works great with programs like KaZaA"
Code: http://www.simbak2k.net/exes/NASetup.exe
- Online JPEG compressor - "Can help you to make your pages load faster by reducing the size of your JPEG files. It will display multiple versions of a given image compressed at different levels for you to pick the smallest image at the best possible image quality you require"
Code: http://www.chami.com/jc/
- PCS NETWORK TOOLS (1150kb) - "The PCS Network Tools is a collection of essential network diagnostic tools. These tools include DNS resolution which provides the IP Address, Hostname, Hostname Alias, Mailhost, and Name Server Records for an entered host. In addition, the following tools are also included: IP Scanner, Traceroute, Ping, Whois, Finger, Time, Quote of the Day, and extensive Localhost information. Local information includes the hostname, alias, IP address, MAC address, username, Primary Domain Controller, NetBIOS, memory, windows version and build, and other vital information"
Code: http://www.learnxgroup.com/software/pcsnt.html
- PEER GUARDIAN - PeerGuardian 2 is Methlabs’ premier IP blocker for Windows. With features like support for multiple lists, a list editor, automatic updates, and blocking all of IPv4 (TCP, UDP, ICMP, etc), PeerGuardian 2 is the safest and easiest way to protect your privacy on P2P. Plus, by integrating with Blocklist.org, lists are built custom just for you. - Look for the Linux/OSX version on this site
Code: http://prdownloads.sour***orge.net/peerguardian/pg2-050423-x64.exe?download
- PING PLOTTER - "This exceptional GUI-based traceroute tool has features I’ve only seen in expensive industrial-strength tools, including dynamic tracking of changes in node response time — great for tracking a network outage across time. It’s also very fast!" - For NT/2K/XP ONLY
Code: http://www.pingplotter.com/downloads/pngplt_1.exe
- PROXIRAMA (154kb) - "A tool for finding and testing proxy servers. it will test them for anonymity, speed, if it's a gateway proxy, https support (=chainability) and geographical location. furthermore, it can be used as a local proxy server that redirects your traffic through a arbitrarily long chain of anonymous proxies. it is small, fast, and easy to use"
Code: http://gaamoa.securibox.net/ProxyramaSetup.exe
- SPYBOT - SEARCH & DESTORY (3.5mb) - "This free program can detect and remove spyware of different kinds from your computer. Spyware is a relatively new kind of threat that common anti-virus applications do not yet cover"
Code: http://www.safer-networking.org/index.php?lang=en&page=download
- OS RELATED
- FILE
- BCWIPE - "Is intended to give you a confidence that your deleted files cannot be recovered by an intruder" For Linux/FreeBSD/OpenBSD/Solaris/Digital UNIX/Irix/Windows
Code: http://www.jetico.com/download.htm
- BEST CRYPT - "A Data Encryption system provides the most comprehensive and easy-to-use secure data storage and access control facilities available" For Linux/FreeBSD/OpenBSD/Solaris/Digital UNIX/Irix/Windows
Code: http://www.jetico.com/download.htm
- CIA UNERASE - " Is the first product using the CIS technology to recover deleted files. Using CIS, CIA Unerase recovers almost any file you deleted even before you installed CIA Unerase and files where all other solutions on the market failed. CIA Unerase is the smallest, easiest and fastest Unerasing-tool we know"
Code: http://217.160.136.183/en/Download/down.php?login=1&loginemail=nikita69@mailinator.com&loginname=tina&status=aktiv&CIA_Unerase=1
- DARIK'S BOOT AND NUKE (1962kb) - "Darik's Boot and Nuke ("DBAN") is a self-contained boot floppy that securely wipes the hard disks of most computers. DBAN will automatically and completely delete the contents of any hard disk that it can detect, which makes it an appropriate utility for bulk or emergency data destruction." Available in floppy and CD version. This tool is very dangerous. After using the WinImage extractor to create the “nuke” boot floppy disk, you then reboot the target system with the disk in drive A. The main point of this program is to securely delete everything, so NEVER run it on a system that you intend to use again.
Code: http://dban.sour***orge.net/
- ERASER (2745kb) - "Eraser is an advanced security tool (for Windows), which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns. Works with Windows 95, 98, ME, NT, 2000, XP and DOS. Eraser is FREE software and its source code is released under GNU General Public License.
The patterns used for overwriting are based on Peter Gutmann's paper "Secure Deletion of Data from Magnetic and Solid-State Memory" and they are selected to effectively remove magnetic remnants from the hard drive.
Other methods include the one defined in the National Industrial Security Program Operating Manual of the US Department of Defence and overwriting with pseudorandom data. You can also define your own overwriting methods." The US Defence Security Service (DSS) is one of their clients. Code: http://prdownloads.sour***orge.net/eraser/Eraser57Setup.zip
- DELLATER (3kb) - "DelLater is the ideal program to use when you can't delete a file, no matter how hard you try"
Code: http://www.diamondcs.com.au/downloads/dellater.zip
- HIDE IT - Hide running applications
Code: http://www.annoyances.org/downloads/ftp/hideit.zip
- KILL - "Shuts down one or more running Windows NT tasks or processes" - For 2K/XP
Code: http://helpdesk.kixtart.org/Download/Utils/KILL.EXE
- KILL95 - Shuts down any processes running in memory
Code: http://helpdesk.kixtart.org/Download/Utils/kill95.zip
- ZAP - "deletes files that are either in use or otherwise cannot be deleted" - For 2K/XP *****
Code: http://helpdesk.kixtart.org/Download/Utils/zap.exe
- CONTROL/MONITOR
- CIS - "A free security scanner written and maintained by Cerberus Information Security, Ltd and is designed to help administrators locate and fix security holes in their computer systems. This tool is a must!" To see the checks it does, go http://www.cerberus-infosec.co.uk/vulndb.txt]HERE - For NT/2K
Code: http://www.cerberus-infosec.co.uk/CIS-5.0.02.zip
- COOL BEANS SYSTEM INFO (820kb) - "A small but powerful program that monitors your computer's CPU, physical memory, and swap memory usage"
Code: http://dl.winsite.com/files/180/ar1/winxp/sysutil/sysinf02.exe
- DEPENDENCY WALKER (406KB) - "A free utility that scans any 32-bit or 64-bit Windows module (exe, dll, ocx, sys, etc.) and builds a hierarchical tree diagram of all dependent modules." Can be helpful to identify missing files/dll after installtion of programs
Code: http://www.dependencywalker.com/depends21_x86.zip
- HHD SRVADMIN - "A very useful as a replacement to the ordinary NT service and device control panel applets, because it repeats and extends the functionality provided by them. Plus, it allows administrators to perform tasks, which usually not available to them without installing Windows NT Resource Kit." For NT/2K
Code: http://www.hhdsoftware.com/Download/srvadmfull.zip
- NTFS Reader for DOS - This is an absolutely essential recovery tool if you use NTFS partitions. Add this 147 KB executable file to your Win9x-based boot floppy and it will let you read any NTFS partition and copy off files to any FAT partition. (Don’t be thrown when the page says “Demo software.” It’s outright freeware.) - For NT/2K/XP ONLY
Code: http://www.ntfs.com/downloads/readntfs.zip
- NTSubst - "Extended version of the NT subst command. NtSubst allows you to assign the drive letter not only to any valid path, but also any valid NT Object Manager path." For NT/2000
Code: http://www.hhdsoftware.com/Download/ntsubst.exe
- POWER PROMPT - "will allow you to run programs as System"
Code: http://www.skrubbeltrang.com/Tools.aspx?Tool=PowerPrompt
- PROCESS EXPLORER (150kb) - "The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work"
Code: http://www.sysinternals.com/files/procexpnt.zip
- REVELATION - Discloses passwords that are only displayed as asterisks. I suppose, ultimately, this is a cracker’s tool; but there are practical, legitimate uses for it, so I decided to post the link. - For 9x/2K/XP. Please use it in good faith.
Code: http://www.snadboy.com/RevelationV2.zip
- RUN AS USER v4.1 - The function of this software is to allow Administrators to deploy applications that require elevated user rights to users who have restricted rights without having to issue Administrator Credentials to the user. It does this by passing a Run As User type command to the Operating System for the duration of the task at hand. It will only give the elevated rights to that specific task, so you can be safe knowing that the user will not have access to any restricted resources while the application is running. Other uses of this software include running games that require the administrator account to run. - For XP. Please use it in good faith.
Code: http://www.palmersoft.co.uk/software/runasusersetup.exe
- SHUTDOWN - Small commandline utility that makes it a breeze to log off, shutdown, restart, hibernate, or put in stand-by mode your Win XP computer. It’s the only utility I know that shuts down Win XP and then reliably powers off the computer. For XP ONLY.
Code: http://aumha.org/downloads/shutdown.zip
- STARTUP CPL - "A nifty control panel applet that allows you to easily configure which programs run when your computer starts."
Code: http://www.mlin.net/files/StartupCPL.zip
- STARTUP MONITOR - "A small utility that runs transparently (it doesn't even use a tray icon) and notifies you when any program registers itself to run at system startup. It prevents those utterly useless tray applications from registering themselves behind your back, and it acts as a security tool against trojans like BackOrifice or Netbus."
Code: http://www.mlin.net/files/StartupMonitor.zip
- STORM WINDOW - A great and FREE utility for Windows desktop security
Code: http://www.cetussoft.com/stormwin.htm
- INFORMATION
- ADVISOR - Displays all your PC info (hardware/software) on one page
Code: http://www.belarc.com/Programs/advisor.exe
- SKRUB THE WEB - "Search Mcft Knowledge Base, MSDN, Google and Google Groups in a single click"
Code: http://www.skrubbeltrang.com/Tools.aspx?Tool=SkrubTheWeb
- UTILITIES
- DOS HERE (197kb) - "An Explorer Shell Extension to provide easy and quick access to the DOS Prompt in the requested folder"
Code: http://user.tninet.se/~fgo483j/files/ch20.zip
- TWEAKS
- ANSWERS THAT WORK - "Through our support service we often come across problems caused primarily by programs running in the background, programs which in most cases start at the same time as Windows. Sometimes these programs are useful and need to be there; quite often, however, they are not needed, and in too many cases they cause severe problems." This is not a program, however it would be a great small utility if packaged.
Code: http://www.answersthatwork.com/
- ERUNT - "Finally, a tool to back up the Win XP Registry! (Mcft didn’t include one with Win XP itself.)" - For NT/2K/XP ONLY
Code: http://home.t-online.de/home/lars.hederer/erunt/erunt.zip
- NTRegOpt is included in the above file - This optimizes the Win NT/2K/XP Registry much as SCANREG /OPT does for Win98/ME.
- HIJACK THIS - "HijackThis examines certain key areas of the Registry and Hard Drive and lists their contents. These are areas which are used by both legitimate programmers and hijackers." - USE WITH CAUTION AND AT YOUR RISK
Code: http://www.tomcoyote.org/hjt/hijackthis.zip
- TWEAKUI - THE BEST OF ALL THE PowerToys! This should be standard on every (pre-XP) Windows computer whatsoever! Many new features added.
Code: http://download.Mcft.com/download/winme/Install/1.0/WinMe/EN-US/Tweakui.exe
RESULTS WILL VARY
No matter how good your systems may be, they're only as effective as what you put into them. | 
01-30-2006, 03:55 PM
|  | X-Staff | | | Last Online: Yesterday 06:58 PM Join Date: Nov 2005 Location: USA , NY
Posts: 299
Thanks: 6
Thanked 124 Times in 62 Posts
Nominated 0 Times in 0 Posts TOTW/F/M Award(s): 0
Latest Blog:
Rep Power: 7 Points: 4,144.48 Bank: 0.00 Total Points: 4,144.48 | | HOW TO BLOCK ADS AND MAINTAIN THE SUPERTRICK (hosts file - example 1) - Get the original FILE
- Get a list of updated Ad sites from ACCS-NET
Code: http://www.accs-net.com/hosts/get_hosts.html
SomeoneWhoCares Code: http://someonewhocares.org/hosts/
MVPS Code: http://www.mvps.org/winhelp2002/hosts.txt
Blood Image Code: http://www.bloodimage.com/hosts_bak
EveryThingIsnt Code: http://everythingisnt.com/Hosts
and if you want more then always Google here Code: http://www.google.com/search?hl=en&ie=ISO-8859-1&q=hosts+file
and here Code: http://www.google.com/search?hl=en&ie=ISO-8859-1&q=windows+hosts+file
- Update file either manually or use HOSTS Manager by simply adding the files from above.
Code: http://www.aldostools.com/hosts.html
While visiting the sites listed above, enhance your knowledge about HOSTS file and utilize it properly to improve the Ad Blocking on your PC. FINAL NOTE: If you open the hosts file (C:\WINDOWS\system32\drivers\etc) and see most if not all addresses have an IP addressess other than 127.0.0.1 or 0.0.0.0 then RUN windows update then an Anti-Virus program, then go back to my first point.
The Fortnight virus makes changes in your hosts file: C:\WINDOWS\system32\drivers\etc\hosts or C:\WINNT\system32\drivers\etc\hosts. The Windows hosts file serves to associate host names with IP addresses. The hosts file dropped by this virus contains of a list of URLs, each associated with a bogus IP address.
REFERENCE: Mcft Security Bulletin MS03-011 Code: http://www.Mcft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-011.asp
- A sample of an example INFECTED hosts file:
Code: # Copyright � 1993-1999 Mcft Corp.
#
# This is a sample HOSTS file used by Mcft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
66.159.20.80 moviesheaven.com
66.159.20.80 vidsvidsvids.com
66.159.20.80 my-teensex.com
66.159.20.80 nobull****movies.com
66.159.20.80 watch-xxx.com
66.159.20.80 wolrdteenparadise.com
66.159.20.80 www.google.com
66.159.20.80 worldsex-archives.com
66.159.20.80 ww2.link-o-rama.com
66.159.20.80 link-o-rama.com
How to Clean manually - simply remove anthing below "127.0.0.1 localhost" or some people have it "0.0.0.0 localhost":
# Copyright � 1993-1999 Mcft Corp.
#
# This is a sample HOSTS file used by Mcft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
- WINDOWS UPDATE NOTE: Akamai.net is used by Mcft to host the Windows Update features, known as the "AutoUpdate" and "v5.windowsupdate.Mcft.com [63.209.144.181]". In addition, Akamai.net also hosts others, such as ad/spware websites.
So if either feature of the Windows Update is not working and/or you get "Windows Update Failure - Error Code 0x800A138F". Then close ALL broswers' windows, open hosts file, press {CTRL+F}->look for this address "a248.e.akamai.net [63.251.152.201]", without the brackets, and delete it then save and exit. Now try https://a248.e.akamai.net/v4.windowsupdate.Mcft.com/getmanifest.asp again. If it works, then go to http://windowsupdate.Mcft.com and get your Updates. If it still does not work then your company or your ISP may be blocking this hostname. Or some anti-ad/spy programs may have this address blocked, such as SPYBLOCKER Code: http://spyblocker-software.com/IPB/index.php?showtopic=420&st=0&#entry1820
DO NOT DELETE ALL AKAMAI.NET SITES, OTHERWISE YOU WILL END UP WITH AD/SPY SITES POPING BACK.
Below is a small sample of hundreds of the Akamai.net servers that process ad/spy sites:- 0.0.0.0 a08.g.akamai.net
- 0.0.0.0 a1.g.akamai.net
- 0.0.0.0 a10.g.akamai.net
- 0.0.0.0 a100.g.akamai.net
- 0.0.0.0 a100.g.akamaitech.net
- 0.0.0.0 a1016.g.akamai.net
- 0.0.0.0 a1028.g.akamai.net
- 0.0.0.0 a1032.g.akamai.net
- 0.0.0.0 a104.g.akamai.net
- 0.0.0.0 a1040.g.akamai.net
- 0.0.0.0 a1061.g.akamai.net
- 0.0.0.0 a1066.g.akamai.net
- 0.0.0.0 a108.g.akamai.net
- 0.0.0.0 a11.g.akamai.net
- 0.0.0.0 a1100.g.akamai.net
- 0.0.0.0 a111.g.akamai.net
- 0.0.0.0 a1156.g.akamai.net
- 0.0.0.0 a1168.g.akamai.net
- 0.0.0.0 a117.g.akamaitech.net
- 0.0.0.0 a1172.g.akamaitech.net
- 0.0.0.0 a1180.g.akamai.net
- 0.0.0.0 a1196.g.akamai.net
- 0.0.0.0 a12.g.akamai.net
- 0.0.0.0 a12.g.akamaitech.net
- 0.0.0.0 a1208.g.akamai.net
- 0.0.0.0 a1224.g.akamaitech.net
- 0.0.0.0 a1228.g.akamai.net
- 0.0.0.0 a1234.g.akamai.net
- 0.0.0.0 a1240.g.akamaitech.net
- 0.0.0.0 a1252.g.akamai.net
- 0.0.0.0 a1261.g.akamai.net
- 0.0.0.0 a1284.g.akamai.net
- 0.0.0.0 a13.g.akamai.net
- 0.0.0.0 a1300.g.akamai.net
- 0.0.0.0 a1316.g.akamai.net
- 0.0.0.0 a1356.g.akamai.net
- 0.0.0.0 a1360.g.akamai.net
- 0.0.0.0 a1380.g.akamai.net
- 0.0.0.0 a14.g.akamai.net
Now continue to Example 2, below RESULTS WILL VARY
No matter how good your systems may be, they're only as effective as what you put into them. | 
01-30-2006, 03:55 PM
|  | X-Staff | | | Last Online: Yesterday 06:58 PM Join Date: Nov 2005 Location: USA , NY
Posts: 299
Thanks: 6
Thanked 124 Times in 62 Posts
Nominated 0 Times in 0 Posts TOTW/F/M Award(s): 0
Latest Blog:
Rep Power: 7 Points: 4,144.48 Bank: 0.00 Total Points: 4,144.48 | | |
I might add more >.<
Last edited by lllAE86lll; 01-30-2006 at 04:04 PM..
| 
01-30-2006, 04:59 PM
|  | Ultra Aqua dragon | | | Last Online: 10-01-2008 11:24 PM Join Date: Sep 2005 Age: 19
Posts: 1,704
Thanks: 21
Thanked 347 Times in 97 Posts
Nominated 0 Times in 0 Posts TOTW/F/M Award(s): 0
Latest Blog:
Rep Power: 0 Points: 467.30 Bank: 0.00 Total Points: 467.30 | | |
Please try not to double post, just edit your old one.
| 
01-30-2006, 05:03 PM
|  | Blue Dragon | | | Last Online: 11-07-2006 07:43 PM Join Date: Jan 2006
Posts: 854
Thanks: 14
Thanked 124 Times in 94 Posts
Nominated 0 Times in 0 Posts TOTW/F/M Award(s): 0
Latest Blog:
Rep Power: 8 Points: 803.74 Bank: 49,992.87 Total Points: 50,796.61 | | |
Isn't that like 4 post ???
But how'd you get all those ?!
Copy and Paste ... ???
I read a lil' of it and then my eyes started hurting >_< !
One,
Dust...
| 
01-30-2006, 06:01 PM
|  | X-Staff | | | Last Online: Yesterday 06:58 PM Join Date: Nov 2005 Location: USA , NY
Posts: 299
Thanks: 6
Thanked 124 Times in 62 Posts
Nominated 0 Times in 0 Posts TOTW/F/M Award(s): 0
Latest Blog:
Rep Power: 7 Points: 4,144.48 Bank: 0.00 Total Points: 4,144.48 | | |
Copy and psate credits given
|  | |
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | | | | Thread Tools | | | | Display Modes | Linear Mode |
Posting Rules
| You may not post new threads You may not post replies You may not post attachments You may not edit your posts HTML code is Off | | | | |