Many of you should be familiar with Windows Task Manager. Since Windows 98, the combination of Control+Alt+Delete key is the probably only thing to do when a program hung. You are presented with a “Close Program” window to terminate the application that is not responding or you can just hit the same combination again to soft reboot the computer. In NT based Windows, pressing the hotkey would directly invoke the Task Manager. The Task Manager is a program used to provide information about the processes and programs running on a computer, as well as the general status of the computer. It can also be used to terminate processes and programs, as well as change the processes’ priority.

As useful as it is, there’s a very weird feature built-in to the Windows Task Manager and it makes some users thinks that their Task Manager has an error or corrupted. The normal Windows Task Manager comes with a few tabs such as Applications, Processes, Performance, Networking, Users and it also has a menu bar such as File menu, Options ,View, Windows Shut Down and Help. If you’re not careful, you could end up with a Task Manager WITHOUT the tabs and menu bar.

So far I’ve seen this question being asked 3 times in forum by LunarWolf, yexist and gwa-53 reporting the same problem and I thought I should write an article to inform everyone that the Task Manager is not corrupted or caused by virus when you see such behavior.


Normally when you press the Alt key it should highlight/select the File menu which shows the menu bar. An example is the latest Windows Live Messenger 2009 which by default the menu bar is not shown and you can make the menu bar appear by pressing the Alt key. However, this won’t work in Windows Task Manager when the menu bar and tabs are missing.

To fix this problem, all you need to do is to double click at the edge of the Task Manager and the menubar with tabs will re-appear.

Yeap this is a really weird feature of the Task manager and I bet many users don’t even know about this. Not sure why Microsoft implemented this because I could never find a chance or any reason to use the compact version of Task Manager.

Many years ago I was in the e-book business and the usual problem that I went through during that time was copyright. Being in ebusiness is not easy because I had to deal with strict checkings to prevent against credit card chargebacks or fraud and also piracy. The most I can do to prevent credit card fraud is to make sure their IP address matches the country of the credit card and also they are not using a proxy.

As for piracy, I found one of the best PDF encryption from FileOpen and I was able to restrict the buyer to only open the PDF from a particular computer. The encryption is very good and so far uncrackable but there is weakness in the system. I found out that it identifies the computer by using the hard disk Volume Serial Number. A hard disk volume serial number randomly generates every time you format the hard drive, hence the chances of getting the exact same one very low. So whenever my customer reformat his hard drive to reinstall Windows, or changed a new hard drive, I’ll have to generate a new key for them.

If you do a simple search in Google, you’ll find tons of information to change your hard disk volume serial number, BUT not the real hard disk serial number that is hardcoded to the hardware. Some people said that it is impossible to change it but I will show you how easy it is to change BOTH volume and hardcoded serial number for hard disk.


To find your current hard disk volume serial number, open command prompt and type dir. The second line shows your volume serial number for that partition.

There is a free tool called Hard Disk Serial Number Changer which I think is misleading because it can ONLY change the volume ID but not the hardcoded serial number.

One of my all time favorite tool to change a hard disk volume serial number is VolumeID by Windows Sysinternals. It is a very small command line tool which is very straight forward. The command line to change a drive letter is as follow:

volumeid [driveletter:] xxxx-xxxx

You should shut down all your running applications before using this tool and if you’re changing a volume ID on a NTFS partition, a restart will be required for the changes to take effect. If you’re not familiar with command line, then go ahead and try Hard Disk Serial Number Changer which has a graphical user interface.

Now for the fun part, changing a hardcoded serial number in hard disk. It’s not easy finding a tool to do that but it actually exist. Some multiplayer games that implements punkbuster gets cheaters off the server using hardware bans. It used to ban the hard disk serial number but no longer does that since there are ways to spoof and change the so-called hardcoded serial number. So now they’ve started to ban the CD-Key.

There is a tool called PB DownForce which is able to temporarily spoof your hardcoded serial number in hard disk to a random or even your predefined serials.

The animation image below shows before and after using PB DownForce to change my hard disk serial number.

Do take note that the change is temporary and will reset back to original after restarting your computer. Some antivirus will flag PB DownForce as a threat and this is normal since it hooks low-level (ring0) Windows functions, so that the end result (in ring3) is different.

I believe many of us have Windows Live Hotmail, Yahoo, Gmail and other email accounts. I have all 3 (Hotmail, Yahoo, Gmail) and I never use all of them. I just have it because I want all my login name to be the same. My uncle also has 3 webmails and 1 POP3 streamyx email. He finds it very troublesome to check all of his webmail because he had to manually key in the web address, his username and password every time he wants to check them. After done checking his webmail, he will need to check his pop3 streamyx email using Microsoft Outlook.

So he asked me is there any solution to automatically check all his emails from one location? 2 years ago, I wrote about ePrompter, which is able to check multiple webmails including hotmail, yahoo, gmail and pop3 but ePrompter doesn’t have email sending capability. So it’s not a good solution for my uncle.

After a little searching and testing, I’ve found a free email client that is able to send and receive emails from Hotmail, Yahoo, Gmail and POP3. This is extremely useful for those who has multiple email accounts.


Well, what I found is not really a fully featured email client. It’s more like an email notifier called POP Peeper.

POP Peeper runs in your Windows task bar and alerts you when you have new email on your POP3, IMAP (with IDLE support), Hotmail\MSN\LiveMail, Yahoo, Mail.com, MyWay, Excite, Lycos.com, RediffMail, Juno and NetZero accounts. IMAP supports allows you to access AOL, AIM, Netscape and other services. So don’t compare POP Peeper with email clients like Microsoft Outlook.

What I like about POP Peeper is it can send mail directly from POP Peeper and use the address book to email your frequently used contacts. Many multiple email checker can’t do that…. POP Peeper allows you to view messages using HTML or you can choose to safely view all messages in rich or plain text. Several options are available that will decrease or eliminate the risks of reading your email (viruses, javascript, webbugs, etc). POP Peeper can be run from a portable device and can be password protected. Many notification options are available to indicate when new mail has arrived, such as sound alerts (configurable for each account), flashing scroll lock, skinnable popup notifier, customized screensaver and more.

There are new features such as Junk Filters, Auto Complete and a lot more in development. Give POP Peeper some time and I am sure it can turn into a more powerful email notifier.

The con about using email clients to support web based email is you have to depend a lot on the software’s update. If slight changes being made on webmail server, it’s going to give you problems. So when you encounter problems, make sure you visit POP Peeper known issues page first.

[ Download POP Peeper ]

I’ve just been called in today by one of my client because he complained that the computer sometime hangs when he opens up any folder or application. I tried duplicating the problem and I did saw how it happened. The computer doesn’t hang completely. The desktop shortcuts work as I am still able to launch programs from the shortcuts. It’s only the taskbar, start button and explorer that freezes. If I wait for few minutes(sometimes can be up to 10 minutes) for the folder/application to run, I would then be able to access the taskbar and start button.

I launched Task Manager to see which program might be causing the full load of the CPU and resulting it to hang but nothing. Everything was normal as the System Idle Process is at 80-90%. It’s easy if Task Manager shows a process is taking up all the CPU usage as I can just kill the process and it’d go back to normal. It’s quite hard to troubleshoot what’s causing this weird behavior because it’s intermittent. Sometimes opening My Documents folder would hang and sometimes don’t. There’s no 100% way to duplicate this problem.

After much searching for an answer and hours of troubleshooting, I think I might have found the answer to this problem.


Here are a list of suggestions I found that “could” solve the problem. Some might work for you and some don’t because it depends on which services or programs that causing the taskbar and explorer to hang problem. Only try the suggestions below if there are no 100% CPU usage on your Task Manager when the taskbar freezes.

1. Disable “Automatically search for network folders and printers”
– Go to Control Panel and run Folder Options. Click the View tab and uncheck “Automatically search for network folders and printers”

2. Delete any unused network Printers.
– Go to Control Panel and run Printers and Faxes. Delete any unused network Printers by using your mouse to right click and select Delete.

3. Delete automatically found network shared folders.
– Go to My Network Places and delete the found shared folders.

4. Delete mapped drives.
– Go to My Computer and delete any mapped drives.

5. Hide icons for networked UPnP devices.
– Go to My Network Places and on the left pane, click “HIDE icons for network UPnP devices“. If it says “SHOW icons for networked UPnP devices”, then it’s currently hidden. You can skip this suggested step.

6. Disable “Background Intelligent Transfer Service“.
– Go to Start -> Run and type msconfig. Click on Services tab and uncheck Background Intelligent Transfer Service to disable it.

7. Disable “SSDP Discovery Service“.
– Go to Start -> Run and type msconfig. Click on Services tab and uncheck Background Intelligent Transfer Service to disable it.

If all the 7 suggestions above still doesn’t solve your problem, use Task Manager to “End Process” any third party programs that’s running. I’ve tried all 7 steps above and none worked for me. But when I terminated a process called “Watch3.exe”, immediately the taskbar and explorer starts to respond.

You can also try disabling Startup items from “msconfig” and see which is the culprit that is causing this problem.

As you can see, there are no one solution to fix this problem as all computers are different. Different in the sense of having different software installed and configured differently. That’s why some method will work for you and some don’t.

Two of the best ways to login to Windows if you’ve forgotten the password is by reseting the password or replacing sfcfiles.dll with a cracked one to allow login with any password. However, a lot of anti-virus detects the cracked sfcfiles.dll as a hacktool and it prevents the DLL file from loading making it unusable.

The best and highly successful way to login to Windows if you’ve forgotten the password is by resetting the password. All you need to do is put in a BootCD, boot up with it and follow the simple instructions to reset any user’s password. No bruteforce cracking, modifying of cracked DLL files….

Today I found a software that’s better and more powerful than Windows Key included in Passware Kit Enterprise.


Active@ Password Changer is designed for resetting local administrator and user passwords on Windows XP / VISTA / 2003 / 2000 / NT systems in case an Administrator’s password is forgotten or lost. You do not need to re-install and re-configure the operating system.

Forgotten password recovery software has a simple user interface, supports multiple hard disk drives, detects several SAM databases (if multiple OS were installed on one volume) and provides the opportunity to pick the right SAM before starting the password recovery process. It displays a list of all local users. The software user simply chooses the local user from the list to reset the password.

This is the part which makes Active@ Password Changer better than Windows Key. Other Windows login security restrictions like ‘Account is disabled‘, ‘Password never expires‘, ‘Account is locked out‘, ‘User Must Change Password at Next Logon‘ and ‘Logon Hours‘ can be changed or reset.

You’ll be surprised that this feature is included in the DOS version!

Windows Key only works in DOS but Active@ Password Changer has program for Windows and DOS. Surprisingly, Active@ Password Changer only cost USD59.99 while Windows Key cost US195.00 for the Professional version and USD295.00 for the enterprise version. Obviously you’ll purchase Active@ Password Changer if given a choice as it’s cheaper and better.

Free Demo version allows you to detect the correct Windows SAM database, view the user list and specific user attributes. Professional version allows the user to actually reset passwords and attributes.

P/S: The retail version of Active@ Password Changer Pro v3.5 build 0067 has already been leaked out. But very sorry, I am unable to provide the links. Please do NOT ask or request for it here. Use your friendly Google 😉

[ Download Active@ Password Changer Demo ]

Windows power meter doesn’t provide so much details about your laptop battery. If you are not charging it, you will see a battery on your traybar. Double clicking it will bring up Power Meter and will display the current power source, total battery power remaining and total time remaining.

To see detailed information about the battery such as name, unique ID, power state, chemistry, and manufacturer of the battery, you can click on the battery in Power Meter.

I found a FREE software that provides much more information about your notebook battery.


Notebook BatteryInfo is able to display the internal values of the Notebook battery. It is easy to find out the battery wear or the maximum usable capacity of the battery. It can even provide a more thorough battery information compared to Windows Power Meter.

I prefer Notebook BatteryInfo over the default Windows Battery Meter because the symbol in the traybar shows only the rough estimate of the remaining battery capacity. If more exact information are needed the mouse must hovered over the battery symbol to show a tooltip with the exact remaining capacity. As for Notebook BatteryInfo, the current battery values will always be displayed on the taskbar, making it much easier for you to know the exact remaining capacity.

[ Download Notebook BatteryInfo ]

There are times when Windows or a software doesn’t allow us to click a button. It could be a shareware that only after registering the button would be enabled or a feature that doesn’t make any sense if it was enabled. For example, if you run Windows Task Manager, go to the Users tab and click on the user that you are currently logged on as, the Send Message button is disabled. This sending message feature is useful if there are a few users logged on and you can send a message to another user but there is no logic in sending the message to yourself. That explains why the Send Message is disabled for currently logged on user.

Jack ONeill, the owner of EvilFingers has created a simple free tool called Enabler that can enable any disabled or grayed out buttons in Windows. There is no requirement or need for privilege escalation because this will enable any button on the user’s windows and there is no requirement to be a root or super user for enabling the buttons.


Here is a simple proof of concept on how Enabler works. Right click on Windows Taskbar and select Task Manager. Click on the Users tab and then select the current logged on user. The disconnect and Logoff button is enabled but the Send Message button is not accessible. Keep Windows Task Manager open and do not close it.

Now run Enabler and click the Enable button.

Click OK when you get a confirmation window saying that it’s Done.

Go to the Windows Task Manager again and you should see that the Send Message button can be used. Try clicking the Send Message button, type any message and click OK. A new message window should appear with the message that you’ve written.

It is important to make sure that the user is in focus/selected after enabling the button. Once you click on other areas and then you go back to the user again, the button will be disabled and you have to use Enabler to bring it back. If Enabler doesn’t work for you, then perhaps you can try DM2 or TurnItOn.

[ Download Enabler ]

After many many months of beta testing Service Pack 3, the official stable Windows XP SP3 is finally here! Many tech websites announced the release of Windows XP Service Pack 3 to manufacturers (RTM) yesterday. I never post about beta updates or patches on operating systems because I wouldn’t advice you to install something that is not stable for your system. This time I am confident that the final version of Windows XP Service Pack 3 is here, and I am sharing this news with you.

Although the XP SP3 final version has been released to manufacturers, we, the end users can only download via Windows Update and the Microsoft Download Center on 29th April. If you can’t wait until the 29th of April, here’s how to be one of the first end users to install and use the final stable version of XP SP3.


A very well known and reputable cracking group Zero Waiting Time (ZWT) managed to obtain the XP SP3 RTM and released it to the “scene” with the name MICROSOFT.WINDOWS.XP.SERVICE.PACK.3.v5.1.2600.5512.RTM.ENGLISH-WZT
. The XP SP3 RTM final version first surfaced at ThePirateBay about 12 hours ago and was uploaded by a person named bgreen.

Here are some information on the Windows XP Service Pack 3 setup file:

Filename: WindowsXP-KB936929-SP3-x86-ENU.exe

Language: English Only

Size: 331,805,736 bytes in 1 file

SFV: C411A9DA

MD5: BB25707C919DD835A9D9706B5725AF58

SHA1: C81472F7EEEA2ECA421E116CD4C03E2300EBFDE4

After spending about 30 minutes to install XP Service Pack 3, I didn’t notice anything new after logging in except that it asked me whether to turn on the Automatic Updates. Well, Microsoft did state that SP3 is mostly a security, performance and stability update. So don’t expect any funky features in this release.

Some people accuse team ZWT of releasing keygenerators and cracks with trojans but they do not do that. These groups have reputations which they are not going to tarnish it by embedding some lame trojans in their releases. Usually those files are tampered by other people who.

I am sorry because I cannot provide the download link to Windows XP Service Pack 3 RTM final because Microsoft will definitely shut down this website. You can do a simple search on some of the “important” keywords that I’ve mentioned in this article. It is already available at torrent and rapidshare. Remember to check the HASH so you won’t download a modified one. Here’s how to check the HASH if you don’t know how. Download VisualHash, extract and run VisualHash.exe. Make sure you’re at the Hash Files tab, right click, select Add File… and locate WindowsXP-KB936929-SP3-x86-ENU.exe. Click the Compute Hashes button and wait for a few seconds. Refer the MD5 and SHA-1 values with the above. If it matches, then the file hasn’t been tampered.

Good luck and enjoy the new Windows XP Service Pack 3!

Hopefully I don’t bore you too much with Windows Live Messenger 2011 tips but I just recently discovered this. Whenever I finished installing Windows Live Messenger, the first thing I would do is to remove the advertisement that is embedded to the interface. Microsoft founder Bill Gates is consistently ranked among the world’s wealthiest people and removing an ad or two from WLM won’t hurt their wallet at all. Anyway, one of a very good tool that I recommend to remove ads from Windows Live Messenger 2011 is A-Patch. A-Patch has been around since MSN Messenger 6 and kept up to date until today. What I like about A-Patch is its free, portable (don’t require installation), clean (no installation of toolbar or any spyware), easy to use and it works.

There are two Remove Advertisement checkboxes on A-Patch and the difference is the first one removes the advertisement banner from the bottom of the contact list, and the second one is to remove the text advertisement from the bottom of your message window. Everything should look much cleaner after removing the ads from Windows Live Messenger 2011 but I noticed that the chat / conversation window still has a small advertisement at the bottom.

A-Patch doesn’t seem to remove that advertisement and every time I had to click on the X button to close the ad. Fortunately it is possible to hide the ad at the Windows Live Messenger 2011 chat window from the Options.


From Windows Live Messenger 2011, press Alt+T which will show the Tools menubar. Select Options. Click on Messages at the left navigation bar, uncheck “Show expanded footer in conversation windows” and click the OK button.

You will notice that the ads are no longer shown at the bottom of the conversation window. Now Windows Live Messenger 2011 is perfectly clean without advertisement even while chatting. Took me a while to discover what is that “expanded footer” option for because the description is not very clear and doesn’t say anything about advertisement.

Michael Y from forum has reminded me about booting computer using USB flash drive. I’ve heard about that long ago and I know it’s possible but then I’ve never tried it myself. That’s because so far I’ve been fixing computers that has a working CD/DVD-Rom. Even IF there is a non functional CD/DVD-ROM, I can dismantle a working CD/DVD-ROM from another computer. However, I figured that it’s good to learn and know how to make your USB flash drive bootable. You can boot up Hiren’s BootCD from USB flash drive, install Windows using USB flash drive and even resetting Windows account password using Windows Key. See how useful it is to know how to make your USB flash drive bootable?

We all know that we can use floppy drive and CD/DVD to boot up your computer. There are also ISO files that contains boot image that when you burn it with Nero, the media disc will be bootable.

Here are some question that I ask myself before starting to do research on how to make a USB flash drive bootable.
1. Is it possible to copy floppy boot image to USB flash drive?
2. Is it possible to copy CD/DVD boot image to USB flash drive?
3. Is it possible to extract boot image from ISO files and write it to USB flash drive?
4. How to configure BIOS to boot with USB flash drive?
5. Can all USB flash drive be made bootable?

I am glad to have found all the answers to the question above.


1. Is it possible to copy floppy boot image to USB flash drive?
It is possible possible to copy floppy boot image to a USB flash drive by using BootDisk2BootStick. Just select the source (floppy) and destination (USB flash drive) and click the Start button.

2. Is it possible to copy CD/DVD boot image to USB flash drive?
It is possible but not with BootDisk2BootStick because it doesn’t support CD/DVD. You need to extract the boot image from the CD/DVD first, and then write the boot image that you’ve extracted to the USB flash drive.

– Extract boot image from CD/DVD using BBIE by Bart Lagerweij
Command to extract CD/DVD boot image using BBIE is “bbie D:” without the quotes and assuming D: is your CD/DVD drive.

[ Download BBIE ]

– Write the extracted boot image from CD/DVD to USB flash drive using MKBT by Bart Lagerweij
Command to write boot image file to USB flash drive is “MKBT -x image1.bin e:” without the quotes. image1.bin is the filename of the boot image and e: is the drive letter of your USB flash drive.

[ Download MKBT ]

3. Is it possible to extract boot image from ISO files and write it to USB flash drive?
Yes it is possible. The steps to extract boot image from ISO file is very similar to the answer on question number 2.
Use BBIE to extract boot image from ISO with the command “bbie filename.iso“. Then write the boot image to USB flash drive using MKBT with the command “mkbt -x image1.bin e:”

4. How to configure BIOS to boot with USB flash drive?
Different BIOS has different way to setting your USB flash drive as a boot device. If your system can’t support it, try checking for BIOS update. Also, not all computers can get in to BIOS by pressing the “Del” key. Some are F2 and some are F10. If you’re unsure, it will be displayed on the screen during the initial boot of a computer. If it’s too fast, you can hit the Pause/Break key.

For computer that uses AMI BIOS.
Option 1;
Go to “Feature Setup” and enable these options: “USB Function Support”, “USB Function For DOS” and “ThumbDrive for DOS”.
Go to “Advanced Setup” and set the “1st Boot Device” to “USB RMD-FDD”.
Reboot the PC and it now should boot from the USB flash drive.

Option 2;
Go to “USB Mass Storage Device Configuration”, select “Emulation Type” and set it to “Harddisk”.
Go to the “Boot Menu” and set the “1st boot device” to “USB-Stick”.
No you can exit the BIOS, saving the changes. If this does not seem to work, then you can try (it sometimes seems to work) setting the “Emulation Type” value to “Floppy” or “Forced FDD”.

For computer that uses PHOENIX/AWARD BIOS.
Go to “Advanced BIOS Features”, then to the “1st Boot device” and set it to “USB-ZIP”.

Some newer motherboard supports Boot Order by pressing the F8 (keys might vary). I have a MSI 945P Platinum board and it is using Phoenix BIOS, Revision 6. At first I wasn’t able to boot up my USB flash drive but later I found out that I need to go to the Boot Order screen and select “Hard Disk” and hit enter. It will then give me a list of Hard Drives. My Kingston USB flash drive is listed as USB-HDD0.

For computer that uses Generic BIOS.
If your BIOS is not in the list above, or the settings do not seem to work with your PC, then you can try this:
– Go into the BIOS
– Go to the page that determines the boot order (usually called “Advanced Setup”, “Boot options”, or “Feature Setup”)
– Try all USB drive variants. Start with “USB ZIP”, then “USB FDD”, “USB HDD “, etc.

5. Can all USB flash drive be made bootable?
I don’t have a 100% sure answer for this question but I’ve tested it on 3 different types of USB flash drives and all can be made bootable. The brands are Kingston, PenDrive and Corsair. In my opinion, you should be more concern about whether your motherboard supports booting from USB flash drive rather than having a USB flash drive that can boot.

You can test your USB flash drive whether it is bootable or not by using a memory testing tool called USBTest created by PenDriveLinux. Just download, extract the files to your USB flash drive and run makeboot.bat. Configure your BIOS to boot up with the USB flash drive. If you see a white background with a USB connector picture and some text that says “The installed program can be used to check your system memory for problems…”, that means your USB flash drive is bootable and your system is capable of booting from a USB flash drive.

This concludes my research on making USB flash drive bootable. Michael Y’s question was he wanted to reset Windows password using DreamPack_PL but his CD/DVD drive is not working. I’ve tried to extract DreamPack_PL boot image and write it to my USB flash drive but it couldn’t be booted up while I have no problems with other ISO. There might be something wrong or different with DreamPack_PL’s boot image that is causing BBIE not to extract the boot image properly. A better tool to reset Windows user account password is Windows Key. You can also load additional drivers to unlock SCSI/RAID/SATA hard drive which DreamPack_PL can’t do.

Windows Key Enterprise cost US$295 and I wonder who actually buys them? But Team ARN has already released a retail version and serial number (LostPassword.Passware.Kit.Enterprise.v8.1.2670.Retail-ARN) for Passware Kit which contains Windows Key Enterprise.

I’ve got a comment from a user asking me how to remove Brontok virus. Brontok virus is from Indonesia and I’ve seen this virus infected on a computer before and it prevents you from running Registry Editor. Most obvious way to know that you’ve been infected by Brontok virus is when your computer starts up, you’ll get an error messsage saying that it is unable to locate the file “Kesenjangan Sosial.exe“.

Here’s how to remove Brontok virus.


Found a lot of free removal tools you can use to easily remove Brontok virus.
1. CompactbyteAV

2. GData Anti…Worm

3. Sophos BRONTGUI

4. Kaspersky Brontok Removal Tool

5. BitDefender Brontok Removal Tool

6. Brontok Washer(Most Effective against Brontok Virus)

7. OgAV

Choose to run either one to clean Brontok virus from your system. If you have the time, you can run all of them but not at the same time. Do it one by one just to be 100% sure that Brontok virus is completely removed.

September 19, 2007 Update: Brontok Washer link has been updated. It is one of the most effective Brontok virus cleaner. However, Symantec will flag Brontok Washer as “brontok virus” itself. There is also one Brontok virus variant that will automatically stop Brontok Washer from being run in Windows normal mode. Make sure you run Brontok Washer in Windows Safe Mode.

There are a lot of things in life that we know for a fact are going to happen. We’re going to live, we’re going to die, and we’re going to be taxed. Anything between all this is uncertain. However, if you use a computer, one thing is for sure, that if you prod the dark side of the web, it will infect you. And that’s where today’s post comes in, as there is a new email worm circulating the Internet right now. And when I say new, I mean somewhere in August is when it first started and it just recently broke into the news. This worm is very simple to notice, and is named ‘Here You Are’, after the subject line in the email. Effectively, the way it tricks you to infect you, is to appear to link to a PDF, but in reality, is a executable file. Once infected, the worm then sends itself on via contacts found in your email contact lists.

And the worst part is, despite how simple it is and how simple it is to avoid, it is marked as rather active for a worm. Especially seeing as most geeks should be able to avoid it with ease. Yesterday, a person using an Iraq Resistance revealed himself as the creator of the worm, which has keylogging software as well as a backdoor in it as well.

So now that you know about it, no doubt you’d like to know how to remove it. Especially seeing as I know a friend’s desktop got infected with the worm and has been mass spamming me since then. I’d just like to issue a major thank you to Ant, one of our forum members for showing the manual way to remove it, no doubt there will be some scanners that will remove it automatically soon. What you have to do is kill the following processes if running, then delete them:

%windows%\system\updates.exe
%windows%\csrss.exe
%windows%\ff.exe
%windows%\gc.exe
%windows%\hst.iq
%windows%\ie.exe
%windows%\im.exe
%windows%\op.exe
%windows%\pspv.exe
%windows%\rd.exe
%windows%\re.exe
%windows%\re.iq
%windows%\tryme1.exe
%windows%\vb.vbs
%system%\SendEmail.dll

then manually delete the following registry keys:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options0hoeav.com
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsw.com
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6.bat
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6fnlpetp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6×8be16.cmd
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BIOSREad.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BdSurvey.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CaVCmd.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CavaUd.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cavapp.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2cmd.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2free.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2upd.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aNtIaRP.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aNtS.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aPVxdWIN.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aVCONSOL.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aVENGINE.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aVP32.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aVPCC.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aVPM.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\abk.bat
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adobe Gamma Loader.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\algsrvs.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\algssl.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\angry.bat
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antihost.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apu-0607g.xml
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apu.stt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arSwp.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashEnhcd.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashPopWz.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashQuick.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashdisp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswBoot.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRegSvr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoRun.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoRunKiller.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.bin
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.ini
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.reg
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.txt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.wsh
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorunsc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avMonitor.ExE
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastSS.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgamsvr.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgas.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avginet.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscan.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgupsvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avltd.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avzkrnl.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bad1.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bad2.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bad3.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsubwiz.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackd.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caiss.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caissdt.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\catcache.dat
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cauninst.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavasm.ExE

And restore the following registry keys back to their defaults, which are included below.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
EnableLUA=dword:00000000 to EnableLUA=dword:00000001
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell= Explorer.exe %windows%\csrss.exe to Shell=Explorer.exe

Overall, it is a lot of manual work, and if I can find the spare time and right documentation, I’ll certainly make a batch file to automatically delete and restore these files to what they should be. If anyone would like to have a shot at it, go right ahead, and I’ll post it up here, giving you full credit in making it.

ComputerActive has given away the commercial version of Webroot Spy Sweeper 5.5, a full anti-spyware utility worth £30 last year from 27th December 2007 to 17th January 2008. I did not post about this because you can find this news on nearly every blog site. I didn’t want to bore you with what you might have just read on other sites. Perhaps that is what makes Raymond.CC special eh? 😉

Although the offer went on for 3 weeks, there are some people that didn’t manage to get the free commercial license for the latest version of Webroot Spy Sweeper. The original offer link page http://www.webroot.com/activate has expired and no longer available. So here’s a second round of free subscription offer for FREE Webroot Spy Sweeper 5.5. Get it quick before this offer expires again!


Spy Sweeper detects and removes spyware on personal computers that run Microsoft Windows. It scans a computer for spyware by examining files on the computer’s hard disk drive, as well as objects in memory, the Windows registry and cookies, and quarantines any suspicious objects it finds. Spy Sweeper runs continuously while the computer is in operation, monitoring to warn the user of programs being set to start automatically, suspicious programs running and to block cookies.

Webroot Spy Sweeper key features:

Most comprehensive antispyware solution available – 360 degrees of protection

Continuous monitoring stops spyware before it can attack

Advanced detection and removal capabilities for stubborn spyware

Automatic defense updates keep you protected from the latest threats

FREE customer support

The steps to get your free Webroot Spy Sweeper 5.5 license is exactly the same as the first round.

1. Go to this URL http://www.webroot.com/start, enter your email and click Register button.

2. Check the email address that you’ve entered at step 1. Open the email from Webroot Sales (noreply@webroot.com) with the subject “Your Download Instructions for Invoice F0000XXXXXXXX”. Note down the personalized license code.

3. Download latest Spyware Sweeper sspsetup1_1.exe and install.

4. During installation, you’ll be prompted to enter the keycode. Simply copy and paste the code into the box.

Spyware Sweeper is nearly as good as Ad-Aware but not as popular because it doesn’t offer free version of its software. It is also lighter in resource usage when compared to Ad-Aware 2008. This free license is only valid for 6 months but not 1 year like the previous offer. I think there’s a reason why they are only providing free license up to this year. Here are some information I managed to gather.

August 2006 = version 5.0.7
October 2006 = version 5.2
June 2007 = version 5.5

Looking at the cycle of Spyware Sweeper versions above, I have a feeling that a newer version of Spy Sweeper is going to be released sometime around end of the year or early next year. Perhaps that is the reason why they don’t mind giving out free licenses for Spy Sweeper v5.5 the second time but with the condition that it will only last until end of 2008. Enjoy.