Steps to Remove Win32:Rootkit-gen[Rtk] Virus

Win32:Rootkit-gen[Rtk], another Virus, another addition in the list and another solution to remove it. Faced by some of our readers, this was an irritating problem that their PC was infected by this virus.

Symptoms of the problem:
•    Win32:Rootkit-gen[Rtk] virus infection notice.
•    Resides in ur0.com file which happens to be a virus itself.
•    Also resides in System Volume Information folder.
•    May also prevent double click opening of a drive.
Solution:
Steps to remove ur0.com virus
•    Run Task Manager, delete the ur0.com process, if any.
•    Run msconfig in the Run box and remove the virus file from startup list, if any.
•    Reboot into safe mode, search the ur0.com file, and remember to include hidden files option as well.
•    Permanently delete the files found.
Steps to remove Win32:Rootkit-gen[Rtk] Virus
•    The only reason why this virus infects the PC again is that, it has been saved in the System Restore files.
•    So turn off the System Restore now (Right click on My Computer-> Properties-> System Restore tab-> click on Turn off System Restore on all drives).
•    Reboot the PC to let the restore files to get deleted.
•    Now just turn on the system restore.
The virus has been removed!!

Steps to Remove csrcs.exe or csrsc.exe Virus

This was the error message faced by one of our readers that when he boots the PC up, the CSRCS.exe error message comes up on the screen.
csrsc.exe is a process which is registered as W32.Spybot.CF Virus. DO NOT confuse it with csrss.exe which is an important file used by Windows. The attackers of this virus can access our computer and gain access to some important data remotely.
Steps to remove this virus:
1.    Scan the system with a good and updated Anti Virus.
2.    Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.
3.    Now type msconfig in the Run box, and then go to startup tab.
4.    Locate this exe file, if any, and then remove it from there as well.
5.    Now search the file in the C: drive.
6.    Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
7.    Reboot the PC for changes to take place.
UPDATE
After doing the above steps, you need to clean the registry as well.

1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
2. On the right side, there is a key named “Shell”, it may be having a value “explorer.exe csrcs.exe”. Just modify it to delete the csrcs.exe from it (not explorer.exe). Restart the computer

The virus should have gone.

Solution to ‘You may be a victim of software counterfeiting’ Problem

Microsoft has started bugging the users of non genuine copies of Windows. If you are also running a non genuine or pirated copy of Windows then there is a full chance of you getting this notification one day or the other.

The problem was reported by one of our viewers that when she updated her copy of Windows with Windows Update then her system started showing this notification that reads “You may be a victim of software counterfeiting” and “This copy of windows does not pass genuine Windows validation”.

These notifications start coming back again after some time and do not feel good. Though I never encourage piracy but here is how you can remove this problem:
1.    Before doing anything serious try restoring your system. If the problem is occurring after the Windows Update then System Restore will surely help.
2.    But if it does not then do try this, launch Windows Task Manager.
3.    Locate the process “wgatray.exe” and end it.
4.    Log in into the Safe Mode and delete the file WgaTray.exe from c:\Windows\System32
5.    Also delete the WgaTray.exe from c:\Windows\System32\dllcache
6.    Type regedit in Run to open Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify key.
7.    Delete the folder WgaLogon and all of its contents.
8.    Restart the PC normally.
Update:
Download this WGA remover tool called RemoveWGA.exe, just download it and run.

XP REPAIR INSTALL

1. Boot the computer using the XP CD. You may need to change the
boot order in the system BIOS. Check your system documentation
for steps to access the BIOS and change the boot order.


2. When you see the "Welcome To Setup" screen, you will see the
options below This portion of the Setup program prepares Microsoft
Windows XP to run on your computer:

To setup Windows XP now, press ENTER.

To repair a Windows XP installation using Recovery Console, press R.

To quit Setup without installing Windows XP, press F3.




3. Press Enter to start the Windows Setup.

do not choose "To repair a Windows XP installation using the
Recovery Console, press R", (you do not want to load Recovery
Console). I repeat, do not choose "To repair a Windows XP
installation using the Recovery Console, press R".

4. Accept the License Agreement and Windows will search for existing
Windows installations.

5. Select the XP installation you want to repair from the list and
press R to start the repair. If Repair is not one of the options,
read this Warning!!

6. Setup will copy the necessary files to the hard drive and reboot.
Do not press any key to boot from CD when the message appears.
Setup will continue as if it were doing a clean install, but your
applications and settings will remain intact.

Blaster worm warning: Do not immediately activate over the internet
when asked, enable the XP firewall
[ http://support.microsoft.com/?kbid=283673 ]
before connecting to the internet. You can activate after the
firewall is enabled. Control Panel - Network Connections. Right click
the connection you use, Properties, and there is a check box on the
Advanced [ http://michaelstevenstech.com/xpfirewall1.jpg ] page.


7. Reapply updates or service packs applied since initial Windows XP
installation. Please note that a Repair Install from the Original
install XP CD will remove SP1/SP2 and service packs will need to be
reapplied.
Service Pack 2
http://www.microsoft.com/downloads/details.aspx?FamilyId=049C9DBE-3B8E-
4F30-8245-9E368D3CDB5A&displaylang=en
An option I highly recommend is creating a Slipstreamed XP CD with SP2.
Slipstreaming Windows XP with Service Pack 2 (SP2)
http://www.winsupersite.com/showcase/windowsxp_sp2_slipstream.asp

______________________________________________________________________

Warning!!
If the option to Repair Install is not available and you continue
with the install;you will delete your Windows folder and Documents
and Settings folder. All applications that place keys in the registry
will need to be re-installed. You should exit setup if the repair
option is not available and consider other options.

Try the link below if the repair option is not available.
Windows XP Crashed?
http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm
Here's Help.
A salvage mission into the depths of Windows XP, explained by a
non-geek

by Charlie White
http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

Related links
You May Lose Data or Program Settings After Reinstalling, Repairing,
or Upgrading Windows XP (Q312369)
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q312369

System Restore "Restore Points" Are Missing or Deleted (Q301224)
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q301224

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP
(Q315341)
http://support.microsoft.com/search/preview.aspx?scid=kb;en-us;Q315341

Warning!! If the Repair Option is not Available
What should I do? Most important do not ignore the information below!

If the option to Repair Install is NOT available and you continue
with the install; you will delete your Windows folder, Documents and
Settings folders. All Applications that place keys in the registry
will need to be re-installed.

You should exit setup if the repair option is not available and
consider other options. I have found if the Repair option is not
available, XP is usually not repairable and will require a Clean
install.http://michaelstevenstech.com/cleanxpinstall.html
If you still have the ability to access the Windows XP installation,
backup all important files not restorable from other sources before
attempting any recovery console trouble shooting attempts.

Possible Fix by reconfiguring boot.ini using Recovery Console.
1.Boot with XP CD or 6 floppy boot disk set.
2. Press R to load the Recovery Console.
3. Type bootcfg.
4. This should fix any boot.ini errors causing setup not to see the
XP OS install.
5. Try the repair install.

One more suggestion from MVP Alex Nichol

"Reboot, this time taking the immediate R option, and if the CD
letter is say K: give these commands

COPY K:\i386\ntldr C:\
COPY K:\i386\ntdetect.com C:\


(two other files needed - just in case)

1. Type: ATTRIB -H -R -S C:\boot.ini DEL C:\boot.ini

2. Type: BootCfg /Rebuild

which will get rid of any damaged boot.ini, search the disk for
systems and make a new one. This might even result in a damaged
windows reappearing; but gives another chance of getting at the
repair"

XP tweaks-2

-----------------------------------
General Performance Tweaks
-----------------------------------


IRQ Priority Tweak
******************
[HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Control \ PriorityControl]

You will need to create a new DWORD: IRQ#Priority (where # is the number of the IRQ you want to prioritize) and give it a setting of 1. This setting gives the requisite IRQ channel priority over the other IRQs on a software level. This can be extremely important for functions and hardware subsystems that need real-time access to other parts of the system. There are several different subsystems that might benefit from this tweak. Generally, I recommend giving either the System CMOS or the video card priority. The System CMOS generally has an IRQ setting of 8, and giving it priority enhances the I/O performance of the system. Giving priority to the video card can increase frame rates and make AGP more effective.

You can give several IRQs priority, but I am not entirely certain how the system interacts when several IRQs are given priority – it may cause random instabilities in the system, although it is more likely that there's a parsing system built into Windows XP to handle such an occurrence. Either way, I would not recommend it.

QoS tweak
*********
QoS (Quality of Service) is a networking subsystem which is supposed to insure that the network runs properly. The problem with the system is that it eats up 20% of the total bandwidth of any networking service on the computer (including your internet connection). If you are running XP Professional, you can disable the bandwidth quota reserved for the system using the Group Policy Editor [gpedit.msc].

You can run the group policy editor from the Run command line. To find the setting, expand "Local Computer Policy" and go to "Administrative Templates" under "Computer Configuration." Then find the "Network" branch and select "QoS Packet Scheduler." In the right hand box, double click on the "Limit Reservable Bandwidth." From within the Settings tab, enable the setting and then go into the "Bandwidth Limit %" and set it to 0%. The reason for this is that if you disable this setting, the computer defaults to 20%. This is true even when you aren't using QoS.

Free Idle Tasks Tweak
*********************

This tweak will free up processing time from any idle processes and allow it to be used by the foreground application. It is useful particularly if you are running a game or other 3D application. Create a new shortcut to "Rundll32.exe advapi32.dll,ProcessIdleTasks" and place it on your desktop. Double-click on it anytime you need all of your processing power, before opening the application.

Windows Indexing Services
Windows Indexing Services creates a searchable database that makes system searches for words and files progress much faster – however, it takes an enormous amount of hard drive space as well as a significant amount of extra CPU cycles to maintain the system. Most users will want to disable this service to release the resources for use by the system. To turn off indexing, open My Computer and right click on the drive on which you wish to disable the Indexing Service. Enter the drive's properties and under the general tab, untick the box for "Allow the Indexing Service to index this disk for fast file searching."

Priority Tweak
**************
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ PriorityControl]

This setting effectively runs each instance of an application in its own process for significantly faster application performance and greater stability. This is extremely useful for users with stability problems, as it can isolate specific instances of a program so as not to bring down the entire application. And, it is particularly useful for users of Internet Explorer, for if a rogue web page crashes your browser window, it does not bring the other browser windows down with it. It has a similar effect on any software package where multiple instances might be running at once, such as Microsoft Word. The only problem is that this takes up significantly more memory, because such instances of a program cannot share information that is in active memory (many DLLs and such will have to be loaded into memory multiple times). Because of this, it is not recommended for anyone with less than 512 MB of RAM, unless they are running beta software (or have some other reason for needing the added stability).

There are two parts to this tweak. First is to optimize XP's priority control for the processes. Browse to HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ PriorityControl and set the "Win32PrioritySeparation" DWORD to 38. Next, go into My Computer and under Tools, open the Folder Options menu. Select the View tab and check the "Launch folder windows in separate process" box. This setting actually forces each window into its own memory tread and gives it a separate process priority.

Powertweak application
**********************
xxx.powertweak.com

Powertweak is an application, which acts much like a driver for our chipsets. It optimizes the communication between the chipset and the CPU, and unlocks several "hidden" features of the chipset that can increase the speed of the system. Specifically, it tweaks the internal registers of the chipset and processor that the BIOS does not for better communication performance between subsystems. Supported CPUs and chipsets can see a significant increase in I/O bandwidth, increasing the speed of the entire system. Currently the application supports most popular CPUs and chipsets, although you will need to check the website for your specific processor/chipset combo – the programmer is working on integrating even more chipsets and CPUs into the software.

Offload Network Task Processing onto the Network Card
*****************************************************
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters]

Many newer network cards have the ability of taking some of the network processing load off of the processor and performing it right on the card (much like Hardware T&L on most new video cards). This can significantly lower the CPU processes needed to maintain a network connection, freeing up that processor time for other tasks. This does not work on all cards, and it can cause network connectivity problems on systems where the service is enabled but unsupported, so please check with your NIC manufacturer prior to enabling this tweak. Find the DWORD "DisableTaskOffload" and set the value to 0 (the default value is 1). If the key is not already available, create it.

Force XP to Unload DLLs
***********************
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer]
"AlwaysUnloadDLL"=dword:00000001

XP has a bad habit of keeping dynamic link libraries that are no longer in use resident in memory. Not only do the DLLs use up precious memory space, but they also tend to cause stability problems in some systems. To force XP to unload any DLLs in memory when the application that called them is no longer in memory, browse to HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer and find the DWORD "AlwaysUnloadDLL". You may need to create this key. Set the value to 1 to force the operating system to unload DLLs.

Give 16-bit apps their own separate processes
*********************************************
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ WOW]
"DefaultSeparateVDM"="Yes"

By default, Windows XP will only open one 16-bit process and cram all 16-bit apps running on the system at a given time into that process. This simulates how MS-DOS based systems viewed systems and is necessary for some older applications that run together and share resources. However, most 16-bit applications work perfectly well by themselves and would benefit from the added performance and stability of their own dedicated resources. To force Windows XP to give each 16-bit application it's own resources, browse to HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ WOW and find the String "DefaultSeparateVDM". If it is not there, you may need to create it. Set the value of this to Yes to give each 16-bit application its own process, and No to have the 16-bit application all run in the same memory space.

Disable User Tracking
*********************
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
"NoInstrumentation"=dword:00000001

The user tracking system built into Windows XP is useless to 99% of users (there are very few uses for the information collected other than for a very nosy system admin), and it uses up precious resources to boot, so it makes sense to disable this "feature" of Windows XP. To do so, browse to HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer and find the DWORD "NoInstrumentation". You may need to create this key if it is not there. The default setting is 0, but setting it to 1 will disable most of the user tracking features of the system.

Thumbnail Cache
***************
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced]
"DisableThumbnailCache"=dword:00000001

Windows XP has a neat feature for graphic and video files that creates a "thumbnail" of the image or first frame of the video and makes it into an oversized icon for the file. There are two ways that Explorer can do this, it can create them fresh each time you access the folder or it can load them from a thumbnail cache. The thumbnail caches on systems with a large number of image and video files can become staggeringly large. To disable the Thumbnail Cache, browse to HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced and find the DWORD "DisableThumbnailCache". You may need to create this key. A setting of 1 is recommended for systems where the number of graphic and video files is large, and a setting of 0 is recommended for systems not concerned about hard drive space, as loading the files from the cache is significantly quicker than creating them from scratch each time a folder is accessed.

XP tweaks-1

-----------
STARTUP
-----------


Windows Prefetcher
******************
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management \ PrefetchParameters]

Under this key there is a setting called EnablePrefetcher, the default setting of which is 3. Increasing this number to 5 gives the prefetcher system more system resources to prefetch application data for faster load times. Depending on the number of boot processes you run on your computer, you may get benefits from settings up to 9. However, I do not have any substantive research data on settings above 5 so I cannot verify the benefits of a higher setting. This setting also may effect the loading times of your most frequently launched applications. This setting will not take effect until after you reboot your system.


Master File Table Zone Reservation
**********************************
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem]

Under this key there is a setting called NtfsMftZoneReservation, the default setting of which is 1. The range of this value is from 1 to 4. The default setting reserves one-eighth of the volume for the MFT. A setting of 2 reserves one-quarter of the volume for the MFT. A setting of 3 for NtfsMftZoneReservation reserves three-eighths of the volume for the MFT and setting it to 4 reserves half of the volume for the MFT. Most users will never exceed one-quarter of the volume. I recommend a setting of 2 for most users. This allows for a "moderate number of files" commensurate with the number of small files included in most computer games and applications. Reboot after applying this tweak.


Optimize Boot Files
*******************
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Dfrg \ BootOptimizeFunction]

Under this key is a text value named Enable. A value of Y for this setting enables the boot files defragmenter. This setting defragments the boot files and may move the boot files to the beginning (fastest) part of the partition, but that last statement is unverified. Reboot after applying this tweak.

Optimizing Startup Programs [msconfig]
**************************************

MSConfig, similar to the application included in Win9x of the same name, allows the user to fine tune the applications that are launched at startup without forcing the user to delve deep into the registry. To disable some of the applications launched, load msconfig.exe from the run command line, and go to the Startup tab. From there, un-ticking the checkbox next to a startup item will stop it from launching. There are a few application that you will never want to disable (ctfmon comes to mind), but for the most part the best settings vary greatly from system to system.

As a good rule of thumb, though, it is unlikely that you will want to disable anything in the Windows directory (unless it's a third-party program that was incorrectly installed into the Windows directory), nor will you want to disable anything directly relating to your system hardware. The only exception to this is when you are dealing with software, which does not give you any added benefits (some OEM dealers load your system up with software you do not need). The nice part of msconfig is that it does not delete any of the settings, it simply disables them, and so you can go back and restart a startup application if you find that you need it. This optimization won't take effect until after a reboot.

Bootvis Application
*******************
The program was designed by Microsoft to enable Windows XP to cold boot in 30 seconds, return from hibernation in 20 seconds, and return from standby in 10 seconds. Bootvis has two extremely useful features. First, it can be used to optimize the boot process on your computer automatically. Second, it can be used to analyze the boot process for specific subsystems that are having difficulty loading. The first process specifically targets the prefetching subsystem, as well as the layout of boot files on the disk. When both of these systems are optimized, it can result in a significant reduction in the time it takes for the computer to boot.

Before attempting to use Bootvis to analyze or optimize the boot performance of your system, make sure that the task scheduler service has been enabled – the program requires the service to run properly. Also, close all open programs as well – using the software requires a reboot.

To use the software to optimize your system startup, first start with a full analysis of a fresh boot. Start Bootvis, go to the Tools menu, and select next boot. Set the Trace Repetition Settings to 2 repetitions, Start at 1, and Reboot automatically. Then set the trace into motion. The system will fully reboot twice, and then reopen bootvis and open the second trace file (should have _2 in the name). Analyze the graphs and make any changes that you think are necessary (this is a great tool for determining which startup programs you want to kill using msconfig). Once you have made your optimizations go to the Trace menu, and select the Optimize System item. This will cause the system to reboot and will then make some changes to the file structure on the hard drive (this includes a defragmentation of boot files and a shifting of their location to the fastest portion of the hard disk, as well as some other optimizations). After this is done, once again run a Trace analysis as above, except change the starting number to 3. Once the system has rebooted both times, compare the charts from the second trace to the charts for the fourth trace to show you the time improvement of the system's boot up.

The standard defragmenter included with Windows XP will not undo the boot optimizations performed by this application.

Passwords hacking.

There are many ways to search for vulnerable sites with google. I'll show you here how to get username and password from sites that use FrontPage extentions. Microsoft FrontPage Extensions creates a service.pwd file inside the _vti_pvt directory in the HTTP server's document root. This file contains user names and passwords that could be remotely retrieved by an attacker. The good news is that Google indexes this kind of files, so they are very easy to search for. The bad news is that the passwords are encrypted, but wait, this is not really a bad news :-) because you can crack them if you are patient and you have the will. If you want to become a hacker, you have to be patient and you have to have the will. Please note: I'm not telling you to hack sites, this stuff is just for learning. So if you want to do illegal things, you should know that jail is a possibility.

So lets go to the details:

1- Some administrators change the name of service.pwd file to authors.pwd or administrators.pwd or users.pwd or some thing else. So to get the biggest chance to retreive this file we will add an "inurl" condition to our search string in Google like this: inurl:(service | authors | administrators | users)

2- The file extension is "pwd" and we are not interested to get other extensions, so we will add an "ext" condition to the search string in Google like this: ext:pwd

3- The first line in the file service.pwd is "# -FrontPage-". So we will search for this string with Google

And here is the full search string:(you can click it to go to Google result page)
inurl:(service | authors | administrators | users) ext:pwd "# -FrontPage-"

In the Google result page click any link, you should see some thing like this:

# -FrontPage-

ekendall:bYld1Sr73NLKo

louisa:5zm94d7cdDFiQ

Here, there are 2 users with their encrypted passwords. The first user is ekendall, his encrypted password is bYld1Sr73NLKo and the second user is louisa, her encrypted password is 5zm94d7cdDFiQ.

After this u can decrypt the password by any password decryptor software.

Changing the Location of Special Folders

You can modify the registry to change the location of special folders like:

My Documents
Favorites
My Pictures
My Music
Personal,etc.

Start Regedit
Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Double click on any locations you want to change and alter the path
Logoff or restart for the changes to go into effect.

Hide Your Computer Drives.

In the Registry navigate to HKEY__USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer. Right-click on Explorer and choose New and DWORD value. In the pane on the right, rename the new value NoDrives and double-click on it to open the Edit DWORD Value box. Click the Decimal option to select it, instead of the Hexidecimal option.

Now for the complicated part. To hide a drive or drives, a number that corresponds to the drive(s) must be entered. Enter the value listed below for the drive. If multiple drives are to be hidden, add the numbers for those drives together. For example, hiding drives D and E requires a value of 24, because you are adding the value for D (8) to the value for E (16), which equals 24.


A: 1

B: 2

C: 4

D: 8

E: 16
F: 32

G: 64

H: 128

I: 256

J: 512
K: 1024

L: 2048

M: 4096

N: 8192

O: 16384
P: 32768

Q: 65536

R: 131072

S: 262144

T: 524288
U: 1048576

V: 2097152

W: 4194304

X: 8388608

Y: 16777216
Z: 33554432

All: 67108863

The boot disk, usually the C drive, tends to show up in Explorer even if you hide it in My Computer. To bring back hidden disks, just change the value of NoDrives to 0 or delete the value altogether.

Rename Multiple Files At Once

When you download photos from your digital camera, they often have unrecognizable names. You can rename several similar files at once with the following procedure. This also works for renaming other types of files.

1.Open the My Pictures folder. (Click Start, and then click My Pictures.) Or open another folder containing files that you want to rename.


2.Select the files you want to rename. If the files you want are not adjacent in the file list, press and hold CTRL, and then click each item to select it.


3.On the File menu, click Rename.

4.Type the new name, and then press ENTER
All of the files in the series will be named in sequence using the new name you type. For example, if you type Birthday, the first will be named Birthday and subsequent files in the series will be named Birthday (1), Birthday (2), and so on. To specify the starting number for the series, type the starting number in parentheses after the new file name. The files in the series will be numbered in sequence starting with the number you type. For example, if you type Birthday (10), the other files will be named Birthday (11), Birthday (12), and so on.

Cant open hidden files !!!

steps U have to follow :
1. START
2. RUN
3. REGEDIT
4. In registry editor press ctrl+F
.5. In FIND dialog box type "hidden" also check all the fields appear in FIND dialog box
6. press Enter key.
7. In right side U will find three colums named NAME , TYPE, DATA.
8. Double click on "hidden" & put value data =1 in Hexadecimal.
9. Go at the place where Ur files are hidden & refresh PC 2-3 times.
10.You are done .....

Hidden Programs In Windows Xp

Private Character EditorThis program is for designing icons and Characters(Alphapet)Click :start
Then :run
type :EUDCEDIT
.................................................. .................................................. .............................................
2- iExpressThis Program is for conerting your files to EXCUTABLE files
Click : start
Then : run
type : iexpress
.................................................. .................................................. .............................................
3-Disk Cleanup This program used for cleaning harddisk to offer space
Click : start
Then : run
type : cleanmgr
.................................................. .................................................. .............................................
4-Dr WatsonThis program Is for repairing problems in Windows
Click : start
Then : run
type : drwtsn32
.................................................. .................................................. .............................................
5-Windows Media Player 5.1Opens the old media player
Click : start
Then : run
type : mplay32

The Myth Of Refreshing The Desktop

"Do you refresh your desktop?". Ask this to any Windows user and 99% of them will reply with a "yes". Of course, there are various needs for refreshing the desktop but the majority of people who does it doesn't even know why he is doing it. Refreshing the desktop is perhaps the biggest computer myth among all Windows users.

Every single person I have met does this or at least used to do it. It's not known who first discovered this remarkably useless trick and what he achieved from it, but it just spread. Most new users learn this trick from other new users without caring to know what it does. Some do it devotedly just because others do it, while some others have various weird explanations for it. A few of them assumes that it refreshes the RAM, while some others believe that doing it will somehow keep their PCs running smooth and easy. I have seen some users obsessed with refreshing the desktop, doing it every 30 seconds or so. They have even learnt the keyboard shortcut - F5 (just to mention, these are the people who never use keyboard shortcuts). They would press the key and wouldn't release it for a long time, sending the desktop into a frenzy of refreshes.

What does a desktop refresh actually do? Refreshing the desktop simply redraws the icons on the desktop. That's it! It doesn't refreshes the RAM. It doesn't clean your PC. It doesn't refreshes your computer the way it does to you when you wake up from a nap. Refreshing the desktop has absolutely no effect on the working or performance of the computer. So why is the tool there? As I said, refresh is used to re-display or redraw the icons on the desktop. Sometimes when you bring some changes to the desktop icons, the change doesn't get reflected instantly. In such cases, refreshing the desktop becomes necessary to bring the change to effect. Say, you have the desktop icons set to arrange themselves alphabetically on your desktop. When you add a new item to the desktop, this item wouldn't get arranged alphabetically, instead it would appear at the bottom of icon list on the desktop, irrespective of it's name. Now if you refresh the desktop, all the icons would be once more arranged alphabetically and the newly added item would go to it's appropriate position. This is what refresh is for. It is to re-display the desktop. Refresh has the same function when done in explorer. Also Refresh is basically the command used to refresh/reload the video buffer(VGA memory). Sometimes the changes made in the VGA memory are not reflected to the screen properly...Refresh just corrects the prob...
So, if you are in the habit of refreshing the desktop, stop it. You are just wasting your time and effort. And the next time you see a person doing it, don't forget to explain to him the futility of this action

Few Registry Messup Tricks

DISABLING DRIVES IN MY COMPUTER
To turn off the display of local or networked drives when you click on My Computer:
1.Open RegEdit
2.Go toHKEY_CURRENT_USER\Software\ Microsoft\ Windows\ CurrentVersion\ Policies\ Explorer
3.Add a New DWORD item and name it NoDrives
4.Give it a value of 3FFFFFF
5.Now when you click on My Computer, none of your drives will show.
----------------------------------------

CHANGE THE LOCATION OF WINDOWS INSTALLATION FILES
If you need to change the drive and or path where Windows looks for its installation files:
1.Open RegEdit
2.Go toHKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Setup
3.Edit the value next to SourcePath
------------------------------------------

CHANGE THE CAPTION ON TITLE BAR
Change the Caption on the Title Bar for OutLook Express or the Internet Explorer:For Outlook Express:
1. Open RegEdit
2. Go toHKEY_CURRENT_USER\Software\Microsoft\OutLook ExpressFor IE5 and up use:HKEY_CURRENT_USER\IDENTITIES \{9DDDACCO-38F2-11D6-93CA-812B1F3493B}\ SOFTWARE\ MICROSOFT\ OUTLOOK EXPRESS\5.0
3. Add a string value "WindowTitle" (no space)
4. Modify the value to what ever you like.

For no splash screen, add a dword value "NoSplash" set to 1The Key {9DDDACCO-38F2-11D6-93CA-812B1F3493B} can be any key you find here. Each user has his own Key number.The Key 5.0 is whatever version of IE you have

For Internet Explorer:
1. Open RegEdit
2. Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
3. Add a string value "Window Title" (use a space)
4. Modify the value to what ever you like.
---------------------------------------------------

ADD/DELETE PROGRAMS TO RUN EVERY TIME WINDOWS STAR

You can start or stop programs from executing at boot up by adding or deleting them to/from the run Keys in the Registry. Windows loads programs to start in the following order; Program listed in the Local Machine hive, then the Current User hive, then theWin.ini Run= and Load = lines. then finally programs in your Start Up folder.

To add or remove programs in the Registry
1.Open RegEdit
2.Go to the desired KeyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \RunHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \RunServicesHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows \CurrentVersion \RunHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows \CurrentVersion \RunServices
3. Add a new String Value and name it anything you like
4. For the value data, enter the path and executable for the program you want to run.
By adding the value to the HKEY_CURRENT_USER hive instead allows the program to start only when that user is logged on.

If you add the value to the RunOnce key the program will run once and be removed from the key by Windows.

MULTIPLE COLUMNS FOR START MENU

To make Windows use multiple Start Menu Columns instead of a single scrolling column, like Windows 9x had, Also if you are using Classic Mode in XP

1. Open RegEdit
2. Go to the keyHKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ Advanced
3. Create a string value "StartMenuScrollPrograms"
4. Right click the new string value and select modify
5. Set the value to "FALSE"

DISABLING MY COMPUTER

In areas where you are trying to restrict what users can do on the computer, it might be beneficial to disable the ability to click on My Computer and have access to the drives, control panel etc.
To disable this:
1.Open RegEdit
2.Search for 20D04FE0-3AEA-1069-A2D8-08002B30309D
3.This should bring you to the HKEY_CLASSES_ROOT\CLSID section
4.Delete the entire section.

Now when you click on My Computer, nothing will happen.You might want to export this section to a Registry file before deleting it just in case you want to enable it again. Or you can rename it to 20D0HideMyComputer4FE0-3AEA-1069-A2D8-08002B30309D. You can also hide all the Desktop Icons, see Change/Add restrictions.

CREATING A LOGON BANNER

If you want to create a Logon Banner: A message box to appear below your logon on.

1.Open RegEdit
2.Go ToHKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Winlogon
3.Create a new String value"LegalNoticeCaption "
4. Enter the Title of the window. What is displayed in the Title Bar.
5. Create a new string value "LegalNoticeText"
6. Enter the text for your message box that will appear even before the Logon window.

ADDING EXPLORE FROM HERE TO ALL FILES

When you want to right click on any folder and want to open up an Explorer window of that folder.

1. Open RegEdit
2. Go to HKEY_CLASSES_ROOT\Folder\shell
3. Add a new Key "RootExplore " under the "Shell" Key
4. Set the (Default) value to "E&xplore From Here "
5. Right Click the "RootExplore " Key and add a new Key "Command"to the RootExplore
6. Set the (Default) value of Explorer.exe /e,/root,/idlist,%i

ADDING AN APPLICATION TO RIGHT CLICK

Here is how to add any application to the Context Menu when you right click on any Folder. This way you do not have to always go to the Start Menu. When you right click on any folder, you can have access to that application, the same as using Sent To.

1. Open RegEdit
2. Go to HKEY_CLASSES_ROOT\Folder\shell
3. Add a new Key to the "Shell" Key and name it anything you like.
4. Give it a default value that will appear when you right click a folder, i.e. NewKey (use an "&" without the quotes, in front of any character and it will allow you to use the keyboard)
5. Click on the Key HKEY_CLASSES_ROOT\Folder\shell\NewKey
6. Add a New Key named Command
7. Set the (Default) value of the application you want to run
8. For example: c:\program files\internet explorer\iexplore.exe (Include the full path and parameters if you need them)

CUSTOMIZE SYSTEM TRAY

You can add your name or anything you like that consists of 8 characters or less. This will replace the AM or PM next to the system time. But you can corrupt some trial licenses of software that you may have downloaded.

1. Open RegEdit
2. Go to HKEY_CURRENT_USER\Control Panel\International
3. Add two new String values, "s1159" and "s2359"
4. Right click the new value name and modify.
Enter anything you like up to 8 characters.

If you enter two different values when modifying, you can have the system tray display the two different values in the AM and PM.