Mel's Web Pages .................................................

Friday 20th April 2007

City goes Wireless

Also in this issue:

Your Windows/PC Quick Tips of the Week

Vista: Saving a web Image in Internet Explorer Produces Unexpected Results

Vista: Modifying the Method for Accessing Control Panel from the Start Menu

Incoming Security Alerts to Keep Your PC Healthy

W32.Rinbot.BC

W32.Yadurna.A

-------------------

If you have ever attempted using your laptop to connect to the Internet in a public place, then you will be familiar with the frustrating complexity of wireless hotspots. In an ideal world, seamless WiFi connectivity would be possible across the entire UK. Hotspots would either be free, or cost a few pence per minute and the process of getting online would be straightforward and simple. In reality, we are far from achieving this utopian vision. In some areas, community groups or businesses provide free access points that are open to the casual browser. This is the exception rather than the rule. Most wireless access is chargeable and the rates seem far from reasonable. For example, BT’s wireless service is called BT Openzone. It provides hotspots in public places across the UK (and has international partners too). Hotspots are usually identifiable by the distinctive BT Openzone sign. Users can also login to points managed by another provider called The Cloud.

So, what does it cost? If you are not a BT Broadband customer, or you are not interested in taking out yet another monthly commitment, then you can buy a one-off voucher (available online) for £6 inc. VAT. This gives you 60 non-consecutive minutes within 24-hours from your first login to a BT Openzone hotspot. This works out at 10p per minute…not cheap. If you subscribe to BT Broadband, BT Total Broadband, BT Yahoo! Broadband, BT Business Broadband, BT Mobile, BT Fusion or you have a BT wireless networking product, then you can sign up for an Openzone subscription for £5 ex. VAT per calendar month. This gives you 500 minutes (over 8 hours) and you can buy subsequent minutes for 10p ex. VAT. However, if you are not a BT Broadband customer, then 500 minutes will cost you £20 ex. VAT per calendar month. That assumes that BT allows you to purchase double their standard 250-minute Subscription (over 4 hours), which comes in at £10 ex. VAT per calendar month. It’s important to note that any minutes not used, as part of your monthly allowance, cannot be carried over into the following month.

Here’s a good tip if you are interested in changing your broadband provider: BT Total Broadband are currently offering 250 free OpenZone minutes per calendar month. This is included with BT Total Broadband Options 1, 2 and 3. You only get the 250 minutes for the minimum contract period. This is 12 or 18 months, depending on which you chose when you signed up for BT Total Broadband.

Meanwhile in the City of London, approximately 350,000 workers are about to get unlimited wireless access for £12 per calendar month. The system is provided by The Cloud. As I mentioned earlier, this company are a BT Openzone partner. The technology uses a ‘mesh’ structure to pass data from wireless point to point, within The Square Mile. Further expansion across the rest of the capital is planned.

If you want to find a BT Openzone hotspot near to you, try this: http://btopenzone.hotspot-directory.com/ ------------------- Vista: Saving a web Image in Internet Explorer Produces Unexpected Results

If you right-click an image in Internet Explorer and then click Save Picture as, you may experience an unwanted result where an open copy of the image appears to have embedded itself in your desktop, surrounded by a coloured border. You may even think that this is some new feature of Vista and attempt to drag and manipulate the image. In fact, all that has happened is that you have accidentally clicked Set as background, instead of Save Picture as. The picture is therefore likely to be in the folder: C:\Windows\Web\Wallpaper

To reset your desktop background in Windows Vista Home Premium/Vista Home Basic:

1. Right-click on the desktop and then click Personalize > Desktop Background.
2. Select an image from the Windows Wallpapers (these are the image files in the folder C:\\Windows\\Web\\Wallpaper), or click Browse to choose an image in another location.
3. Select the original background, or an image of your choice.
4. Click OK.

To access the image that you originally wanted to save, look for it in C:\\Windows\\Web\\Wallpaper. If you are still having difficulties, you may have to go back to the website and save it again (this time clicking Save Picture as!). ------------------- Vista: Modifying the Method for Accessing Control Panel from the Start Menu

Do you find it tiresome to wait for Control Panel to open in its own window? If so, you might like to try a customisation that allows you to access its items as a sub-menu.

Note: the following assumes that you are using the default Vista Start menu (where each sub-menu or search appears in the same screen space), as opposed to the Classic Windows Start menu (with submenus opening to the side, in a second column).

To modify Control Panel in Windows Vista Home Premium/Vista Home Basic:
1. Right-click on Start and then click Properties > Start menu.
2. With Start menu selected (rather than Classic Start menu), click Customize.
3. Scroll down and under Control Panel click the radio-button Display as a menu.
4. Click OK > Apply > OK.

The next time that you click Start, you should see an arrow on the right-hand side of the Control Panel link. Click on the arrow and you will see all of the Control Panel items listed as a sub-menu. ------------------- W32.Rinbot.BC

This virus copies itself to networked drives and particularly removable storage (flash drives, external USB drives etc).

A quick way to discover if your PC is infected is to search for the following registry subkey value:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Microsoft DNSx" = "\mdnex.exe"

To remove this virus, first backup your registry…

To backup the registry in Windows Vista Home Premium/Vista Home Basic by setting a Manual System Restore Point:
1. Click Start.
2. Type: Sys and then wait for the search results to appear.
3. Under Programs, click System Restore.
4. If the User Account Control dialog appears, click Continue.
5. Click open System Protection.
6. Under Available Disks, tick one or more drives. Remember that System Restore will not make any difference to drives that only contain documents and standard file types. The important drive to tick is the one that Windows and your program files are installed on.
7. Click Create.
8. Type an appropriate and memorable name for your restore point.
9. Click Create.
10. When the process is complete, click OK.
11. To close any the open dialogs, keep clicking Cancel.

To backup the registry in Windows XP, by setting a Manual System Restore Point:
1. Click Start > All Programs > Accessories > System Tools > System Restore.
2. Select Create a Restore Point and click Next.
3. Type a memorable name for your restore point.
4. Click Create.
5. Click Close.

To backup the registry in Windows 2000, using the Backup Wizard:
1. Click Start > All Programs > Accessories > System Tools > Backup > Welcome > Backup Wizard.
2. Click Next.
3. Select Only back up the System State data and click Next
4. Click Browse.
5. If the Insert Disk warning message is displayed, click Cancel.
6. From the Look in drop-down box, choose Desktop.
7. In the File name field, type a suitable filename.
8. Click Open > Next > Finish.
9. When you see the message The backup is complete, click Close.
10. Close the Backup Utility window.

To backup the registry in Windows Me/98SE (using the Windows Registry Checker - SCANREGW.EXE):
1. Click Start > Run.
2. Type: scanregw
3. Click OK.
4. Click Yes > OK.

Now…
1. Click Start > Run.
2. Type: regedit and press [Enter].
3. Go to the registry subkey:
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\
4. In the right pane, delete the value:
"Microsoft DNSx" = "\\mdnex.exe"
5. Exit the Registry Editor. ------------------- W32.Yadurna.A

This virus copies itself to map network drives (these are resources on other computers that you reference over a network using a drive letter allocated by your PC: for example Z:\).

A quick way to discover if your PC is infected is to search for the following file(s):

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\System32\nakula sadewa
Windows 2000: C:\Winnt\System32\nakula sadewa
Windows Me/98SE: C:\Windows\System\nakula sadewa

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\System32\w4y4n9
Windows 2000: C:\Winnt\System32\w4y4n9
Windows Me/98SE: C:\Windows\System\w4y4n9

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\System32\Microsoft Administrator
Windows 2000: C:\Winnt\System32\Microsoft Administrator
Windows Me/98SE: C:\Windows\System\Microsoft Administrator

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\System32\Administrator durjana
Windows 2000: C:\Winnt\System32\Administrator durjana
Windows Me/98SE: C:\Windows\System\Administrator durjana

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\System32\Software Administrator
Windows 2000: C:\Winnt\System32\Software Administrator
Windows Me/98SE: C:\Windows\System\Software Administrator

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\nakula sadewa
Windows 2000: C:\Winnt\nakula sadewa
Windows Me/98SE: C:\Windows\nakula sadewa

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\w4y4n9
Windows 2000: C:\Winnt\w4y4n9
Windows Me/98SE: C:\Windows\w4y4n9

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\Microsoft Administrator
Windows 2000: C:\Winnt\Microsoft Administrator
Windows Me/98SE: C:\Windows\Microsoft Administrator

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\Administrator durjana
Windows 2000: C:\Winnt\Administrator durjana
Windows Me/98SE: C:\Windows\Administrator durjana

or

Windows Vista Home Premium/Vista Home Basic/XP: C:\Windows\Software Administrator
Windows 2000: C:\Winnt\Software Administrator
Windows Me/98SE: C:\Windows\Software Administrator

To remove this virus, first backup your registry using the instructions given above.
Once you have backed up your registry, proceed as follows:

1. Click Start > Run.
2. Type: regedit and press [Enter].
3. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"dokument" = "dokument.exe"
4. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"lo5tword" = "lo5tword.exe"
5. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Tugas" = "Tugas.exe"
6. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"HP Bunga Citra Lestari" = "HP Bunga Citra Lestariexe"
7. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"w4y4n9" = "w4y4n9.exe"
8. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"svchost" = "svchost.exe"
9. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"spoolsv" = "spoolsv.exe"
10. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"services" = "services.exe"
11. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Hanuman" = "Hanuman.exe"
12. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"w4y4n9" = "w4y4n9.exe"
13. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"GatoTkaca" = "GatoTkaca.scr"
14. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"csrss" = "csrss.exe"
15. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"smss" = "smss.exe"
16. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"lsass" = "lsass.exe"
17. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"w32 Wayang" = "w32 Wayang.exe"
18. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"daLang MistiQ" = "daLang MistiQ.exe"
19. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SMA Negeri 4" = "SMA Negeri 4.exe"
20. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Kota P4hlawan" = "Kota P4hlawan.exe"
21. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Majnun was H3re" = "Majnun was H3re.exe"
22. Go to and delete the value in this registry subkey (just the end value, not the entire subkey):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Windows [RANDOM NUMBER]" = "Windows [RANDOM NUMBER].exe"
23. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoFolderOptions" = "1"
24. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoDrives" = "1"
25. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoControlPanel" = "1"
26. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoFind" = "1"
27. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoRun" = "1"
28. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoTrayContextMenu" = "1"
29. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoViewContextMenu" = "1"
30. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\explorer\advanced\"Hidden" = "0"
31. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\explorer\advanced\"ShowSuperHidden" = "0"
32. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\explorer\advanced\"HideFileExt" = "1"
33. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableRegistryTools" = "1"
34. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableCMD" = "1"
35. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr" = 1"
36. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"ReportBookOk" = "0"
37. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"SFCDisable" = "0"
38. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"SFCScan" = "0"
39. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"shell" = "explorer.exe [WORM FILENAME].exe"
40. Go to the following registry subkey and (if required) restore the specified value to its original setting:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"system" = "[WORM FILENAME].exe"
41. Exit the Registry Editor.