LAO AV WEBSITE : Forum / topic

Thu, 01 Jan 1970 02:00:00 -0500

Re:

Sat, 27 Oct 2007 16:03:31 -0400

1. ໄວຣັສຈະສ້າງໄຟ
- vkq.dll ໃນໂພນເດີ Temp
- avpo.exe ໃນໂພນເດີ System32
- avpo0.dll ໃນໂພນເດີ System32
- ntde1ect.com ແລະ Autorun.inf ໃນແຕ່ລະຊອ່ງເຊັ່ນ C:\,D:\,E:\...
ໄວຣັສຈະສ້າງ ntde1ect.com ແລະ Autorun.inf ເຂົ້າໃນ USB ເຮົາ
ເມື່ອເຮົາເອົາ USB ໃສ່ຄອມ
ໃນໄຟ Autorun.inf ມີໂຄດຄຳສັ່ງດັ່ງນີ້

[AutoRun]
open=ntde1ect.com
;shell\open=Open(&O)
shell\open\Command=ntde1ect.com
shell\open\Default=1
;shell\explore=Manager(&X)
shell\explore\Command=ntde1ect.com

2. ໄວຣັສຈະສ້າງຄ່າໃນຄີ
-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run\
ມີຄ່າ avp0= C:\Windows\System32\avp0.exe
-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
ມີຄ່າ CheckedValue= 0 ຊື່ງເຮັດໃຫ້ເຮົາບໍ່ສາມາດສະແດງໄຟທີ່ເຊື່ອງໄວ້

Re:

Sat, 27 Oct 2007 16:04:20 -0400

Virus Worm Fullhouse

1. ເມື່ອໄວຣັສນີ້ຖືກ Run ແລ້ວມັນຈະສ້າງຟາຍແລະ Folder
- ສ້າງ Folder ຊື່ Config ໃນຊອງ C:\Config
- ສ້າງຟາຍ smss.exe ໃນ C:\Config\smss.exe
- ສ້າງຟາຍ Taskmgr.exe ໃນ C:\Taskmgr.exe
- ສ້າງ Folder ຊື່ Fullhouse ໃນຊອງ C:\Fullhouse
- ສ້າງຟາຍ Fullhouse.jpg ໃນຊອງ C:\Fullhouse\Fullhouse.jpg
2. ອາການເມື່ອຕິດໄວຣັສນີ້ແລ້ວ
- ມີ Folder ຊື່ Full House ໃນ My Computer ແລະ Control Panel
- ເປີດ Task Manager ບໍ່ໄດ້
- ເປີດ Regedit ບໍ່ໄດ້
- ເມື່ອເຮົາເອົາ Handy Drive ໃສ່ ມັນຈະ Copy ຕົວເອງໃສ່ Handy Drive ໂດຍມັນຈະໃສ່ຊື່ Folder ຂອງເຮົາເລີຍສ່ວນ Folder ຂອງເຮົາແທ້ຈະຖືກ Hidden ໄວ້
3. ສ້າງຄ່າໃນ Regedit
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explore\Run
ມີຄ່າ Manager Task= C:\Config\smss.exe
- HKEY_CLASSES_ROOT\exefile
ມີຄ່າ NeverShowExt = ””
- HKEY_CLASSES_ROOT\CLSID\
{00020D75-0000-0000-C000-0000000000AA}
ມີຄ່າ Default= Full House
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\MyComputer\NameSpace\
{00020D75-0000-0000-C000-0000000000AA}
ມີທໍ່ນີ້ແລະຕາມທີ່ເອົາມາວິເຄາະໄດ້ ::)

Re:

Sat, 27 Oct 2007 16:02:38 -0400

1. Goto Start>Run ພິມ Tskill smss ແລ້ວ Enter
2. Goto My computer>Folder Options>View>ຕິກເອົາ Show hidden file.....>ຕິກອອກ Hide protect operating......>ok
3. ໄປລົບ Folder ໃນຊອງ C:\Config ແລະ C:\Taskmgr.exe ແລະ C:\FullHouse ອອກ
3. ໄປ ເປີດ Regedit Start>Run ພິມ Regedit ແລ້ວ Enter
4. ໃນ Regedit ໃຫ້ໄປລົບຄີລຸ່ມນີ້ອອກໃຫ້ໝົດ
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\E xplore\Run
ລົບ -> Manager Task= C:\Config\smss.exe
- HKEY_CLASSES_ROOT\exefile
ລົບ ->NeverShowExt = ””
- HKEY_CLASSES_ROOT\CLSID\
ລົບ ->{00020D75-0000-0000-C000-0000000000AA}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ MyComputer\NameSpace\
ລົບ ->{00020D75-0000-0000-C000-0000000000AA}
5. ແລ້ວ Restart ຈົບ
Lao antivirus ກະຂ້າໄດ້ແລ້ວ
Visit http://laoav.pt.nu

Re:

Sat, 27 Oct 2007 16:01:35 -0400

ເຮັດຕາມຂັ້ນຕອນດັ່ງລຸ່ມນີ້

Re:

Sat, 27 Oct 2007 16:05:06 -0400

- Worm ຕົວນີ້ເມື່ອຖືກໃຊ້ງານມັນຈະກອບປີຕົວເອງໄປຢູ່ທີ່
• %SYSDIR%\dvupdate.exe
ແລ້ວມັນກໍ່ຈະລົບຟາຍທີ່ຖືກໃຊ້ງານເທື່ອທຳອິດຂອງມັນດ້ວຍຕົວມັນເອງ
- Worm ມັນຈະໄປສ້າງຄີໃນ Registry
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
ມີຄ່າ
• Driver Update="%SYSDIR%\dvupdate.exe"
- Worm ຍັງສົ່ງຕົວມັນເອງໄປທາງອີເມວອີກຊື່ງມີ
Subject:
One of the following:
• A friendly warning
• Greetings. Please read on.
• Hello there! Read on.
• Hey, just warning you
• HEY, THIS IS KINDA URGENT
• Some important information
• You might want to read this...
• You need to protect yourself
ແລະ Attachment ທີ່ມີຊື່ຟາຍ
• ReadMe_TXT
• ReadThisNow_TXT
• UrgentInfo
• MSWinFix
• MSHotFix_Latest
• Latest_Patch
• Info_Doc
• ImportantInfo
• %random character string%
ຕາມດ້ວຍນາມສະກຸນເປັນ .exe ແລະ .zip
- Worm ຕົວນີ້ແມ່ນພັດທະນາຂື້ນມາໂດຍໃຊ້ພາສາ MS Visual C++
ເບີ່ງຂໍ້ມູນເພີ່ມທີ່

http://www.avira.com/en/threats/section/fulldetails/id_vir/3900/ worm_mydoom.bh.1.html

Re:

Sat, 27 Oct 2007 16:05:44 -0400

ໄວຣັສ ນີ້ ເປັນປະເພດ ໜອນ ມັນຈະກອບປີຕົວເອງຕາມທີ່ເຫັນລຸ່ມນີ້
• %SYSDIR%\stwinsdat.exe
• %SYSDIR%\odcwinst.exe
• %SYSDIR%\windb32.exe
• %SYSDIR%\servftc.exe
ແປງຄ່າ Registry
– HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
• Windows Sysdat="explorer.exe odcwinst.exe"
•

– HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
• "Logon Settings2"="odcwinst.exe"

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\
Run
• "Policies Options2"="o﷽﷽�ā쵨ĊⷨĂ"

– HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• System Driver2=-

– HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
• "Services Start2"="odcwinst.exe"

The following registry keys are added:

– HKLM\Software\RMX\cfg
• j="j"

– HKCU\Software\RMX\cfg
• j="j"

ໄວຣັສນີ້ຂຽນດ້ວຍພາສາ Ms C++

ລາຍລະອາດເພີ່ມເຕີ່ມ

http://www.avira.com/en/threats/section/fulldetails/id_vir/3691/ worm_skipi.c.html

Re:

Sat, 27 Oct 2007 16:06:17 -0400

ທ່ານສາມາດໃຊ້ ໂປຣແກຣມ Lao anti virus ແກ້ບັບຫານີ້ໄດ້ ໂດຍ:

1 ກົດ ຕົວຊ່ວຍອື່ນໆ
2 ກົດ Registry Edit
3 ໃນ Disable registry Tools ຖ້າຫາກຖືກເລືອກໄວ້ໃຫ້ຕິກອອກ ຫລືຕົວເລືອກອື່ນໆຄືກັນໃຫ້ຕິອອກໝົດ
ແລ້ວທ່ານລອງເຂົ້າ Regedit ເບີ່ງວ່າໄດ້ບໍ
ຖ້າມີບັນຫາຫຍັງກ່ຽວກັບຄອມສາມາດລົງຄຳຖາມໄວ້ໄດ້ ເວັບບອດນີ້ (ກ່ອນອື່ນຕ້ອງສະໝັກເປັນສຳມະຊິກກ່ອນ)
ຂອບໃຈ

Re:

Sat, 27 Oct 2007 16:06:44 -0400

ສະເພາະຜູ້ໃຊ້ Lao antivirus 2008

or
http://img142.imageshack.us/my.php?image=nofolderzf3.jpg
ແລ້ວ Restart Computer

Re:

Sat, 27 Oct 2007 16:07:19 -0400

ສະບາຍດີຊາວໄອທີທັງຫລາຍ
ທ່ານສາມາດລົງຄຳຄິດເຫັນຫລືມີບັນຫາໄວຣັສຄອມສາມາດລົງຄຳຖາມໄດ້
ຂອບໃຈ

Re:

Wed, 31 Oct 2007 08:53:29 -0400

ມັນຈະ copy ຕົວເອງໄປທີ່:
• %SYSDIR%\\Norton Update.exe

ຕາມດ້ວຍຟາຍທີ່ສ້າງ:

– A file that contains collected email addresses:
• %SYSDIR%\\%random%.dll

– C:\\s.cm

ເພີ່ມຄ່າໃນ Registry:

– HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• "Wxp4" = " %SYSDIR%\\Norton Update.exe"

– [HKLM\\Software\\Microsoft\\Wxp4]
• rD=dword:00000101
• t1="%current username%"
• t3=" %SYSDIR%\\Norton Update.exe"
• t4="%SYSDIR%\\%random character string%.dll"
• lA="%PROGRAM FILES%\\MSN\\MSNCoreFiles"

ພາສາທີ່ໃຊ້ຂຽນໄວຣັສນີ້:
MS Visual C++.

ບີບອັດດ້ວຍໂປຣແກຣມ:

• FSG 2.0

ລາຍລະອຽດເພີ່ມເຕີມ

Re:

Fri, 02 Nov 2007 05:09:21 -0400

- ຖ້າ Virus ຖືກຮຽກໃຊ້ ມັນສ້າງຄ່າ Autorun ໃນ Registry HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
ມີຄ່າ Yahoo Messengger=C:\\WINDOWS\\system32\\scvshosts.exe
- Copy ຕົວເອງອອກໄປທີ່
> C:\\WINDOWS\\system32\\scvshosts.exe
> C:\\WINDOWS\\hinhem.scr
> C:\\WINDOWS\\scvshosts.exe
> C:\\WINDOWS\\system32\\blastclnnn.exe
> C:\\WINDOWS\\Tasks\\At1.job (ແມ່ນຟາຍທີ່ໄວຣັສຕັ້ງເວລາເປີດອັດຕະນາໂນມັດ)
> C:\\WINDOWS\\system32\\autorun.ini ແລະມັນຈະຕິດໄປທາງຟາຍແຊໃນເນັດເວີກແລະ USB ໃນຟາຍ Autorun.inf ແລະ Autorun.ini
ມີໂຄດ
[Autorun] Open=scvshosts.exe
Shellexe cute=scvshosts.exe
Shell\\Open\\command=scvshosts.exe
Shell=Open
ຊື່ງເຮັດໃຫ້ເປີດໄວຣັສອັດຕະນາໂນມັດເວລາເຮົາເປີດຊ່ອງ USB ນັ້ນ
Antivirus ລາຍຕົວທີ່ອັບເດດສາມາດຂ້າໄດ້ແລ້ວແຕ່ທ່ານໃດຍັງມີບັນຫານີ້ຢູ່ກໍ່ສາມາດອ່ານລາຍລະອຽດນີ້ໄດ້
ວິທີການກຳຈັດແມ່ນຖ້າໄວຣັສໄດ້ໄປສ້າງຄ່າຢູ່ໃສໃຫ້ທ່ານໄປນຳລົບອອກຕາມນັ້ນ
ຕົວຢ່າງ:HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
ລົບ -> Yahoo Messengger=C:\\WINDOWS\\system32\\scvshosts.exe
ແລະ ຢຸດການທຳງານຂອງໄວຣັສກ່ອນ
ໄປທີ່ Start>Run ພິມ Tskill scvshosts enter

ຮູບໄວຣັສທີ່ຕິດ USB ແລ້ວຈະເຫັນໄວຣັສແບບນີ້ແລະໃນແຕ່ລະ Sub folder ກໍ່ຈະມີ

Re:

Mon, 12 Nov 2007 04:51:34 -0500

ຊ່ວງນີ້ຂ້າພະເຈົ້າໄດ້ເຫັນໄວຣັສ "Dancer.exe" ກຳລັງລະບາດດ້ວຍການສົ່ງເມວມາ
ຊື່ງມີລາຍລະອຽດດັ່ງຮູບ

ຫ້າມເປີດເດັດຂາດໃຫ້ລົບເມວອອກເລີຍ

Re:

Mon, 26 Nov 2007 04:39:21 -0500

Virus Knight.exe

1. Files ໄວຣັສຈະສ້າງຟາຍ
- C:\WINDOWS\Knight.exe
- C:\WINDOWS\recover.reg
2. ຕິດທາງ USB ໃນຊ່ອງຈະມີ 2 ຟາຍ
- Autorun.inf
- Knight.exe
-> Code ໃນຟາຍ Autorun.inf

[autorun]
open=Knight.exe open

icon=Knight.exe,0

shellexecute=Knight.exe open

shell=auto

action=Disk Knight(Protection Against Mobile Disk Viruses)

shell\auto=&Auto

shell\auto\command=Knight.exe open

shell\open=&Open

shell\open\command=Knight.exe open

shell\explore=E&xplore

shell\explore\command=Knight.exe open

shell\find=S&earch...

shell\find\command=Knight.exe open

shell\install=&Disk Knight

shell\install\command=Knight.exe open

3. ສ້າງຄ່າໃນ Registry - HKLM\Software\Microsoft\Windows\CurrentVersion\Run ມີຄ່າ Disk Knight=C:\WINDOWS\Knight.exe

Re:

Fri, 14 Dec 2007 04:49:33 -0500

ໄວຣັສ Seacon.exe

1. ເມື່ອມັນທຳງານຫລືຖືກ Run
-> Copy ຕົວເອງໄປຢູ່
-C:\Windows\Seacon.exe (Hidden)
-C:\Windows\PPstream.exe
-C:\Windows\Save.sos
-C:\Seacon.exe
-C:\Mp3.exe
-C:\Autorun.inf
-C:\PPstream.exe
ແລະໃນແຕ່ລະຊ່ອງລວມເຖີ່ງຊອງ USB ຈະມີໄຟເຫລົ່ານີ້
-Seacon.exe
-Mp3.exe
-Autorun.inf
-PPstream.exe
2. ສ້າງຄ່າໃນ Registry

-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\SuperHidden
CheckedValue=1

-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\SuperHidden
DefaultValue=1

-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit=C:\Windows\System32\Userinit.exe,C:\Windows\Seacon.exe

-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ Advanced
SuperHidden=1

3. ອາການຕອນຕິດໄວຣັສ
-ເຄື່ອງທຳງານຊ້າປົກກະຕິ
-ໄວຣັສຈະລົບໄຟລ *.MP3 ໃນທຸກຊ່ອງ
-ເມື່ອເອົາ USB ໃສ່ ຈະຖືກລົບຂໍ້ມູນອອກທັງໝົດ (ອັນຕະລາຍຫລາຍ)
-Process ຂອງໄວຣັສບໍ່ສາມາດເຫັນໄດ້ Windows Task manager ເມື່ອໄວ
ຣັສກຳລັງທຳງານ
-ໄວຣັສໃຊ້ ICON ຂອງຮູບ Folder XP ເພື່ອລວງຕາຜູ້ໃຊ້ຄອມວ່າເປັນ Folder
4. ການລົບໄວຣັສ
-ໃຫ້ທ່ານດາວໂລດເອົາຕົວຂ້າໄວຣັສນີ້ສະເພາະສະມາຊິກໃຫ້ດາວໂລດເອົາໄດ້ໃນໜ້າ
ທຳອິດໃນເມນູ Remove tool

Re:

Fri, 21 Dec 2007 04:56:22 -0500

Virus Cetix (Worm)

1. ເມື່ອຖືກ Run ມັນຈະສ້າງໄຟລ
-C:\WINDOWS\cetix.exe
-C:\WINDOWS\system32\toxic.exe

-C:\WINDOWS\system32\poison.exe

-C:\WINDOWS\racun.exe

-C:\Documents and Settings\%UserProfile%\Start Menu\Programs\Startup\vserve.exe

-C:\aboutCetix.html

-C:\infoBali.txt

-C:\Documents and Settings\%UserProfile%\Desktop\aboutCetix.html

-C:\Autorun.inf

ແລະຍັງລະບາດໄປທົ່ວທຸກຊ່ອງລວມທັງ USB ລັກສະນະຊື່ໄຟລແມ່ນເອົາຕາມຊື່ໄຟລ ແລະໂຟນເດີໃນຊ່ອງນັ້ນຊື່ງມີຮູບດັ່ງນີ້

-View ແບບ Tiles

ຈະເປັນຮູບ Folder
-View ແບບ Icon

ຈະເປັນຮູບ ຂອງໄຟລ Ms Word
-View ແບບ List and Details

ເພື່ອເປັນການລວງຕາໃຫ້ເຮົາຄິດວ່າ Folder ແລ້ວ ເປີດມັນແລ້ວໄວຣັສກໍ່ຈະຕິດຄອມ ທັນທີ
2. ສ້າງຄ່າໃນ Registry -HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
ມີຄ່າ cetix , poison
-HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ ແປງຄ່າຂອງ AlternateShell -HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ແປງຄ່າຂອງ Shell , Userinit , ແລະແປງຄ່າ
-HKCR\exefile\shell\open\command
-HKCR\lnkfile\shell\open\command
-HKCR\piffile\shell\open\command
-HKCR\batfile\shell\open\command
-HKCR\comfile\shell\open\command
-HKCU\Control Panel\International
-HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion ແປງຄ່າຂອງ RegisteredOwner, RegisteredOrganization, -HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden
ແປງຄ່າຂອງ UncheckedValue -HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ແປງຄ່າຂອງ HideFileExt , ShowSuperHidden
3. ການກຳຈັດ
ໄວຣັສນີ້ ບິບອັດດ້ວຍ Compressor ແລະສ້າງດ້ວຍ VB 6.0 ດາວໂລດເອົາຕົວອັບເດດຂອງໂປຣແກຣມ ລາວແອັນຕີໄວຣັສລ່າສຸດເພື່ອຂ້າໄວຣັສຕົວນີ້

ໂດຍ Lao Antivirus

Re:

Wed, 26 Dec 2007 05:11:06 -0500

=>ມື້ນີ້ຂ້າພະເຈົ້າໄດ້ກວດເມວເຊື່ງໄດ້ຮັບເມວທີ່ບໍ່ຮູ້ຈັກມາສະບັບໜື່ງເຊື່ງເ ນື້ອໃນແມ່ນການ
ອວຍພອນປີໃໝ່ 2008 ແລະວັນ Christmas ນີ້ ດັ່ງຮູບ

ຕ້ອງລົບເມວນັ້ນອອກເລີຍຫລືມີເມວໃນລັກສະນະນີ້
ຖ້າເຮົາກົດລີ້ງມັນຈະເຂົ້າເວັບດັ່ງນີ້

ເມື່ອເຮົາເປີດມັນຈະໄດ້ດາວໂລດໄຟໄວຣັສມາໃສ່ເຄື່ອງຖ້າເປີດໄຟນັ້ນກໍ່ຈະຕິດໄວຣັ ສທັນທີ
ເມວມາລັສະນະນີ້ມັກມີຊ່ວງວັນສຳຄັນຕ່າງໆເຊັ່ນ ປີໃໝ່ , ວັນ Christmas ແລະອື່ນໆ
By Lao antivirus

Re:

Tue, 15 Jan 2008 17:50:44 -0500

ເຈິໄວລັດຕົວໃໝ່ ເວລາພິມເອກະສານເປັນພາສາລາວ ຈະມີພາສາຫວຽດນາມເຂົ້າມາແທນພາສາລາວທີ່ເຮົາພິມ, ເປັນແບບນີ້ຕະຫຼອດ ເຮັດໃຫ້ລົບກວນຫຼາຍໃນການພິມເອກະສານ ແລະ ມັນມັກຈະຂຶ້ນເປັນພາສາຫວຽດນາມອາດຈະເປັນຊື່ຂອງຜູ້ຂຽນໄວລັດກໍ່ເປັນໄດ້ຢູ່ຂ້າງ
ເອກກະສານຊ່ວຍແກ້ໄຂໃຫ້ແດ່ ຂອບໃຈລ່ວງໜ້າ

Re:

Fri, 18 Jan 2008 04:40:10 -0500

ໄວຣັສ Ntdelect.com

+ ເມື່ອຄອມຕິດໄວຣັສຕົວນີ້ມັນຈະກອບປີຕົວເອງດັ່ງນີ້
-C:\windows\system32\kavo.exe
-C:\windows\system32\kavo0.dllແລະໃນແຕ່ລະຊ່ອງຈະມີໄຟດັ່ງນີ້
-ntdelect.com
-autorun.inf
ຖ້າເອົາ USB ໃສ່ຈະຕິດໄວຣັສຕົວນີ້ທັນທີໂດຍມີ 2 ໄຟນັ້ນ
+ ໄວຣັສຍັງມີການແກ້ໄຂ Registry -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run
ມີຄ່າ Kavo= C:\windows\system32\kavo.exe
+ການກຳຈັດແມ່ນດາວໂລດເອົາຕົວອັບເດດຂອງ Lao AV ລ່າສຸດ

Re:

Fri, 18 Jan 2008 08:12:57 -0500

ໄວຣັສ W32.DashferX.PE

+ເມື່ອຕິດໄວຣັສນີ້ຈະກອບປີໄປທີ່
%SysDir%\Com\smss.exe
%SysDir%\Com\lsass.exe
%SysDir%\Com\netcfg.dll
%SysDir%\Com\netcfg.000
%SysDir%\dnsq.dll
ແລະ pagefile.pif ກັບ autorun.inf ທຸກໆຊ່ອງລວມເຖີ່ງຊ່ອງ USB
ທີ່ສຳຄັນມັນຍັງສາມາດຕິດກັບບັນດາໄຟດັ່ງນີ້
jsp, php, spx, asp, tml, htm ແລະຂຽນໂຄດໃສ່ຄື
""

ແລະຍັງຕິດກັບບັນດາໄຟໂປຣແກຣມອີກເຊັ່ນ ໄຟທີ່ມີນາມສະກຸນ .exe (ອັນຕະລາຍ)
ຈະເຮັດໃຫ້ໂປຣແກຣມຫລືໄຟນັ້ນເສຍຫາຍບໍ່ສາມາດແປງໄດ້ ໝາຍວ່າເປັນໄວຣັສໝົດ
+ ແປງຄ່າໃນ Registry
HKLM\...\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\...\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
"AppInit_DLLs" = "C:\\WINDOWS\\system32\\dnsq.dll"

Re:

Mon, 21 Jan 2008 11:52:01 -0500

Withlove.exe ມານຳເມວ ເປັນລັກສະນະຊວນເຊື່ອໃຫ້ເປີດມັນ
ດັ່ງຮູບ

ຊື່ໄຟລໄວຣັສ ແມ່ນ Withlove.exe ແລະອາດຈະມີຫລາຍແບບໃນລັກສະນະນີ້
ຖ້າເຮົາດາວໂລດແລ້ວເປີດຈະຕິດເຊື້ອທັນທີ

Re:

Fri, 25 Jan 2008 04:21:31 -0500

+Trojan gen_host.exe ເປັນປະເພດດັກຈັບຂໍ້ມູນຕ່າງໆທີ່ເຮົາພິມໃນຄອມພິວເຕີ
ລວມໄປເຖີ່ງ ລະຫັດ ຊື່ Credit card number ແລະອື່ນໆ.
+ ຄອມທີ່ຕິດໂຕຣຈັນຕົວນີ້ມັນຈະຢູ່ໃນລະບົບເຊັ່ນ:
- %System%\gen_host.exe
- ຂະໜາດໄຟ 131,072 bytes
ແລະມັນຍັງດາວໂລດເອົາໂປຣແກຣມໃນເວັບຂອງມັນມາລົງໃນຄອມອີກທີ່ເວັບ
- http://www.microsofttw.com/jj/cc.rar
ແລະລົງໄປທີ່ %Temp%\cc.rar

Re:

Mon, 28 Jan 2008 09:23:26 -0500

Trojan.Zlob

+ ສ້າງໄຟລ ເປັນໂຕຣຈັນເມື່ອຖືກຣັນຈະສ້າງໄຟລດັ່ງນີ້
1. %Programs%\XXXHoliday\Uninstall.lnk
2. %ProgramFiles%\XXXHoliday\Uninstall.exe
3. %System%\kdyfy.exe
4. %CommonAppData%\Microsoft\Network\Connections
\Pbk\rasphone.pbk

ໂພນເດີທີ່ຖືກສ້າງ:

c:\System Volume Information\.
c:\System Volume Information\..
%Programs%\XXXHoliday
%ProgramFiles%\XXXHoliday

+ ສ້າງຄ່າ Registry

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXHoliday
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXHoliday\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall \XXXHoliday
HKEY_CURRENT_USER\Software\XXXHoliday

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXHoliday\CLSID]

(Default) = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal l\XXXHoliday]

UninstallString = ""%ProgramFiles%\XXXHoliday\Uninstall.exe""
InstallLocation = "%ProgramFiles%\XXXHoliday"
DisplayName = "XXXHoliday"
DisplayIcon = "%ProgramFiles%\XXXHoliday\Uninstall.exe,0"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion]

kdid = 7E 34 D6 FA 14 EF 73 4A A2 E5 8D 60 2D 90 DF A3

[HKEY_CURRENT_USER\Software\XXXHoliday]

(Default) = "%ProgramFiles%\XXXHoliday"
Start Menu Folder = "XXXHoliday"

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

System = "kdyfy.exe"

ສະນັ້ນ kdyfy.exe ຈະຣັນທຸກຄັ້ງເມື່ອ ວິນໂດວເປີດ

Re:

Thu, 31 Jan 2008 10:49:56 -0500

Win32.Bifrose.yg

> ເປັນ Backdoor ເມື່ອຄອມຕິດໄວຣັສຕົວນີ້ມັນຈະທຳງານລັບໆໂດຍທີ່ຜູ້ໃຊ້ບໍ່ເຫັນ
ແລະມັນຈະເປີດ Port ທີ່ສາມາດເຮັດໃຫ້ hacker ໂຈມຕີເຄື່ອງທີ່ໄວຣັສຕົວນີ້ໄດ້
+ ໄຟທີ່ສ້າງຂື້ນ
- %System%\perfd00952.dat
- %System%\REGSVRS32.EXE
+ແປງຄ່າໃນ Registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A5CDF7EC-751B-46aa-AD69-4005FE080DE8}
HKEY_LOCAL_MACHINE\SOFTWARE\SKav
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msv ideo
HKEY_CURRENT_USER\Software\SKav

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A5CDF7EC-751B-46aa-AD69-4005FE080DE8}]

stubpath = "%System%\REGSVRS32.EXE s"

[HKEY_LOCAL_MACHINE\SOFTWARE\SKav]

nck = 98 66 E4 52 A0 AC EA 5F F7 EC 7F 84 DC 8A DA 00 A8 5F E4 52 A0 AC EA 5F F7 EC 7F 84 DC 8A DA 00

[HKEY_CURRENT_USER\Software\SKav]

klg = 00
plg1 = EB 65 B8 05 E9 E2 AE 10 A0 BF 23 F7 A5 F9 AE 65 C5 6C D6 0E D0 C9 98 39 93 DC 4F BD E9 B8 F4 64 C9 2B E4 52 A0 48 11 59 F7 EC 7F 84 DC 06 21 06 A8 5F E4 D2 A0 0C 10 59 F7 EC 7F 84 DC 8A DA 00 A8 5F E4 52 A0 B4 EA 45 F7 FC 83 82 DC 8A DA 00 A8 5F 34 A

The following Host Names were requested from a host database:

pmail.7766.org
chatzone.servebbs.com

Re:

Fri, 08 Feb 2008 07:34:32 -0500

Trojan.OnlineGames

1. ກອບປີໄຟໃສ່ລະບົບ
%Temp%\tmp4.tmp
%System%\drivers\msaclue.sys
%System%\iemnaw.cfg
%System%\iemnaw.dll

2. ແປງຄ່າ Registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSSKYE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSSKYE\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSSKYE\0000\C ontrol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msskye
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msskye\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msskye\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSSKYE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSSKYE\00 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSSKYE\00 00\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msskye
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msskye\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msskye\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs = "gnefnaib.dll,rj.dll,aixauh.dll,nuygnef.dll,jmx.dll,oadgnohiac.dll,dgz g.dll,vlihzouhgnfe.dll,sfhx.dll,ijougiemnaw.dll,fmxh.dll,2ty.dll,wtwx. dll,gnaixnauhuoyizqq.dll,gnaixnauhqq.dll,2nauygniqaixnaij.dll,naijihze uyouhz.dll,iemnaw.dll,eve.dll,ddtj.dll,x

so that iemnaw.dll runs every time a Windows application starts

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSSKYE\0000\ Control]

*NewlyCreated* = 0x00000000
ActiveService = "msskye"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSSKYE\0000]

Service = "msskye"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "msskye"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSSKYE]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msskye\Enum]

0 = "Root\LEGACY_MSSKYE\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msskye\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msskye]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "system32\DRIVERS\msaclue.sys"
DisplayName = "msskye"
Description = "msskye"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSSKYE\0 000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "msskye"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSSKYE\0 000]

Service = "msskye"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "msskye"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSSKYE]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msskye\Enum]

0 = "Root\LEGACY_MSSKYE\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msskye\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msskye]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "system32\DRIVERS\msaclue.sys"
DisplayName = "msskye"
Description = "msskye"

The following Registry Value was deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs = ""

Re:

Mon, 18 Feb 2008 11:31:15 -0500

Worm.Alcra.F

1. ໄຟທີ່ຖືກສ້າງ
%Programs%\Startup\lsass.lnk
%System%\weethhlvb\lsass.exe
%System%\taskkill.com
%System%\weethhlvb\lsass.ini
-ແລະແປງໄຟ
%System%\drivers\etc\hosts
-ໂພນເດີທີ່ສ້າງ
%System%\weethhlvb
-ໄຟທີ່ທຳງານ
%System%\weethhlvb\lsass.exe
ຍຸດການເຮັດວຽກຂອງ Services

-ALG (Application Layer Gateway Service)
-SharedAccess (Windows Firewall/Internet Connection Sharing (ICS))
-wscsvc (Security Center)
2. ແປງຄ່າ Registry

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\S ystem

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

lsass = ""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter]

Enabled = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ System]

DisableRegistryTools = "1"
NoAdminPage = "1"

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

lsass = ""

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

run = "%System%\weethhlvb\lsass.exe"

so that lsass.exe runs every time Windows starts

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command]

(Default) = ""%1""

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

load = "%System%\weethhlvb\lsass.exe"

ດັ່ງນັ້ນ lsass.exe ເປີດທຸກຄັ້ງເມື່ອວີນໂດວເປີດ

Re:

Mon, 25 Feb 2008 06:16:04 -0500

IM-Worm.Win32.VB.at

1. ການປ່ຽນແປງລະບົບໄຟລ໌

%Programs%\Startup\winlogon.lnk
%System%\cpppka\winlogon.exe
%System%\cpppka\winlogon.ini
%System%\netstat.com
%System%\taskkill.com

*ຍຸດການທຳງານຂອງ Services
-ALG
-SharedAccess
-wscsvc

2. ແປງຄ່າ Registry

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\S ystem

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

winlogon = ""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter]

Enabled = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ System]

DisableRegistryTools = "1"
NoAdminPage = "1"

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

winlogon = ""

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

run = "%System%\cpppka\winlogon.exe"

so that winlogon.exe runs every time Windows starts

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command]

(Default) = ""%1""

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

load = "%System%\cpppka\winlogon.exe"

ສະນັ້ນ winlogon.exe ເຮັດວຽກທຸກຄັ້ງເມື່ອເປີດຄອມ

3. ແປງຄ່າໄຟລ Host
ເປັນ
1.1.1.1 f-secure.com
1.1.1.1 www.f-secure.com
1.1.1.1 ftp.f-secure.com
1.1.1.1 ftp.sophos.com
1.1.1.1 liveupdate.symantec.com
1.1.1.1 customer.symantec.com
1.1.1.1 dispatch.mcafee.com
1.1.1.1 download.mcafee.com
1.1.1.1 rads.mcafee.com
1.1.1.1 mast.mcafee.com
1.1.1.1 my-etrust.com
1.1.1.1 www.my-etrust.com
1.1.1.1 nai.com
1.1.1.1 www.nai.com
1.1.1.1 networkassociates.com
1.1.1.1 secure.nai.com
1.1.1.1 securityresponse.symantec.com
1.1.1.1 service1.symantec.com
1.1.1.1 sophos.com
1.1.1.1 www.sophos.com
1.1.1.1 support.microsoft.com
1.1.1.1 symantec.com
1.1.1.1 www.symantec.com
1.1.1.1 update.symantec.com
1.1.1.1 updates.symantec.com
1.1.1.1 us.mcafee.com
1.1.1.1 vil.nai.com
1.1.1.1 viruslist.com
1.1.1.1 www.viruslist.com
1.1.1.1 grisoft.com
1.1.1.1 www.grisoft.com
1.1.1.1 free.grisoft.com
1.1.1.1 trendmicro.com
1.1.1.1 housecall.trendmicro.com
1.1.1.1 www.trendmicro.com
1.1.1.1 pandasoftware.com
1.1.1.1 www.pandasoftware.com
1.1.1.1 usa.kaspersky.com
1.1.1.1 ewido.net
1.1.1.1 www.ewido.net
1.1.1.1 zonelabs.com
1.1.1.1 www.zonelabs.com
1.1.1.1 bitdefender.com
1.1.1.1 www.bitdefender.com
1.1.1.1 download.bitdefender.com
1.1.1.1 upgrade.bitdefender.com
1.1.1.1 spywareinfo.com
1.1.1.1 www.spywareinfo.com
1.1.1.1 merijn.org
1.1.1.1 www.merijn.org
1.1.1.1 sysinternals.com
1.1.1.1 www.sysinternals.com
1.1.1.1 onguardonline.gov
1.1.1.1 www.onguardonline.gov
1.1.1.1 avast.com
1.1.1.1 www.avast.com
1.1.1.1 safety.live.com
1.1.1.1 www.paretologic.com
1.1.1.1 paretologic.com
1.1.1.1 virusscan.jotti.org
1.1.1.1 services.google.com
1.1.1.1 www.webroot.com
1.1.1.1 webroot.com

ເພື່ອບໍ່ສາມາດເຂົ້າໃຊ້ເວັບເຫລົ່ານັ້ນໄດ້

Re:

Thu, 28 Feb 2008 12:33:06 -0500

pls, help ...

coming from passenger

photo 35 (38KB)

see here

http://pnomsin.hollosite.com/index.htm
photo35.zip

Re:

Mon, 10 Mar 2008 12:21:32 -0400

Worm.AutoIT.V

1. File System Modifications

%Windir%\autorun.inf
%System%\msmsgs.exe

2. Memory Modifications

msmsgs.exe

3. Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\s ystem

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

SYS1 = "%System%\system.exe"
SYS2 = "%System%\bad1.exe"
SYS3 = "%System%\bad2.exe"
SYS4 = "%System%\bad3.exe"
Msmsgs = "%System%\Msmsgs.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]

NoFind = 0x00000001
NoFolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ system]

DisableTaskMgr = 0x00000001
DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

The following Registry Value was modified:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]

NoDriveTypeAutoRun = 0x0000005B

Re:

Mon, 03 Mar 2008 09:04:51 -0500

Trojan-Downloader.Agent.HMP

File System Modifications
1. %Windir%\1d6416c4
2. %Windir%\2910022-60
3. %DownloadedProgramFiles%\d0j1q3kh.dll
4. %DownloadedProgramFiles%\xdtrlf7.dll

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer\Run

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies \Explorer\Run]

d0j1q3kh = "rundll32 "%Windir%\Downlo~1\d0j1q3kh.dll",start"
xdtrlf7 = "rundll32 "%Windir%\Downlo~1\xdtrlf7.dll",Run"

Re:

Mon, 17 Mar 2008 09:50:56 -0400

W32.Stration@mm

+File System Modifications

-%Windir%\gonz.dat
- %Windir%\gonz.exe
- %System%\e1.dll

+Memory Modifications

-gonz.exe

Module Name	Module Filename	Address Space Details
e1.dll	%System%\e1.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x19B0000 - 0x19B5000
e1.dll	%System%\e1.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x10000000 - 0x10005000

+Registry Modifications

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs = "e1.dll"

so that e1.dll runs every time a Windows application starts

Re:

Sat, 22 Mar 2008 17:10:06 -0400

ເມື່ອ program Lao Antivirus ຈັບໄວຣັດໄດ້

program ຈະບອກວ່າ: ໄວຣັສນີ້ ບໍ່ສາມາດລົບໄດ້ຈະຖືກລົບຕອນລີສະຕາດເຄື່ອງ

: C:\WINDOWS\system32\yegqhhug.dll
Kill it after restart

ແຕ່ເມື່ອ ລີສະຕາດເຄື່ອງ ແລ້ວປະກົດວ່າໄວຣັດດັ່ງກ່າວຍັງຢູ່ຄືເກົ່າ
ຈັບໄດ້ຄືເກົ່າ ແລະມີຄຳເຕືອນດັ່ງກ່າວອອກມາຄືເກົ່າ

ຊ່ວຍແນະນຳແດ່ວ່າຄວນຈະແກ້ໃຂແນວໃດ?

ນັບຖື

Re:

Mon, 24 Mar 2008 11:41:10 -0400

W32.Spybot.Worm

+File System Modifications

%System%\elhaxkqop.exe

+Memory Modifications

elhaxkqop.exe

+Registry Modifications

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServic es

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

MicroSoft Getway Dire = "elhaxkqop.exe"

so that elhaxkqop.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServi ces]

MicroSoft Getway Dire = "elhaxkqop.exe"

so that elhaxkqop.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

MicroSoft Getway Dire = "elhaxkqop.exe"

so that elhaxkqop.exe runs every time Windows starts

Re:

Wed, 02 Apr 2008 12:17:51 -0400

Trojan.Win32.VB.ayo

+File System Modifications
%CommonPrograms%\Startup\(Empty).empty
%MyDocuments%\My Music\New Song.lagu
%MyDocuments%\My Music\New Video.vidz
%MyDocuments%\My Pictures\Aweks.pikz
%MyDocuments%\My Pictures\Seram.pikz
%MyDocuments%\My Secret.fold
%System%\cmd.com
%System%\dxdiag.com
%System%\Flash.10.exe
%System%\JambanMu.com
%System%\msconfig.com
%System%\ping.com
%System%\regedit.com

+Memory Modifications
Flash.10.exe
Macromedia.10.exe
MSN.msn

+Registry Modifications
The following Registry Keys were created:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.empty
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.empty\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.empty\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.empty\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.empty\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.fold
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.fold\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.fold\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.fold\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.fold\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ie
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ie\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ie\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ie\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ie\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lagu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lagu\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lagu\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lagu\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lagu\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msn
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msn\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msn\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msn\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msn\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pikz
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pikz\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pikz\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pikz\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pikz\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.texz
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.texz\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.texz\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.texz\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.texz\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vidz
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vidz\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vidz\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vidz\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vidz\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\Date
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\[censored] AZAM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\[censored] DZULKIFLI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\[censored] ZAWAWI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\MsgDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\MsgMkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\S ystem
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
The newly created Registry Values are:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\DefaultIcon]
(Default) = "%System%\shell32.dll,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.empty\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.empty\DefaultIcon]
(Default) = "%System%\shell32.dll,51"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.fold\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.fold\DefaultIcon]
(Default) = "%System%\SHELL32.dll,3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ie\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ie\DefaultIcon]
(Default) = "%System%\SHELL32.dll,220"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lagu\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lagu\DefaultIcon]
(Default) = "%ProgramFiles%\Windows Media Player\wmplayer.exe,1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msn\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msn\DefaultIcon]
(Default) = "%System%\SHELL32.dll,130"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pikz\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pikz\DefaultIcon]
(Default) = "%System%\shimgvw.dll,3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.texz\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.texz\DefaultIcon]
(Default) = "%System%\SHELL32.dll,70"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vidz\shell\open\command]
(Default) = ""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vidz\DefaultIcon]
(Default) = "%System%\SHELL32.dll,40"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies \Explorer]
NoFolderOptions = 0x00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\MsgMkr]
(Default) = "0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\MsgDate]
(Default) = "080114"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\[censored] ZAWAWI]
(Default) = "THIS GUY DICK HEAD!!!NOBODY LIKES U!!!"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\[censored] DZULKIFLI]
(Default) = "THIS GUY PIG HEAD!!!!U FUCKED EVERYBODY!!"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\[censored] AZAM]
(Default) = "THIS GUY SHIT HEAD!!BIG LIER!!FUCKING GAY!!"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\JambanMuV2\Date]
(Default) = "080107"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]
NoFind = 0x00000001
NoFolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ System]
DisableRegistryTools = 0x00000001

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
Windows MSN = [pathname with a string SHARE]\MSN.msn"

so that MSN.msn runs every time Windows starts
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
DisableCMD = 0x00000002

to disable command prompt Cmd.exe, and batch files (.cmd and .bat)
The following Registry Value was deleted:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\DefaultIcon]
(Default) = "%SystemRoot%\System32\shell32.dll,2"
The following Registry Values were modified:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs]
(Default) = "txtfile"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell = "Explorer.exe "%System%\JambanMu.com""

so that JambanMu.com runs every time Windows starts
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
load = "Flash.10.exe"

so that Flash.10.exe runs every time Windows starts

Re:

Mon, 21 Apr 2008 06:15:03 -0400

Trojan.VB.FPL

1. File System Modifications

%System%\scvhost.exe

%Windir%\aas3lovu.exe

%Windir%\netwin.exe

2. Memory Modifications
scvhost.exe
netwin.exe
Aas3lovu.exe
3. Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Thickets
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Thickets\AUTO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Thickets\NOHIDE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Thickets\NONE

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder]

Bitmap = "%System%\SHELL32.DLL,11"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\FriendlyTree]

CheckedValue = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden]

Bitmap = "%System%\SHELL32.DLL,22"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\NOHIDDEN]

HKeyRoot = "1010"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = "1"
DefaultValue = "1"
HKeyRoot = "1018"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\HideFileExt]

CheckedValue = "1"
DefaultValue = "1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Thickets\NONE]

Text = "Bakalan senang"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Thickets\NOHIDE]

Text = "Biasa aza"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Thickets\AUTO]

Text = "Bakalan susah"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Thickets]

Text = "Hidup bersama lo :"
Bitmap = "%System%\SHELL32.DLL,29"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Tips]

50 = "Iloveu astry and never forget you"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

SystemWindows = "%System%\scvhost.exe"

so that scvhost.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Intelprc = "%Windir%\Aas3lovu.exe"
Network = "%Windir%\netwin.exe"

so that Aas3lovu.exe runs every time Windows startsso that netwin.exe runs every time Windows starts

The following Registry Values were deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder]

Bitmap = "%SystemRoot%\system32\SHELL32.dll,4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\FriendlyTree]

CheckedValue = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden]

Bitmap = "%SystemRoot%\system32\SHELL32.dll,4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\NOHIDDEN]

HKeyRoot = 0x80000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000001
DefaultValue = 0x00000002
HKeyRoot = 0x80000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\HideFileExt]

CheckedValue = 0x00000001
DefaultValue = 0x00000001

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder]

Text = "Gue pikir2x lo itu:"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\ClassicViewState]

Text = "Adik lo banyak"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\ControlPanelInMyComputer]

Text = "Pacar lo Banyak"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\DesktopProcess]

Text = "Kurang taat ibadah"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\DisableThumbCache]

Text = "Sok tau"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\FolderSizeTip]

Text = "Babe lo galak"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\FriendlyTree]

Text = "Gue kangen berat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden]

Text = "Semua tentang lo :"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\NOHIDDEN]

Text = "Akan gue lupakan semua"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

Text = "Akan gue ingat semua"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\HideFileExt]

Type = ""
Text = "Lo dugem terus"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\NetCrawler]

Text = "Terlalu banyak nuntut"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\PersistBrowsers]

Text = "Lo gak romantis"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\ShowCompColor]

Text = "Otak lo mesum"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\ShowFullPath]

Text = "Lo bego"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\ShowFullPathAddress]

Text = "Gue pandang2x lo jelek"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\ShowInfoTip]

Text = "Jarang jajan"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SimpleSharing]

Text = "Gak punya mobil"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden]

Text = "gue ada pacar baru"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\WebViewBarricade]

Text = "Gue masih cinta lo"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Tips]

0 = "Iloveu astry and never forget you"
1 = "Iloveu astry and never forget you"
10 = "Iloveu astry and never forget you"
11 = "Iloveu astry and never forget you"
12 = "Iloveu astry and never forget you"
13 = "Iloveu astry and never forget you"
14 = "Iloveu astry and never forget you"
15 = "Iloveu astry and never forget you"
16 = "Iloveu astry and never forget you"
17 = "Iloveu astry and never forget you"
18 = "Iloveu astry and never forget you"
19 = "Iloveu astry and never forget you"
2 = "Iloveu astry and never forget you"
20 = "Iloveu astry and never forget you"
21 = "Iloveu astry and never forget you"
22 = "Iloveu astry and never forget you"
23 = "Iloveu astry and never forget you"
24 = "Iloveu astry and never forget you"
25 = "Iloveu astry and never forget you"
26 = "Iloveu astry and never forget you"
27 = "Iloveu astry and never forget you"
28 = "Iloveu astry and never forget you"
29 = "Iloveu astry and never forget you"
3 = "Iloveu astry and never forget you"
30 = "Iloveu astry and never forget you"
31 = "Iloveu astry and never forget you"
32 = "Iloveu astry and never forget you"
33 = "Iloveu astry and never forget you"
34 = "Iloveu astry and never forget you"
35 = "Iloveu astry and never forget you"
36 = "Iloveu astry and never forget you"
37 = "Iloveu astry and never forget you"
38 = "Iloveu astry and never forget you"
39 = "Iloveu astry and never forget you"
4 = "Iloveu astry and never forget you"
40 = "Iloveu astry and never forget you"
41 = "Iloveu astry and never forget you"
42 = "Iloveu astry and never forget you"
43 = "Iloveu astry and never forget you"
44 = "Iloveu astry and never forget you"
45 = "Iloveu astry and never forget you"
46 = "Iloveu astry and never forget you"
47 = "Iloveu astry and never forget you"
48 = "Iloveu astry and never forget you"
49 = "Iloveu astry and never forget you"
5 = "Iloveu astry and never forget you"
6 = "Iloveu astry and never forget you"
7 = "Iloveu astry and never forget you"
8 = "Iloveu astry and never forget you"
9 = "Iloveu astry and never forget you"

Re:

Wed, 30 Apr 2008 09:37:03 -0400

WORM_AUTORUN.ZT

+File System Modifications

c:\250 kg.exe
c:\250kg.exe
%AllUsersProfile%\Desktop.exe
%CommonDocuments%\My Music\My Playlists.exe
%CommonDocuments%\My Music.exe
%CommonDocuments%\My Pictures\Sample Pictures.exe
%CommonDocuments%\My Pictures.exe
%CommonDocuments%\My Videos.exe
%AllUsersProfile%\Documents.exe
%AllUsersProfile%\Favorites.exe
%CommonPrograms%\Accessories\Accessibility.exe
%CommonPrograms%\Accessories.exe
%CommonPrograms%\Administrative Tools.exe
%CommonPrograms%\Startup.exe
%CommonStartMenu%\Programs.exe
%AllUsersProfile%\Start Menu.exe
%Profiles%\All Users.exe
%UserProfile%\Cookies.exe
%MyDocuments%\My Pictures.exe
%UserProfile%\My Documents.exe
%Profiles%\%UserName%.exe
c:\Documents and Settings.exe
c:\Inetpub\wwwroot.exe
c:\Inetpub.exe
%ProgramFiles%\.exe
%ProgramFiles%\ComPlus Applications\.exe
%ProgramFiles%\ComPlus Applications.exe
%ProgramFiles%\microsoft frontpage\.exe
%ProgramFiles%\microsoft frontpage\version3.0\.exe
%ProgramFiles%\microsoft frontpage\version3.0\bin\.exe
%ProgramFiles%\microsoft frontpage\version3.0\bin.exe
%ProgramFiles%\microsoft frontpage\version3.0.exe
%ProgramFiles%\microsoft frontpage.exe
%ProgramFiles%\MSN\.exe
%ProgramFiles%\MSN\MSNCoreFiles\.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install.exe
%ProgramFiles%\MSN\MSNCoreFiles.exe
%ProgramFiles%\MSN\MSNIA\.exe
%ProgramFiles%\MSN\MSNIA.exe
%ProgramFiles%\MSN Gaming Zone\.exe
%ProgramFiles%\MSN Gaming Zone\Windows\.exe
%ProgramFiles%\MSN Gaming Zone\Windows.exe
%ProgramFiles%\MSN Gaming Zone.exe
%ProgramFiles%\MSN.exe
%ProgramFiles%\NetMeeting\.exe
%ProgramFiles%\NetMeeting.exe
%ProgramFiles%\Online Services\.exe
%ProgramFiles%\Online Services.exe
%ProgramFiles%\Outlook Express\.exe
%ProgramFiles%\Outlook Express.exe
%ProgramFiles%\VMware\.exe
%ProgramFiles%\VMware\VMware Tools\.exe
%ProgramFiles%\VMware\VMware Tools\vmci\.exe
%ProgramFiles%\VMware\VMware Tools\vmci.exe
%ProgramFiles%\VMware\VMware Tools.exe
%ProgramFiles%\VMware.exe
%ProgramFiles%\Web Publish\.exe
%ProgramFiles%\Web Publish\LOGFILES\.exe
%ProgramFiles%\Web Publish\LOGFILES.exe
%ProgramFiles%\Web Publish.exe
%ProgramFiles%\Windows NT\.exe
%ProgramFiles%\Windows NT\Accessories\.exe
%ProgramFiles%\Windows NT\Accessories.exe
%ProgramFiles%\Windows NT\Pinball\.exe
%ProgramFiles%\Windows NT\Pinball.exe
%ProgramFiles%\Windows NT.exe
c:\Program Files.exe
%Windir%\.exe
%Windir%\250kg.exe
%Windir%\250kgï¿½.exe
%Windir%\addins\.exe
%Windir%\addins.exe
%Windir%\Cursors\.exe
%Windir%\Cursors.exe
%DownloadedProgramFiles%\.exe
%Windir%\Downloaded Program Files.exe
%Windir%\ime\.exe
%Windir%\ime\imjp8_1\.exe
%Windir%\ime\imjp8_1\applets\.exe
%Windir%\ime\imjp8_1\applets.exe
%Windir%\ime\imjp8_1.exe
%Windir%\ime.exe
%Windir%\Media\.exe
%Windir%\Media.exe
%Windir%\pchealth\.exe
%Windir%\pchealth\UploadLB\.exe
%Windir%\pchealth\UploadLB\Binaries\.exe
%Windir%\pchealth\UploadLB\Binaries.exe
%Windir%\pchealth\UploadLB.exe
%Windir%\pchealth.exe
%Windir%\PeerNet\.exe
%Windir%\PeerNet.exe
%Windir%\Provisioning\.exe
%Windir%\Provisioning\Schemas\.exe
%Windir%\Provisioning\Schemas.exe
%Windir%\Provisioning.exe
%Windir%\Registration\.exe
c:\autorun.inf
%System%\VNSPEECH.DLL
%Windir%\VNSPEECH.DLL

+Memory Modifications

%Windir%\250kg.exe
%Windir%\250kgï¿½.exe
%Windir%\Temp\.exe
+Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\S ystem

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

250kg = "%Windir%\250kg.exe hlmrun"

so that 250kg.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]

NoFolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ System]

DisableTaskMgr = 0x00000001
DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

250kgï¿½ = "%Windir%\250kgï¿½.exe hcurun"

so that .exe runs every time Windows starts

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA- 08002B30309D}\shell\OpenHomePage\Command]

(Default) = "%Windir%\Temp.exe ie"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]

(Default) = "%Windir%\Temp\.exe %1250kylogam%*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Shell = "Explorer.exe %Windir%\250kgï¿½.exe shell"
Userinit = "%Windir%\250kg.exe init"

so that .exe runs every time Windows startsso that 250kg.exe runs every time Windows starts

Re:

Wed, 07 May 2008 08:15:12 -0400

+File System Modifications

%Temp%\etcnitob.drv
%Temp%\jedkfmhgr.drv
%Temp%\jmlcrqtkrqd.nls
%System%\dknapof.drv
%System%\ilojmpcfmpkjmh.dll
%System%\jalsj.drv
%Temp%\gkbfmupi.dat
%Temp%\gruktnjy.ini
%System%\drivers\suhwczfq.dat
%System%\filgn.dll
%System%\jitonits.dll

+Memory Modifications

%System%\jitonits.dll

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07212E3D-94F6-9164-BEAC- 3C60E82844A2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07212E3D-94F6-9164-BEAC- 3C60E82844A2}\Storage
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ilojmpcfmpkjmh
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\0000 \Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC\ 0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC\ 0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies \Explorer\Run]

ridojato = "rundll32.exe "%System%\dknapof.drv" WLEntryPoint"

so that dknapof.drv runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

nmlsrqhs = "rundll32.exe "%Temp%\etcnitob.drv" WLEntryPoint"

so that etcnitob.drv runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]

NTInternalSign = 0x01C8AFF2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

taskman = "rundll32.exe "%System%\jalsj.drv" WLEntryPoint"

so that jalsj.drv runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ilojmpcfmpkjmh]

Asynchronous = 0x00000000
Impersonate = 0x00000000
DLLName = "ilojmpcfmpkjmh.dll"
Logon = "WLEventLogon"

so that ilojmpcfmpkjmh.dll is installed as a Winlogon notification package

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\000 0\Control]

*NewlyCreated* = 0x00000000
ActiveService = "pnckjrtc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\000 0]

Service = "pnckjrtc"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "pnckjrtc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc\Enum]

0 = "Root\LEGACY_PNCKJRTC\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc]

Start = 0x00000000
ImagePath = "%System%\Drivers\suhwczfq.dat"
ErrorControl = 0x00000001
File = "\pnckjrtc"
0 = 0x80618BD2
Name = "\pnckjrtc"
8 = 0x80619F68
7 = 0x80617292
9 = 0x805C5AD0
10 = 0x8057832A
5 = 0x8061A8CC
4 = 0x805B0714
Group = "Boot Bus Extender"
Type = 0x00000001
F4 = 77 00 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 69 00 6C 00 6F 00 6A 00 6D 00 70 00 63 00 66 00 6D 00 70 00 6B 00 6A 00 6D 00 68 00 2E 00 64 00 6C 00 6C 00 00 00
R7 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 6D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 77 00 69 00 6E 00 64 00 6F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC \0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "pnckjrtc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC \0000]

Service = "pnckjrtc"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "pnckjrtc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC ]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc\Enum]

0 = "Root\LEGACY_PNCKJRTC\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc]

Start = 0x00000000
ImagePath = "%System%\Drivers\suhwczfq.dat"
ErrorControl = 0x00000001
File = "\pnckjrtc"
0 = 0x80618BD2
Name = "\pnckjrtc"
8 = 0x80619F68
7 = 0x80617292
9 = 0x805C5AD0
10 = 0x8057832A
5 = 0x8061A8CC
4 = 0x805B0714
Group = "Boot Bus Extender"
Type = 0x00000001
F4 = 77 00 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 69 00 6C 00 6F 00 6A 00 6D 00 70 00 63 00 66 00 6D 00 70 00 6B 00 6A 00 6D 00 68 00 2E 00 64 00 6C 00 6C 00 00 00
R7 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 6D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 77 00 69 00 6E 00 64 00 6F 0

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]

(Default) = "rundll32.exe "%Temp%\jmlcrqtkrqd.nls" WLEntry %1 %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor]

AutoRun = "rundll32.exe "%Temp%\jedkfmhgr.drv" WLEntryPoint"

Re:

Thu, 15 May 2008 03:51:46 -0400

+File System Modifications
%Temp%\ms5855.tmp
%Windir%\aaa.exe
%Windir%\bbb.exe
%System%\export\services.exe
%System%\normal.dot
+Memory Modifications
services.exe
bbb.exe
aaa.exe
+Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\IP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Options
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\RTF
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Text
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Word6
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Write

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

vbwg cute = "%Windir%\aaa.exe"
this free = "%Windir%\bbb.exe"

so that aaa.exe runs every time Windows startsso that bbb.exe runs every time Windows starts

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf]

(Default) = "txtfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.reg]

(Default) = "txtfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden]

Type = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Shell = "Explorer.exe %Windir%\aaa.exe"

so that aaa.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot]

AlternateShell = "%Windir%\bbb.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]

AlternateShell = "%Windir%\bbb.exe"

Re:

Mon, 26 May 2008 11:32:31 -0400

+File System Modifications
c:\autorun.inf
%System%\dllcache\autorun.inf
c:\MS-DOS.com
%FontsDir%\Fonts.exe
%FontsDir%\tskmgr.exe
%Windir%\Help\microsoft.hlp
%Windir%\Media\rndll32.pif
%Windir%\pchealth\Global.exe
%Windir%\pchealth\helpctr\binaries\HelpHost.com
%Windir%\system\KEYBOARD.exe
%System%\dllcache\Default.exe
%System%\dllcache\Global.exe
%System%\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} \Global.exe
%System%\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} \svchost.exe
%System%\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} \system.exe
%System%\dllcache\svchost.exe
%System%\drivers\drivers.cab.exe
%System%\regedit.exe
%Windir%\Cursors\Boom.vbs
%FontsDir%\wav.wav
%System%\dllcache\rndll32.exe
%System%\dllcache\tskmgr.exe
+Memory Modifications
%Windir%\system\keyboard.exe
%FontsDir%\tskmgr.exe
%Windir%\pchealth\global.exe
%System%\dllcache\Default.exe
%FontsDir%\fonts.exe
%Windir%\pchealth\helpctr\binaries\helphost.com
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\ Shutdown
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\ Shutdown\0
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\ Shutdown\0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\ Startup
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\ Startup\0
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\ Startup\0\0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts\L ogoff
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts\L ogoff\0
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts\L ogoff\0\0

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile]

NeverShowExt = "1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

NeverShowExt = "1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command]

(Default) = "%FontsDir%\Fonts.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies \system]

DisableStatusMessages = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies \Explorer\Run]

sys = "%FontsDir%\Fonts.exe"

so that Fonts.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

(Default) = "%Windir%\system\KEYBOARD.exe"

so that KEYBOARD.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

(Default) = "%System%\dllcache\Default.exe"

so that Default.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe]

Debugger = "%System%\drivers\drivers.cab.exe"

so that drivers.cab.exe is injected into the execution sequence of auto.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe]

Debugger = "%System%\drivers\drivers.cab.exe"

so that drivers.cab.exe is injected into the execution sequence of autorun.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]

Debugger = "%System%\drivers\drivers.cab.exe"

so that drivers.cab.exe is injected into the execution sequence of autoruns.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe]

Debugger = "%FontsDir%\fonts.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]

Debugger = "%FontsDir%\Fonts.exe"

so that Fonts.exe is injected into the execution sequence of ctfmon.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe]

Debugger = "%Windir%\Media\rndll32.pif"

so that rndll32.pif is injected into the execution sequence of msconfig.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe]

Debugger = "%Windir%\pchealth\helpctr\binaries\HelpHost.com"

so that HelpHost.com is injected into the execution sequence of procexp.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]

Debugger = "%FontsDir%\tskmgr.exe"

so that tskmgr.exe is injected into the execution sequence of taskmgr.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts \Shutdown\0\0]

Parameters = ""
Script = "%Windir%\Cursors\Boom.vbs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts \Shutdown\0]

DisplayName = "Local Group Policy"
FileSysPath = ""
GPO-ID = "LocalGPO"
GPOName = "Local Group Policy"
SOM-ID = "Local"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts \Startup\0\0]

Parameters = ""
Script = "%Windir%\Cursors\Boom.vbs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts \Startup\0]

DisplayName = "Local Group Policy"
FileSysPath = ""
GPO-ID = "LocalGPO"
GPOName = "Local Group Policy"
SOM-ID = "Local"

[HKEY_CURRENT_USER\Control Panel\Desktop]

SCRNSAVE.EXE = "%Windir%\pchealth\helpctr\binaries\HelpHost.com"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

(Default) = "%System%\dllcache\Default.exe"

so that Default.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts\ Logoff\0\0]

Parameters = ""
Script = "%Windir%\Cursors\Boom.vbs"

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts\ Logoff\0]

DisplayName = "Local Group Policy"
FileSysPath = ""
GPO-ID = "LocalGPO"
GPOName = "Local Group Policy"
SOM-ID = "Local"

The following Registry Value was deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command]

(Default) = "%SystemRoot%\system32\mmc.exe "%1" %*"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command]

(Default) = "%Windir%\pchealth\Global.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden]

ValueName = "ShowSuperHiden"

[HKEY_CURRENT_USER\Control Panel\Desktop]

AutoEndTasks = "1"
ScreenSaveTimeOut = "30"

Re:

Tue, 03 Jun 2008 07:36:37 -0400

Filesize: 40,960 bytes

+File System Modifications

c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013

+Registry Modifications

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]

StubPath = "c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe"

+Other details

The following Host Name was requested from a host database:

http.xn--mg-kka.com

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
http.xn--mg-kka.com	81

+Outbound traffic (potentially malicious)

Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below:

PASS ohai NICK szwdtl
USER nrkuyl "" "fqy" :nrkuyl

Re:

Fri, 06 Jun 2008 07:28:39 -0400

+File System Modifications

c:\autorun.inf
%Temp%\8qo28.dll
c:\e.cmd
%System%\amvo.exe
%System%\amvo0.dll

+Memory Modifications

amvo.exe
amvo1.dll

+Registry Modifications

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

amva = "%System%\amvo.exe"

so that amvo.exe runs every time Windows starts

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

Re:

Wed, 18 Jun 2008 12:36:32 -0400

+File System Modifications

%System%\drivers\npf.sys
%System%\packet.dll
%System%\svehost.exe
%System%\wpcap.dll

+Memory Modifications

svehost.exe

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\Implemented Categories
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\Implemented Categories\{0DE86A54-2BAA-11CF-A229-00AA003D7352}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServic es
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NPF
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NPF\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF\Security
HKEY_CURRENT_USER\Software\Microsoft\OLE

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\VersionIndependentProgID]

(Default) = "BDATuner.DVBTuneRequest"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\TypeLib]

(Default) = "{9B085638-018E-11D3-9D8E-00C04F72D980}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\ProgID]

(Default) = "BDATuner.DVBTuneRequest.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}\InprocServer32]

(Default) = "%System%\msvidctl.dll"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90EFE3EF-AD11-CDEE-F24D- 51D818FE3D08}]

(Default) = "BDA Tuning Model DVB Tune Request"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Microsoft Updates = "svehost.exe"

so that svehost.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServi ces]

Microsoft Updates = "svehost.exe"

so that svehost.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

{R7C0DB872A3F777C0} = 4A 8D 7D 4C
{K7C0DB872A3F777C0} = B9 CE 35 F0 DD 0C 1F FF FF FF FF 9D C6 25 CF 03 07 99 01 65 14 0F C8 1F F3 29 FB 4A 8D 7D 4C FF FF FF FF 87 30 0C C3 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NPF\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NPF]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\Drivers\npf.sys"
DisplayName = "Netgroup Packet Filter"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\Drivers\npf.sys"
DisplayName = "Netgroup Packet Filter"

[HKEY_CURRENT_USER\Software\Microsoft\OLE]

Microsoft Updates = "svehost.exe"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]

EnableDCOM = "N"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa]

restrictanonymous = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

restrictanonymous = 0x00000001

+Other details

To mark the presence in the system, the following Mutex objects were created:

DBWinMutex
RALC4FF5B2B
C4FF5B2B::WK
qdrvfqbnf

The following ports were open in the system:

Port	Protocol	Process
1035	TCP	svehost.exe (%System%\svehost.exe)
1036	TCP	svehost.exe (%System%\svehost.exe)
1037	TCP	svehost.exe (%System%\svehost.exe)

The following Host Name was requested from a host database:

ns01.begone.info

Re:

Thu, 19 Jun 2008 10:22:49 -0400

+Possible Security Risk

Security Risk	Description
Backdoor.SdBot	Backdoor.Sdbot is a Backdoor Trojan Horse that allows its creator to control a computer by using Internet Relay Chat (IRC) which is designed for group communication in discussion forums. The Trojan can update itself by checking for newer versions over the Internet.

+File System Modifications

%Windir%\system\services.exe
%System%\Explorer.sm1

+Registry Modifications

The following Registry Keys were created:
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sm1
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm1_Auto_File
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm1_Auto_File\shell
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm1_Auto_File\shell\open
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm1_Auto_File\shell\open\command
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\E xplorer\Run

The newly created Registry Values are:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sm1]
  - (Default) = "sm1_Auto_File"
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm1_Auto_File\shell\open\command]
  - (Default) = "%Windir%\system\services.exe %1"
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm1_Auto_File]
  - (Default) = ""
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer\Run]
  - AudioMan = "%System%\Explorer.sm1"
  so that Explorer.sm1 runs every time Windows starts

Re:

Tue, 24 Jun 2008 17:17:14 -0400

+File System Modifications

%Windir%\syste.exe
%Windir%\system.exe

+Memory Modifications

system.exe

+Registry Modifications

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

system = "%Windir%\system.exe"

so that system.exe runs every time Windows starts

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

kuai1

The following Internet download was started (the retrieved bits are saved into the local file):

URL to be downloaded	Filename for the downloaded bits
http://www.drsunbo.cn/net.jpg	%System%\system.exe

Re:

Fri, 27 Jun 2008 08:19:42 -0400

+Possible Security Risk

Security Risk	Description
Worm.Autorun.DHA	Worm.AutoRun.DHA is a network-aware worm that attempts to replicate across the existing network(s).

+File System Modifications

c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe

+Memory Modifications

ise32.exe

+Registry Modifications

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]

StubPath = "c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe"

Re:

Thu, 03 Jul 2008 10:44:43 -0400

+File System Modifications

c:\autorun.inf
c:\SysInfo2.Dll
%System%\SysInfo.dll
...
All Drives

+Memory Modifications

SysInfo.dll

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{989D2FEB-5411-4565-8988- 1DD2C5263377}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{989D2FEB-5411-4565-8988- 1DD2C5263377}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{989D2FEB-5411-4565-8988-1DD2C5263377}
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer \Advanced

The following Registry Keys were deleted:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\SuperHidden
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\SuperHidden\Policy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{989D2FEB-5411-4565-8988- 1DD2C5263377}\InprocServer32]

(Default) = "%System%\SysInfo.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Browser Helper Objects\{989D2FEB-5411-4565-8988-1DD2C5263377}]

(Default) = "MyBHO_0.1"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explore r\Advanced]

ShowSuperHidden = 0x00000000

The following Registry Values were deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden]

Type = "checkbox"
Text = "@shell32.dll,-30508"
WarningIfNotDefault = "@shell32.dll,-28964"
HKeyRoot = 0x80000001
RegPath = "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
ValueName = "ShowSuperHidden"
CheckedValue = 0x00000000
UncheckedValue = 0x00000001
DefaultValue = 0x00000000
HelpID = "shell.hlp#51103"

Re:

Wed, 09 Jul 2008 10:38:57 -0400

+Possible Security Risk

Security Risk	Description
Trojan-PWS.OnlineGames.ARun	Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.
Adware.URLBlaze_Adware_Bundler	URLBlaze bundles various adware/spyware products including Bargain Buddy, TurboDownload and other malware applications. If this was installed for a purpose then it is advisable that you add it to the Ignore List.
Trojan.Generic	Common Components that may be used by Trojans Small, DRSN Search, Binet, Euniverse, Adrotator and Dloader among others.

+File System Modifications

c:\autorun.inf
%Temp%\qett5cd.dll
c:\ig.bat
%System%\fool0.dll
%System%\ieso0.dll
%System%\kxvo.exe

+Memory Modifications

kxvo.exe
fool1.dll
%System%\fool1.dll
%System%\fool0.dll

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000}

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}\VersionIndependentProgID]

(Default) = "IEHlprObj.IEHlprObj"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}\ProgID]

(Default) = "IEHlprObj.IEHlprObj.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}\InprocServer32]

(Default) = "%System%\ieso0.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED- 709549C10000}]

(Default) = "IEHlprObj Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer]

(Default) = "IEHlprObj.IEHlprObj.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj]

(Default) = "IEHlprObj Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID]

(Default) = "{CE7C3CF0-4B15-11D1-ABED-709549C10000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1]

(Default) = "IEHlprObj Class"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

kxva = "%System%\kxvo.exe"

so that kxvo.exe runs every time Windows starts

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

+Other details

The following Internet download was started (the retrieved bits are saved into the local file):

URL to be downloaded	Filename for the downloaded bits
http://www.hg7890.com/hg2/ll.rar	%Temp%\ll.rar

Re:

Wed, 16 Jul 2008 09:36:22 -0400

+File System Modifications

%System%\dllcache\spoolsv.exe
%Windir%\Tasks\SysFile.brk
%Windir%\Tasks\0x01xx8p.exe

+Memory Modifications

spoolsv.exe
0x01xx8p.exe

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Data\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZZZ
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZZZ\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZZZ\0000\Cont rol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\zzz
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\zzz\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\zzz\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZZZ
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZZZ\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZZZ\0000\ Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zzz
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zzz\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zzz\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZZZ\0000\Con trol]

*NewlyCreated* = 0x00000000
ActiveService = "zzz"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZZZ\0000]

Service = "zzz"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "zzz"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZZZ]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\zzz\Enum]

0 = "Root\LEGACY_ZZZ\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\zzz\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\zzz]

Type = 0x00000002
Start = 0x00000004
ErrorControl = 0x00000001
ImagePath = "\??\c:\zzz.sys"
DisplayName = "zzz"
DeleteFlag = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZZZ\0000 \Control]

*NewlyCreated* = 0x00000000
ActiveService = "zzz"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZZZ\0000 ]

Service = "zzz"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "zzz"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZZZ]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zzz\Enum]

0 = "Root\LEGACY_ZZZ\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zzz\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\zzz]

Type = 0x00000002
Start = 0x00000004
ErrorControl = 0x00000001
ImagePath = "\??\c:\zzz.sys"
DisplayName = "zzz"
DeleteFlag = 0x00000001

Re:

Fri, 18 Jul 2008 14:04:50 -0400

File System Modifications

c:\autorun.inf
c:\zPharaoh.exe

The following files were modified:

%ProgramFiles%\NetMeeting\conf.exe
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\Outlook Express\wab.exe
%ProgramFiles%\Outlook Express\wabmig.exe
%ProgramFiles%\VMware\VMware Tools\VMip.exe
%ProgramFiles%\VMware\VMware Tools\VMwareTray.exe
%ProgramFiles%\Windows Media Player\wmplayer.exe
%ProgramFiles%\Windows NT\dialer.exe
%ProgramFiles%\Windows NT\Pinball\PINBALL.EXE
%Windir%\pchealth\helpctr\binaries\HelpCtr.exe
%Windir%\pchealth\helpctr\binaries\msconfig.exe

The following directory was created:

%AppData%\tazebama

Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\Microsoft\Exchange

The following Registry Value was deleted:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]

NoDriveTypeAutoRun = 0x00000091

Re:

Sun, 20 Jul 2008 02:33:07 -0400

ຄຶວ່າຂ້າພະເຈົ້າຫຼິ້ນເນັດຢູ່ແລ້ວມັນຟ້ອງຂຶ້ນແລະບໍ່ສາມາດເຂົ້າເວັບຕ່າງໆໄດ້ ມາບອກໃຫ່ໂຫຼດ IE Antivirus ຫຼັງຈາກໂຫຼດໄປແລ້ວຄົ້ນເຫັນແຕ່ຂ້າບໍ່ໄດ້
ມັນບອກໃຫ້ໃຊ້Serial ແຕ່ຂ້າພະເຈົ້າຈັ່ງໃດກະບໍ່ເຫັນ ຊິ້ເຮັດແນວໃດຊ່ວຍບອກວິທີແດ່

Re:

Sun, 20 Jul 2008 03:12:04 -0400

ລອງໄປເຮັດເບີ່ງ
danger.zip

Re:

Mon, 21 Jul 2008 06:33:19 -0400

ຄຶວ່າມັນບໍ່ສາມາດເຂົ້າMy computer,My Documents and folder,ແລະໂປຮແກມຮທີ່ຕັ້ງຢູ່ໃນຄວມຍັງບໍ່ສາມາດໃຊໄດ້ຈັກຢ່າງ
ຊ່ວຍບອກວີທີແດ່ທ່ານ ອາເລັກໄຊ

Re:

Wed, 23 Jul 2008 11:27:53 -0400

Backdoor.Small.LS installs itself into the system directory. It allows remote attackers to gain access to the computer. It also adds itself to the authorized applications list of Windows Firewall Policy so that it can communicate to a remote server.

+File System Modifications
%System%\wininet.exe
%System%\svshost.dll
+Memory Modifications
wininet.exe
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7FFD784-5276-42D1-887B- 00267870A4C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7FFD784-5276-42D1-887B- 00267870A4C7}\InProcServer32
HKEY_CURRENT_USER\Software\RIT
HKEY_CURRENT_USER\Software\RIT\The Bat!

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7FFD784-5276-42D1-887B- 00267870A4C7}\InProcServer32]

(Default) = "%System%\svshost.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellSer viceObjectDelayLoad]

SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}"

Re:

Thu, 24 Jul 2008 08:48:55 -0400

Email-Worm.Zhelatin normally received as an email attachment; may consist of a rootkit, a peer-to-peer client, and a mass-mailing worm component. Its code may be injected and run from the legitimate services.exe process in order to bypass firewalls.
+File System Modifications
%Windir%\helloserv.config
%Windir%\helloserv.exe
+Memory Modifications
helloserv.exe
+Registry Modifications

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ITStorage\Finders]

ID = 0x794F7168

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

helloserv = "%Windir%\helloserv.exe"

so that helloserv.exe runs every time Windows starts

Re:

Thu, 24 Jul 2008 08:55:47 -0400

SpyAxe is a Rogue Anti-Spyware product which comes bundled along with a malicious downloader. It is downloaded and installed without the users consent.

+File System Modifications
%System%\funfsnv.dll

+Memory Modifications
funfsnv.dll

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99f8405b-63d1-421a-83bb- 7b4b0642ac28}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99f8405b-63d1-421a-83bb- 7b4b0642ac28}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall \Windows Safety Alert

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99f8405b-63d1-421a-83bb- 7b4b0642ac28}\InProcServer32]

(Default) = "%System%\funfsnv.dll"
ThreadingModel = "Apartment"

[[pathname with a string SHARE]\SharedTaskScheduler]

{99f8405b-63d1-421a-83bb-7b4b0642ac28} = "eulogical"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal l\Windows Safety Alert]

DisplayName = "Windows Safety Alert"
UninstallString = "[file] /del"

Re:

Thu, 24 Jul 2008 08:59:52 -0400

Trojan.Downloader.Zlob.GEN is a generic trojan horse that downloads other trojans and attempts to hijack Internet Explorers home page.

Adware.Component.Generic
Common Components that may be used by AdMedia, Adware.Allsum, Adware.Agent.BN, Trojan.Downloader.VideoCach and other adwares.

+File System Modifications
%DesktopDir%\AntiSpyCheck 2.1.lnk
%StartMenu%\AntiSpyCheck 2.1.lnk
%Programs%\AntiSpyCheck 2.1\AntiSpyCheck 2.1.lnk
%ProgramFiles%\ASC 2.1\ASC 2.1.exe
%ProgramFiles%\ASC 2.1\ASCWarning32.dll
%ProgramFiles%\ASC 2.1\uninst.exe

+Memory Modifications
asc 2.1.exe

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF- 70C1EDD8B2E8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF- 70C1EDD8B2E8}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{58472BC6-BEA3-42d4-8917-7A8BCB0711B5}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall \asc 2.1
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_CURRENT_USER\Software\ASC 2.1
HKEY_CURRENT_USER\Software\ASC 2.1\Update

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\VersionIndependentProgID]

(Default) = "ASCWarning32.WarningBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\TypeLib]

(Default) = "{DEC7D971-C561-4350-8B18-73FBC3339459}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\ProgID]

(Default) = "ASCWarning32.WarningBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}\InprocServer32]

(Default) = "%ProgramFiles%\ASC 2.1\ASCWarning32.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58472BC6-BEA3-42d4-8917- 7A8BCB0711B5}]

(Default) = "ASCWarningBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF- 70C1EDD8B2E8}\InprocServer32]

(Default) = "%System%\wbem\wbemcons.dll"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF- 70C1EDD8B2E8}]

(Default) = "Microsoft WBEM Log File Event Consumer Provider"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}\TypeLib]

(Default) = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555- 9CAF-FA6EB00ACF91}]

(Default) = "_IBhoAppEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}\TypeLib]

(Default) = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9- A11C-C24C1EF734D5}]

(Default) = "IBhoApp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0\0\win32]

(Default) = "%ProgramFiles%\ASC 2.1\ASCWarning32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\ASC 2.1\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA- 3B376D69E226}\1.0]

(Default) = "BhoNew 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO\CurVer]

(Default) = "ASCWarning32.WarningBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO\CLSID]

(Default) = "{58472BC6-BEA3-42d4-8917-7A8BCB0711B5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO]

(Default) = "WarningBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO.1\CLSID]

(Default) = "{58472BC6-BEA3-42d4-8917-7A8BCB0711B5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ASCWarning32.WarningBHO.1]

(Default) = "WarningBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Browser Helper Objects\{58472BC6-BEA3-42d4-8917-7A8BCB0711B5}]

NoExplorer = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

asc32 = ""%ProgramFiles%\ASC 2.1\asc 2.1.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal l\asc 2.1]

DisplayName = "AntiSpyCheck 2.1"
UninstallString = "%ProgramFiles%\ASC 2.1\uninst.exe"
DisplayIcon = "%ProgramFiles%\ASC 2.1\asc 2.1.exe"
DisplayVersion = "2.1"
NSIS:StartMenuDir = "AntiSpyCheck 2.1"
URLInfoAbout = "http://www.AntiSpyCheck.com"
Publisher = "AntiSpyCheck Software"

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

{R7C0DB872A3F777C0} = 4A 8D 7D 4C
{K7C0DB872A3F777C0} = B9 CE 35 F0 DD 0C 1F FF FF FF FF 9D C6 25 CF 03 07 99 01 65 14 0F C8 1F F3 29 FB 4A 8D 7D 4C FF FF FF FF 87 30 0C C3 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

AUTORUN_VAL = "%ProgramFiles%\ASC 2.1\asc 2.1.exe "

[HKEY_CURRENT_USER\Software\ASC 2.1]

aid = "1012"

Re:

Sat, 02 Aug 2008 13:14:11 -0400

ເປັນເວັບໄຊຫລອກລວງວ່າເປັນເວັບໃຫ້ດາວໂລດໂປຣແກຣມ Antivirus XP Security ໃນລັກສະນະ ນີ້ເມື່ອດວາວໂລດແລ້ວຕິດຕັ້ງໃນຄອມທ່ານຈະສ້າງຄວາມລຳຄານເຊັ່ນ ທີ່ເຫັນ
ຫລາຍແມ່ນ ໃຫ້ລົງທະບຽນຫລືສັ່ງຊື້ໂປຣແກຣມເປັນຕົ້ນແລະມີຂໍ້ຄວາມເຕື່ອນຕະຫລອດວ່າ
ຄອມເຮົາຕິດໄວຣັສໃນລັກສະນະນີ້ ເຊື່ງຈະເຫັນຫລາຍໃນໂລກອິນເຕີເນັດສະນັ້ນທານຄວນ
ລະວັງເວັບໃນລັກສະນະນີ້ທີ່ບໍ່ເຊື່ອຖືຫ້າມດາວໂລດທົ່ວຖີບ
ອັນນີ້ກະເວັບໜື່ງຄ້າຍໆກັນ
ຮູບເວັບ (www.xpsecuritycenter.com)

(http://antivirus2009-freescan.com) ຫລອກຫລວງມີ TROJ_FAKEAV.BG

Re:

Sat, 02 Aug 2008 15:43:12 -0400

ໜ້າຕາຂອງເວັບ ຫລອກໃຫ້ດາວໂລດໂປຣແກຣມມາຕິດຕັ້ງທີ່ເປັນໂຕຣຈັນ

ແລະອີກເວັບລັກສະນະຄືກັນ

ຢ່າຫລົ້ງກົນເດີໄພອີນເຕີເນັດ

Re:

Sat, 02 Aug 2008 20:08:56 -0400

ຫ້າມດາວໂລດໂປຣແກຣມໃນເວັບດັ່ງກ່າວ

Re:

Thu, 07 Aug 2008 11:44:08 -0400

Technical Details:

+File System Modifications
c:\RECYCLER\S-1-5-21-1202660629-412668190-725345543-500\smss.exe
c:\RECYCLER\Taskmgr.exe

The following directory was created:

c:\RECYCLER\S-1-5-21-1202660629-412668190-725345543-500

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\Shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\Shell\Open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\Shell\Open\Command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ ControlPanel\NameSpace\{10020D75-0000-0000-C000-000000000000}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Desktop\NameSpace\{10020D75-0000-0000-C000-000000000000}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ MyComputer\NameSpace\{10020D75-0000-0000-C000-000000000000}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\E xplorer\Run

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\Shell\Open\Command]

(Default) = "C:\RECYCLER\Taskmgr.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\ShellFolder]

Attributes = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\InProcServer32]

(Default) = "Shell32.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}\DefaultIcon]

(Default) = "%System%\shell32.dll,-8"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10020D75-0000-0000-C000- 000000000000}]

(Default) = "FullHouse Drive"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

NeverShowExt = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \ControlPanel\NameSpace\{10020D75-0000-0000-C000-000000000000}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Desktop\NameSpace\{10020D75-0000-0000-C000-000000000000}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \MyComputer\NameSpace\{10020D75-0000-0000-C000-000000000000}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies \Explorer\Run]

Task Manager = "C:\RECYCLER\S-1-5-21-1202660629-412668190-725345543-500\smss.exe"

so that smss.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer\Run]

Manager Task = "C:\RECYCLER\S-1-5-21-1202660629-412668190-725345543-500\smss.exe"

so that smss.exe runs every time Windows starts

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

(Default) = "File Folder"

+Other details

Analysis of the file resources indicate the following possible country of origin:

Thailand

Re:

Sat, 27 Oct 2007 16:09:48 -0400

- ນຳໃຊ້ໂປຣແກຣມ Regedit.exe
1 ໄປທີ່ Start > Run ແລ້ວພິມຄຳສັ່ງ Regedit ແລ້ວ Enter
2 ໄປທີ່ HKEY_CURRENT_USER\Software\Google\NavClient\1.1\History
3 ຄຣິກຂວາທີ່ຄີຍ່ອຍ (Sub Key) ຂອງ History ແລ້ວເລືອກຄຳສັ່ງ Delete ແລ້ວກະສຳເລັດ

Re:

Sat, 27 Oct 2007 16:10:15 -0400

ເວລາທີ່ເຮົາເຂົ້າ My computer ຈະເຫັນວ່າ Icon ເປັນຮູບດຽວກັນໝົດແລ້ວຖະຍອຍກັນອກກເປັນ Icon ທີ່ ຖືກຕ້ອງ
ເຮົາສາມາດແກ້ໄຂໄດ້
1 ໄປທີ່ My computer > Tools > Folder Options
2 ຈາກນັ້ນເລືອກ View
3 ຄຣິກຍົກເລີກທີ່ ຂໍ້ຄວາມ Automatically search for network folder and printer
4 ຄຣິກ Apple > OK ແລ້ວ Icon ທີ່ຊ້າກໍ່ຈະໄວຂື້ນ

Re:

Sat, 27 Oct 2007 16:10:50 -0400

Cache ຄືໜ່ວຍຄວາມຈຳທີ່ຢູ່ໃນ CPU ໂດຍທີ່ CPU ຈະຄາດເດົາເຖີ່ງສີ່ງທີ່ຜູ້ໃຊ້ງານຕ້ອງການກະທຳແລະຈັດເກັບຂໍ້ມູນເຫລົ່ານັ້ນເອົ າໄວ້ໃນ L2 Cache ສ່ວນ L1 Cache ຈະເປັນຕົວເລັ່ງ
ຄວາມໄວໃນການສົ່ງຂໍ້ມູນໃຫ້ກັບ CPU ນັ້ນເອງ
ສ່ວນການເລືອກຊື CPU ຖ້າມີຄວາມຈຳ Cache ສູງຈະເປັນການດີກ່ວາເດີພີນ້ອງ ;D

Re:

Sat, 27 Oct 2007 16:11:19 -0400

Hello inlao.net, i usually open inlao.net web site, its has alot of usefull topic here
And i want to know the way rto kill the virus "Full house" I couldn't delete from my PC, i use Nod32, Kaspersky, AVG, Adware, spyware anti and antivia, but couldn't kill it
Please tell me the way how to kill it
Thank you very much,

Re:

Sat, 27 Oct 2007 16:11:49 -0400

1 ບາງທ່ານອາດເຄີຍພົບບັນຫາ "Low on virtual memory" ກໍລະນີມີຂໍ້ຄວາມເຕື່ອນແບບນີ້ບອກໃຫ້ຮູ້ວ່າຄອມຂອງທ່ານໃຊ Ram ຂອງລະບົບຈົນໝົດແຕ່ຍັງບໍ່ພຽງພໍກັບໂປຣແກຣມທີ່ທ່ານກຳລັງໃຊ້ງານຢູ່ ລະບົບຈີ່ງຕ້ອງໃຊ້ພື້ນທີ່ Hard disk ຈຳນວນໜື່ງມາໃຊ້ ເປັນ (Swapfile)
ກໍລະນີແບບນີ້ເກີດຈາກທ່ານໄດ້ເປີດໂປຣແກຣມທີ່ມີຂະໜາດໃຫຍ່ໆ ເຊັ່ນ Photoshop ເປັນຕົ້ນ
2 ຂັ້ນຕອນການຕັ້ງຄ່າ
      1 ຄຣິກຂວາທີ່ My computer > Properties
      2 Advance > Setting ໃນຂອບຂອງ Performance
      3 ຄຣິກແທັບ Advance > ໄປທີ່ Virtual memory > Change
      4 ໃນຂອບຂອງ Paging file size for selcted drive ໃຫ້ເລືອກ ເປັນ System managed size ແລ້ວ ກະ OK ຖືວ່າສຳເລັດ
3 ຖ້າຫາກທ່ານເຮັດຕາມຂັ້ນຕອນນີ້ໝົດແລ້ວຍັງມີຂໍ້ຄວາມເຕື່ອນຄືຂໍ້ 1 ແນະນຳໃຫ້ທ່ານເພີ່ມ RAM ເປັນ 512 MB ຈະດີກ່ວານອກຈາກຈະເຮັດໃຫ້ລະບົບໃຫ້ໃຊ້ Swapfile
ນ້ອຍທີ່ສຸດແລ້ວຍັງຊ່ວຍໃຫ້ເປີດໂປຣແກຣມໄວຂື້ນແລະເປັນການເພີ່ມຄວາມໄວຂອງລະບົບ ອີກ ::)

Re:

Sat, 27 Oct 2007 16:12:36 -0400

ຄວາມຈີ່ງແລ້ວການ Format HDD ຫລາຍໆຄັ້ງບໍ່ວ່າຈັກກີ່ຄັ້ງກໍ່ຕາມຈະບໍ່ສົ່ງຜົນຕໍ່ການເຮັດວຽກຂອງ HDD ແຕ່ຢ່າງໃດຊື່ງເປັນເລື່ອງປົກກະຕິທີ່ຫລາຍໆຄົນຈະຄິດວ່າມີສວ່ນເຮັດໃຫ້ອາຍຸການໃ ຊ້ງານສັ້ນລົງແຕ່ຄມຈີ່ງແລ້ວເປັນຄວາມເຊື່ອທີ່ຜິດເທົ່ານັ້ນການ Format HDD ບໍ່ຖືເປັນນເຮັດວຽກທີ່ຈະເຮັດໃຫ້ HDD ຕ້ອງຮັບພາລະໜັກຫົວອ່ານຂອງ HDD ຈະບໍ່ມີການສຳພັດກັບໃບຈານດິສຂໍ້ມູນແຕ່ຢ່າງໃດລະຫວ່າງການ Format ສະລຸບແລ້ວຄືວ່າເຮົາສາມາດ Format HDD ຄັ້ງລະວັນກະໄດ້ ນະທ່ານ ອາຍຸການໃຊ້ງານມັນກະບໍ່ແຕກຕ່າງຈາກ HDD ຕົວອື່ນໆດອກ ຮູ້ແລ້ວຢ່າຄິດອີກວ່າ Format ຫລາຍມັນເຟຫັນ

Re:

Sat, 27 Oct 2007 16:13:19 -0400

ສຳລັບ Power Supply ແບບ ATX
ສົມໝຸດວ່າຄອມພິວເຕີຂອງທ່ານເປີດລະໄຟບໍ່ເຂົ້າໃນລັກສະນະນີ້ເປັນຕົ້ນແຕ່ປັກສຽບ ໄຟຕ່າງໆແມ່ນຖືກຕ້ອງແລ້ວແລະສາຍໄຟກະບໍ່ມີບັນຫາແຕ່ເປີດໄຟບໍ່ເຂົ້າ Case
(ບໍ່ເຂົ້າເມນບອດ) ເຮົາສາມາດກວດ Power Supply ໄດ້ດັ່ງນີ້
1 ກ່ອນອື່ນໄຂຝາ case ອອກ
2 ຖອດສາຍໄຟອອກໃຫ້ໝົດຈາກສາຍທີ່ມາຈາກ Power Supply
3 ເອົາສາຍໄຟສຽບໃສ່ Power Supply (ທາງຫລັງ Power Supply)
4 ຊອກສາຍລວດທອງນ້ອຍໆມີຢາງຫຸ້ມມາເສັ້ນໜື່ງຍາວປະມານ 4 ຊມ ແລ້ວປອກສາຍຢາງທີ່ຫຸ້ມສາຍທອງທັງ 2 ສົ້ນອອກ
5 ໃນຫົວປັກສາຍໄຟຈາກ Power Supply ໃສ່ເມນບອດ (ທີ່ມີຫລາຍເສັ້ນກ່ວາໝູ່ນັ້ນ) ໃຫ້ເລືອກເອົາສາຍໄຟສີຂຽວ ກັບສີ ດຳເສັ້ນໃດກະໄດ້ມາຕິດກັນ 2 ສົ້ນ ໂດຍໃຊ້ສາຍລວດທອງທີ່ເຮົາກຽມໄວ້ນັ້ນ
6 ແລ້ວໃຫ້ເຮົາສັງເກດເບີ່ງວ່າພັດລົມ Power Supply ປີ່ນບໍ ຖ້າບໍ່ປີ່ນສະແດງວ່າອາດເປັນຍ້ອນ Power Supply ນັ້ນຕາຍແລ້ວ
ນີ້ກະແມ່ນ ເທັກນິກນ້ອຍໆຖ້າທ່ານໃດບໍ່ທັນຮູ້ກະນຳໄປໃຊ້ເບີ່ງ

Re:

Sat, 27 Oct 2007 16:13:56 -0400

1. ທຳອິດເປີດໂປຣແກຣມດອສ Start>Run ພີມ CMD ໃນບັອກ Run ແລ້ວ Enter
2. ໃນດອສ ພີມຄຳສັ່ງ convert c: /FS:NTFS ແລ້ວ ENTER
3. ຫລັງຈາກ Restart ແລ້ວຈີ່ງໄດ້ຜົນ
:o

Re:

Sat, 27 Oct 2007 16:14:30 -0400

ການບິບອັດຂໍ້ມູນໃນ HDD ເປັນການທີ່ເຮັດໃຫ້ເນື້ອທີ່ HDD ມີທີ່ວ່າງເພີ່ມຂື້ນເນື້ອງຈາກເມື່ອໄດ້ທຳການບິບອັດຂໍ້ມູນແລ້ວເຮັດໃຫ້ຂໍ້ມູນມ ີຂະໜາດນ້ອຍລົງຊື່ງສ່ວນໃຫຍ່ຈະໃຊ້ການບິບອັດເພື່ອຕ້ອງການພື້ນທີ່ຫລາຍຂື້ນ
ແຕ່ບໍ່ໄດ້ເຮັດໃຫ້ລະບົບເຮັດວຽກໄວຂື້ນແຕ່ຢ່າງໄດແຕ່ກັບເຮັດໃຫ້ລະບົບເຮັດວຽກຊ້ າລົງເນື້ອງຈາກເມື່ອທ່ານໄດ້ບິບອັດຂໍ້ມູນແລ້ວເມື່ອຕ້ອງການໃຊ້ງານຂອງ
ຂໍ້ມູນຕ້ອງໃຫ້ລະບົບທຳການຄາຍຂໍ້ມູນກ່ອນມາໃຊ້ກະເລີຍຕ້ອງເຮັດໃຫ້ລະບົບເຮັດວຽກ ເພີ່ມຂື້ນກາຍເປັນການລົດຄວາມໄວໃຫ້ກັບລະບົບເລີຍ

::) ::) ::)

Re:

Sat, 27 Oct 2007 16:15:13 -0400

ຫລາຍໆທ່ານຄງຈະເຄີຍເຫັນ My Recent Documents ທີ່ຢູ່ໃນສະຕາດເມນູຈະມີລາຍການທີ່ເຮົາເຄີຍໃຊ້ມາ
ຖ້າຕ້ອງການລົບຈະເຮັດແນວໃດມີວິທີມາບອກ
1 ໃຫ້ຄຣິກຂວາທີ່ Taskbar ແລ້ວເລືອກ Properties

2 ຄຣິກແທັບ Start Menu ແລ້ວເລືອກ Start Menu

3 ຄຣິກ Customizes...

4 ຄຮິກແທັບ Advanced ແລ້ວກົດປຸ່ມ Clear List ເພື່ອໃຫ້ມັນລົບອອກ
5 ໃຫ້ຄຣິກົກເລີກ ໃນຂໍ້ຄວາມ List my most recent opened document ອອກເພື່ອບໍ່ໃຫ້ມີການເກັບຂໍ້ມູນໄວ້ອີກ

Re:

Sat, 27 Oct 2007 16:15:50 -0400

RAM ເປັນໜ່ວຍຄວາມຈຳທີ່ສາມາດຂຽນແລະລົມໄດ້ແບບບໍ່ສິ້ນສຸດແຕ່ບໍ່ສາມາດເກັບຂໍ້ມູນໄດ ້ຖ້າບໍ່ມີໄຟລ້ຽງໃຫ້ກັບຕົວເອງປະຈຸບັນນີ້ທີ່ນິຍົມໃຊ້ແມ່ນຊະນິດ SDRAM
ແລະ DDRAM ຊື່ງແຕ່ກ່ອນຈະມີຊະນິດ EDO ຊື່ງປະຈຸບັນບໍ່ນິຍົມແລ້ວແລະສຸດທ້າຍເປັນຊະນິດ RDR ຫລືທີ່ຮຽກກັນໃນນາມ Rambus RAM ການທີ່ຈະເລືອກຊື້
RAM ໃນປະຈຸບັນກໍ່ຄວນຈະເລືອກຊື້ຊະນິດ SDRAM ແລະ DDRAM ແລະບໍ່ຄວນຕ່ຳກ່ວາ 256 MB ຖ້າຈະໃຫ້ດີຄວນເປັນ DDRAM ຊື່ມີາຄາທີ່ຕ່ຳລົງກ່ວາແຕ່ກ່ອນ
ແຕ່ທ່ານຕ້ອງຄຳນືງເຖີງວ່າເຂົ້າກັບເມນບອດຂອງເຮົາໄດ້ບໍ

Re:

Sat, 27 Oct 2007 16:16:20 -0400

ທ່ານຣູ້ບໍ່ວ່າທ່ານສາມາດເພີ່ມຄວາມໄວໃຫ້ເຄື່ອງຂອງທ່ານທີ່ໃຊ້ Win XP Pro ຊີ່ງເປັນການເພີ່ມ bandwidth ໃຫ້ XP ໂດຍປົກກະຕິຈະກຳຈັດສ່ວນຂອງຈັດການຂໍ້ມູນ
Packet scheduler ເອົາໄວ້ທີ່ 20% ຂອງ bandwidth ທີ່ໃຊ້ເຊື່ອມຕໍ່ກັບອີນເຕີເນັດແຕ່ທ່ານສາມາດປ່ຽນຄ່ານີ້ໂດຍ:

1 Start>Run ພີມ gpedit.msc ແລ້ວ Enter
2 ໄປທີ່ Local computer policy>Administrative Templates>Nextwork>QoSPacket Scheduler
3 ໃຫ້ດັບເບີນຄຣິກທີ່ Limit reservable bandwidth >enable
4 ໃຫ້ Bandwidth limit(%): = 0
5 aply>ok ແລ້ວ Restart ເປັນອັນວ່າສຳເລັດ

Re:

Tue, 30 Oct 2007 13:27:26 -0400

ເປີດ ໂປຣແກຣມ Regedit ໄປທີ່ Start>run ພິມ Regedit ແລ້ວ Enter
ໄປທີ່ HKEY_CLASSES_ROOT\\AllFilesystemObjects\\shellex\\ContextMenuHandlers
ຄຣິກຂວາທີ່ ContextMenuHandlers >new>key
ປຽນຊື່ມັນເປັນ Copy To ແລ້ວໃຫ້ Double Click ທີ່ (Default) ທາງຂວາມື
ແລ້ວ Copy ເອົາຄ່າ {C2FBB630-2971-11D1-A18C-00C04FD75D13} ນີ້ໃສ່ ບ່ອນ new data:
ຄຣິກຂວາທີ່ ContextMenuHandlers >new>key
ປຽນຊື່ມັນເປັນ Move To ແລ້ວໃຫ້ Double Click ທີ່ (Default) ທາງຂວາມື
ແລ້ວ Copy ເອົາຄ່າ {C2FBB630-2971-11D1-A18C-00C04FD75D13} ນີ້ໃສ່ ບ່ອນ new data:
ຄຣິກ OK ແລ້ວປິດໂປຣແກຣມ
ບັດແລ້ວ Copy To ແລະ Move To ກໍ່ຈະອອກມາເຫັນຢູ່ໃນ Explorer right menu

Re:

Fri, 02 Nov 2007 08:26:05 -0400

1.
copy ເອົາ ທີ່ຢູ່ຂອງ VDO ທີ່ເຮົາກຳລັງເບີ່ງ

2.
ເຂົ້າເວັບ

3.

4.
ກົດ ທີ່ Download ໃນເວັບນີ້ກໍ່ຈະໄດ້ດັ່ງຮູບ

ສຳລັບໂປຣແກຣມທີ່ອ່ານ VDO ນີ້ແມ່ນສາມາດດາວໂລດໄດ້ທີ່ນີ້

ດາວໂລດ

Re:

Tue, 06 Nov 2007 06:26:59 -0500

ຖ້າຫາກວ່າເວັບໄຊຂອງທ່ານບໍ່ຕ້ອງການບໍເຜີຍແຜ່ສູ່ສາທາລານະໂດຍບໍ່ຕ້ອງການ
ໃຫ້ຄົນອື່ນຄົ້ນຫາພົບໃນ Google ທ່ານສາມາດແຈ້ງລົບລາຍຊື່ເວັບຂອງທ່ານໄດ້
ໄປທີ່ www.google.com/remove.htmlແລ້ວຜູ້ດູແລລະບົບຈະເຮັດຕາມທີ່ທ່ານຂໍ

Re:

Wed, 21 Nov 2007 06:55:31 -0500

ສຳລັບຜູ້ທີ່ໃຊ້ບໍລິການ Gmail
1. ໃຫ້ທ່ານໄປຕັ້ງຄ່າໃນ Gmail ຂອງທ່ານກ່ອນ ໄປທີ່ setting ແລະ enable IMAP

ແລ້ວ ກົດ Save Change
2. ໄປເປີດ Outlook Exprss ໃນ Windows Start>>Programs>>Outlook Express
3. ເຮັດຕາມໃນຮູບໃນໂປຣແກຣມ

ກົດ Next

ກົດ Next

ກົດ Next

ກົດ Next>>Finish
4. ໄປເມນູ Tools>Account

ແລ້ວກົດ OK
5. ສຸດທ້າຍລອງ Send/Recieve

ຖ້າບໍ່ມີບັນຫາລາຍການເມວຂອງທ່ານໃນ Account Gmail ກໍ່ຈະໂລດລົງມາໄວ້ ໃນຄອມຂອງການແລະບໍ່ຈຳເປັນຕອງເຂົ້າໄປເວັບກວດເມວອີກພຽງໃຊ້ Outlook ນີ້ກະໄດ້ແລ້ວ (ມີຫລາຍໂປແກຣມທີ່ໃຊ້ກວດເມວມີແຕ່ເອົາແບບການຕັ້ງຄ່ານີ້ໄປໃຊ້ ກໍ່ໄດ້)
ຖ້າມີແນວຂ້ອງໃຈຖາມໄດ້ໃນ Forum ນີ້

Re:

Tue, 27 Nov 2007 12:08:32 -0500

1. ເປີດໂປຣແກຣມ Regedit ໄປທີ່ Start>run ພິມ Regedit ແລ້ວ Enter
2. HKEY_CLASSES_ROOT\lnkfile
ໃຫ້ລົບ ຄ່າ IsShortcut ທາງແທັບຂວາອອກ

3. ແລ້ວ Restart Com ຫາກຈະໄດ້ດັ່ງໃຈ

Re:

Tue, 11 Dec 2007 04:41:01 -0500

ເຄື່ອງພີມເລເຊີບໍ່ຄືກັບອີງເຈັດທີ່ໃຊ້ນ້ຳເມິກເວລາຍ້າຍຫລືຍົກໄປໃຊ້ງານໃນທີ່ຕ ່າງໆຈະ
ເຮັດໄດ້ສະດວກກ່ວາແຕ່ສຳລັບເລເຊີນັ້ນການເຄື່ອນຍ້າຍອາດເຮັດໃຫ້ຟົງເມິກໃນກ້ອງ
ເມິກກະຈາຍໃນເຄື່ອງໄດ້ດັ່ງນັ້ນແນະນຳໃຫ້ຖອດກັບເມິກຫລືໂທນເນີອອກກ່ອນການ
ເຄື່ອນຍ້າຍເພື່ອຄວາມປອດໄພ

Re:

Fri, 28 Dec 2007 10:12:17 -0500

ເປັນເທັກນິກໃນການປິດ Control Panel ຂອງ Windows

1. ເປີດໂປຣແກຣມ Regedit ກ່ອນ
2. ໄປທີ່
-HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Policies\Explorer
ໃຫ້ເພີ່ມຄ່າ NoControlPanel =1 ໃສ່ຖ້າບໍ່ມີກໍ່ສ້າງຂື້ນມາໃໝ່
ເບີ່ງລາຍລະອຽດໃນຮູບ

3. Restart com

ໂຊກດີ

Re:

Thu, 10 Jan 2008 05:33:00 -0500

ທ່ານຮູ້ບໍວ່າທ່ານສາມາດຕັ້ງເວລາການປິດຄອມພິວເຕີຂອງທ່ານໂດຍອັດຕະໂນມັດໃນ
ເວລາທີ່ທ່ານຕ້ອງການ
ມີວິທີດັ່ງນີ້

1. ຄຣິກຂວາທີ່ໜ້າຄອມຂອງທ່ານແລ້ວໄປທີ່ New>Shortcut
2. ໃນບັອກນັ້ນໃຫ້ພິມຄຳສັ່ງດັ່ງນີ້:
shutdown -s -t 3600 ແລ້ວ Next
- 3600 ແມ່ນຈຳນວນວິນາທີ ກ່ອນຄອມຈະ Shutdown ສະນັ້ນ 60 secs*60 mins=
3600 secs ໝາຍຄວາມວ່າ ຄອມຈະມອດພາຍໃນ 60 ນາທີ ຫລື 1 ຊົ່ວໂມງນັ້ນເອງ
3. ກົດ Finish ຖ້າຕ້ອງການໃຊ້ກໍ່ພຽງແຕ່ດັບເບີ້ນຄຣິກໄຟລທີ່ສ້າງມານັ້ນ

ໝາຍເຫດ: ກໍລະນີຕ້ອງການຍົກເລີກແມ່ນໄປທີ່ Start>Run ພີມຄຳສັ່ງດັ່ງນີ້:

Shutdown -a ແລ້ວ Ok ກໍ່ຍົກເລີກແລ້ວ

Re:

Fri, 11 Jan 2008 12:16:32 -0500

ເຮັດຕາມຮູບ:

ແລ້ວປິດໂປຣແກຣມແລະເປີດໃໝ່

Re:

Wed, 19 Mar 2008 11:29:08 -0400

ການແກ້ບັນຫາ Folder ຖືກ Hidden ໄວ້ໃນ USB ອາດຈະແມ່ນຍ້ອນຖືກໄວຣັສ
ເຊັ່ນ: ໄວຣັສ Fullhouse,Flashy ເປັນຕົ້ນ

ມີວິທີການແກ້ໄຂດັ່ງນີ້

1. Start...>Run
2. Type Cmd ແລ້ວ Enter
3. ແລ້ວເຂົ້າໃນ Dos

ໃຫ້ທ່ານສັງເກດເບີ່ງວ່າ USB ຂອງທ່ານແມ່ນເປັນ ຊ່ອງໃດ
ຕົວຢ່າງ:

F:\ ແມ່ນຊ່ອງ USB Drive

ໃນ Dos ໃຫ້ພິມ F: ແລ້ວ Enter
ມັນຈະຢູ່ໃນລັກສະນະນີ້

F:\>
ໃຫ້ທ່ານພີມຄຳສັ່ງນີ້ໃສ່ຕໍ່ຈາກ F:\>

F:\>attrib -h -s /D /S ແລ້ວ Enter ຖ້າຈົນແລ້ວ
Folder ທີ່ຖືກ ເຊື່ອງໄວ້ກໍ່ຈະກັບມາປົກກະຕິ

ໂຊກດີ

Re:

Mon, 21 Jul 2008 07:12:26 -0400

ຊ່ວຍບອກວີແດ່ທ່ານ ອາເລັກໄຊຮ໌

Re:

Mon, 21 Jul 2008 08:38:58 -0400

ຂອບໃຈຫຼາຍລວ່ງໜ້າຫຼາຍທ່ານ ອາເລັກໄຊ
ບອກເບີເຈົ້າໃຫ້ ບາງເທື່ອມີບັນຫາຄວມພໍຊິ້ໄດ້ໂທຫາ

Re:

Mon, 21 Jul 2008 09:37:19 -0400

ມັນສາມາດປ້ອງກັນໄດ້ໜົດທຸກພາກສ່ວນບໍທ່ານ ແລະສາມາດແທນ Anti-Virus ໄດ້ບໍ
ມັນກ່ອນ Antivirus ບໍ

Re:

Thu, 31 Jul 2008 02:52:29 -0400

ຄຶວ່າຢູ່ເຮືອນຂ້າພະເຈົ້າໄດ້ຕໍ່ Network ແລ້ວຕໍ່ພ່ວງກັນຫຼາຍໜ່ວຍຂ້າພະເຈົ້າພັດໄປຄິກທີ່ ໄອຄ້ອນທີ່ມັນສະແດງການ
ເສື່ອມຢູ່ລຸ່ມໜ້າຈໍ ແລ້ວໄປຄິກຂວາ Disable ແລ້ວມັນບໍ່ສາມາດຫຼິ້ນ ອິນເຕິເນັດ ທ່ານພໍມິວີແກ້ບໍ່ຊ່ວຍບອກມັນ

+++++++5555555555+++++++++++

ຂອບໃຈລ່ວງໜ້າ ຫຼາຍ

Re:

Thu, 14 Aug 2008 00:11:06 -0400

ຄຶວ່າຂ້າພະເຈົ້າຊື່ໂປຮແກຮມນຳຮ້ານ ເຖົ້ານາລິນ ທີ່ ມ.ຊ ແລ້ວຕ້ອງການຢາກ Copy ຊີ້ເອົາໂປຮແກຮມໃດເຮັດ
ລອງຫລາຍໂປຮແກຮມແລ້ວເຊັ່ນ: Bad copy,UltraISO,Nero...
ແລະແມ່ນເຂົາເຈົ້າເອົາໂປຮແກຮມໃດເຮັດ ເຮັດເປັນລິ້ງດາວໂຫດໃຫ້ແດ່ *ຂອບໃຈລ່ວງໜ້າ*

Re:

Mon, 18 Aug 2008 00:31:03 -0400

ຄຶວ່າ:ຄອມຂ້າພະເຈົ້າໄດ້ລົງ ວິນໂດໃໜ່ແລ້ວ ພໍແຕ່ລົງສຳເລັດ ແລະຂ້າພະເຈົ້າໄດ້ເປີດ
My Computer ແລ້ວຍ້າຍແທັກຫົວຂໍ້ທີ່ເປິນຢູ່ຂ້າງເທີງສຸດທີ່ເປິນສີ
ຄຶວ່າອາການຂອງການຂອງມັນແມ່ນຊ້າໆທ່ານພໍມີວິທີແກ້ໄຂ້ໃຫ້ມັນໄວບໍ
ເປີດໂປຮແກຮມ,ໂຟຮເດີໂຕໃດກະຄຶກັນໜົດ

*ຂອບໃຈລວງໜ້າຫລາຍ*

Re:

Wed, 20 Aug 2008 11:22:01 -0400

ຢາກຮູ້ວິທີການ ໃນເວລາທີ່ເຮົາຂຽນຄຳສັບ ແລ້ວໃຫ້ google search ແລ້ວເຫັນເວັບໃຊ້ເຮົາຢູ່ໃນໜ້າອິນເດັກຂອງ google ເລີຍພ້ອມເຫັນລາຍລະອຽດຂອງເວັດໃຊ້ເຮົາ

Re:

Sun, 24 Aug 2008 00:06:26 -0400

ຄຶວ່າ: ທ່ານຂ້າພະເຈົ້າຢາກກ່ຽວເວັບໄຊສ໌ຂອງຄົນລາວ ມັນມີເວັບໜຶ່ງທີ່ລືກລັບ
ແຕ່ວ່າຂ້າພະເຈົ້າບໍ່ຈື່ເພາະເວັບໂຕນັ້ນມັນຈະສອນກ່ຽວການສ້າງ ໂທຈັ້ນ ແລະກນາແຮັກ
ເປັນເວັບເດີທ່ານ ຢາກໃຫ້ຊ່ວຍໃຫ້ແດ່.
http://duongforum.awardspace.com
ຊື່ຂອງມັນຄ້າຍໆຄືກັບເວັບນີ້ ແຕ່ປັນຈຸບັນເວັບນິ້ກະເຂົ້າບໍ່ໄດ້

ຢາກຂໍອະນຸຍາດວ່າແຕ່ທ່ານມີ ວິດິໂອສອນການສ້າງໂທຈັ້ນບໍ ຖ້າມີກະເອົາມາຕ້ອນແດ່
ເພາະສ້າງເປັນ ເພື່ອຄົນລາວແດ່ເດີທ່ານ.

Re:

Sun, 24 Aug 2008 22:58:55 -0400

ຄຶວ່າ: ຂ້າພະເຈົ້າຕ້ອງຢາກຈະເຂົ້າຫົວຂໍ້ VIP ຂອງເວັບlaozaa ເພາະວ່າຂ້າພະເຈົ້າຍັງ
ບໍ່ທັນເປັນ VIP ຫົວຂໍ້ຈຳພວກເລົ່ານັ້ນແມ່ນມັນເວົ້າກ່ຽວກັບ Hack
ຄັນວ່າທ່ານໄດ້ເປັນ ວິໄອພີທີ່ເວັບນັ້ນກະຢາກໃຫ້ທ່ານ Copy ເອົາ URL ທີ່ກຳລັງເຂົ້າ
ມາໃຫ້ແດ່ ຫຼຶທ່ານມີວິທີແນວໃດ
ຕ້ອງການຢາກຈະເປັນ Hack. *ເພື່ອຄົ້ນລາວເດີທ່ານ*
ຂອບໃຈຫຼາຍເດີທ່ານ

Re:

Sat, 27 Oct 2007 16:17:30 -0400

ໂດຍນຳໃຊ້ ໂປຣແກຣມ Regedit
1 ເປີດໂປຣແກຣມ ໄປທີ່ Start>Run ແລ້ວພີມ Regedit ແລ້ວ Enter
2 ໄປທີ່ HKEY_LOCAL_MACHINE
                    Software
                            Microsoft
                                    Windows
                                            CurrentVersion
                                                        Explorer
                                                               DriveIcons
                                                                      D       (ໝາຍເຖີ່ງຊ່ອງ ຖ້າ ຊ່ອງຊີຕ້ອງແມ່ນ C)
                                                                            DefaultIcon
                                                                                 ມີຄ່າ (Default) = c:\icons\myicons.dll,4   (ແມ່ນທີ່ຢູ່ຂອງຟາຍໄອຄອນ)
                                                                                      DefaultLabel
                                                                                         ມີຄ່າ (Default) = My ZIP Drive (ຊື່ຊ່ອງ)
3 Restart Computer
ສຳເລັດແລ້ວລອງເບີ່ງໄດ້ຜົນບໍ

Re:

Sat, 27 Oct 2007 16:18:10 -0400

ປົກກິແລ້ວເຮົາເອົາ CD-ROM ໃສ່ມັນຈະເປີດອັດຕະມັດ ເຮົາສາມາດຍຸດຄຳສັ່ງນີ້ໄດ້ດ້ວຍວິທີນີ້
1 ເຂົ້າໂປຣແກຣມ Regeit
2 ໄປທີ່ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDRom
3 ຕັ້ງຄ່າ:
System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDRom]
Name: Autorun
Type: REG_DWORD (DWORD Value)
Value: (0=disable, 1=enable)

Re:

Sat, 27 Oct 2007 16:18:36 -0400

ຖ້າທ່ານຕ້ອງການເພີ່ມຂໍ້ມູນກ່ຽວກັບ Device ເປັນປະເພດໃດນັ້ນໃນ Device Manager ທ່ານສາມາດໃຊ້ເທັກນິກນີ້ເພື່ອໃຫ້ Device Manager ສະແດງຂໍ້ມູນ Device ໃຫ້ລະອຽດ
1 ເປີດໂປຣແກຣມ Regedit
2 ຊອກຫາ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
ໃຫ້ສ້າງ ຄ່າ DEVMGR_SHOW_DETAILS ໃໝ່ຖ້າບໍ່ມີ
3 ຕັ້ງຄ່າ
System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\
Environment]
Name: DEVMGR_SHOW_DETAILS
Type: REG_SZ (String Value)
Value: (0 = default, 1 = show detailed info)

4 Restart Computer

Re:

Sat, 27 Oct 2007 16:19:11 -0400

ການສ້າງຄ່າຫລືປ່ຽນແປງຄ່ານີ້ PowerdownAfterShutdown ແລະຕັ້ງຄ່າ =1 ແມ່ນ to power off the computer at shutdown ຫລື =0 ແມ່ນ Reboot

Settings:
System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Name: PowerdownAfterShutdown
Type: REG_SZ (String Value)
Value: (0 = default, 1 = power down)

ຫລັງຈາກຕັ້ງຄ່າແລ້ວຕ້ອງ Restart ຄອມຈີ່ງສົມບູນ

Re:

Mon, 05 Nov 2007 09:48:03 -0500

1 ເຂົ້າໄປທີ່ HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole
2 ໃຫ້ແປງຄ່າ ຫລືເພີ່ມຄ່າ EnableRemoteConnect =N

Settings:

System Key: [HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole]
Name: EnableRemoteConnect
Type: REG_SZ (String Value)
Value: "Y" = enable automatic connections, "N" = disabled

3 ອອກໂປຣແກຣມ ແລ້ວ Restart Windows

Re:

Thu, 08 Nov 2007 09:01:50 -0500

ທ່ານຄົງຈະເຄີຍເຫັນແບບວ່າເຂົ້າໃຊ້ໂປຣແກຣມ Regedit ບໍ່ໄດ້ເປັນຍ້ອນຖືກໄວຣັສ ຫລືເປັນຍ້ອນອື່ນໆ
ສຳລັບການໃຊ້ຄ່ານີ້ທ່ານຕ້ອງ Backup Registry ກ່ອນການແກ້ໄຂ
1. ໄປທີ່ Start>run ພິມ Regedit then Enter
2. ໄປທີ່ HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\
CurrentVersion\\Policies\\System
3. ສ້າງຄ່າ DisableRegistryTools ດັ່ງນີ້

Settings:

User Key: [HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Poli cies\\
System]
Name: DisableRegistryTools
Type: REG_DWORD (DWORD Value) "ໂດຍການຄຣິກທາງແທັບຂວາມືຈະມີ New>DWORD Value"
Value: (0 = allow regedit, 1 = disable regedit)

4. Restart Computer

ຮູບຕົວຢາງ

Re:

Wed, 14 Nov 2007 12:35:15 -0500

ທ່ານສາມາດປິດຄຳສັ່ງປຸ່ມ Shutdown ຂອງ Windows ໄດ້ດ້ວຍການໃຊ້ວິທີນີ້
- ເຮັດຕາມຄຳແນະນຳນີ້
ໃຊ້ Regedit ໂປຣແກຣມ
ເຂົ້າໄປທີ່
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

ຫລື
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies

ສ້າງຄ່າ NoClose ປະເພດ REG_DWORD ມີຄ່າ=1 ເບີ່ງຮູບຕື່ມອີກ

Settings:

User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]
System Key: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies \
Explorer]
Name: NoClose
Type: REG_DWORD (DWORD Value)
Value: (0 = shutdown enabled, 1 = shutdown disabled)

Re:

Wed, 05 Dec 2007 06:37:36 -0500

ເປີດໂປຣແກຣມ Regedit.exe
ຕົວຢ່າງ ເຊືອງຊ່ອງ D:
ຄ່າ NoDrives=8

ລາຍລະອຽດຂອງຄ່າແຕ່ລະຊ່ອງ

A: 1, B: 2, C: 4, D: 8, E: 16, F: 32, G: 64, H: 128, I: 256, J: 512, K: 1024, L: 2048, M: 4096, N: 8192, O: 16384, P: 32768, Q: 65536, R: 131072, S: 262144, T: 524288, U: 1048576, V: 2097152, W: 4194304, X: 8388608, Y: 16777216, Z: 33554432, ALL: 67108863


(Default)	REG_SZ	(value not set)
NoDrives	REG_DWORD	0x03ffffff (67108863)


	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\E xp...

Settings:

User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]
System Key: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]
Name: NoDrives
Type: REG_DWORD (DWORD Value)

ຫລັງຈາກຕັ້ງຄ່າແລ້ວຕ້ອງ Restart Computer

Re:

Wed, 19 Dec 2007 11:19:40 -0500

-ເພື່ອການສືກສາ ກະລຸນາ Backup Registry ກ່ອນການທົດລອງ
1. ທຳອິດໄປເປີດ Regedit.exe ໃນ box Run (Start>Run)
2. ໃນ Registry ໄປທີ່
- HKEY_CURRENT_USER / HKEY_LOCAL_MACHINE>
\Software\Microsoft\Windows\CurrentVersion\Policies\
ActiveDesktop\

ຊື່ງມີຄ່າດັ່ງນີ້

NoChangingWallpaper - Disable the ability to change wallpapers.

NoComponents - Disable components.

NoAddingComponents - Disable the ability to add components.

NoDeletingComponents - Disable the ability to delete components.

NoEditingComponents - Disable the ability to edit components.

NoCloseDragDropBands

NoMovingBands - retrict adjustments to desktop toolbars

NoHTMLWallPaper - only allow bitmaps (BMP) as wallpaper

Type: REG_DWORD (DWORD Value)
Value: (0 = disable restriction, 1 = enable restriction)

ຕົວຢ່າງໃນຮູບ

3. ແລ້ວ Restart com

ໂຊກດີ

Re:

Wed, 09 Jan 2008 08:49:30 -0500

1. ເປີດໂປຣແກຣມ Regedit.exe
2. ຈາກນັ້ນໄປທີ່
-HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Policies\Uninstall
3.ມີຄ່າກຳນົດດັ່ງນີ້

NoAddRemovePrograms - Disable Add/Remove Programs

NoRemovePage - Disable Change and Remove Programs

NoAddPage - Disable Add Programs

NoWindowsSetupPage - Disable Windows Components Wizard

NoAddFromCDorFloppy - Hide "Add a program from CD-ROM or disk" option

NoAddFromInternet - Hide "Add programs from Microsoft" option

NoAddFromNetwork - Hide "Add programs from your network" option

NoServices - Go directly to Windows Components Wizard

NoSupportInfo - Disable Support Information

ຮູບຕົວຢ່າງ:

4. Restart computer

Good Luck!

Re:

Fri, 01 Feb 2008 06:30:18 -0500

>> ທ່ານຄົງເຄີຍເຫັນທີ່ Handy Drive ຫລື USB ຂອງທ່ານທີ່ມີອັນລ້ອກໄວ້ເພື່ອ
ບໍ່ໃຫ້ສາມາດລົບຫລືປ່ຽນແປງຂໍ້ມູນໄດ້ໃນ USB ຂອງທ່ານ.
ແຕ່ສຳລັບວິທີນີ້ແມ່ນເປັນການລັອກການກອບປີຂໍ້ມູນໃນຄອມເຂົ້າ USB Drive
ມີວິທີການດັ່ງນີ້:
1. ເປີດໂປຣແກຣມ Registry Editor
ກົດ Start>run ພີມ Regedit ແລ້ວ Enter
2. ໄປທີ່ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
\StorageDevicePolicies

ຖ້າຫາກວ່າບໍ່ມີ Folder StorageDevicePolicies ກໍ່ຕ້ອງສ້າງເອົາເອງ
ວິທີສ້າງ Folder ນີ້ ແມ່ນ ຄຣິກຂວາທີ່ Folder Control > New >Key
ແລ້ວຕັ້ງຊື່ StorageDevicePolicies
3. ໃນ Folder StorageDevicePolicies ໃຫ້ທ່ານສ້າງຄ່າໜື່ງຂື້ນມາ
ດັ່ງໃນຮູບນີ້

4. ສຸດທ້າຍປິດໂປຣແກຣມແລ້ວ ເອົາ USB ຊຸບໃສ່ເບີ່ງຈະສາມາດກອບປີຫລືສ້າງ
ຂໍ້ມູນໃນ USB ໄດ້ບໍ

Re:

Tue, 12 Feb 2008 08:59:49 -0500

Disable the Ability to Right Click on the Desktop

ສຳລັບເທັກນິກນີ້ແມ່ນການປິດເມນູຄຣິກຂວາທີ່ໜ້າ Desktop
ມີຂັ້ນຕອນດັ່ງນີ້:

1. Start>Run ພີມ Regedit.exe ແລ Enter
2. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer

3. ສ້າງຄ່າດັ່ງນີ້
Name: NoViewContextMenu
Type: REG_DWORD (DWORD Value)
Value: (0 = disabled, 1 = enabled)

4. Restart computer

Good Luck!

Re:

Fri, 22 Feb 2008 12:08:18 -0500

ການປິດແລະເປີດໃຊ້ Folder Options

ທ່ານອາດເຄີຍເຫັນບັນຫາທີ່ໃນ My computer ຂອງເຮົາໃນເມນູ Tools ທີ່ບໍ່ເຫັນຄຳສັ່ງ Folder Options ເຊີ່ງປົກກະຕິແລ້ວຕ້ອງເຫັນຄຳສັ່ງນີ້ຖ້າຫາກວ່າ
ບໍ່ເຫັນກໍ່ໝາຍວ່າມີການປ່ຽນແປງຄ່ານີ້ໃນລະບົບແລ້ວອາດສາເຫດມາຈາກການຕິດໄວຣັສ
ຫລືມີການແປງຄ່ານັ້ນເປັນຕົ້ນ

ໃນທີ່ນີ້ແມ່ນວິທີການປິດຫລືເປີດໃຊ້ Folder Options ມີວິທີການດັ່ງນີ້

1. ເປີດ Regedit ກ່ອນ "Start>Run"
2. ໄປທີ່

-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer
ຫລື
-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies \
Explorer

ມີຄ່າດັ່ງນີ້
Name: NoFolderOptions
Type: REG_DWORD (DWORD Value)
Value: (0 = show options, 1 = hide options)

3. Restart computer for success

Re:

Thu, 28 Feb 2008 05:49:59 -0500

ການປິດແລະເປີດໃຊ້ Windows Task Manager

ການປິດການໃຊ້ງານຂອງໂປຣແກຣມນີ້ສວ່ນຫລາຍແມ່ນຄອມທີ່ຖືກໄວຣັສຫລືບາງ
ໂປແກຣມທີ່ບໍ່ອະນຸຍາດໃຫ້ໃຊ້ Task Manager ນີ້
ມີວິທີການແກ້ໄຂດັ່ງນີ້:

1. Start>Run ພີມ Regedit ແລ້ວ Enter
2. ໄປຫາໂພນເດີດ່ງນີ້

-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
System
(ໝາຍເຫດ: ຖ້າບໍ່ມີໂພນເດີຕາມທີ່ບອກກໍ່ສາມາດສ້າງເອງໄດ້ໂດຍການຄຣິກຂວາໃນ
ໂຟນເດີທີ່ສດທ້າຍນັ້ນ)
3. ກຳນົດຄ່າດັ່ງນີ້

Name: DisableTaskMgr
Type: REG_DWORD (DWORD Value)
Value: (0 = default, 1 = disable Task Manager)

4. Restart computer

ໂຊກດີ

Re:

Tue, 25 Mar 2008 11:12:42 -0400

ການລົບ Tab Security ນີ້ອອກຈາກ Windows explorer ເຊື່ງປ້ອງກັນບໍ່ໃຫ້ຜູ້
ໃຊ້ທົ່ວໄປເຂົ້າມາປ່ຽນແປງຄ່ານີ້ສຳລັບ Folders ແລະ Files
ມີວິທີ່ ດັ່ງນີ້
+ ເປີດໂປຣແກຣມ Regedit ໂດຍ Start>Run ພີມ Regedit then enter
ການຕັ້ງຄ່າ:

Settings:

User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]
Name: NoSecurityTab
Type: REG_DWORD (DWORD Value)
Value: (0 = default, 1 = enable restriction)

ຮູບຕົວຢ່າງ:

Re:

Thu, 24 Apr 2008 05:11:36 -0400

ສຳລັບການໃຊ້ສິດທິນີ້ແມ່ນແມ່ນການເອົາ Tab Hardware ໃນ Control panel
ແລະ local drive properties ເພື່ອປ້ອງກັນໃຊ້ຜູ້ໃຊ້ມາປ່ຽນແປງຄ່າຂອງ hardware device properties
ວິທີ
ເປີດ program Regedit.exe
1. Start>Run ພິມ Regedit.exe ແລ້ວ Enter
2. ໄປຫາຄ່າໃນ HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Policies\Explorer

ຕົວຢ່າງ ການຕັ້ງຄ່າ

Settings:

User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]
Name: NoHardwareTab
Type: REG_DWORD (DWORD Value)
Value: (0 = default, 1 = enable restriction)

3. ເມື່ອໃສ່ຄ່າໄດ້ແລ້ວ Restart computer
+ເບີ່ງຮູບຕົວຢ່າງ:

ເອົາອອກແລ້ວ

Re:

Fri, 15 Aug 2008 08:04:54 -0400

There is an undocumented way to disable the Ctrl Alt Del key sequence on Windows NT/2000/XP using the registry.

The key, 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon : AutoAdminLogon (REG_SZ)' has only two legal values, according to Microsoft: "0" and "1". 0 disables automatic logon of the account stored, and 1 enables it. The strange thing is that if you set the key to "2", it will enable automatic logon AND disable CTRL + ALT + DEL sequence registration by windows on boot, effectively disabling Task Manager, etc... Of course for this to work you will have to set the "DefaultUserName" and "DefaultPassword" keys to the username to automatically logon.

I've found this the easiest way to kill the Ctrl-Alt-Del sequence.

Again, here are the keys needed to be set:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon : AutoAdminLogon = "2"

Re:

Wed, 20 Aug 2008 15:34:03 -0400

ຂອບໃຈລ່ວງໜ້າຫຼາຍ
ຊ່ວຍຊອກໃຫ້ແດ່ທ່ານ

Re:

Thu, 21 Aug 2008 14:39:09 -0400

ຊ່ວຍບອກວິທີແດ່ລະອ່ຽດສຸດໆເດີທ່ານ
ຂອບໃຈລ່ວງໜ້າຫລາຍ
+1

Re:

Thu, 28 Aug 2008 04:15:19 -0400

ຄຶວ່າ: ຂ້າພະເຈົ້າຕິດ ໄວສ໌ຮັດທີ່ສ້າງຂຶ້ນ ຄຶ Fullhouse Drive
ຢາກຮູ້ວິທີສ້າງແດ່ທ່ານ ບອກວິທີແດ່ ພ້ອມໂຄດ ແລະໂປຮແກຮມສ້າງ

Re:

Mon, 01 Sep 2008 19:06:53 -0400

+ File System Modifications
c:\autorun.inf
c:\explorer.exe
%System%\init.exe
%Windir%\windowsmp.exe
%Windir%\yoos.b
+Memory Modifications
windowsmp.exe
init.exe
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\4LLI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\4LLI

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

windowsmp = "%Windir%\windowsmp.exe"

so that windowsmp.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\4LLI]

UI = "%System%\userinit.exe,"
DisplayName = "Microsoft Services"
ImagePath = "%Windir%\yoos.b"
ErrorControl = 0x00000001
ObjectName = "LocalSystem"
Start = 0x00000002
Type = 0x00000110

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\4LLI]

UI = "%System%\userinit.exe,"
DisplayName = "Microsoft Services"
ImagePath = "%Windir%\yoos.b"
ErrorControl = 0x00000001
ObjectName = "LocalSystem"
Start = 0x00000002
Type = 0x00000110

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit = "%System%\userinit.exe,,%System%\init.exe,"

so that init.exe runs every time Windows starts

Re:

Wed, 03 Sep 2008 04:57:10 -0400

ໃຜຮູ້ແດ່ວ່າໄວຣັດ full house drive ຕິດຕໍ່ໄດ້ຈາກທາງໃດແດ່ຊ່ວຍບອກແດ່

Re:

Wed, 03 Sep 2008 13:54:17 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ແລະ ທີມງານ Laoav ທຸກທ່ານ

ຂໍສະແດງຄວາມຊົມເຊີຍ ມາຍັງ ທີມງານLaoav ຂ້າພະເຈົ້າເຄີຍໃຊ້ Program Antivirus ມາແລ້ວຫຼາຍ Program ແຕ່ລະ Program ຍີ່ຫໍ້ດັງໆທັງນັ້ນ ເຊັ່ນ Kaspersky,Nod32,Avast,Norton,McArfee ,Bitdefender,AVG...ແຕ່ກໍ່ບໍ່ສາມາດຂ້າ ໄວຮັສ fullhouse drive ໄດ້ເຣັດໃຫ້ ຂ້າພະເຈ້າຫມົດປັນຍາ ແຕ່ວ່າໂຊກຍັງດີທີ່ມີຫມູ່ແນະນຳວ່າ ລອງໃຊ້ Laoav ເບິ່ງ ,ຂ້າພະເຈົ້າລອງແລ້ວປະກົດວ່າ ໄດ້ຜົນ
ໃນເບື້ອງຕົ້ນ ຂ້າພະເຈົ້າບໍ່ເຊື່ອວ່າ ຂອງ Lao ຊິຂ້າ virus ໄດ້ບໍ ? ເພາະ anti ຂອງຕ່າງປະເທດ
ເຂົາແຮ່ງເກ່ງຍັງຂ້າບໍ່ໄດ້, ແຕ່ເມື່ອລອງໃຊ້ເບິ່ງແລ້ວ ຂ້າພະເຈົ້າຄິດວ່າເຈງທີ່ສຸດ , ບໍ່ຄວນປະມາດຝືມືຄົນລາວ
ທ້າຍນີ້ ຂໍອວຍໄຊໃຫ້ພອນ ທີມງານ Laoav ຈົ່ງປະສົບຜົນສຳເລັດ ແລະ ພັດທະນາຕໍ່ໄປ

Re:

Tue, 09 Sep 2008 10:26:45 -0400

ຍິນນຳທ່່ານ ຫລາຍໆໆ ທີໄດ້ປະສົລຜົນສຳເລັດ ໃນການກຳຈັດ ຂ້າໄວຣັດ ເຕັມເຮືອນີ້ ແລະເປັນທີ ຍອມຮັບໃນສັງຄົມລາວ ຂໍຊົມເຊີຍນຳທ່ານ ເດີ ຂໍໃຫ້ປະສົບຜັນສຳເລັດ ໃນຂັ້ນຕອນຕໍ່ໄປ ສູ້ໆໆ

Re:

Tue, 09 Sep 2008 10:30:43 -0400

ໃນຄະນະນີ້ ຂ້າພະເຈົ້າມີບັນຫາ ກ່ຽວກັບໄວຣັດ boot sector ເຊິ່ງຂ້າເຈົ້າ ບໍ່ສາມາດ ເຂົ້າໄປໃນ HDD ໄດ້ເລີຍ ແລະບໍ່ສາມາດເຂົ້າໄປ format ໄດ້
ນຳອີກ ເຊິ່ງເປັນບັນຫາໃຫ້ກັບ ຂ້າພະເຈົ້າຫລາຍ ຊ່ວຍຫາວິທາງ ໃຫ້ ຂ້າພະເຈົ້າແດ່ ແລະ ວິການກະຈັດນັ້ນແມ່ນມີ ແບບໃດ

ຂອບໃຈລ່ວງໜ້າ

Re:

Mon, 15 Sep 2008 07:20:50 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ

ຂ້າພະເຈົ້າໃຊ້ program Laoav scan ຫາ virus ແລະ ກໍ່ພົບວ່າ
ພົບ virus ໃນ c:\windows\system32\see32z.dll ແມ່ນ file ແທ້ບໍ່ ສາມາດລຶບອອກໄດ້ບໍ່ ຂໍຄຳແນະນຳແດ່ ເພາະຢ້ານວ່າ: ເປັນ file ທີ່ຕິດ spyware ລຶບໄປແລ້ວຢ້ານວ່າເປິດເຄື່ອງບໍ່ໄດ້

ຂໍຂອບໃຈ

Re:

Mon, 15 Sep 2008 11:41:34 -0400

+File System Modifications
%ProgramFiles%\Microsoft Common\wuauclt.exe
+Registry Modifications

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]

Debugger = "%ProgramFiles%\Microsoft Common\wuauclt.exe"

so that wuauclt.exe is injected into the execution sequence of explorer.exe by being installed as its default debugger

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Interne t Settings]

ProxyEnable = 0x00000000

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]

Directory = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]

CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]

CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]

CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]

CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explore r\Shell Folders]

Cookies = "%System%\config\systemprofile\Cookies"
Cache = "%System%\config\systemprofile\Local Settings\Temporary Internet Files"
History = "%System%\config\systemprofile\Local Settings\History"

+Other details

The following Host Name was requested from a host database:

www.microsoft.com

The data identified by the following URLs was then requested from the remote web server:

http://aaszxu.ru/load3/ld.php?v=1&rs=13441600&n=1&uid=1
http://aaszxr.ru/loadx/ld.php?v=1&rs=13441600&n=1&uid=1

Re:

Wed, 17 Sep 2008 16:34:43 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ກ່ອນອື່ນຕ້ອງຂໍຊົມເຊີຍໃນຜົນງານກ່ຽວກັບ Lao Antivirus ຂອງທ່ານ ແຕ່ວ່າ ເຮົາມີເລື່ອງຢາກຖາມທ່ານວ່າ ເຮົາໄດ້ Update Lao Antivirus 9 ເພື່ອຂ້າ Virus Full house ໄດ້ສຳເລັດ ແຕ່ເມື່ອສຽບ USB ເຂົ້າໄປໃນເຄື່ອງ ມັນຈະສະແກນຫາໃຫ້ໂດຍອັດຕະໂນມັດ ເມື່ອສະແກນຣຽບຣ້ອຍແລ້ວໄປເປີດ Folder ໃນ USB ປາກົດວ່າ Folder ນັ້ນບໍ່ມີ ໄປປິດ Hide ໃນ Folder Option ແລ້ວ ແຕ່ກໍ່ບໍ່ເຫັນ
ລົບກວນທ່ານອາເລັກໄຊ ຈົ່ງແກ້ໄຂໃຫ້ດ້ວຍ ເດີ...

Re:

Fri, 19 Sep 2008 09:19:02 -0400

ຢາກຖາມທ່ານ Admin ກ່ຽວກັບບັນຫາຟາຍ System.exe ທີ່ພົບເຫັນໃນເມື່ອເວລາເປີດຄອມກໍ່ຄື Startup ແລະໃນ Regedit ໂດຍມີຊື່ວ່າ HBService32 ມັນແມ່ນຟາຍຫຍັງແທ້, ເຊີ່ງເຮົາກໍ່ໄດ້ທຳການລືບອອກ ແຕ່ເມື່ອເວລາເປີດຄອມໃໝ່ມັນກໍ່ຍັງກັບມາຄືເກົ່າ

ຂໍຂອບໃຈ

Re:

Fri, 19 Sep 2008 10:01:08 -0400

A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Securi ty
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

HBService32 = "System.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Enum]

Count = 0x00000000
NextInstance = 0x00000000
INITSTARTFAILED = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32]

Type = 0x00000001
Start = 0x00000000
ErrorControl = 0x00000000
ImagePath = "%System%\Drivers\HBKernel32.sys"
DisplayName = "HBKernel32 Driver"
Group = "Boot Bus Extender"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Enum]

Count = 0x00000000
NextInstance = 0x00000000
INITSTARTFAILED = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Secur ity]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32]

Type = 0x00000001
Start = 0x00000000
ErrorControl = 0x00000000
ImagePath = "%System%\Drivers\HBKernel32.sys"
DisplayName = "HBKernel32 Driver"
Group = "Boot Bus Extender"

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs = "HBmhly.dll,HB1000Y.dll,HBWOOOL.dll,HBXY2.dll,HBJXSJ.dll,HBSO2.dll,HBF S2.dll,HBXY3.dll,HBSHQ.

dll,HBFY.dll,HBWULIN2.dll,HBW2I.dll,HBKDXY.dll,HBWORLD2.dll,HBASKTAO.d ll,HBZHUXIAN.dll,HBWOW.dll,

HBZERO.dll,HBBO.dll,HBCONQUER.dll,HBSOUL.dll,HBCHIBI.dll,HBD

Re:

Fri, 19 Sep 2008 10:39:51 -0400

Khor tharm tharn ALEXAI : me processess t sue wa YUR1, YUR2... kert kuen u process nai task manager la, khit wa na ja tit virus or spyware malware yang? la ja kae khai neo dai?
THXSS ting.

Re:

Fri, 19 Sep 2008 12:04:31 -0400

+File System Modifications
%DesktopDir%\BEST ZOO [censored].url
%DesktopDir%\QUALITY [censored].url
%System%\YUR1.exe
c:\x
+Memory Modifications
yur1.exe
+Registry Modifications

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

\YUR1.exe = "%System%\YUR1.exe"

so that YUR1.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

\YUR1.exe = "%System%\YUR1.exe"

so that YUR1.exe runs every time Windows starts

+Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

Re:

Sat, 27 Sep 2008 05:19:11 -0400

+File System Modifications
%System%\drivers\HBKernel32.sys
%System%\HBFY.dll
%System%\System.exe
+ Memory Modifications
System.exe
HBFY.dll
HBFY.dll
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HBKERNEL32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HBKERNEL32\00 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HBKERNEL32\00 00\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\HBKernel32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HBKERNEL3 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HBKERNEL3 2\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HBKERNEL3 2\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Securi ty
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

HBService32 = "System.exe"

so that System.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HBKERNEL32\0 000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "HBKernel32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HBKERNEL32\0 000]

Service = "HBKernel32"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "HBKernel32 Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HBKERNEL32]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Enum]

0 = "Root\LEGACY_HBKERNEL32\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HBKernel32]

Type = 0x00000001
Start = 0x00000000
ErrorControl = 0x00000000
ImagePath = "%System%\Drivers\HBKernel32.sys"
DisplayName = "HBKernel32 Driver"
Group = "Boot Bus Extender"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\HBKernel32]

DisplayName = "HBKernel32 Driver"
ErrorControl = 0x00000000
ImagePath = "%System%\Drivers\HBKernel32.sys"
Start = 0x00000000
Type = 0x00000001
Group = "Boot Bus Extender"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HBKERNEL 32\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "HBKernel32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HBKERNEL 32\0000]

Service = "HBKernel32"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "HBKernel32 Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HBKERNEL 32]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Enum]

0 = "Root\LEGACY_HBKERNEL32\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32\Secur ity]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HBKernel32]

Type = 0x00000001
Start = 0x00000000
ErrorControl = 0x00000000
ImagePath = "%System%\Drivers\HBKernel32.sys"
DisplayName = "HBKernel32 Driver"
Group = "Boot Bus Extender"

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs = "HBmhly.dll,HB1000Y.dll,HBWOOOL.dll,HBXY2.dll,HBJXSJ.dll,HBSO2.dll,HBF S2.dll,HBXY3.dll,HBSHQ.dll,HBFY.dll,HBWULIN2.dll,HBW2I.dll,HBKDXY.dll, HBWORLD2.dll,HBASKTAO.dll,HBZHUXIAN.dll,HBWOW.dll,HBZERO.dll,HBBO.dll, HBCONQUER.dll,HBSOUL.dll,HBCHIBI.dll,HBD

so that HBFY.dll runs every time a Windows application starts

+Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

HBInjectMutex

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%System%\HBFY.dll

the hook is handled by its export "_ServiceRouteEx@12()"

Re:

Wed, 08 Oct 2008 18:03:27 -0400

Trojan.FakeAlert will hijack the desktop background with an image alerting the user that their computer system has been infected with spyware. It also changes some settings of windows which include:- disabling permissions for the user to change the background image and setting the active desktop to 'show web content'. It is usually installed in conjunction with a rogue anti-spyware application.
+File System Modifications
%System%\iefl.dll
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{8B2AE9C0-1555-4C92-905A-531532F15698}
HKEY_CURRENT_USER\Software\Microsoft\Bind

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\VersionIndependentProgID]

(Default) = "BhoNew.Bho"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\TypeLib]

(Default) = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\ProgID]

(Default) = "BhoNew.Bho.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}\InprocServer32]

(Default) = "%System%\iefl.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8B2AE9C0-1555-4C92-905A- 531532F15698}]

(Default) = "IE.Filter"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}\TypeLib]

(Default) = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A- BD83-FEC9B39B2356}]

(Default) = "_IBhoEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}\TypeLib]

(Default) = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B- 8E19-EE27C3D04EE7}]

(Default) = "IBho"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0\0\win32]

(Default) = "%System%\iefl.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0\HELPDIR]

(Default) = "%System%\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B- 637FCD3488EF}\1.0]

(Default) = "Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer]

(Default) = "BhoNew.Bho.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID]

(Default) = "{8B2AE9C0-1555-4C92-905A-531532F15698}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho]

(Default) = "IE.Filter"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\CLSID]

(Default) = "{8B2AE9C0-1555-4C92-905A-531532F15698}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoNew.Bho.1]

(Default) = "IE.Filter"

[HKEY_CURRENT_USER\Software\Microsoft\Bind]

comment = "3913170"

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Devices]

_#VMwareVirtualPrinter = "winspool,TPVM:"

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts]

_#VMwareVirtualPrinter = "winspool,TPVM:,15,45"

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

Device = "_#VMwareVirtualPrinter,winspool,TPVM:"

Re:

Wed, 08 Oct 2008 18:10:07 -0400

+File System Modifications

The following files were created in the system:
%Windir%\cmd.bat
+Memory Modifications

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
Acceset Interface	Accesset Interface	"Stopped"	%Windir%\cmd.bat

+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Acceset Interface
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Acceset Interface\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Acceset Interface
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Acceset Interface\Security

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Acceset Interface\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Acceset Interface]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%Windir%\cmd.bat"
DisplayName = "Accesset Interface"
ObjectName = "LocalSystem"
Description = "Í¨ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ñ¯ï¿½ï¿½ï¿½ï¿½ï¿½á¹©ï¿½Ä¼ï¿½ï¿½ï¿½ï¿½Ù·ï¿½ï¿½ï¿½"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Acceset Interface\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Acceset Interface]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%Windir%\cmd.bat"
DisplayName = "Accesset Interface"
ObjectName = "LocalSystem"
Description = "Í¨ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ñ¯ï¿½ï¿½ï¿½ï¿½ï¿½á¹©ï¿½Ä¼ï¿½ï¿½ï¿½ï¿½Ù·ï¿½ï¿½ï¿½"

Other details

Analysis of the file resources indicate the following possible country of origin:

China

Re:

Fri, 10 Oct 2008 06:28:22 -0400

ຄືວ່າ antivirus ຂ້ອຍມັນຟ້ອງຂື້ນມາຕະຫຼອດວ່າ js/TrojanDownloader.small.NBC trojan ບໍ່ຮູ້ວ່າມັນຊິເຮັດແນວໃດ....................... ຂໍຄຳແນະນຳແດ່ທ່ານ...

Re:

Wed, 29 Oct 2008 17:51:38 -0400

ຄອມພິວເຕ່ ຂ້າພະເຈົ້າ ເວລາເອົາ usb ສຽບໃສ່ ໂປແກມ Antivirus ຈະຟ້ອງ autorun.inf ຂື້ນມາທຸກເທີ່ອ ຂພຈ ລົບຟາຍດັ່ງກ່າວອອກແລ້ວແຕ່ມ ໂປແກມ antivrus ຍັງຟ້ອງຢູ່ຕະລອດເວລາ ແຕ່ຖ້າເອົາ usb ອອກ ມັນຈະບໍ່ຟ້ອງ ຢາກໃຫ້ທ່ານຊ່ວຍແດ່ (ຂອບໃຈລ່ວງໜ້າ).

Re:

Sat, 01 Nov 2008 10:23:35 -0400

Backdoor.Bifrose.PG Backdoor.Bifrose.PG injects itself into other running processes in attempts to hide from the user. It also opens up a port which allows attackers access and control over the infected machine.

File System Modifications

%System%\wmipst.exe
%AppData%\waultc.exe

Memory Modifications

waultc.exe	%AppData%\waultc.exe	86,016 bytes
wmipst.exe	%System%\wmipst.exe	49,152 bytes
update.exe	%AppData%\update.exe	49,152 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A5CDF7EC-751B-46aa-AD69-4005FE080DE8}
HKEY_LOCAL_MACHINE\SOFTWARE\SKav
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msv ideo
HKEY_CURRENT_USER\Software\SKav

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A5CDF7EC-751B-46aa-AD69-4005FE080DE8}]

stubpath = "%System%\wmipst.exe s"

[HKEY_LOCAL_MACHINE\SOFTWARE\SKav]

nck = 98 67 D6 6A CC D9 84 5F F7 EC 7F 84 DC 8A DA 00 A8 5F E4 52 A0 AC EA 5F F7 EC 7F 84 DC 8A DA 00

[HKEY_CURRENT_USER\Identities]

Last User Identity = 0x00029AD1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

waultc = "%AppData%\waultc.exe"

so that waultc.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\SKav]

klg = 00

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

Device = "_#VMwareVirtualPrinter,winspool,TPVM:"

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

09AE1F65372CD881

The following Host Names were requested from a host database:

securitybbs.ddns.info
61.34.203.120

Re:

Fri, 07 Nov 2008 05:41:20 -0500

ເຖິງທ່ານອາເລັກໄຊທີ່ເຄົາລົບ
ຄອມຂອງຂ້າພະເຈົ້າຖືກໄວຣັດຫຍັງກະບໍ່ຮູ້ ມັນເຊື່ອງໝົດທຸກໄອຄອນຢູ່ໜ້າຈໍຄອມພິວເຕີ້ເລີຍ, ເມື່ອນຳຫຍັງກໍ່ຕາມໄປໄວ້ທີ່ເຖິງໜ້າຈໍກໍ່ຈະຖືກເຊື່ອງໝົດເລີຍ. ແຕ່ກໍ່ບໍ່ຮູ້ວ່າການທຳລາຍຂອງໄວຣັດນີ້ເປັນແນວໃດຄືກັນ
ຮຽນທ່ານອາເລັກໄຊໃຫ້ຊ່ວຍເຫຼືອຂ້າພະເຈົ້າດ້ວຍ

ດ້ວຍຄງາມເຄົາລົບແລະບັນຖື

Re:

Thu, 27 Nov 2008 06:03:53 -0500

ເຈົ້າສະບາຍດີທ່ານ, ຂ້າພະເຈົ້າຂໍຖາມແດ່. ເລື່ອງກໍຄືວ່າຂ້າພະເຈົ້າຢາກສືກສາການສ້າງ file autorun ຂອງໂປຣແກຣມໃດໜື່ງຂື້ນມາອັນໜື່ງເພື່ອທົດສອບການເຮັດວຽກຂອງມັນໂດຍໃຫ້ມັນ run ເອງເມື່ອເຮົາມີການ boot ເຄື່ອງ ແລະ file autorun ນັ້ນໃຫ້ຕິດໄປກັບໂປຣແກຣມເລີຍ
ເຮົາມີວີທີເຮັດແນວໃດ? ຂອບໃຈຫຼາຍໆ

Re:

Tue, 09 Dec 2008 07:36:33 -0500

ເປັນ ໜອນອີນເຕິເນັດ
ມັນຈະກອບປີຕົນເອງໄປໃນລະບົບ
%System%\explorer.exe
%System%\hh.exe
ແລະໃນລາຍການໂປຣແກຣມທີ່ເຮັດວຽກຈະມີຊື່ໄຟລ
explorer.exe ແລະ hh.exe
ນອກນັ້ນຍັງສ້າງຄ່າອໍໂຕລັນໃນ Registry

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Userinit = "%System%\userinit.exe,,explorer.exe"

Re:

Tue, 09 Dec 2008 07:42:53 -0500

ເປັນໜອນອີນເຕີເນັດແລະລະບາດໄປທາງ USB...
ລະບົບທີ່ຕິດມັນຈະກອບປີໄປທີ່
%DesktopDir%\manager.exe
c:\melt.bat
ແລະຊື່ໄຟລທີ່ລັນແມ່ນ manager.exe
ນອກນັ້ນສ້າງຄ່າອໍໂຕລັນໃນ Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5FA6F268-CE88-0CA3-93B3-8190D34C6BD4}
StubPath = "%Windir%\system32:msupdate.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Microsoft Update Service = "%Windir%\system32:msupdate.exe"

Re:

Wed, 10 Dec 2008 04:53:41 -0500

ເຖິງ ມ່ານອາເລັກໄຊ ທີ່ນັບຖື

ຂ້າພະເຈົ້າຂອງຄວາມຊ່ວຍເຫຼືອມາຍັງທ່ານດ້ວຍ, ເນື່ອງຈາກວ່າຄອມຂອງຂ້າພະເຈົ້າ ຖືໄວຣັດ work.exe ເຂົ້າ ແລະອາການຂອງມັນ ແມ່ນ ເວລາເປີດ msconfig ຫຼື regedit ແມ່ນມັນຈະລີສະຕາດຕົວເອງໂລດ ໂດຍທີ່ບໍ່ໄດ້ບອກໃຫ້ລີສະຕາດ ເອ໋າະ ແລະກໍ່ມີອີກຢ່າງໜຶ່ງຄື ຄອມຂອງຂ້າພະເຈົ້າຍັງມີໄວຣັດ system.exe ນຳ. ຮືໆໆໆໆໆ

ດັ່ງນັ້ນຈິ່ງຂໍຄວາມກະລຸນາມາຍັງທ່ານເພື່ອຄວາມຊ່ວຍເຫຼືອດ້ວຍ
ຂໍຂອບໃຈຫຼ່ວງໜ້າ

Re:

Thu, 11 Dec 2008 06:08:16 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ມີເລື້ອງມີລົບກວນອີກແລ້ວ ຄືວ່າ ຄອມຂອງ ຂ້າພະເຈົ້າຕິດ

autorun.inf
Threat:
INF/Autorun.gen trojan ຫຼືອາດຈະແມ່ນ ໄວຮັສຕົວອື່ນອີກ
ອາການຂອງ ຄອມ ແມ່ນ ເຂົ້າຄຳສັ່ງ runບໍ່ໄດ້ ເວລາStart >run ພິມຂໍ້ຄວາມໃສ່ runແລ້ວກົດ Enter ປັ໊ບ ຫນ້າຈໍຈະຫາຍ ຄ້າຍຄື Screen saver ປະມານ 3 ວິນາທີມັນຈະກັບສູ່ສະພາບເດີມ ບໍ່ຮູ້ວ່າເປັນຫຍັງ ແລະ ເວລາຊິລົງ Program ໃດໆກໍລົງບໍ່ໄດ້ ແມ້ແຕ່ຊິລົງຕິດຕັ້ງ Laoav ເພື່ອ Scan ຫາກໍ່ບໍ່ໄດ້ ,ເຂົ້າ Safe mode ກໍ່ຕິດຕັ້ງບໍ່ໄດ້ ຊວ່ຍແດ່ ທ່ານ
ຂໍຂອບໃຈ ເປັນຢ່າງສູງ

Re:

Sat, 13 Dec 2008 06:45:48 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ເຄົາລົບ ນັບຖື

ເຄື່ອງຂອງ ຂ້າພະເຈົ້າໂດນ virus.win32.Sality.aa ເຮັດໃຫ້ ຂພຈ ຍອມ
ລົງ windowໃຫມ່ກໍ່ແກ້ບໍ່ໄດ້ ມັນກັບມາຄືນອີກ ເຂົ້າ Task Ma..ກໍ່ບໍ່ໄດ້ ລົງProgram ຫຍັງ ກໍ່ບໍ່ໄດ້ ,ເຂົ້າ Safe mode ກໍ່ບໍ່ໄດ້ ຊິລົງ Laoav ມັນກໍ່ບໍ່ໃຫ້ລົງ.....ໂອ໊ຍ!!!!....ຊວ່ຍເດ ຕັ້ງwindow ໃຫມ່ 3 ເທື່ອແລ້ວ
ກໍ່ຄືເກົ່າ ຂໍໃຫ້ທ່ານ ຊວ່ຍຫາວິທີແກ້ໄຂໃຫ້ແດ່......ຂໍຂອບໃຈ ເປັນຢ່າງສູງ

Re:

Sat, 20 Dec 2008 06:12:46 -0500

ເປັນໜອນ Internet ຍັງສາມາດຕິດຕາມເນັດເວີກອີກ
ເມື່ອລະບົບຫາກຕິດໜອນຕົວນີ້ແລ້ວຈະມີໄຟລແປກໆດັ່ງນີ້
%Temp%\Flu Burung.txt
c:\Recycled\CTFMON.EXE
c:\Recycled\SMSS.EXE
c:\Recycled\SPOOLSV.EXE
c:\Recycled\SVCHOST.EXE
ແລະສ້າງຄ່າໃນ Registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\IP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Options
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\RTF
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Text
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Word6
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wo rdpad\Write

ມັນລົບຄ່ານີ້ອອກ

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command]

(Default) = ""%1""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config]

(Default) = "C&onfigure"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command]

(Default) = "rundll32.exe desk.cpl,InstallScreenSaver %l"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install]

(Default) = "&Install"

ສ້າງຄ່ານີ້ໃໝ່

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

Shell = "Explorer.exe "C:\recycled\SVCHOST.exe""

ແລະແປງຄ່າ

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]

QuickTip = "prop:Type;Size"
InfoTip = "prop:Type;Write;Size"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile]

(Default) = "Microsoft Word Document"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\open]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\HideFileExt]

UncheckedValue = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden]

UncheckedValue = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit = "C:\recycled\SVCHOST.exe,"

Re:

Mon, 29 Dec 2008 06:40:47 -0500

A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

c:\AutoRun.Inf
%System%\arf
c:\Documents and Settings.lnk
c:\Thumbs.lnk
%System%\IPv6.dll
%System%\NvCpl64.dll
%System%\WinXP.bmp
%System%\cryptnet21.dll
%System%\ReSSDT.sys

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\SaveInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000231-1000-0010-8000- 00AA006D2EA4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000231-1000-0010-8000- 00AA006D2EA4}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{00000231-1000-0010-8000-00AA006D2EA4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet21

The following Registry Keys were deleted:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\SuperHidden
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\SuperHidden\Policy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000231-1000-0010-8000- 00AA006D2EA4}\InprocServer32]

(Default) = "%System%\WinXP.bmp"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Browser Helper Objects\{00000231-1000-0010-8000-00AA006D2EA4}]

(Default) = "Thunder5BHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

NvCpl = "RunDll32.exe "%System%\NvCpl64.dll",NvStartup"

so that NvCpl64.dll runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet21]

Impersonate = 0x00000000
Asynchronous = 0x00000000
Startup = "WLSStartEvent"
DllName = "%System%\cryptnet21.dll"

so that cryptnet21.dll is installed as a Winlogon notification package

The following Registry Values were deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\SuperHidden]

Type = "checkbox"
Text = "@shell32.dll,-30508"
WarningIfNotDefault = "@shell32.dll,-28964"
HKeyRoot = 0x80000001
RegPath = "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
ValueName = "ShowSuperHidden"
CheckedValue = 0x00000000
UncheckedValue = 0x00000001
DefaultValue = 0x00000000
HelpID = "shell.hlp#51103"

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs = "%System%\IPv6.dll"

so that IPv6.dll runs every time a Windows application starts

Re:

Fri, 02 Jan 2009 03:57:00 -0500

ເວັບນີ້ ເມຶ່ອເຮັດຕາມທີ່ບອກແຕ່ວ່າ lao antivirus ບໍບອກຄືມັນວ່າ. ຢາກຖາມວ່າມັນເປັນໄວຣັດສ໌ຫລືບໍ??

Re:

Wed, 07 Jan 2009 11:26:14 -0500

ເຖິງທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື

ຂ້າພະເຈົ້າມີແນວທີ່ຈະຕ້ອງຂໍຄວາມກາລຸນາ ລົບກວນທ່ານອີກແລ້ວ
ຄອມຂອງໝູ່ຂ້າພະເຈົ້າຖືກໄວຣັດantivirusເຂົ້າ ແລ້ວantivirus ກະເລີຍບໍ່ສາມາດໃຊ້ງານໄດ້ ແລະ ຂ້າພະເຈົ້າໄດ້ລີມູບອອກ ແລ້ວເອົາອັນໃໝ່ມາລົງກະລົງບໍ່ໄດ້ເລີຍ ຫຼືລົງໄດ້ແຕ່ບໍ່ເຮັດວຽກກະບໍ່ແນ່ໃຈຄືກັນ ເພາະບໍ່ເຫັນມັນຂື້ນມາ ຫຼື ອັບເດດໄດ້ເລີຍ

ດັ່ງນັ້ນຈິ່ງຂໍຄວາມກະລຸນາມາຍັງທ່ານ ຊ່ວຍຂ້າພະເຈົ້າແກ້ໄຂບັນຫານີ້ດ້ວຍ
ໝູ່ຂອງຂ້າພະເຈົ້!ບໍ່ຍາກລົງວິນໂດໃໝ່ ເພາະເປັນຄອມໂນແນມ ແລະ ບໍ່ມີ ໄດເວີ້

ຮຽນມາດ້ວຍຄວາມເຄົາລົບແລະນັບຖືຢ່າງສູງ

Re:

Thu, 08 Jan 2009 06:18:13 -0500

ຂໍຄວາມຊ່ວຍເຫຼືອແດ່ທ່ານ ເລື່ອງມີຢູ່ວ່າ: ຂ້າພະເຈົ້າກະໃຊ້ usb ນັ້ນໄປຕາມປົກກະຕິ ແຕ່ມີມື້ໜື່ງເອົາມາໃຊ້ມັນບອກວ່າ: the disk in drive G is not formatted. do you want to format it now? ແຕ່ເມື່ໄປ format ພັດບອກວ່າ windows was unable to complete the format. ແລະ ເບິ່ງ properties ແລ້ວ file system ເປັນ RAW ແລະ ເນື້ອທີ່ປັນ 0 bytes
ຊ່ວຍແນະນຳວິທີແກ້ໄຂແດ່ທ່ານ . ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Wed, 14 Jan 2009 15:48:39 -0500

ເມື່ອຕິດໄວຣັສນີ້ມັນຈະສ້າງໄຟລໃນຄອມດັ່ງນີ້:
%Temp%\Network.txt
%Temp%\DeathTime.Die
c:\My Girls\FolderData.exe
c:\RECYCLER\lsass.exe
ສ້າງຄ່າໃສ່ Registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msnmsgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msnmsgs.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32krn.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

NeverShowExt = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]

Debugger = "C:\RECYCLER\lsass.exe"

so that lsass.exe is injected into the execution sequence of ctfmon.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msnmsgr.exe]

Debugger = "C:\RECYCLER\lsass.exe"

so that lsass.exe is injected into the execution sequence of msnmsgr.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msnmsgs.exe]

Debugger = "C:\RECYCLER\lsass.exe"

so that lsass.exe is injected into the execution sequence of msnmsgs.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32.exe]

Debugger = "C:\RECYCLER\lsass.exe"

so that lsass.exe is injected into the execution sequence of Nod32.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32krn.exe]

Debugger = "C:\RECYCLER\lsass.exe"

so that lsass.exe is injected into the execution sequence of Nod32krn.exe by being installed as its default debugger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe]

Debugger = "C:\RECYCLER\lsass.exe"

so that lsass.exe is injected into the execution sequence of Regedit.exe by being installed as its default debugger

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

(Default) = "File Folder"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000000

ດາວໂລດຕົວກຳຈັດ ແມ່ນ Kill FolderData
http://laoav.co.cc/download.php?view.60

Re:

Mon, 19 Jan 2009 13:50:31 -0500

ຄອມຂ້ອຍຈັກໄປຖືກໄວຣັສໂຕໃດ ຢູ່ດີໆກະລົງໂປຼແກຼມຫຍັງບໍ໋ໄດ້ເລີຍ, ເຂົາໜ້າຕ່າງ Run ກໍ່ດີດອອກຄືນ, ແຖມລົງໂປຼແກມຫຍັງກໍບໍໄດ້ແລ້ວ.
Nod32 ທີ່ໃຊ້ຢູ່ກໍໃຊ້ງານບໍໄດ້ເລີຍ. ທ່ານໃດມີວິທີແກ້ໄຂບອກຂ້າພະເຈົ້າແດ່
ຂອບໃຈຢ່າງສູງ

Re:

Tue, 20 Jan 2009 16:04:15 -0500

ເມື່ອຕິດຄອມທ່ານແລ້ວມັນຈະສ້າງໄຟລ
c:\Zita.exe
ແລະສ້າຄ່າໃນ Registry

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

NeverShowExt = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]

Debugger = "C:\Zita.exe"

so that Zita.exe is injected into the execution sequence of ctfmon.exe by being installed as its default debugger

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

(Default) = "File Folder"

Re:

Wed, 21 Jan 2009 04:21:07 -0500

ສະບາຍດີທ່ານ
ຄອມຂອງຂ້າພະເຈົ້!ຫຼັງຈາກທີ່ຂ້າໄວຣັດແລ້ວ ໂຕໜັງສືຂອງໄອຄອນຢູ່ເທິງໜ້າຈໍມັນມີຂອບພື້ນສີຟ້າຂຶ້ນມາ
ເບິ່ງແລ້ວບໍ່ງາມເລີຍຍາກໃຫ້ມັນກັບມາເປັນຄືເກົ່າ ແຕ່ບໍ່ຮູ້ວ່າຈະສາມາດເຮັດໄດ້ແນວໃດ ດັ່ງນັ້ນຈິ່ງຂໍຮ້ອງມາຢັງທ່ານ ຂໍຄວາມກະລຸນານຳທ່ານດ້ວຍ

ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Tue, 27 Jan 2009 17:11:28 -0500

ເປັນໜອນອີນເຕີເນັດສົງເມວຫາຄົນອື່ນດ້ວຍຕົນເອງແລະແຜ່ກະຈາຍໄປຕາມເນັດເວີກ
ເມື່ອຕິດຄອມ ແລ້ວຈະມີໄຟລ
%System%\javaqs.exe
%System%\javaupd.exe
ສ້າງຄ່າໃນ Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ CabinetFileStateKAV

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Kaspersky Email Security = "%System%\javaupd.exe"

Re:

Wed, 04 Feb 2009 15:56:30 -0500

ເປັນໜອນອິນເຕີເນັດແລະລະບາດຕາມ Handy Drive ໂດຍອາໃສໄຟລ Autorun.inf
ແລະ ໃສ່ຊືໄຟລຕົວເອງເປັນ clfmon.exe
ເມື່ອຄອມທ່ານຕິດມັນຈະສ້າງໄຟລດັ່ງນີ້
c:\Autorun.inf
c:\clfmon.exe
%System%\clfmon.exe
ສ້າງຄ່າໃນ Registry

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ System]

DisableTaskMgr = 0x00000001
DisableRegistryTools = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

clfmon = "%System%\clfmon.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000000

ໄວຣັສນີ້ມັນຍັງພະຍາຍາມຕິດຕໍ່ຫາທີ່ຢູ່ນີ້ອີກ
http://users.cjb.net/d15839d0/clfmon.txt

Re:

Wed, 04 Feb 2009 16:15:29 -0500

ມັນເປັນໜອນໄວຣັສທີ່ແຜ່ຕາມ USB Drive ເຊື່ງມີໄຟລ autorun.inf ແລະ Secret.exe
ເມື່ອຄອມທ່ານຕິດແລ້ວມັນສ້າງໄຟລດັ່ງນີ້
%Windir%\kdcoms.dll
%System%\system.exe
%Windir%\userinit.exe
ແລະສ້າງຄ່າໃນ Registry

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit = "%Windir%\userinit.exe"

ເຊີ່ງມັນມາປ່ຽນຄ່າຂອງວິນໂດວໂດຍປົກະຕິແລ້ວຄ່າແມ່ນ
Userinit = "C:\Windows\System32\userinit.exe"

ສະນັ້ນຖ້າເຮົາຂ້າໄວຣັສແລ້ວຖ້າຫາກບໍ່ມາແປງຄ່ານີ້ຄືເກົ່າຂອງວິນໂດວເມື່ອທ່ານ
ມອດແລ້ວມາເປີດເທື່ອໜ້າຈະເຂົ້າວິນໂດວບໍ່ໄດ້ມີແຕ່ກັບໄປກັບມາບ່ອນ Login
ດັ່ງນັ້ນ Laoav ຈີ່ງສ້າງຕົວຂ້າທີ່ປອດໄພກວ່າ ແມ່ນໃສ່ຊື່ Secret.exe Killer ທ່ານ
ສາມາດດາວໂລດມາໃຊ້ພຣີໄດ້

Re:

Sat, 07 Feb 2009 08:47:12 -0500

ໍຊ່ວຍແດ່ຄອມຕິດໄວຣັດ skynet.exe ມັນ coppy folder ເປັນນາມສະກຸນ .exe ຫມົດເລີຍ ຂ້າກໍ່ບໍ່ຫມົດຈັກເທື່ອ

Re:

Mon, 16 Feb 2009 09:37:19 -0500

ປຸ່ມ turn off ຫາຍໄປ ເຫຼືອແຕ່ log off ຈະປິດເຄື່ງແຕ່ລະເທືອຕ້ອງຜ່ານຫຼາຍຂັ້ນຕອນ ເອີ້ນປຸ່ມ turn off ມາໄດ້ແນວໄດ
please, tell us, thank you before hand

Re:

Thu, 19 Feb 2009 04:40:16 -0500

ບໍສາມາດມອດຄອມໄດ້ເນື່ອງຈາກຕິດໄວຣັສ
ຊ່ວຍແນະນຳວິທີແກ້ໄຂແດ່

ຂອບໃຈຫລາຍໆ

Re:

Mon, 23 Feb 2009 05:49:32 -0500

i have a problem on my computer. i call to computer shop they always recommend me to install new windows coz no way to solve. i think they don't know much about internet.
i don't want to install new windows coz i already install it 2 times.

if anyone can help call me plz 7830745

thanks

Re:

Sun, 24 Aug 2008 23:49:06 -0400

ສະບາຍດີທ່ານ ຕ້ອງການບົດຮຽນຕາມດ້ານລ້າງ:
- ວິທີການ ຍິງ MSN ຂອງຄົນອື່ນໃຫ້ Online ບໍ່ໄດ້
- Live CD_-_Wireless_hacking ວ່າກັນວ່າ FBI ກໍ່ໃຊ້ຕົວນີ້
- ໂປຣແກຣມ Hack Hotmail , Yahoo , Gmail ທັ້ງຫລາຍ
- ໂປຣແກຣມ Hack Hotmail , Yahoo , Gmail ທັ້ງຫລາຍ

ຊ່ວຍຊອກໃຫ້ແດ່ທ່ານ ຈະບໍ່ລືມບຸນຄຸນຕໍ່ທ່ານຢ່າງສູງ

Re:

Mon, 25 Aug 2008 01:26:28 -0400

ທ່ານພໍມີວິທີບໍ່ທີ່ຈະສາມາດ Hack ຫຼຶ Password ໃນຕອນ Login
ທີ່ເວັບ www.laohacker.com
ເພາະມັນມີບົດຄວາມກ່ຽວການ Hack ຫລາຍ ຊ່ວຍບອກວິທີແດ່ທ່ານ

ແລະ ຢາກຮູ້ວ່າແມ່ນໃຜເປັນຜູ້ສ້າງເວັບນັ້ນ

Re:

Tue, 26 Aug 2008 02:54:54 -0400

Re:

Tue, 26 Aug 2008 12:03:39 -0400

ເຮົາຈະເຮັດແນວໃດເພື່ອບໍ່ໃຫ້ຜູ້ໃຊ້ສາມາດ save ຂໍ້ມູນລົງໃນ Hard drive( C,D) ໄດ້ ທ່ານມີວິທີໃດ ຊ່ວຍບອກແດ່.
" phet_info@yahoo.com "
ຂອບໃຈ

Re:

Wed, 27 Aug 2008 12:35:33 -0400

ຂ້ອຍພໍມີພື້ນຖານກ່ຽວກັບ Computer ພໍສົມຄວນ ແລະ ຂ້ອຍເຄີຍອອກແບບລະບົບ Network ນ້ອຍໆ ແຕ່ຂ້ອຍໄດ້ຮັບວຽກທີ່ເປັນໂຄງການໃຫຍ່ຂ້ອຍອາດຈະເຣັດຜິດພາດ. ສະນັ້ນ, ຈຶ່ງຂໍຄຳແນະນຳຈາກທ່ານທີ່ມີ ຂໍ້ມູນ ແລະ ບົດຮຽນກ່ຽວກັບເລື່ອງດັ່ງກ່າວ ຫລື website ທີ່ຄັກໆມີບົດຮຽນລະອຽດ. ກະລຸນາສົ່ງມາທີ bounpanhs@yahoo.com

ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Wed, 27 Aug 2008 19:20:14 -0400

ສະບາຍດີ, ສະມາຊິກໃໝ່ຂໍລາຍງານຕົວ

ມາແວ່ລົງທະບຽນເປັນສະມາຊິກແຕ່ເຊົ້າຮອດຄຳນີ້ ຫາກໍ່ລົງທະບຽນໄດ້ ແຕ່ຈັງໃດກໍ່ຍັງດີກວ່າບໍ່ໄດ້ເນາະ

Re:

Thu, 28 Aug 2008 04:00:44 -0400

ຄຶວ່າ: ດ່ຽວນິ້ຢູ່ເຮືອນຂ້າພະເຈົ້າໃຊ້ ອິນເຕີເນັດລາຍເດືອນຂອງ ລາວໂທລະຄົມ ແລະ
ເປັນລະບົບ Adsl 128kbps
ຂ້າພະເຈົ້າໄດ້ລົງ Windows ໃໜ່ແລ້ວມັນບໍສາມາດຫຼິ້ນອິນເຕີເນັດ ແລະ ດ່າຍເວີ ກະລົງໄດ້ຄົບຖ້ວນແລ້ວ ແຕ່ວ່າ Connection ແມ່ນເຊື່ອມຕໍ່ໄດ້ ແຕ່ພໍເຂົ້າໂປມແກຮມ
Internet Explorer ແລ້ວອາການຂອງມັນຄຶບໍ່ໄດ້ເຊື່ອມຕໍ່ກັບ ອິນເຕີເນັດ
ທ່ານພໍຈະມີວິທີແກ້ໄຂ້ບໍ່ຊ່ວຍບອກວິທີແດ່ທ່ານ.

Re:

Fri, 29 Aug 2008 05:13:21 -0400

Autorun, or "Autoplay", are extended automatic functions associated with removable media such as CDs and DVDs. The foundation of this feature is the insert notification support in the device driver. Most, if not all, removable devices available today support this feature. After Windows detects that a disk has been inserted, it looks in the disk's root directory, finds, reads, and follows specific instructions defined in a text based configuration file, Autorun.inf. In short, a computer looks for an "autorun.inf" file within any removable media inserted into it, such as a floppy, CD, or DVD, and if such a file is found, treats the media as an Autorun device. This is the essense of applications automatically launching when a CD/DVD is inserted into a computer. An prime example of this would be the "setup" application executing when a product's CD is inserted. The Autorun.inf file defines the process or application that will automatically run when a disk is inserted. The Autorun file can also define the following, among other things:

The Icon that will represent your application's CD or DVD when the drive is viewed with My Computer or Explorer.

Menu commands displayed when the user right-clicks the CD-ROM icon from My Computer or Explorer.

Note: Autorun can be disabled by the user through the device manager or with an entry in SYSTEM.INI. Click here for more information on enabling/disabling autorun.

Autorun Menu, What is it?

An Autorun Menu is the list of items presented to the user in the Context menu, (Right mouse click) on the CD in Explorer or My Computer. This menu, its items and the functions that they perform are defined in the Autorun.inf file. This section describes the configuration of the Autorun.inf file that creates menu items.

TERMINOLOGY:	DEFINITION:
Context menu	Or popup menu, is the menu displayed when the user selects (right mouse click) the cd drive icon in Explorer or My Computer.
Keyword	Defines the item to be added to the Popup or Context menu and defines the item that an action is to be taken.
Keyword modifier	Keyword modifier distinguishing the Popup or Context menu item from others.
Shell	The root of the command that specifies both the display of a Popup or Context menu item and its action.
Hotkey	Placement of the ampersand (&) defines the hotkey or access key for the menu item. The next character adjacent to the ampersand will be the hot key. A hot key is not required. Note: Be careful to select unique hotkeys. Any duplication will result in the second instance being null.

EXAMPLE AUTORUN FILE:	DEFINITION:
[autorun]	The flag used to signify the start of the Autorun procedures. All autorun instructions follow this flag.
open=filename.exe /argument1	An instruction to the system to open the program called filename.exe in the current directory passing in argument1 as the supplied parameter.
icon=\foldername\filename.dll,5	This command sets the icon of the drive that the autorun CD is inserted into. Windows is instructed to set the CD-ROM icon as the 5th icon found within the filename.dll library.
shell\install = &Install	shell\install = &Install Shell is the keyword to define the item to be added to the Popup or Context menu. \install is the keyword modifier distinguishing the Popup or Context menu item from others. &Install is the value defining the text to be displayed in the Popup menu. The ampersand preceding Install, defines the Hotkey for that item.
shell\install\command = setup.exe	shell\install\command is the keyword defining that an action is to be taken. setup.exe is the value defining the action to be taken when the user selects the item in the Popup menu.
shell\uninstall = &UnInstall	Additional Popup menu examples: Uninstall runs an uninstall application
shell\uninstall\command = Uninstall.exe
shell\readme = &Read Me	Readme displays a readme file using notepad passing the filename readme.txt as an argument.
shell\readme\command = notepad readme.txt
shell\help = &Help	Help displays a helpfile using the default registration of winhelp
shell\help\command = helpfilename.hlp
Note: Each of the shell keywords are followed by a unique modifier distinguishing each context menu items and providing an id association to their action.

Autorun.inf, What is it?

Autorun.inf is the primary instruction file associated with the Autorun function. Autorun.inf itself is a simple text-based configuration file that tells the operating system which executable to start, which icon to use, and which additional menu commands to make available. In other words, autorun.inf tells Windows how to deal open the presentation and treat the contents of the CD. The entire sequence is initiated when the "disk change notifcation" polling discovers a new disk in the CD or DVD ROM drive. Then, if the "Auto insert notification" feature is enabled (it is by default), Windows checks in the new disk's root directory for the existence of an "autorun.inf" file. If found, Windows then reads and follows the specific instructions this file defines. If no autorun.inf file is found, then Windows refers to the new disk by its serial number and executes the default actions associated with the (data or audio) content on the disk. The Autorun.inf file defines the following:

	The process or application that will automatically run when a disk is inserted
	Optionally, one can define the process or application that will run for specific Operating environments.
	The icon that will represent your application's CD or DVD when the drive is viewed with My Computer or Explorer.
	Menu commands displayed when the user right-clicks the CD-ROM icon from My Computer or Explorer.

A simple Autorun.inf example:
	[autorun]
	open=autorun.exe
	icon=autorun.ico

A complex Autorun.inf example:
This example is used in the following section for complete definition and descriptions.
	[autorun]
	open=filename.exe /argument1
	icon=\foldername\filename.dll,5
	[autorun.mips]
	open=filenam2.exe
	icon=filename.ico
	[autorun.alpha]
	open=filenam3.exe
	icon=filename.ico
	[autorun.ppc]
	open=filenam4.exe
	icon=filename.ico
	shell\install = &Install
	shell\install\command = setup.exe
	shell\uninstall = &UnInstall
	shell\uninstall\command = Uninstall.exe
	shell\readme = &Read Me
	shell\readme\command = notepad readme.txt
	shell\help = &Help
	shell\help\command = helpfilename.hlp

This section describes the configuration of the Autorun.inf file and each of the potential items.

Example Autorun File:	Description:
[autorun]	[autorun] is the primary, required section name.
open=filename.exe /argument1	Open is the keyword to determine what action to take upon insert notification.
filename.exe is the value defining the application that will be automatically started.
/argument1 is the argument, parameter or switch passed to the application being run. Logically, any command line parameters used must be supported by the application.
icon=\foldername\filename.dll,5	Icon is the keyword to determine the icon used for the disk.
filename.dll is the value defining the file containing the icon.
,5 is the argument to the icon resource defining which icon to display.
Note: By default, the system looks for the file in the root directory of the inserted disk. If you want to access a file located in a specific folder or subdirectory, specify a path relative to the root. Example: open = foldername\filename.exe This will not change the current directory. Although AutoPlay is the default menu item, you can define a different command to be the default by including the following line. shell = verb When the user double-clicks on the icon, the command associated with this entry will be carried out. Note: a more common method of defining the icon resouce is an explicit reference to a .ico file. Example: icon=autorun.ico Note: The icon defined representing your application's CD or DVD is the drive icon as viewed with My Computer or Explorer. Valid file types containing icons include .ICO .BMP .EXE .DLL If the file includes more than one icon, by default, the second icon in the files icon resource will be displayed.

Example Autorun File:	Description:
[autorun.mips]	Defining the autorun items for a mips machine
open=filenam2.exe	The platform specific application to run
icon=filename2.ico	The platform specific autorun icon
[autorun.alpha]	Defining the autorun items for a DEC Alphamachine
open=filenam3.exe	The platform specific application to run
icon=filename3.ico	The platform specific autorun icon
[autorun.ppc]	Defining the autorun items for a Power PC
open=filenam4.exe	The platform specific application to run
icon=filename4.ico	The platform specific autorun icon
shell\install = &Install	The Keyword defining a menu item and the Hot key for that item
shell\install\command = setup.exe	The keyword defining the operation to perform when the user selects this item
shell\uninstall = &UnInstall	Additional menu item example
shell\uninstall\command = Uninstall.exe	Additional menu item example
shell\readme = &Read Me	Additional menu item example
shell\readme\command = notepad readme.txt	Additional menu item example
shell\help = &Help	Additional menu item example
shell\help\command = helpfilename.hlp	Additional menu item example

How to Test Autorun.inf Without Burning to a CD

It is possible to test an Autorun.inf file without burning all the necessary files onto CD-ROM, as long as the computer has autorun enabled on at least one of its removeable devices. More information on such procedures to enable autorun can be found here. By utilizing the following methods, constant refining of the Autorun.inf file is possible without the need to burn multiple CDs.

Using removable media (Floppy/Zip/etc...)

1. Enable autorun on the desired removable media drive. 2. Copy the autorun.inf and all dependant files onto the removable media. 3. Remove and insert the media.

Using a Virtual Drive

1. Download and install a virtual CD/DVD-ROM emulator, such as the tool available from Daemon-Tools. 2. Using CD-Burning software, such as provided by Nero or Roxio, create a CD project with the Autorun.inf file inserted into the root directory of the CD. 3. Save the project to a CD project file, usually with a .bin or .iso or .cdi extension, with the CD-Burning software. 4. Using the CD/DVD-ROM emulator, load the project file into the virtual drive. This has the same effect as physically inserting the CD with the Autorun.inf into the CD/DVD-ROM.

Enable/Disable Autorun

How To Enable/Disable Autorun (Windows 95/98/Me)

Access the System Properties Dialog. Using Control Panel: My Computer: Properties or Explorer: My Computer: Properties.
Select the Device Manager tab.
Select the CD-ROM folder.
Select the entry for your CD-ROM drive.
Select Properties.
Select the Settings tab.
Turn on or off the Auto insert notification option.
Select OK.
Select OK

How To Enable/Disable Autorun (Windows NT/2000)

Start RegEdit (regedt32.exe).
Go to HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Cdrom.
Edit the Autorun value to '1' to enable autorn, and '0' to disable autorun.
Close RegEdit

How To Enable/Disable Autorun (Windows XP)

Open Windows Explorer by pressing the Windows + "e" key.
Right-click the desired CD-ROM and select Properties from the menu.
Select the AutoPlay tab.
Select each item from the pulldown list and for the Action to perform, select "Take no action" to disable autorun, or pick the apporpriate action to take if enabling autorun.
Select OK.

How To Enable Autorun for Other Removable Media

Autorun can be enabled or disabled for all Removable media types, such as a floppy or Zip disk. Windows systems are configured to enable CD Notification, other removable media are by default disabled. The System Properties User interface only exposes the CD Enable or Disable selection. The setting reflected in this dialog makes an entry in the System Registry. It is in this same location that other media types are configured. Notes:

Modifiying the Registry is not for the inexperienced user. Anyone will tell you, be VERY careful.
The modifications made in this case use Hex not Decimal numbers. If you are unfamiliar with the Registry or the characteristics of base numbering and Hex, studying these topics prior to making these modifications is advisable.

To Modify these Registry Settings, Use Regedit and navigate to the following Key:

HKEY_CURRENT_USER
Software
Microsoft
Windows
CurrentVersion
Policies
Explorer
"NoDriveTypeAutoRun"

The default value for the setting is 95 0 0 0. Change the first byte to 91. Restart the computer to make the new setting take effect. You may have to right-click on the floppy and choose AutoPlay from the menu to see the AutoPlay behavior.

Additional Technical Info

The first byte defines which drive types to EXCLUDE from Autorun behavior. The hex value of the byte is the sum of all of the drive type values to exclude + 128.

DRIVE_UNKNOWN 1
DRIVE_NO_ROOT_DIR 2
DRIVE_REMOVABLE 4 (floppy disks and removable cartridges)
DRIVE_FIXED 8 (hard disks)
DRIVE_REMOTE 16 (network drives)
DRIVE_CDROM 32 (CD-ROMs)
DRIVE_RAMDISK 64

The default configuration excludes UNKNOWN (1), REMOVABLE (4) and REMOTE (16) which would be 16 + 4 + 1 + 128 = 149, which is hex 95. If you take out REMOVABLE you get 16 + 1 + 128 = 145, which is hex 91. The calculation for this value is 1 + 4 + 16 + 128 = 149. 149 Decimal is 95 Hex The new calculation is 1 + 16 + 128 = 145. 149 Decimal is 91 Hex You may have to restart for the system to recognize a floppy or Zip as an Autoplay drive. If your floppy drive does not show a custom icon or AutoPlay in the menu when right-clicked, double-click on the icon for your computer on the desktop and press F5 to refresh the information in the Explorer window. Zips and floppies will not autolaunch when media is inserted. You must double-click their icon or right-click and choose AutoPlay from the menu.

Re:

Sat, 30 Aug 2008 08:21:35 -0400

ຕອນນີ້ ຂ້າພະເຈົ້າຫຼີ້ນ internet ຜ່ານ wireless ໂດຍທີ່ຜູ້ຈະໃຊ້ສັນຍານ ຈະຕ້ອງມີ key ໃສ່ ຈິ່ງຈະສາມາດເຊື່ອມຕໍ່ໄດ້ ແລະເຄື່ອງຂອງຂ້າພະເຈົ້າກໍ່ໄດ້ໃສ່key ດັ່ງກ່າວລົງໄປແລ້ວ
ແຕ່ຂ້າພະເຈົ້າຢາກຣູ້ວ່າ key ທີ່ໃສ່ແມ່ນຫຍັງເພາະມີພະນັກງານ ITໃສ່ໃຫ້ ຢາກລົບທ່ານ ອາເລັກໄຊວ່າ
ມີfile ທີ່ preview ຫາ key ໄດ້ບໍ່ ເພາະເວລາລົງ windows ໃຫມ່ key ຈະຫາຍໄປ
ຂໍຂອບໃຈ

Re:

Mon, 01 Sep 2008 06:02:56 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ

ຂ້າພະເຈົ້າຂໍລົບກວນທ່ານແດ່ ຄືວ່າຂ້າພະເຈົ້າຢາກອັດສຽງເວົ້າ ເຂົ້າເຄື່ອງຄອມພິວເຕີ້ ແລ້ວບັນທຶກເປັນຣູບແບບ file ສຽງ ທີ່ສາມາດເປີດຟັງໄດ້ ຄືກັບ file ສຽງເພງ
ຂໍລົບກວນເທົ່ານີ້
ຂໍຂອບໃຈເປັນຢ່າງສູງ

Re:

Mon, 01 Sep 2008 13:18:50 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ
ຂ້າພະເຈົ້າມີບັນຫາ ມາລົບກວນທ່ານອີກແລ້ວ ຄືວ່າຂ້າພະເຈົ້າໃຊ້ Internet ຮວ່ມກັນ ຫຼາຍຫນວ່ຍ ແຕ່ລະຫນວ່ຍສາມາດເບິ່ຯ drive ຂອຯຫນວ່ຍອື່ນໄດ້ ໂດຍເປີດຜ່ານ
My Network places ແລະ click ເຂົ້າໄປເບິ່ຯຂໍ້ມູນຜູ້ອື່ນ ແລະ ມີຜູ້ບໍ່ປະສົຯດີຕໍ່ເຣົາ
ເປີດຂໍ້ມູນໃນເຄື່ອຯຂອຯເຣົາອອກມາ ແລ້ວລຶບຖີ້ມ ດັ່ໍັຯນັ້ນຂ້າພະເຈົ້າຈີ່ຯ ຢາກຣູ້ວິທີ lock
ໃສ່ password ບໍ່ໃຫ້ຜູ້ອື່ນເປີດເບິ່ຯໄດ້

ຂໍຂອບໃຈ

Re:

Mon, 01 Sep 2008 13:25:56 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື

ຂ້າພະເຈົ້າມີບັນຫາອີກແລ້ວ ຄືວ່າ ຂໍ້ມູນຂອຯຂ້າພະເຈົ້າທີ່ save ໄວ້ໃນ drive D: ຖືກຜູ້ອື່ນເປີດເຂົ້າໄປລຶບ ຊະແລ້ວ!!! ສ້າຯຄວາມປວດຫົວຫຼາຍ ຈິ່ຯຢາກຂໍລົບກວນ ທ່ານ ອາເລັກໄຊ
ຊວ່ບຫາວິທີ ກູ້ file ຄືນມາໃຫ້ແດ່

ຂໍຂອບໃຈເປັນຢ່າຯສູູຯ

Re:

Fri, 05 Sep 2008 07:38:23 -0400

ເຖິງທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ຄືວ່າຄອມຂອງຂ້າພະເຈົ້າບໍ່ສາມາດໃຊ້ປຸ່ມສະແຕນບາຍໄດ້ ແລະ ຄອມຢູ່ຫ້ອງການກໍ່ເຊັ່ນດຽວກັນ ແຕ່ວ່າເປັນປຸ່ມ trun off
ອາການຂອງມັນກໍ່ແມ່ນ ມັນເປັນປຸ່ມລາງໆແຕ່ບໍ່ສາມາດກົດໄດ້
ດັ່ງນັ້ນຈິ່ງຂໍຄວາມຊ່ວຍເຫຼືອມາເຖິງທ່ານອາເລັກໄຊຊ່ວຍຂ້າພະເຈົ້າດ້ວຍ T.T

ຮຽນມາດ້ວຍຄວາມນັບຖືຍ່າງສູງ

Re:

Fri, 05 Sep 2008 18:08:59 -0400

ຂອບໃຈລວງໜ້າ ຖ້າມັນມີ ຄີກະເອົາໃຫ້ພ້ອມແດ່

Re:

Mon, 08 Sep 2008 01:59:47 -0400

ຄຶວ່າ: ຄອມຂ້າພະເຈົ້າຊື້ມາຈາ ຮ້ານ ດາຕ່າຄອມ ແລ້ວເຂົາເຈົ້າມີການ Protestion
ຫຼຶມີ ການປ້ອງກັນບໍ່ໃຫ້ລົງ ວິນໂດນໄດ້ ແລະ ລີ່ແພ່ກະຍັງບໍ່ໄດ້
ແມ່ນຢູ່ໃນຊ່ວງ ຄາລັງຕີ່ ຈຳເປັນຕ້ອງໄດ້ເອີ້ນເຂົາເຈົ້າມາ ແຕ່ກົງກັນຂ້າມພໍກາຍຊ່ວງ
ຄາລັງຕີ່ ຖ້າເກີດບັນຫາຂຶ້ນມາ ແລ້ວຢາກລົງເອົາເອງ
ຊ່ວຍບອກວິທີແດ່ ບໍ່ຮູ້ຊີເຮັດແນວໃດ ແລະອີກຢ່າງໜື່ງຂ້າພະເຈົ້າກະຕ້ອງການເກັ່ງຄຶກັນ
ຊ່ວຍບອກວີທີສ້າງໃຫ້ມີການ Protestion.

ຂໍຂອບພະເຈົ້າຕໍ່ທ່ານຢ່າງສູງ

Re:

Mon, 08 Sep 2008 08:13:16 -0400

ທ່ານພໍຈະມີ ໂປຮແກຮມ Block ບໍ່ໃຫ້ຄົນອື່ນຫິ້ຼນ Messenger online ໄດ້
ຂ້ອຍເຄີຍເຫັນທີ່ເວັບ laozaa ແຕ່ເຂົາເຈົ້າບໍ່ໃຫ້ໂລດຕ້ອງເປັນ ວິໄອຟີ
ຊ່ວຍຊອກໂປຮແກມຮໃຫ້ແດ່ທ່ານ ແລະວີທີໃຊ້

Re:

Wed, 10 Sep 2008 10:08:05 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ

ຂ້າພະເຈົ້າ ໄດ້ scan ກວດຫາ file ທີ່ຜິດພາດໃນ window ໂດຍການເຂົ້າ run>cmd>sfc /scannow ແລ້ວພົບ file ທີ່ມີບັນຫາຄື ມັນຟ້ອງວ່າ
The specific error code is 0X000006ba [the RPC server is unavailable.
ເມື່ອມັນຟ້ອງແນວນີ້ ເຣົາຕ້ອງແກ້ຢ່າງໃດ

ຊວ່ຍບອກແດ່ ຂໍຂອບໃຈ

Re:

Thu, 11 Sep 2008 09:00:50 -0400

ສະບາຍດີທຸກໆ ທ່າຂ້າພະເຈົ້າມີບັຫາກ່ຽວກັບ External hard disk ( USB 2), ເວລາສຽບເຂົ້າຊ່ອງ USB ມັນບໍ່ອ່ານ ແລະ ໄດ້ລອງມາແລ້ວນຳຈັກຫລາຍໜ່ວຍທີ່ໄຊ້ລະບົບ window 95 ຫາ vista , ແຕ່ຂ້າພະເຈົ້າເອົາໄປສຽບໃສ່ຊ່ອງ USB ຂອງ notebook ຂອງໝູ່ຂ້າພະເຈົ້າມັນພັດອ່ານພຽງແຕ່ໜ່່ວຍດຽວເທົ່ານັ້ນ, ຈັກຂອງໝູ່ຂ້າພະເຈົ້າໃຊ້ ຍີ່ຫໍ້ TOSHIBA ( Window XP professional ) , ຖ້າຜູ້ໃດຮູ້ກາລຸນາແນະນຳຂ້າພະເຈົ້າແດ່ ຂໍຂອບໃຈເປັນຢ່າງສູງ

Re:

Fri, 12 Sep 2008 02:09:08 -0400

ຊ່ວຍຊອກໃຫ້ແດ່ທ່ານ

Re:

Fri, 12 Sep 2008 09:30:03 -0400

ຂໍຄວາມຊ່ວຍເຫຼືອ
ຄືວ່າລົງໂປແກມບັນຊີແລ້ວເມນູຕ່າງໆພ້ອມດ້ວຍພາສາລາວສະແດງເປັນ ???????? ມັນບໍ່ຂຶ້ນເປັນຕົວໜັງສືລາວ
ມີວິທີແກ້ຈັ່ງໃດແດ່ ລົງຄອມບາງໜ່ວຍໄດ້ບາງໜ່ວຍກໍ່ບໍ່ໄດ້ ບໍ່ຮູ້ວ່າມັນຜິດພາດບ່ອນໃດ ແລ້ວຕ້ອງແກ້ຈັ່ງໃດ

Re:

Mon, 15 Sep 2008 09:26:15 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ເຄົາລົບ ນັບຖື
ຄືວ່າ ຂ້າພະເຈົ້າ ເປີດ website ອອກມາແລ້ວຖືກລ໋ອກ ມັນບອກວ່າ web filter ຕາມດ້ວຍຂໍ້ຄວາມດັ່ງນີ້
This web page was blocked because it is considered inappropriate.
Reason: extension (exe)Please contact your network administrator
ຢາກຮູ້ວ່າ ມີວິທີແກ້ໄຂໄດ້ບໍ່ ?
ຂໍຂອບໃຈ

Re:

Wed, 17 Sep 2008 07:20:33 -0400

Dear sir
I tried to install laoscript v6.04 on winxp
it just stay on installing Saysettha Lao
it won't complete for the instalation
help please?

Re:

Tue, 16 Sep 2008 02:48:55 -0400

ດ້ວຍຄົບລົບ ແລະນັບຖືຢ່າງສູງ

ຄຶວ່າ: ຂ້າພະເຈົ້າຕ້ອງປ່ຽນຮູບ ແລະ Welcome ຕອນເວລາບູດຂຶ້ນມາແລ້ວຈະເຫັນ
ຄຳວ່າ: welcome ແລະມັນມີຮູບສີຟ້າ ຕ້ອງການປ່ຽນໃຫ້ເປັນຮູບອື່ນ.
ຊ່ວຍບອກວິທີແດ່ທ່ານ

Re:

Wed, 17 Sep 2008 08:26:33 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ

ຄອມ ຂພຈ ມີບັນຫາ ເລື່ອງ driver ບໍ່ຖືກຕ້ອງເພາະ ຂ້າເຊັກເບິ່ງແລ້ວໃ
driver Verifier Manager
The list of unsigned drivers chosen to be verified:
Name                         Description
amdk8.sys                   AMD Processor Driver
klif.sys                       spuper-ptor
secdrv.sys                  Macrovision SECURITY Driver
syslib.sys
tcpip.sys                    TCT/IP Protocol Driver
usbport.sys                 USB 1.1 & 2.0 Port Driver

ຢາກໃຫ້ທ່ານ ຊອກຫາໃຫ້ແດ່ ຫຼືບອກ website ກໍ່ໄດ້

ຂໍຂອບໃຈເປັນຢ່າງສູງ

Re:

Wed, 17 Sep 2008 09:03:23 -0400

Hi
I'm using Lao dictionary professional v.20
I can type english only
how can I type in Lao?

Re:

Wed, 17 Sep 2008 11:36:11 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ
ຄອມ ຂພຈ ມີບັນຫາ ເລື່ອງ driver ບໍ່ຖືກຕ້ອງເພາະ ຂ້າເຊັກເບິ່ງແລ້ວໃນ
driver Verifier Manager
The list of unsigned drivers chosen to be verified:
Name           Description
amdk8.sys    AMD Processor Driver
klif.sys        spuper-ptor
secdrv.sys    Macrovision SECURITY Driver syslib.sys tcpip.sys      TCT/IP Protocol Driver
usbport.sys USB 1.1 & 2.0 Port Driver
ຢາກໃຫ້ທ່ານ ຊອກຫາໃຫ້ແດ່ ຫຼືບອກ website ກໍ່ໄດ້ ຄອມ notebook ຍີ່ຫໍ້ HP pavilion zv5000,cpuຍີ່ຫໍ້ AMD Athlon
ຂໍຂອບໃຈເປັນຢ່າງສູງ

Re:

Thu, 18 Sep 2008 05:59:26 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ເຄົາລົບ

ຂພຈ ມີເລື່ອງ ຂໍລົບກວນທ່ານແດ່ ຄືວ່າ notebook ຂອງ ຂພຈ ຟ້ອງຕອນເປີດເຄື່ອງໃຫມ່ ວ່າຕິດຕັ້ງ find new hardware ເພາະຂາດ driver ຕົວຫນື່ງຄື
ໃນກຸ່ມຂອງ device Manager ໃນຫມວດ + system Device
-> Base system deviceທີ່ຟ້ອງເປັນສີເຫຼືອງ ຂໍໃຫ້ທ່ານ ອາເລັກໄຊ ຊວ່ຍຊອກໃຫ້ແດ່ Link ໄປ download ເລີຍ ເພາະບໍ່ຮູ້ຊອກ

ຂໍຂອບໃຈເປັນຢ່າງສູງ

Re:

Thu, 18 Sep 2008 06:04:02 -0400

ຫລັງຈາກທີຂ້ອຍຕິດຕັ້ງ Laoscript v7.03 ແລ້ວຈະມີ small pop up windows ຂື້ນມາຂຽນວ່າ Laoscript for windows ແລະ ມັນກໍ່ບໍ່ຫາຍໄປ ຈັກເທື່ອ ມັນຄ້າງຢູ່ຫັ້ນຕະຫລອດ ເຣັດໃຫ້ພາສາລາວບໍ່ເຣັດວຽກ
ຂ້ອຍຄວນຈະແກ້ແນວໃດ?

Re:

Thu, 18 Sep 2008 11:07:39 -0400

ສະບາຍດີ
ຫລັງຈາກທີຂ້ອຍ installed laoscript v 7.03
ແລ້ວ program dictionary lao ບໍໍ່ເຣັດວຽກມັນຈະຟ້ອງຢູ່ຕະຫລອດ ເວລາວ່າ Cannot lacate program files! reinstall lao script for windows ຂ້ອຍກໍ່ຕິດຕັ້ງໃໝ່ແລ້ວກໍ່ເປັນຄືເກົ່າ
ຄວນຈະເຣັດແນວໃດ? please help?

Re:

Thu, 18 Sep 2008 11:59:44 -0400

The Laoscript for windows v 7.03 that you gave me not working on windows vista
even I copy the Laokey.exe to the laoscript folder in programs file
when i turn the laoscript on it keep asking
C:\Programe files\LsWin7\Laokey.exe
A referral was returned from the server
can you help me please?

Re:

Fri, 19 Sep 2008 07:52:36 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ

ຂ້າພະເຈົ້າໄດ້ ຊື້ key ປົດລ໋ອກນຳ ທ່ານ ເກດ ແລະ ໄດ້ນຳໃຊ້ແລ້ວ
ຢາກຖາມວ່າ ເວລາທີ່ ຂພຈ ລົງwindows ໃຫມ່ keyມັນຈະຫາຍໄປ
ຕ້ອງໄດ້ເອົາ key ໃຫມ່ບໍໍ? ແຕ່ ທ່ານ ເກດໄດ້ ຈົດ key user ແລະ ຕົວປົດລ໋ອກໄວ້ໃຫ້ ຂພຈ ສາມາດເອົາຕົວເກົ່າມາໃຊ້ໄດ້ອີກບໍ່ ແລະ ເວລາ setup
ມັນຈະປ່ຽນ user ບໍ່

ຂອບໃຈ

Re:

Mon, 22 Sep 2008 03:07:40 -0400

ຄຶວ່າ:ຂ້າພະເຈົ້າຢາກໃຫ້ທ່ານຊ່ວຍແນນນຳການຈັດລຽນສາຍແລນ
ແລະ ຢູ່ເຮືອນມີຄອມ 2ໜ່ວຍ ຂ້າພະເຈົ້າໄດຊື້ສາຍເລນມາ ແລະ ຫົວຂອງມັນ,ເຄື່ອງນີບພ້ອມ ແລ້ວຂ້ອຍບໍ່ເຂົ້າໃຈກ່ຽວກັບການຈັດລຽນ
ແຕ່ລະສີ
-ຢາກໃຫ້ຊ່ວຍຕໍ່ແບບ2ໜ່ວຍໂດຍບໍ່ມີເຄື່ອງຮັບ ເຮົາຊີ້ຈັດສີແຕ່ສີໃດຫາສີໃດ
-ແລະ ຕໍ່ແບບມີເຄື່ອງຮັບ ເຮົາຊີ້ລຽນແຕ່ສີໃດຫາສີໃດ
ບອກແຕ່ລະສົນເດີທ່ານ

Re:

Mon, 22 Sep 2008 05:38:51 -0400

ສະບາຍດີ ອາເລັກໄຊ
ຂ້າພະເຈົ້າ ໄດ້ຊື້ Licens ລາວແອນຕີ້ມາໃຊ້ ເຄື່ອງມີບັນຫາເລື່ອງ file window ໄດ້
ລົງ window ໃຫມ່ ກໍ່ໄປເອົາLicens ລາວແອນຕີ້ມາເປັນຄັ້ງທີ ສອງແລ້ວ ແຕ່ວ່າຍັງທັນເຖິງ 3 ເດືອນ ໃນຊວ່ງຣັບປະກັນ.ຖ້າຫາກວ່າ ຂພຈ ຈະລົງວິນໂດອີກ ຈະສາມາດໃຊ້ Licens ລາວແອນຕີ້ ໄດ້ອີກບໍ? ຫຼືຕ້ອງໄດ້ຊື້ໃຫມ່ ຫຼືນຳໃຊ້ key ເກົ່າໄດ້ບໍ່
ເຫດຜົນທີ່ລົງ window ໃຫມ່ spec ເຄື່ອງຕໍ່າ

ຂໍຂອບໃຈ

Re:

Mon, 22 Sep 2008 08:56:58 -0400

ສະບາຍດີ
ຫລັງຈາກທີຂ້ອຍ installed laoscript v 7.03
ແລ້ວ program dictionary lao ບໍໍ່ເຣັດວຽກມັນຈະຟ້ອງຢູ່ຕະຫລອດ ເວລາວ່າ Cannot lacate program files! reinstall lao script for windows
ຂ້ອຍໄດ້ຕັ້ງໃໝ່ທັງ Laoscript and Lao dictionaryແລ້ວກໍ່ເປັນຄືເກົ່າ
ສຳລັບ laoscript ນັ້ນມັນເຣັດວຽກດີກັບ Microsoft winword

ຄວນຈະເຣັດແນວໃດ? please help?

Re:

Tue, 23 Sep 2008 23:56:32 -0400

- ຂ້າພະເຈົ້າຢາກໃຫ້ທ່ານ ສ້າງໂປຮແກຮມ Lao Anti-Virus ໃຫ້ມັນສາ
ມາດລົງໃນໂທລະສັບໄດ້
- ແລະ ຂ້ອຍຕ້ອງການ ໂປຮແກຮມ ຄົ້ນຫາໄດເວີ ວ່າອຸປະກອນຄອມຊື່
ຫຍັງ,ລຸ້ນ
ຂ້າພະເຈົ້າມີ Modem ຕົວໜຶ່ງ ແລ້ວບໍ່ຮູ້ວ່າແມ່ນຍີ່ຫຍໍ້ໃດ,ເວີຊັນ
ເພາະຕ້ອງການໄດເວີຂອງມັນ

Re:

Mon, 22 Sep 2008 09:11:38 -0400

ສະບາຍດີ
ຂ້ອຍມີເລື່ອງກ່ຽວກັບ FileMaker Pro ມາຖາມ
ເວລາຂ້ອຍເປີດ File/Open remote ມັນບໍ່ສາມາດເປີດໄດ້
ມັນຈະມີ popup windows ຂື້ນມາວ່າ FileMaker cannot share or be a client of a file because the networking stack could not be intialized.
ບໍ່ຣູ້ວ່າຈະເຣັດເວໃດ?

Re:

Fri, 10 Oct 2008 06:00:41 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ຂ້າພະເຈົ້າ ຢາກຮູ້ຂໍ້ມູນກ່ຽວກັບ windows truefaster(wtf)
1. wtf ແມ່ນລູ້ນໃດ ຖັດຈາກwindow xp 2008 ບໍ່?ຫຼືລູ້ນພິເສດ?
2. wtf ສາມາດເປີດ window updateໄດ້ບໍ?ຖ້າ update ມັນຊິບໍເກີດwindow genuineບໍ່ ?(windowເຖື່ອນ)
3. wtf ມີຂໍ້ບົກຜ່ອງບໍ່? ເຊັ່ນວ່າ ລົງ software ບາງຕົວບໍ່ໄດ້
4. wtf ລົງກັບເຄື່ອງລຸ້ນເກົ່າໄດ້ບໍ່ ສະເປກຕໍ່າ CPU700MHz,Ram128
5 .wtf ຈຸດເດ່ນຂອງມັນແມ່ນຫຍັງ? (ຄວາມສາມາດທີ່ເປັນເອກະລັກ) ໄວບໍ່ ?

ຂໍຂອບໃຈ ເປັນຢ່າງສູງ

Re:

Wed, 15 Oct 2008 02:09:07 -0400

ຄຶວ່າ: Notebook ຂອງຂ້າພະເຈົ້າເມື່ອເວລາເປີດຂຶ້ນມາ ແລ້ວ CPU
ມັນເຮັດວຽກຮອດ 50%-60% ແລ້ວເຮັດເຄື່ອງຊ້າ.ຖ້າປົກກະຕິມັນຈະພຽງແຕ່
3%-6% ເທົ່ານັ້ນ.ລຸ້ນ Toshiba Satellite M300

ຊ່ວຍຂ້າພະເຈົ້າແດ່ທ່ານ
ດ້ວຍເຄົາລົບນັບຖື

Re:

Thu, 16 Oct 2008 06:09:17 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື

ຂ້າພະເຈົ້າ ມີເລື່ອງຂໍລົບກວນ ທ່ານ ຄືວ່າ com ຂອງ ຂພຈ ຊອກຫາ system information ບໍ່ເຫັນ ໃນຊ່ອງ c ເປີດ show all ແລ້ວກໍ່ຍັງບໍ່ເຫັນ ບໍ່ຮູ້ວ່າມັນຕັ້ງບໍ່ມີບໍ່ ? ຂພຈ ໃຊ້ window xp 2007 v.5
ພົບແຕ່ system restore ສ່ວນ system information ບໍ່ເຫັນ
ຂໍໃຫ້ທ່ານ ຊ່ວຍແດ່

ຂໍຂອບໃຈ ເປັນຢ່າງສູງ

Re:

Thu, 23 Oct 2008 01:15:08 -0400

ຂ້າພະເຈົ້າຕ້ອງການ Driver VGA ຂອງ Notebook ລຸ້ນ
Toshiba Satellite M300

ຊ່ວຍຊອກໃຫ້ແດ່ທ່ານ ຂອບໃຈລ່ວງຫນ້າຫລາຍ

Re:

Thu, 23 Oct 2008 01:26:27 -0400

ຄຶວ່າ:ຂ້າພະເຈົ້າຕ້ອງການໂປຮແກຮມ ລຶບຂໍ້ມູນທິ່ຕໍ່ແລນກັນຫລາຍໜ່ວຍ
ຕົວຢ່າງ:ທີ່ເຮືອນຂ້າພະເຈົ້າມີຄອມ 10ໜ່ວຍແລ້ວແຊ່ຮໃສ່ກັນໜົດທຸກໜ່ວຍ
ໜ່ວຍທີ່1 ເປັນໜ່ວຍແມ່ ແລະຂ້າພະເຈົ້າຫລີ້ນໜ່ວຍທີ່ 10 ແລ້ວເຫັນຂໍ້ມູນ ຫຼຶ
ເອກະສານ ທີ່ໜ່ວຍທີ1 ແລ້ວຍາກລຶບຂໍ້ມູນໜ່ວຍທີ 1 ຖິ້ມບາງອັນ
ແຕ່ໜ່ວຍທີ1 ມີການປ້ອງບໍ່ໃຫ້ລຶບຫຍັງ? ມີແຕ່ Copy ໄດ້ ແຕ່ບໍ່ສາມາດລຶບໄດ້
ຢາກໃຫ້ທ່ານຊ່ວຍຊອກໂປຮແກຮມໃດທີ່ມັນສາມາດລຶບໄດ້
-ອີກບັນຫາໜຶ່ງຂ້າພະເຈົ້າຫລິ້ນໜ່ວຍທີ່10 ແລ້ວຢາກໃຫ້ໜ່ວຍທີ່ 1
Restart,Ture off,Stand by ເຮັດຈັງໃດທ່ານຊ່ວຍບອກແດ່.

Re:

Thu, 30 Oct 2008 05:19:33 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື

ຂ້າພະເຈົ້າໄດ້ລົງ window ໃຫມ່ ແຕ່ບໍ່ເຫັນ driver Audio ບໍ່ຮູ້ຊິຊອກແນວໃດ ? com ກໍເປັນເຄື່ອງປະກອບ ບໍ່ຮູ້ ຍີ່ຫໍ້ອີກ
ຂໍຄຳແນະນຳຈາກທ່ານ (ແຜ່ນ CD ທີ່ແຖມມານຳກໍ່ບໍມີ Driver)
ຂໍຂອບໃຈ

Re:

Fri, 31 Oct 2008 10:28:56 -0400

ຢາກເອົາ ເມວ ຈາກຄອມໜື່ງມາໃສ່ອີກຄອມໜື່ງເຮັດແນວໃດຊວ່ຍບອກເທັກນິກແດ່

Re:

Sun, 02 Nov 2008 01:08:23 -0500

ຄຶວ່າ:ຂ້າພະເຈົ້າຕ້ອງການໂປຮແກຮມແຕກຟາຍຕິດຕັ້ງໂປຮແກຮມ
ຕົວຢ່າງ:ໂປຮແກຮມ Anti-Virus kaspersky
ແລ້ວຕ້ອງການແຕກຟາຍໂຕຕິດຕັ້ງຫັນລະ ແລະ ເມື່ອແຕກອອກມາແລ້ວ
ຢາກເຫັນທຸກຟາຍເລີຍນັບທັງໄອຄ້ອນ,ແລະຮູບພາບຕ່າງໆຂອງໂປຮແກຮມ
-ໜາຍເຫດ:ເມື່ອແຕກອອກມາແລ້ວຢາກໃຫ້ມັນກັບມາເປັນຟາຍຕິດຕັ້ງ
ແບບປົກກະຕິ.

ຊ່ວຍຊອກໃຫ້ແດ່ທ່ານ (Thank you)

Re:

Tue, 04 Nov 2008 04:55:31 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ຂ້າພະເຈົ້າ ໄດ້ upload file unlocker 1.8.7 ທີ່ຟ້ອງວ່າເປັນ Trojan
ຢາກໃຫ້ ທ່ານ check ວ່າທີ່ ຈະນຳ file ດັ່ງກ່າວມາຕິດຕັ້ງ ໃນເຄື່ອງໄດ້ບໍ່ ?
ຖ້າໃຊ້ laoav ຂ້າ ກໍ່ບໍ່ສາມາດນຳໃຊ້ file ດັ່ງກ່າວໄດ້ ແລະ ເຣັດແນວໃດ
ຈິ່ງຈະໄດ້ ຕິດຕັ້ງ file unlocker ລົງເຄື່ອງໄດ້ ເພາະມັນຖືກລຶບຕະຫຼອດ
ຂໍຂອບໃຈ

Re:

Tue, 04 Nov 2008 12:27:56 -0500

ຊ່ວຍຊອກໃຫ້ແດ່ທ່ານ.

Re:

Tue, 04 Nov 2008 13:48:01 -0500

ຊ່ວຍຊອກໃຫ້ແດ່ທ່ານເອົາ Crack ພ້ອມເດີທ່ານ

Re:

Tue, 04 Nov 2008 14:29:27 -0500

ຂອບໃຈລວງຫນ້າ

Re:

Wed, 05 Nov 2008 16:05:01 -0500

ຄອມຂອງ ຂ້າພະເຈົ້າ ເວລາເປີດເຄື່ອງໃໝ່ທຸກເທື່ອ ວັນທີ ຈະເລີ່ມວັນທີ 1 ເດືອນ 1 ປີ 2003 ແລະ ເວລາຈະເລີ່ມທີ 00ຊົ່ວໂມງ ທຸກເທື່ອ ຂພຈ ລອງປ່ຽນແບັດເຕີລີໃໝ່ແລ້ວ ແຕ່ກໍ່ຍັງເປັນຄືເກົ່າ ຂໍຄວາມຊ່ວຍເຫຼືອຈາກທ່ານອາເລັກໄຊແດ່ ຂໍຂອບໃຈ.

Re:

Mon, 10 Nov 2008 07:34:05 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ຂ້າພະເຈົ້າ ຢາກຮູ້ວ່າLaoav ທີ່ປັບປຸງ ໃນວັນທີ 4 ຕຸລາ ມີຫຍັງເພີ້ມເຕີມແນ່
ເພາະວ່າ ຂພຈ ຊື້ License ນຳ ແມ່ນປັບປຸງ ໃນວັນທີ 8 ສິງຫາ ຖ້າວ່າ ຂພຈ ຢາກ update program ໄດ້ບໍ ຫາກວ່າຕິດຕັ້ງຕົວເຂົ້າໄປ key ປົດລ໋ອກຊິລຶບບໍ່ ?
ຂໍໃຫ້ທ່ານ ແນະນຳດ້ວຍ
ຂໍຂອບໃຈ

Re:

Wed, 12 Nov 2008 02:04:19 -0500

ເມື່ອເປີດຄອມ ແລ້ວ ມັນບູດ ວິນໂດບໍ່ຂື້ນ, ພໍປະໄວ້ຄອມ ກໍ່ປິດເປີດໃຫ່ມເອງມັນກໍ່ບູດ ວິນໂດບໍ່ຂື້ນ ຄືເກົ່າ, ຂພຈ ເລີຍຈັດການລົງວິນໂດໃຫ່ມແຕ່ກະຍັງບູດບໍ່ໄດ້ ຂພຈ ກະບໍ່ຮູ້ເລີຍວ່າເປັນຍ້ອນຫຍັງ? ເພາະໃຊ້ມາດີໆຢູ່ກະມາເປັນຈັ່ງຊີ້ ເປັນຍ້ອນຊອບແວທາງໃນ ຫຼື ເປັນຍ້ອນຮາດແວທາງນອກ ຈຶ່ງຢາກໃຫ້ທຸກທ່ານໃນທີ່ນີ້ ຊ່ວຍໃຫ້ຄຳແນະນຳໃຫ້ແນ່...ຂໍຂອບໃຈ

Re:

Thu, 13 Nov 2008 09:14:35 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ຂພຈ download Program Rocover My file ແລະ ຂພຈ ຢາກໄດ້key ຂອງມັນ ຂໍໃຫ້ທ່ານ ຊ່ວຍຫາໃຫ້ແດ່
ຂໍຂອບໃຈ ເປັນຢ່າງຍິ່ງ

Re:

Thu, 13 Nov 2008 14:56:59 -0500

ຢາກທ່ານຊອກໃຫ້ແດ່ທ່ານ ເອົາຟາຍ PDFເດີທ່ານ ແລະ ກ່ຽວກັບຖານຂໍ້
ມູນ ໂດຍໃຊ້ໂປຮແກຮມ Cmd ເອົາເປັນພາສາໄທເດີ ທ່ານ
ດ່ຽວນີ້ ຂ້າພະເຈົ້າກຳລັງສືກສາຢູ່.

ຂອບໃຈລວງຫນ້າຫຼາຍໆທ່ານ

Re:

Sat, 15 Nov 2008 07:44:42 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ

ຂ້າພະເຈົ້າໃຊ້ Program ກວດສອບອາຍຸການ ຂອງHDD ແຕ່ມັນໃຫ້ໄຊ້ພຽງ14ວັນເທົ່ານັ້ນ ແລະມັນຊວນໃຫ້ຊື້ຢູ່ຕະຫຼອດ ລຳຄານຫຼາຍ ຂ້າພະເຈົ້າ ຢາກໄດ້ key
ຈິ່ງຂໍຄຳແນະນຳຈາກ ທ່ານ
ຂໍຂອບໃຈ ເປັນຢ່າງສູງ

Re:

Fri, 28 Nov 2008 10:11:11 -0500

**ຂອບໃຈຫຼາຍໆທີ່ໃຫ້ຄວາມສົນໃຈ**

ເຈົ້າສະບາຍດີທ່ານ, ຂໍຄວາມຊ່ວຍເຫຼືອແດ່ ຂ້າພະເຈົ້າຢາກຮູ້ກ່ຽວກັບ web server. ພໍດີຂ້າພະເຈົ້າໄປອ່ານປື້ມຫົວໜື່ງມາແຕ່ເຂົາເຈົ້າບໍ່ບອກລະອຽດເລີຍບໍ່ເຂົ້າໃຈ ກ່ຽວກັບ ເວັບເຊີເວີ ເຮົາມີວິທີເບິ່ງແນວໃດຈື່ງຮູ້ວ່າເວັບເຊີເວີນັ້ນໃຊ້ Apache,PHP,MySQL. ແລະ ບໍ່ຮູ້ວ່າ FTP Server ມັນໝາຍເຖີງຫຍັງ? FTP ມັນເປັນໂປຣແກຣມຫວາ?
ທ່ານຜູ້ຮູ້ຊ່ວຍອະທິບາຍແດ່ຢາກເຂົ້າໃຈ
**ຂອບໃຈຫຼາຍໆທ່ານ**

Re:

Mon, 01 Dec 2008 05:21:07 -0500

ສະບາຍດີທ່ານ ຂໍຄວາມຊ່ວຍເຫຼືອແດ່ ເນື່ອງຈາກວ່າຂ້າພະເຈົ້າຢາກຮຽນສ້າງເວັບໄຊ໌ ແຕ່ຍັງບໍ່ຮູ້ວິທີສະມັກໂດເມນເທື່ອເລີຍຂໍລົບກວນໃຫ້ທ່ານຊ່ວຍອະທິບາຍ ແລະ ບອກຂັ້ນຕອນການສະມັກແດ່ໄດ້ບໍ? ເຊິ່ງວ່າຂ້າພະເຈົ້າຢາກຮູ້ໂຕທີ່ມີໂຄສະນາໃນໜ້າເວບຂອງທ່ານເລີຍ (http://www.co.cc)
*****ຂອບໃຈຫຼາຍໆ*****

Re:

Mon, 15 Dec 2008 14:36:30 -0500

ຕ້ອງການ Diver ມັນເປັນສະແປ່ຄອມຂ້າພະເຈົ້າເດີທ່ານ
- VGA
-Video controller

Note Book TOSHIBA Satellite M300-A403T

Type : Satellite M300-A403T
CPU : Intel Pentium Core2 Duo T5850

2.16GHz, 2 MB L2 Cache, 667 MHz FSB
Chipset : Express Chipset
Memory : 1024MB DDR2-667
Display : 14.1inch TFT wide display Built-in Webcam
Graphic : Intel X3100 Share
Hard Drive : 200 GB.
Optical Drive : DVD Super Multi Recorder
Modem : 56 K
Bluetooth
Audio : 82801H (ICH8 Family ) HD Audio Controller
Network : Integrated 10/100/1000 Gigabit Ethernet
wireless : Broadcom 802.11bg wireless
I/O Port : VGA Out
Option : Four-in-one multicard reader with Secure Digital, MultiMedia and Memory Stick cards , Express Port

Re:

Thu, 18 Dec 2008 02:32:07 -0500

ຫລັງຈາກຕິດຕັ້ງ internet explorer 8 beta ແລ້ວຊ້ຳອ່ານພາສາລາວບໍ່ໄດ້ ໄຜມີວິທີແກ້ໄຂຊ່ວຍແດ່ sumlane@yahoo.com or 0202565595

Re:

Sun, 21 Dec 2008 03:28:27 -0500

ສະບາຍດີທ່ານ A.L.X ຄືວ່າຂ້າພະເຈົ້າໄປສະໝັກ ເເຕ່ບໍ່ຮູ້ວ່າມັນ Upload ແນວໃດ ??
ໍຊ່ວຍບອກວິທີ Upload ໃຫ້ຂ້າພະເຈົ້່່າແດ່
ຮຽນມາດ້ວຍຄວາມນັບຖື

Re:

Tue, 06 Jan 2009 09:51:45 -0500

່່ ສາທາລະນະລັັດ ປະຊາທິປະໄຕ ປະຊາຊົນລາວ
ສັນຕິພາບ ເອກະລາດ ປະຊາທິປະໄຕ ເອກະພາບ ວັດທະນາຖາວອນ
****000****
ສະບາຍດີທ່ານ A.L.X ທ່ານຊ່ວຍແກ້ໄຂໃຫ້ແດ່ວ່າເປັນຫຍັງ USB
ຂອງຂ້ານ້ອຍກາຍເປັນ File FILE.CHK ຫມົດເລີຍ ??
ກ່ອນທີ່ມັນຈະກາຍເປັນ File ດັ່ງກ່າວຂ້ານ້ອຍໄດ້ໄປປົດບ່ອນວ່າ Hidden ອອກແຕ່ມັນອອກຫຍັງກໍບໍ່ຮູ້ຂ້ານ້ອຍ click ok(ລືມອ່ານ)
ແລ້ວມັນກໍກາຍເປັນ File FILE.CHK ຫມົດເລີຍເຮັດແນວໃດກໍບໍ່
ໄດ້............. ຂໍຄວາມຊ່ວຍເຫລືອແດ່ທ່ານ (ຂອບໃຈຢ່າງສູງ)

Re:

Tue, 13 Jan 2009 03:30:01 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ເຄົາລົບ
ຂ້າພະເຈົ້າພົບ ໄວຮັສ c:\Recycler\lsass.exe ຂ້າຈັ່ງໃດກໍ່ບໍ່ໄດ້
ມັນສ້າງຄວາມລຳຄານ ໃຊ້ Laoav ກໍ່ບໍ່ໄດ້ ຂໍໃຫ້ທ່ານ ແນະນຳວິທີ ຫຼືຊອກຕົວ Remove ໃຫ້ແດ່ ພ້ອມກັນນີ້ file lsass.exe ຂ້າພະເຈົ້າໄດ້ ບີບໃສ່ Winrar ສົ່ງທ່ານກວດສອບຫາວິທີແກ້ໄຂໃຫ້
ຂໍຂອບໃຈ

Re:

Wed, 14 Jan 2009 03:11:00 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ຂ້າພະເຈົ້າ ໄດ້ນຳໃຊ້ Laoav Explorer 2.0 ກວດຫາໄວຮັສ ແລະ ກໍ່ພົບ ໃນ Drive C:\Recyler\lsass.exe ແລະ ຂພຈ click ຂວາ delete ມັນຄືບໍ່ໃຫ້ delete ແຕ່ມາເບິ່ງMy computer\C: ກໍບໍ່ເຫັນ ນອກຈາກເບິ່ງໃນ Laoav Explorer 2.0ແລ້ວ ເບິ່ງບ່ອນອື່ນກໍ່ບໍ່ເຫັນvirus
ຢາກຮູ້ວ່າ ຂພຈ ໃຊ້ເຄື່ອງມື ຖືກ ຫຼື ບໍ່ ຂໍຄຳແນະນຳດ້ວຍ
ຂໍຂອບໃຈ ເປັນຢ່າງສູງ

Re:

Sat, 17 Jan 2009 18:03:39 -0500

ທ່ານເອີ້ຍ ຊ່ວຍແນ່

ຄືວ່າບັນດາ folder ຂອງຂ້າພະເຈົ້ານະ ພາກັນໄປ .exe ກັນທົ່ວຫນ້າ ແລະ ກໍ່ສະແດງເນື້ອທີ່ ເປັນ 44kb ຫມົດທຸກອັນເລີຍ

ແລະ ຢູ່ທີ່ task manager ກໍ່ມີແຕ່ຄຳວ່າ Zita ເຕັມໄປຫມົດ ມັນເຮັດໃຫ້ເຄື່ອງຊ້າລົງ

ຈັກເປັນນຳຫຍັງ ໄວລັດໂຕໃດ ກະບໍ່ຮຸ້

ຊ່ວຍແນ່ທ້ອນທ່ານ

ຂອບໃຈ

Re:

Fri, 23 Jan 2009 04:23:26 -0500

ຄຶວ່າ: Notebook ຂ້າພະເຈົ້າໄດແບ່ງ harddisk ອອກເປັນ 4ຊ່ອງ ແລະຊ່ອງC
ໄດ້ລົງ Windows XP ຫັຼງຈາກລົງໃຊ້ແລ້ວ ແລະຊ່ອງ D ຂ້າພະເຈົ້າພັດລົງ Windows Vista ແລະ ເວລາເປີດຂຶ້ນມັນກໍວ່າຊິ້ເຂົ້າ windows xp or Vista
ແລະກໍໃຊ້ປົກະຕິໜົດ.ແຕ່ເວລາທີ່ Windows XP ມີບັນຫາແລ້ວພະເຈົ້າໄດ້ລົງ Windows Xp ໃຫມ່ ແລະຊ່ອງທີ່ລົງWindows Vista ກໍບໍ່ໄດ້ກວນຫຍັງມັນເລີຍ
ຫຼັງຈາກລົງແລ້ວໃນເວລາເປີດມັນພັດບໍ່ຟ້ອງຂຶ້ນມາວ່າຊິ້ເຂົ້າ Windows ຕົວໃດ ແລະມັນເຂົ້າແຕ່ Windows XP ທີ່ລົງໃໜ່,ຂ້ອຍໄດ້ລອງລົງ Windows vista
ໃໜ່ພັດໄດ້ມັນກໍຂຶ້ນມາແບບເກົ່າ.ບັນຫາຂ້າພັດບໍ່ຍາກລົງ windows vista new
ບໍ່ຮູ້ວ່າຊິ້ແກ້ໄຂບັນຫາແນວໃດເພື່ອໃຫ້ Windows ເຕືອນໃເວລາເປີດວ່າຊິ້ເຂົ້າ Windows ຕົວໃດ.

Re:

Sun, 01 Feb 2009 17:58:35 -0500

ຄຶວ່າ: ມັນບໍ່ມີບ່ອນອັດເພັງ MP3 ແລະຂ້າພະເຈົ້າບໍ່ຮູ້ວິທີ
ແກ້ແລະຍາກໃຫ້ທ່ານຊ່ວຍບອກວິທີແດ່ທ່ານ ຫຼຶທ່ານມີ
Plug in ຕົວໃດມາເສີມ, ຍາກໃຫ້ທ່ານຊ່ວຍຊອກໃຫ້ແດ່.

Re:

Mon, 02 Feb 2009 15:53:00 -0500

ສະບາຍດີທູກທ່່ານທີເຄົາລົບແລະນັບຖື............... ມີ້ນີ້ເຮັາໄດໄປເວັບໄໍຊແຫ່ງນີ້http://smsfree4all.com/free-sms-laos.php? number=75698&provider=free+sms+Laos+Laotel+(2056) &message=+hi+nyob+zoo+os+&keystring=K47dC&submit3=Submit&to=&sendto=&s endername=&senderemail= ຈູດປະສົງກໍຄືມັນໃຊ້ງານແນວໃດ
ຊ່ວຍບອກແດ່........... ຂອບໃຈລ່ວງໜ້າ

Re:

Fri, 06 Feb 2009 10:46:15 -0500

ສະບາຍດີ
ຂ້າພະເຈົ້າຢາກໄດ້ໂປແກມ Unlocked iPhone 3G ທີບໍ່ເສຍເງິນເອົາໄດ້ຢູ່ໃສ່
ຊ່ວຍບອກແດ່
ຂອບໃຈ

Re:

Sun, 08 Feb 2009 01:57:26 -0500

ຄຶວ່າ: ຂ້າພະເຈົ້າຢາກໃຫ້ທ່ານຊ່ວຍບອກວິທີກວດເບີ່ງ
Virus or Spyware ໃນຄອມພິວເຕີວ່າມັນມີ Virus ບໍ່.

ຊ່ວຍບອກແດ່ທ່ານ

Re:

Sun, 08 Feb 2009 02:10:19 -0500

ຂ້າພະເຈົ້າຕ້ອງການບົດຮຽນ ກ່ຽວກັບການສ້າງໂປຮແກຮມຕົວດຽວແລ້ວເອົາໂປຮ
ແກຮມ ຫຼາຍໆຕົວມາລວມກັນໃຫ້ເປັນໂປຮແກຮມດຽວຄຶກັບໂປຮແກຮມຂອງທ່ານ
ເຊັ່ນ: "ລວມຕົວກຳຈັກໄວຣັສ ແລະເຄື່ອງມື" ພ້ອມໂປຮແກຮມສ້າງເດີທ່ານ

Re:

Mon, 09 Feb 2009 18:42:14 -0500

ມີທ່ານໃດທີ່ສາມາດຫາຟ້ອນດັ່ງນີ້ໄດ້ເດ່ເນ໋າະ
NOSNR60.TTF
NSSB60.TTF
NSTSB60.TTF
ກະລຸນາຊ່ວຍບອກເດ່
ຂໍຂອບໃຈ ລ່ວງໜ້າ

Re:

Sun, 08 Feb 2009 10:10:00 -0500

ສະບາຍດີ....... ກ່ອນອື່ນຂໍຂອບໃຈທຸກທ່ານທີ່ຕອບຄຳຖາມຂອງເຮົາ.......... ມາເຂົ້າເລື່ອງກັນເລີຍ........ ຂ້ອຍເຫັນເຂົາເຈົ້າມີ programs ເປັນຂອງຕົນເອງເລີຍຢາກຈະສ້າງ programs ໜື່ງເປັນຂອງຕົນເອງແຕ່ບໍຮູ້ວ່າຈະສ້າງດ້ວຍໂປຣແກຣັມສໃດຊ່ວຍບອກແດ່! ແລະສາມາດດາວໂຫຼດໄດ້ ຢູ່ໃສ ແລະສຸດທ້າຍກໍຂໍຂອບໃຈອິກຄັ້ງທ່ານທີ່ຕອບທຸກທ່ານ

Re:

Thu, 12 Feb 2009 16:54:44 -0500

ສະບາຍດີທຸກທ່ານ
ເມື່ອເຮົາເອົາ usb ສຽບໃສ່ຄອມແລ້ວຈະເຫັນ Dialog box Autoplay ຂື້ນມາມັນ
ອາດງ່າຍທີ່ຂົ້າໃຊ້ ແຕ່ຫາກວ່າຄອມຂອງທ່ານບໍ່ເປັນລັກສະນະແລ້ວສາມາດແກ້ໄຂ
ເຮັດຕາມທີ່ຈະແນະນຳຕໍ່ໄປນີ້

1. Open your run box (Start | Run) and type regedit and click OK.
2. Go to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer.
3. You should see a key called NoDriveTypeAutoRun (see picture below). Double click it and set the Value Data to 91 (hexadecimal).
4. Restart your computer and it should be fixed.

ຮູບປະກອບ

Re:

Fri, 13 Feb 2009 02:14:22 -0500

1./ ຄອມຂ້າພະເຈົ້າ Icon on Desktop ຢູ່ພຶ້ນຕົວໜັງສືມັນພັດເປັນສີ ຟ້າແລ້ວຕົວໜັງສືສີຂາວ.
ຂ້າພະເຈົ້າໄດ້ລ້ອງຄິກຂວາ Arrange Icons By/Lock web Items on Desktop
ລ້ອງຄິກໄປຄິກມາກະບໍ່ໄດ້ ແລະຢາກໃຫ້ທ່ານຊ່ວຍບອກວິທີແດ່.

2./ ຄອມຂ້າພະເຈົ້າໃນShare ເວລາຂໍ້ມູນບໍ່ວ່າຈະshare folder ກໍຕາມ ໃນເວລາຄິກຂວາຊ່ອງ C ເລືອກ
Sharing and security.../ແລ້ວເລືອກຫົວຂໍທີ່ວ່າSharing/ແລ້ວເລືອກ
If you understant the risk but still want to share the root of the drive,Click here
ແລ້ວຄິກຄຳວ່າ: Share this folder on the Network ແລ້ວຄິກ Apply ແລ້ວມັນຈະຂໍ້ຄວາມຂຶ້ນແບບຂ້າງລາງລຸ່ມນິ້: ແລະ ກໍບໍ່ສາມາດ Share ຫຍັງໄດ້ເລີຍ
An error occurred while trying to share C. The Sever service is not started.
The shared resourec was not created at this time

Re:

Fri, 13 Feb 2009 04:12:19 -0500

ສະບາຍດີ ທ່ານອາເລັກໄຊ ຂ້ອຍໄດ້ເປັນສະມາຊິກເວບນີ້ດົນແລ້ວ ແລະ ກໍ່ໃຊ້ເຄື່ອງມືລີມູບທູນທ່ີທ່ານສ້າງຂື້ນມາໄດ້ຜົນດີຫຼາຍ ແຕ່ຂ້ອຍມີບັນຫາເລື່ອງVirus explorer.exe and secret.exe ເພາະຂ້ອຍໃຊ້ ລີມູບທູນຂອງທ່ານແລ້ວ ພັດບໍ່ສາມາດເຂົ້າ Window ໄດ້ ຮອດແຕ່ ບອ່ນລອກອິນແລ້ວກໍ່ກັບຄືນຄືເກົ່າ ຂ້ອຍຄວນແກ້ໄຂຫຍັງແນ່ຈິງຊິເຂົ້າວິນໂດ ໄດ້ ຂອບໃຈລວ່ງໜ້າ

Re:

Sat, 14 Feb 2009 05:34:46 -0500

ສະບາຍດີ ທ່ານ A L X ຊ່ວຍບອກວິທີໃຊ້ງານ VB 6 ໃຫ້ແດ່ທ່ານ ຂອບໃຈລ່ວງໜ້າຫຼາຍໆເດີ້ທ່ານ

Re:

Sat, 14 Feb 2009 10:55:17 -0500

Happy valentine

Re:

Thu, 19 Feb 2009 14:14:37 -0500

Dear,Admin
1.I can't write jump menu in lao on dreamwaver. what is your suggestion?
2. how to block pop up in my webpage

Re:

Fri, 20 Feb 2009 00:15:34 -0500

ຕ້ອງການໂປຮແກຮມ Hide user name and password ສະເພາະຄົນທີ່ໃຊ້ການຫລິ້ນ Internet ແບບ Dialup.
ແລະ ທ່ານ ອາເລັກໄຊ ຮ້ານ KK computer ແມ່ນຮ້ານຂອງທ່ານເອງບໍ່

Re:

Sun, 22 Feb 2009 06:24:57 -0500

ช่วยข้อยแด คอมข้อยเวลาสุม port USB แล้วคอมมันค้างตะลอดเลีย นะ

Re:

Wed, 25 Feb 2009 01:44:20 -0500

1.ຄຶວ່າຂ້າພະເຈົ້າເອງໃຊ້Windows Vista Ultimate ແລ້ວໄດ້ໃສ່
password ໄວ້ແລ້ວລືມຂ້າພະເຈົ້າບໍ່ຮູ້ວິທີແກ້ຊ່ວຍບອກແດ່
2.ຄອມຂ້າພະເຈົ້າໄດ້ແບ່ງອອກເປັນຊ່ອງC,D,E ແລະຂ້າພະເຈົ້າໄດ້ຕິດຕັ້ງ
ໂປຮແກຮມ folderaccess2.1 ແລ້ວຂ້າເຈົ້າໄດ້ລັອກfolder ຢູ່ໃນຊ່ອງ E
ແລ້ວມັນກໍລັອກຳໄດ້ປົກະຕີ ແລະມາມື້ໜື່ງຄອມມີບັນເລີຍລົງ Windows ໃໜ່
ຫຼັງລົງແລ້ວຂ້າພະເຂົ້າລືມປົດ Folder ທີ່ຖືກລັອກໄວ້ຫັນແລະໄດ້ຕິດຕັ້ງ
ໂປຮແກຮມ folderaccess2.1 .ໃຫ່ມແລະກໍຫຍັງບໍ່ສາມາດປົດລັອກອອກ
ໄດ້ ແລະຢາກໃຫ້ທ່ານ ຊ່ວຍຊອກວີທີແກ້ໄຂ້ໃຫ້ແດ່

Re:

Thu, 28 Aug 2008 05:26:34 -0400

ຂ້າພະເຈົ້າໄດ້ສະແກນ USB ເນື່ອງຈາກຕີດໄວລັດFullhouse drive ແລ້ວscan ທີ່ Lao antivirus 2009 ຜົນທີ່ອອກມາກໍ່ຄືຂໍ້ມູນທີ່ມີຢູ່ຖືກລືບຈົນຫມົດ .

Re:

Mon, 01 Sep 2008 14:38:34 -0400

ເລື່ອງມີຢູ່ວ່າ ເຄື່ອງຄອມ ຂພຈ ມີ Message Box ຂືນມາຝ້ອງຕະຫລອດ ປິດອອກກໍບໍໄດ້ ຂພຈ ຄິດວ່າຕ້ອງແມ່ນຕິດ Virus ແນ່ນອນ ຈາກນັນ ຂພຈ ດາວໂຫລດ ເອົາ Lao AV 2009 ມາສະແກນ ປະກົດວ່າພົບເຫັນ Virus 22 ໂຕສ່ວນຫລາຍຈະຕິດຢູ່ ໃນ File c:\Windows\System32\...... ເມື່ອ ໂປຣແກຣມທຳການລົບອອກໝົດ 22 File ຈາກນັນ Restart Com ປະກົດວ່າ Com ຂພຈ ລອກອີນເຂົາ windows ບໍໃດ້ ເວລາເຂົາມັນຈະ Reset ເຂົາມາໜ້າຕ່າງ ລອກອີນຄືເກົ່າເປັນຈັ່ງຊີຕະຫລອດ ຂໍໃຫ້ທ່ານຊ່ວຍຊີແນະແດ່ .
ຂອບໃຈ.......

Re:

Mon, 08 Sep 2008 02:21:43 -0400

ຢາກໃຫ້ປັບປຸງ Anti virus 2009 ຄຶວ່າຫຼັງ ອັບເດດ ແລ້ວສ່ວນຫຼາຍມັນມັກກິນຟາຍ
ວິນໂດນ ເຊັ່ນ: ຟາຍທີ່ລົງທ້າຍດ້ວຍ .exe ບາງເທື່ອກິນຮອດຟາຍ explorer
ຖ້າມັນກິນຟາຍໂຕນີ້ເວລາເປີດຄອມມັນຈະບໍ່ສະແດງ Icon ຕ່າງ ເຫັນແຕ່ພາບໜ້າຈໍ

Re:

Mon, 15 Sep 2008 10:03:52 -0400

How can I update from file on Lao AV 2009
when I go to the download update file it doesn't show the correct date
please help?

Re:

Tue, 16 Sep 2008 09:10:06 -0400

ເລື່ອງມີຢູ່ວ່າ ກ່ອນໜ້ານີ້ ຂພຈ ໃຊ້ laoAV 9.5 ເປັນໂປຣແກຣມທົດລອງໃຊ້ແຕ່ດຽວນີ້ ວັນໝົດອາຍຸ ແລະ ກວດໄວຣັດກໍບໍ່ເຫັນ ຂພຈ ຈຶ່ງລືບຖີ້ມເພື່ອຈະລົງໂຕໄຫມ່ 2009 ແຕ່ເມື່ອລືບຖີ້ມແລ້ວ RST ເຄື່ອງໄຫມ່ແລ້ວ Install Laoav 2009 ສະແກນ ຢູ່ປະມານ 30ນາທີ ສຳເລັດ ພົບໄວຣັດ 15ໂຕ ແລະ ຂພຈ ລືບທັງໝົດຈາກນັ້ນ RST ເຄື່ອງໄຫມ່ປະກົດວ່າເຂົ້າ Windows ບໍ່ໄດ້ມີແຕ່ໜັງສືຂື້ນມາເຕືອນ
Windows could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

You can attempt to repair this file by starting Windows setup using the original Setup CD-ROM.
Select 'r' at the first screen to start repair.
ຂພຈ ກໍ່ລອງເອົາແຜ່ນ CD Windows XP ເຂົ້າລອງເບີງຕາມທີ່ມັນບອກແລ້ວກົດ 'r' ແຕ່ກໍ່ຍັງບໍ່ໄດ້ ຂໍລົບກວນທ່ານມີວິທີແກ້ໄຂບໍໂດຍບໍ່ຢາກລົງ WD ໄຫມ່ຂອບໃຈລວງໜ້າທີ່ແວະເຂົ້າມາອ່ານ ແລະຄຳແນະນຳ

Re:

Wed, 01 Oct 2008 09:20:11 -0400

ຂ້ອຍຕັ້ງ laoav ໃສ່ user A ກໍ່ເຮັດວຽກດີ ແຕ່ຍາມຂ້ອຍ login ເປັນ user B ມັນບໍ່ເຮັດວຽກ, ຂ້ອຍມີ ຫຼາຍໆuser ຢາກໃຫ້ມັນເຮັດວຽກ ໝົດ ຄວນຈະເຮັດແນວໃດ?

Re:

Fri, 03 Oct 2008 09:14:59 -0400

Program Laoav ບໍ່ເຮັດວຽກນຳ user ອື່ນ
ຕົວຢ່າງ: ຂ້ອຍ login ຊື່ວ່າ user A ແລະກໍ່ຕິດຕັ້ງ LaoAV ໃສ່ມັນກໍ່ເຮັດວຽກດີ ແລ້ວຂ້ອຍກໍ່ logoff user A and login ຊື່ວ່າ user B ແຕ່ມັນບໍ່ເຮັດວຽກ,ມັນມີ error message ແລະກໍ່ບໍ່ສາມາດເປີດ Laoav ໄດ້ ເມື່ອຂ້ອຍ logoff user B and login back to user A it working fine ໝາຍຄວາມວ່າ laoav ເຮັດວຽກນຳ ແຕ່ user ທີທຳການຕິດຕັ້ງ laoav ລົງເທົ່ານັ້ນ ສ່ວນ user ອື່ນທີ່ຢູ່ ຄອມດຽວກັນ ມັນບໍ່ເຮັດວຽກ.
ຖ້າຂ້ອຍມີ ຫຼາຍໆuser ຢູ່ ຄອມດຽວກັນ ຢາກໃຫ້ມັນເຮັດວຽກ ໝົດ ຄວນຈະເຮັດແນວໃດ?

Re:

Thu, 23 Oct 2008 14:57:34 -0400

ຄອມຂອງຂ້າພະເຈົ້າໄດ້ຖືກໄວລັດບໍ່ຮູ້ຊື່ຫລິ້ນງານເອົາ ເພາະວ່າຂ້າພະເຈົ້າຈະກອບປີຟາຍຫຍັງບໍ່ໄດ້ເລີຍ ແລະເມື່ອເຮົາດາວໂຫລດໂປຮແກມແອນຕິໄວລັດໃຊ້ຢູເອສບີ
ແລ້ວໄປກອບປີ້ລົງຄອມມັນກໍ່ບໍ່ໃຫ້ກອບ ຖ້າກອບໄດ້ແຕ່ຕິດຕັ້ງບໍ່ໄດ້ ເວລາຕິດຕັ້ງໄດ້ ແລ້ວແຕ່ເຮົາເປີດ,ປແກມມັນບໍ່ໃຫ້ເປີດແລະ ເຄື່ອງກໍ່ບໍ່ມີຫຍັງຢູ່ຫນ້າຈໍເລີຍ ໄອຕອນກໍ່ຫາຍແລະ ສະຕາດເມນູກໍ່ຫາຍແລະບາງເທື່ອກໍ່ແຮ້ງໄປເລີຍແຕ່ ເຮົາລີ່ສະຕາດເຄື່ອງໃຫມ່ກໍ່ເຫັນຄືເກົ່າແຕ່ເຮົາໃຊ້ງານຫຍັງບໍ່ໄດ້ເລີຍ ລອງລົງວິນ,ດໄປໃຫມ່ແລ້ວ ຫລາຍເທື່ອແຕ່ກໍ່ເປັນຄືເກົ່າເມື່ອເຮົາສຸບ ຢູເອສບີເຂົ້າຈະຕິດຕັ້ງແອນຕິໄວລັດ ທ່ານຜູ້ຮູ້ ຊ່ວບບອກແດ່ ຂໍຂອບໃຈລ່ວງຫນ້າ
ຖ້າທ່ານຮູ້ ສ່ວຍສົ່ງເຂົ້າເມວຂ້າພະເຈົ້າກໍ່ໄດ້ jamskone@hotmail.com

Re:

Fri, 24 Oct 2008 09:09:51 -0400

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ເຄົາລົບ
ຂ້າພະເຈົ້າ ຂໍຖາມບັນຫາເລື່ອງ LAN ຄອມຂອງ ຂພຈ ໃຊ້LAN ຣ່ວມກັນ 5 ຫນວ່ຍ ແລະ ເມື່ອ ເຂົ້າRun ພິມ \\somsy... ກໍ່ສາມາດເຂົ້າໄປຫາຫນວ່ຍທີ່ຊື່ ສົມສີໄດ້ ແລະ ຂພຈ ຢາກໃສ່ password ບໍ່ໃຫ້ run ເຂົ້າມາໄດ້ ເພື່ອປ້ອງກັນຂໍ້ມູນຫາຍ
ຈິ່ງຢາກຂໍຄຳແນະ ວິທີໃສ່ password ຈາກທ່ານ

ຂໍຂອບໃຈ ຢ່າງສູງ

Re:

Wed, 12 Nov 2008 11:09:41 -0500

ສະບາຍດີ ທ່ານອາເລັກ ຂ້າພະເຈົ້າເປັນຜູ້ໜື່ງທີ່ສົນໃຈກ່ຽວກັບເລື່ອງໄອທີ ແຕ່ບໍ່ມີທີ່ປືກສາເລີຍ ຊື່ງໄດ້ພະຍາຍາມສຶກສາການເຮັດວຽກຂອງໄວຣັດ ແລະ ເພື່ອເປັນການສຶກສາ ດັ່ງນັ້ນຈື່ງຂໍຖາມທ່ານແດ່ໄດ້ບໍວ່າເຮົາມີວິທີແນວໃດທີ່ຈະສ້າງໄວຣັດຂື້ນມາ ຫຼື ດັດແປງ code ໄວຣັດ ເຊັ່ນວ່າໄວຣັດ fullhouse, fullhouse drive, flashy.... ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Fri, 21 Nov 2008 07:26:26 -0500

ຂອບໃຈຫຼາຍໆທີ່ໃຫ້ຄວາມສົນໃຈ. ເຈົ້າ, ສະບາຍດີທ່ານ ຂອງຄາມຊ່ວຍເຫຼືອແດ່ ເນື່ອງຈາກຄວາມຢາກຮູ້ຢາກສຶກສາຈື່ງມີຄຳຖາມນີ້ຂື້ນມາ ໂດຍທີ່ບໍ່ຮູ້ມາກ່ອນວ່າເຄີຍມີແບບນີ້ມາກ່ອນຫຼືບໍ່ ແລະ ມັນມີວິທີຫຼືບໍ່ ເລື່ອງກໍ່ຄືວ່າ:ຢາກຮູ້ວິທີສ້າງໃຫ້ file ຂໍ້ມູນໄຫຼເຂົ້າ USB ອັດຕະໂນມັດເມື່ອມີການດັບໂບ clik ໃສ່ file ດັ່ງກ່າວໃນຂະນະທີມີການສີບ USB ຢູ່ ໂດຍພຽງແຕ່ດັບໂບຄລີກກໍ່ເຂົ້າUSBເລີຍ. ຂໍຂອບໃຈຫຼາຍທ່ານ(ຄົງບໍ່ວ່າກັນຖ້າການໃຊ້ງານແບບນີ້ບໍ່ມີໃນການໃຊ້ງານwindows) ຂອບໃຈອີກເທື່ອໜື່ງທີ່ໃຫ້ຄວາມສົນໃຈ.

Re:

Tue, 25 Nov 2008 13:09:14 -0500

- ຂ້າພະເຈົ້າຕ້ອງການບົດຮຽນກ່ຽວກັບການສ້າງ Crack ຂອງໂປຮແກຮມ
ເອົາເປັນພາສາໄທເດີທ່ານ ເຮັດໃຫ້ໂປຮແກຮມສາມາດໃຊ້ໄດ້ຕະຫຼອດ
- ແລະ ຕ້ອງການບົດຮຽນກ່ຽວກັບການ Hack Server

Re:

Sat, 13 Dec 2008 09:06:00 -0500

Internet Cafe Master 1.0
ໃໍຊ້ງານແນວໃດ

Re:

Sat, 13 Dec 2008 09:32:53 -0500

ສະບາຍດີ
ມື້ນີ້ຂ້າພະເຈົ້າໄດໄປເບີ່ງເວັບໄຊແຫ່ງນີ້ http://alx.freewebspace.com/index.htm
ເຂົາບອກວ່າເປັນ lao antivirus 2007 ແຕ່ວ່າເມື່ອດາວໂຫຼດມາແລ້ວຕິດຕັ້ງບໍ່
ໄດ້ເລີຍ........... ມັນເປັນ virus ຫຼືບໍ່???

Re:

Tue, 16 Dec 2008 03:27:15 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ ທີ່ນັບຖື
ຂ້າພະເຈົ້າ ໄດ້ download remove Trojan ມາແລ້ວ ແຕ່ວ່າ ອະນຸຍາດໃຫ້ໃຊ້ 30 ວັນ ທ່ານ ພໍມີ key ບໍ່
ຂໍຂອບໃຈ ເປັນຢ່າງສູງ

Re:

Thu, 22 Jan 2009 02:34:53 -0500

My computer have virus my girl i think it maybe new virus
please help me. if you know to kill this virus

Re:

Thu, 29 Jan 2009 02:40:56 -0500

ເປັນຫຍັງຄືວ່່າລາວແອນຕີ້ໄວຣັດສຈື່ງບໍອັບເດດເລີຍໄດ້ 10 ມື້ແລ້ວ

Re:

Wed, 11 Feb 2009 11:10:06 -0500

ສະບາຍດີ ນີ້ເປັນຄັ້ງທຳອິດຂອງຂ້ອຍ
ຄອມພິວເຕີຂອງຂ້ອຍໄດ້ໄປຕິດເອົາ Spyware Protect 2009 ນະຄະນະທີ່ຂ້ອຍ Oline ໂດຍບໍ່ຮູ້ໂຕ
ເຊິ່ງມັນສ້າງຄວາມລຳຄານຫຼາຍຖ້າຕິດ Spyware Protect 2009 ເພາະມັນຈະສະແດງ Popup ຕະຫຼອດ
ຢາກຮູ້ຈັກວິທີແກ້ໄຂ ແລະປ້ອງກັນ?

Re:

Wed, 11 Feb 2009 13:28:40 -0500

Now your anti virus has out of user, so how can i register

Re:

Fri, 13 Feb 2009 16:20:00 -0500

ສະບາຍດີທ່ານ A L X ຂ້ານ້ອຍຂໍອະນຸຍາດເອົາ lao antivirus ໄປວາງໃນເວັບໄຊຂອງຂ້ານ້ອຍແດ່ເດີ້ ຂອບໃຈລ່ວງໜ້າ
ເວັບຂອງຂ້ານ້ອຍຄື: www.xarhang.co.cc

Re:

Wed, 18 Feb 2009 10:05:09 -0500

ຢາກຮຽນພິເສດ ພັດທະນາເວບໄຊ ໃຊ້ເວລາ ປະມານ 1-2 ເດືອນ
ໃຜຮູ້ອາຈານທີ່ເກ່ງໆ ຫຼື ໂຮງຮຽນດີໆ ຊ່ວຍບອກແດ່

fueyching@hotmail.com

Re:

Thu, 26 Feb 2009 03:27:09 -0500

ສະບາຍດີ ທ່ານ ອາເລັກໄຊ

ຂ້າພະເຈົ້າມີແນວລົບກວນທ່ານອີກແລ້ວ
ຄືວ່າ ຄອມຂອງຂ້າພະເຈົ້າຢູ່ຊື່ໆກະບໍ່ສາມາດເປີດ properties ໄດ້, ກ່ອນໜ້ານີ້ແມ່ນມີໂຟນເດີ້ທີ່ຍາກລຶບຖິ້ມແຕ່ມັນບໍ່ໃຫ້ລຶບ ກະເລີຍລອງເປີດເບິ່ງ properties ແຕ່ປະກົດວ່າ ບໍ່ສາມາດເຂົ້າຫາ properties ໄດ້. ບໍ່ຮູ້ວ່າທ່ານສາມາດພໍຮູ້ບໍ່ວ່າມັນເປັນຍ້ອນຫຍັງ? ແລະ ທ່ານມີຕົວລີມູບ ທີ່ສາມາດຊ່ວຍຄອມຂອງຂ້າພະເຈົ້າໄດ້ບໍ່ເຍ໋າະ. ຂ້າພະເຈົ້າບໍ່ຍາກເຮັດວິນໂດລີແພນະທ່ານ.

ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Sun, 01 Mar 2009 16:36:54 -0500

ເມື່ອຕິດຄອມແລ້ວຈະມີການສ້າງໄຟລ
c:\autorun.inf
c:\gi2ky.exe
%System%\olhrwef.exe
%System%\nmdfgds0.dll
%System%\nmdfgds2.dll
ແລະສ້າງຄ່າໃນ registry

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

cdoosoft = "%System%\olhrwef.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000000

Re:

Sun, 01 Mar 2009 16:45:14 -0500

ເມື່ອຕິດຄອມມັນຈະສ້າງໄຟລ
c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\svchost.exe
ແລະສ້າງຄ່າໃນ Registry

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCG-11CF-AAX5-81CX5C625612}]

StubPath = "c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330- 1013\svchost.exe"

Re:

Mon, 02 Mar 2009 16:44:36 -0500

Repair Safemode ເປັນໂປຣແກຣມນ້ອຍທີ່ໃຊ້ສຳລັບແກ້ບັນຫາ ການເຂົ້າ Safemode ບໍ່ໄດ້ເນືອງຈາກຖືກໄວຣັສ ສະນັ້ນຈີ່ງສ້າງໂປຣແກຣມນີ້ມາເພື່ອ
ງ່າຍໃນການແກ້ບັນຫານີ້
ດາວໂລດ
http://laoav.co.cc/download.php?view.64

Re:

Thu, 05 Mar 2009 16:26:06 -0500

ຄຶວ່າ:ຂ້າພະເຈົ້າມີບົດຮຽນທີ່ມີຟາຍເປັນນາມສະກຸນ mhc ທີ່ສ້າງດ້ວຍ
ໂປຮແກຮມ html workshop ແລ້ວຢາກຮູ້ວ່າຕ້ອງເອົາໂປຮແກຮມໃດ
ມາລົງຈຶ່ງຈະສາມາດອ່ານໄດ້.

Re:

Mon, 09 Mar 2009 18:39:25 -0400

ສ້າງໄຟລ
c:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\Drive13.exe
ສ້າງໂພນເດີ

c:\RESTORE
c:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013

ສ້າງຄ່າໂອໂຕລັນໃນ registry

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-21CX1C635622}

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-21CX1C635622}]

StubPath = "c:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\Drive13.exe"

Re:

Tue, 10 Mar 2009 04:47:25 -0400

ຄືວ່າ ຄອມພິວເຕີຂອງເພື່ອນຮ່ວມຫ້ອງການດຽວກັບ ເປັນຫຍັງບໍ່ຣູ້ ວ່າລາ ເສບ ໂປແກມ ເວີດ ແລ້ວ ພັດເວລາເປີດອອກມາມັນພັດໃຫ້ໃສ່ password ທັງທັງບໍໄດ້ຕັ້ງຄ່າຍັງເລີຍ ແລະ ກໍ່ເປັນຄືກັນ 4 ໜ່ວຍ
ແກ້ໄຂກາບໍ່ໄດ້ ລິບແລ້ວຕັ້ງໃໝ່ ທຳອິດໄດ້ຢູ່ພັດໄຊ້ໄປດົນແລ້ວ ກໍ່ເປັນຄືເກົ່າ ຂ້າພະເຈົ້າສົ່ງໃສ່ ແຕ່ ບັກໄວລັດອັນດຽວນີ້ລະເພາະ ບໍ່ເຄີຍເປັນແບບນີ້ຈັກເທື່ອ ຊ່ວຍໃຫ້ຄຳຄິດເຫັນແນ່ ທ້ານ ອາເລັກໃຊ້

Re:

Mon, 23 Mar 2009 02:06:21 -0400

ຄຶວ່າອາການມັນເປັນແບບນິ້:ຂ້າພະເຈົ້າໄດ້ໃຊ້ Kaspersky Internet
Security 7.0 ແລະເວລາໃຊ້ຄອມມັນຈະຟ້ອງວ່າຟາຍທີ່ສຳຄັນຂອງWindows
ແມ່ນ ໄວສ໌ຮັດເຊັ່ນ:Winlogon,explorer ແລະຟາຍອື່ນໆທີ່ສຳຄັນຂອງ
ວິນໂດຮ ພ້ອມທັງຟາຍໂປຮແກຮມອີກ ແລະຂ້າພະເຈົ້າໄດ້ລົງAnti-Virus ໂຕອື່ນ
ກະເປັນຄຶກັນ

Re:

Wed, 25 Mar 2009 15:53:25 -0400

ເປັນໂຕຣເຈັນແລະ Rootkit ເຊື່ງເຮັດໃຫ້ຄອມທີ່ຕິດນັ້ນເນັດເວີກມີບັນຫາເຊັ່ນ Share drive ,share printer ແລະ Connection ມີບັນຫາພ້ຽນໄປ
ທ່ານສາມາດສັງເກດງ່າຍໆໃຫ້ກວດເບີ່ງວ່າໃນຄອມທ່ານມີໄຟລນີ້ບໍໃນ ໂພນເດີ
C:\Windows\System32\Drivers
ndisio.sys ຫລື ndisi.sys ຖ້າມີແມ່ນຕິດແລ້ວ

+ ສ້າງໄຟລໃນຄອມ
%UserProfile%\netsf.inf
%Windir%\inf\netsf.inf
%UserProfile%\netsf_m.inf
%Windir%\inf\netsf_m.inf
%UserProfile%\xwc.exe
%System%\wcjp.exe
%Windir%\inf\netsf.PNF
%Windir%\inf\netsf_m.PNF
%System%\drivers\ndisio.sys
+????????? Registry

    * The following Registry Keys were created:
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325- 11CE-BFC1-08002bE10318}\0012
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325- 11CE-BFC1-08002bE10318}\0013
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A}
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A} \Ndi
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A} \Ndi\Interfaces
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A} \Parameters
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\RefNames
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0000
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0000\D evice Parameters
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0000\L ogConf
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0001
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0001\D evice Parameters
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0001\L ogConf
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Passthru
          o HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Passthru\Security

    * The newly created Registry Values are:
          o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
                + Installation Sources = "%Profiles%\%UserName%"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325- 11CE-BFC1-08002bE10318}\0012]
                + Characteristics = 0x00000029
                + ComponentId = "ms_passthrump"
                + InfPath = "netsf_m.inf"
                + InfSection = "PassthruMP.ndi"
                + ProviderName = "Microsoft"
                + DriverDateData = 00 00 87 80 D4 BD BE 01
                + DriverDate = "6-24-1999"
                + DriverVersion = "5.0.2071.1"
                + MatchingDeviceId = "ms_passthrump"
                + DriverDesc = " "
                + NetCfgInstanceId = "{E109290D-C1C4-4E9C-A08A-E5750D8BA28E}"
                + FilterInfId = "ms_passthru"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325- 11CE-BFC1-08002bE10318}\0013]
                + Characteristics = 0x00000029
                + ComponentId = "ms_passthrump"
                + InfPath = "netsf_m.inf"
                + InfSection = "PassthruMP.ndi"
                + ProviderName = "Microsoft"
                + DriverDateData = 00 00 87 80 D4 BD BE 01
                + DriverDate = "6-24-1999"
                + DriverVersion = "5.0.2071.1"
                + MatchingDeviceId = "ms_passthrump"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972- E325-11CE-BFC1-08002BE10318}\Descriptions]
                + = "1 2"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A} \Ndi\Interfaces]
                + UpperRange = "noupper"
                + LowerRange = "nolower"
                + FilterMediaTypes = "ethernet, tokenring, fddi, wan"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A} \Parameters]
                + Param1 = "4"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A} \Ndi]
                + HelpText = "Client For Microsoft Sharing"
                + FilterClass = "failover"
                + FilterDeviceInfId = "ms_passthrump"
                + Service = "Passthru"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E974- E325-11CE-BFC1-08002BE10318}\{9F28D4A4-EE69-4EDE-A325-8CC29527CA6A}]
                + Characteristics = 0x00004410
                + InfPath = "netsf.inf"
                + InfSection = "Passthru.ndi"
                + Description = "Client For Microsoft Sharing"
                + ComponentId = "ms_passthru"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\RefNames]
                + = " "
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0000\ Device Parameters]
                + InstanceIndex = 0x00000001
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0001\ Device Parameters]
                + InstanceIndex = 0x00000002
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0001]
                + ClassGUID = "{4D36E972-E325-11CE-BFC1-08002BE10318}"
                + Class = "Net"
                + HardwareID = "ms_passthrump"
                + Driver = "{4D36E972-E325-11CE-BFC1-08002BE10318}\0013"
                + FriendlyName = " #2"
                + Mfg = "Microsoft"
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\MS_PASSTHRUMP\0000]
                + ClassGUID = "{4D36E972-E325-11CE-BFC1-08002BE10318}"
                + Class = "Net"
                + HardwareID = "ms_passthrump"
                + Driver = "{4D36E972-E325-11CE-BFC1-08002BE10318}\0012"
                + Mfg = "Microsoft"
                + Service = "Passthru"
                + DeviceDesc = " "
                + ConfigFlags = 0x00000000
                + FriendlyName = "WAN Miniport (Network Monitor) - "
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Passthru\Security]
                + Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
          o [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Passthru]
                + Type = 0x00000001
                + Start = 0x00000003
                + ErrorControl = 0x00000001
                + Tag = 0x00000008
                + ImagePath = "%System%\Drivers\ndisio.sys"
                + DisplayName = "Service"
                + Group = "PNP_TDI"

Re:

Mon, 30 Mar 2009 11:32:06 -0400

ຮຽນທ່ນ Administrator ຄອມຂ້ອຍສົງໃສຕິດໄວລັດ ບໍ່ຮູ້ວ່າເປັນຫຍັງມັນຄືລົງ ໂປຼແກມ Antivirus ບໍ່ໄດ້ ຍົກຕົວຢ່າງ ເວລາເຮົາຊິຕິດຕັ້ງໂປຼແກມເມື່ອເປີດ File ໂປຼແກມອອກມາເພື່ອກຽມຕິດຕັ້ງ Box ມັນກໍ່ຫາຍໄປເລີຍ ເມື່ອປົກະຕິແລ້ວ Box ກໍ່ຫາຍເລີຍເມື່ອເຂົ້າໄປ FILE ໂປຼແກມອີກ ມັນກໍ່ຫາຍໄປຄືເກົ່າ. ນອກຈາກນີ້ເວລາ ເຮົາເປີດ Folder ທີ່ມີໂປຼແກມ Antivirus, Box ກໍ່ຫາຍໄປອີກ. ບໍ່ຮູ້ວ່າມັນເປັນຫຍັງ, ກະລຸນາຊ່ວຍບອກວິທີ່ແກ້ໄຂໃຫ້ແດ່ເດີທ່ານ. Thank you!

Re:

Fri, 03 Apr 2009 10:52:48 -0400

ສະບາຍດີທ່ານ ອາເລັກໄຊ

ຄືວ່າຄອມຂອງຂ້າພະເຈົ້າມີໄວຣັດ ຊື່ວ່າnetmon.exe ບໍ່ຮູ້ວ່າເຄີຍໄດ້ຍິນໄວຣັດຕົວນີ້ມາກ່ອນບໍ່
ຄືວ່າມັນເຮັດໃຫ້server ແຮ້ງຕະຫຼອດເລີຍ ແລະ ສັ່ງພິມກະບໍ່ໄດ້ ແຖມຍັງອັບເດດເອນຕິໄວຣັດກະບໍ່ໄດ້ນຳອີກ
ຂ້າພະເຈົ້າຍາກຊິບສົ່ງໄປໃຫ້ທ່ານຢູ່ແຕ່ວ່າ ສັ່ງຊິບຍາມໃດລະຄອມມັນກະແຮ້ງໂລດ ກະເລີຍບໍ່ຮູ້ວ່າທ່ານ ພໍທີ່ຈະຊ່ວຍສ້າງໂຕລີມູບໃຫ້ຂ້າພະເຈົ້າເດ່ໄດ້ບໍ່ເນ໋າະທ່ານ

ຂໍຂອບໃຈຫຼ່ວງໜ້າ

Re:

Thu, 09 Apr 2009 17:05:08 -0400

Trojan ຕົວນີ້ມັນເຊື່ອງຕົວເອງໃນ
%Windir%\system\msddll.exe
ແລະສ້າງ Services ຊື msddll ກັບໃນ Registry ດັ່ງນີ້

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDDLL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDDLL\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDDLL\0000\C ontrol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msddll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msddll\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msddll\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDDLL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDDLL\00 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDDLL\00 00\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msddll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msddll\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msddll\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDDLL\0000\ Control]

*NewlyCreated* = 0x00000000
ActiveService = "msddll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDDLL\0000]

Service = "msddll"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "msddll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDDLL]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msddll\Enum]

0 = "Root\LEGACY_MSDDLL\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msddll\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msddll]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = ""%Windir%\system\msddll.exe""
DisplayName = "msddll"
ObjectName = "LocalSystem"
FailureActions = 0A 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 B8 0B 00 00
Description = "msddll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDDLL\0 000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "msddll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDDLL\0 000]

Service = "msddll"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "msddll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDDLL]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msddll\Enum]

0 = "Root\LEGACY_MSDDLL\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msddll\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msddll]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = ""%Windir%\system\msddll.exe""
DisplayName = "msddll"
ObjectName = "LocalSystem"
FailureActions = 0A 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 B8 0B 00 00
Description = "msddll"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control]

WaitToKillServiceTimeout = "7000"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) = 0x00000128

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]

WaitToKillServiceTimeout = "7000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) = 0x00000128

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explore r\Shell Folders]

Cookies = "%Profiles%\LocalService\Cookies"
History = "%Profiles%\LocalService\Local Settings\History"

ສຳລັບຕົວ Remove ແມ່ນສ້າງແລ້ວຫາດາວໂລດໄດ້ທີ່ເວັບນີ້ Kill msddll.exe Trojan

Re:

Fri, 24 Apr 2009 05:43:42 -0400

-Registers a 32-bit in-process server DLL
-Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
+File System Modifications
%ProgramFiles%\Common\helper.dll
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\main.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\X-33A0E1054B-01EE-4D57-A059- 4D99F339709FX.,-
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\main.DLL]

AppID = "X-33A0E1054B-01EE-4D57-A059-4D99F339709FX.,-"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\X-33A0E1054B-01EE-4D57- A059-4D99F339709FX.,-]

(Default) = "Browser Helper Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\VersionIndependentProgID]

(Default) = "main.BHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\TypeLib]

(Default) = "{8E3C68CD-F500-4A2A-8CB9-132BB38C3573}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\ProgID]

(Default) = "main.BHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}\InprocServer32]

(Default) = "%ProgramFiles%\Common\helper.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFD4AD01-58C1-47DB-A404- FBE00A6C5486}]

(Default) = "Browser Helper Object"
AppID = "X-?9 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}\TypeLib]

(Default) = "{8E3C68CD-F500-4A2A-8CB9-132BB38C3573}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{986A8AC1-AB4D-4F41- 9068-4B01C0197867}]

(Default) = "IBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0\0\win32]

(Default) = "%ProgramFiles%\Common\helper.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\Common\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E3C68CD-F500-4A2A-8CB9- 132BB38C3573}\1.0]

(Default) = "mainLib"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO\CurVer]

(Default) = "main.BHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO\CLSID]

(Default) = "{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO]

(Default) = "Browser Helper Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO.1\CLSID]

(Default) = "{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\main.BHO.1]

(Default) = "Browser Helper Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Browser Helper Objects\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}]

(Default) = ""
NoExplorer = 0x00000001

Re:

Wed, 29 Apr 2009 11:50:24 -0400

ກະລຸນາຊ່ວຍຂ້າພະເຈົ້າແດ່ ຄອມຕິດໄວລັດທີ່ສ້າງໂຟເດີຂື້ນເອງ ຂອບໃຈລອງໜ້າ

Re:

Sat, 02 May 2009 09:58:38 -0400

ຄືວ່າເວລາເປີດຄອມໃຊ້ເມື່ອຮອດໂລໂກ້ຂອງວິນໂດຣມັນມັກຈະ restartໃໜ່ຕະຫວຼດນະທ່ານ, ກ່ອນໜ້ານັ້ນ ຂພຈ ເອົາ usb ໂອນຂໍ້ມູນເຂົ້າ , ສົງໃນ ຢ້ານຕິດໄວຣັດແລ້ວ ມີວິທີແກ້ບໍ່ທ່ານ ຂໍຄຳແນະນຳແດ່ທ່ານ .
ຂອບໃຈ !

Re:

Sun, 03 May 2009 09:16:28 -0400

ຂພຈ ໃຊ້ ວິນໂດຣ , ມັນບໍສາມາດ ຄິຣກທີ່ໄດ້ຊ່ອງທີ່ຕ້ອງການໄດ້. ຕ້ອງໄດ້ເປີດຢູ່ຫນ້າ explore ຢ່າງດຽວທ່ານ.
, ແລະ ໂຟນເດີອ໋ອບເຊີນມັນກາຫາຍ. ແຕ່ ຂພຈ ແກ້ໃຫ້ ໂຟນເດີອ໋ອບເຊີນກັບມາໄດ້ແລ້ວແຕ່ບໍ່ສາມາດໂຊ໌ວຟາຍທີ່ມັນເຊື່ອງບໍໄດ້ ຂໍຄຳແນະນຳແດ່ທ່ານ .

Re:

Thu, 07 May 2009 06:18:18 -0400

ສະບາຍດີທ່ານຜູ້ຮູ້ທັງຫຼາຍ

ຂພຈ ມີບັນຫາເລື່ອງໄວຣັດ

ຊ່ວຍແດ່ ສົງໃສວ່າມຮໄວຣັດແທ້ໆໆໆໆໆ

ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Fri, 08 May 2009 10:48:30 -0400

ສະບາຍດີ ທ່ານ adm.
ບໍ່ຮູ້ວ່າເປັນຫຍັງຄອມຂອງຂ້າພະເຂົ້າເວລາເປີດມາຍາມໃດ ແລ້ວມັນຈະຟ້ອງວ່າ SVCHOST.EXE ເອີເລີ ຕະຫຼອດ. ແຕ່ວ່າເວລາໄປເປີດເບິ່ງຢູ່system32ເບິ່ງກະຍັງເຫັນມີເປັນປົກກະຕິໃ ບໍ່ຮູ້ວ່າທ່ານພໍທີ່ຈະສາມາດຊ່ວຍຂ້າພະເຈົ້າເດ່ໄດ້ບໍ່ເນ໋າະ

ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Fri, 22 May 2009 02:33:30 -0400

1. ບັນຫາໄວສ໌ຣັດຄຶວ່າຂ້າພະເຈົ້າໄດ້ເອົາ USB ຂອງຫນູ່ມາຊຽບແລ້ວໄວສ໌ຣັດ ມັນລັນໂອໂຕເລີຍແລ້ວເຄື່ອງມັນ Restart ເມື່ອເປີດມາໃໝ່ແລ້ວມັນ Restart ກັໄປກັບມາ ແລະຂ້າະພເຈົ້າໄດ້ໃຊ້ແຜ່ນບູດສຸກເສີນແລ້ວໄປກວດເບີ່ງຊ່ອງ C ແລ້ວໄປປົດລັອກແລ້ວໂຊ້ໜົດທຸກຟາຍແລ້ວໄດ້ສັງເກດເບີ່ງກະມີຟາຍຄົບຢູ່ຄຄຶໜ່ວຍອຶ່ ນ. ມີຕອນໜຶ່ງມີຟາຍ NTDETECT.com ຖືກໄວສ໌ຣັດລົບກະມີອາການຄ້າຍຄຶກັນ ແລະ ຂ້າພະເຈົ້າກະກັອບຈາກໜ່ວຍອື່ນມາໃສ່ກະສາມາດໃຊ້ໄດ້ປົກະຕິ.ແຕ່ອາການເທື່ອນິ້ແມ ່ນຂ້າພະເຈົ້າບໍ່ຮູ້ເລີຍວ່າແມ່ນຟາຍໃດເສຍແລ້ວຢາກໃຫ້ທ່ານຊ່ວຍບອກ
ໃຫ້ແດ່ວ່າຟາຍໃດເສຍແລ້ວຊີ້ກັອບຈາກໜ່ວຍອຶ່ນມາໃສ່.
2. ຄອມຂ້ອຍເມື່ອ View ເບິ່ງເອກະສານ ຫຼຶເບິ່ງຮູບ.ຕົວຢ່າງ: ຂ້າພະເຈົ້າຈະView ເບິ່ງຮູບເມື່ອເວລາປ່ຽນການView ເປັນແບບ Thumbnails ມັນຈະເຫັນແຕ່ຮູບແລ້ວຊື່ຂອງແຕ່ລະຟາຍແມ່ນບໍ່ເຫັນ.ຖ້າປ່ຽນເປັນການ ViewແບບTiles-Detailscແມ່ນເຫັນຢູ່ ຖ້າເປັນຮູບຈະເຫັນແຕ່ລັກສະນະຮູບແລະຈະບໍ່ຮູ້ວ່າແມ່ນຮູບໃດ ບໍ່ວ່າຈະ Viewເບິ່ງໂຟເດີອຶ່ນໆ ກໍ່ຕາມເປັນຄຶກັນໜົດ ແລະມັນກໍເປັນໜົດຄອມເລີຍ ຊ່ວຍບອກວິທີແກ້ແດ່ທ່ານ.

Re:

Sat, 23 May 2009 15:40:15 -0400

ຄຶວ່າຂ້າເຈົ້່າໄດ້download file update Lao-AntiVirus 2008
ເມື່ອອັບເດດແລ້ວບາງເທື່ອກະຂ້າຕາຍ.ສ່ວນຫລາຍຂ້າບໍ່ຍາກຕາຍ ຕາຍ ຊົ່ວຄາວເມື່ອເປີດມາໃຫມ່ກະຍັງເຫັນຄຶເກົ່າ ແລະຢາກໃຫ້ທ່ານສ້າງເຄື່ອງມື
ມາຂ້າຄຶຕົວອຶ່ນໆ ທີ່ທ່ານສ້າງມາຫັັ້ນແລະ. ບາງເທື່ອເອົາປະໄວ້ຂ້າໜ່ວຍທີ່ ລົງAnti-Virus ບໍ່ໄດ້

Re:

Fri, 12 Jun 2009 09:58:10 -0400

+File System Modifications
c:\AutoRun.inf
%ProgramFiles%\Common Files\SafeSys.exe
c:\SafeSys.exe
%ProgramFiles%\lteks.bak
%Windir%\Temp\Temporary Internet Files\Content.IE5\2FGHCJ2R\desktop.ini
%Windir%\Temp\Temporary Internet Files\Content.IE5\456VKRGZ\desktop.ini
%Windir%\Temp\Temporary Internet Files\Content.IE5\desktop.ini
%Windir%\Temp\Temporary Internet Files\Content.IE5\UJQRSHID\desktop.ini
%Windir%\Temp\Temporary Internet Files\Content.IE5\W9UDELK9\desktop.ini
%Windir%\Temp\Temporary Internet Files\Content.IE5\index.dat
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiArp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoGuarder.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findt2005.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IsHelp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.COM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavCopy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwolusr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsMain.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

SafeSys = "%ProgramFiles%\Common Files\SafeSys.exe"

so that SafeSys.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiArp.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoGuarder.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findt2005.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IsHelp.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.COM]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavCopy.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwolusr.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsMain.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe]

Debugger = "ntsd -d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe]

Debugger = "ntsd -d"

Re:

Tue, 23 Jun 2009 06:46:42 -0400

+File System Modifications
-%UserProfile%\%UserName%.exe
+Memory Modifications
%UserName%.exe
+Registry Modifications

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

%UserName% = "%UserProfile%\%UserName%.exe"

so that %UserName%.exe runs every time Windows starts

The following port was open in the system:

Port	Protocol
1033	TCP

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
n	8000

Re:

Sun, 28 Jun 2009 06:46:35 -0400

+ເມື່ອຕິດຄອມແລ້ວມັນສ້າງໄຟລດັ່ງນີ້
%System%\iconhandle.dll
%System%\web.dat
%System%\winweb.exe
%System%\webad.dll
+ມີ Process ແລະ Module
winweb.exe
webad.dll
ໍ+ສ້າງຄ່າໃນ Registry

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iconhandle.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{DD0AD1D0-6C36-4894-B38E- 9E5D3392114D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F6136F5A-4C58-40C7-8DFC- 945F5570CB79}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shellEx
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad.DLL]

AppID = "{F6136F5A-4C58-40C7-8DFC-945F5570CB79}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iconhandle.DLL]

AppID = "{DD0AD1D0-6C36-4894-B38E-9E5D3392114D}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{DD0AD1D0-6C36-4894-B38E- 9E5D3392114D}]

(Default) = "iconhandle"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F6136F5A-4C58-40C7-8DFC- 945F5570CB79}]

(Default) = "ad"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\VersionIndependentProgID]

(Default) = "ad.h"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\TypeLib]

(Default) = "{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\ProgID]

(Default) = "ad.h.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}\InprocServer32]

(Default) = "%System%\webad.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73EF2588-E4D1-4623-9B45- E0BBD6B65E9C}]

(Default) = "h Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\VersionIndependentProgID]

(Default) = "iconhandle.seticon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\TypeLib]

(Default) = "{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\ProgID]

(Default) = "iconhandle.seticon.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}\InprocServer32]

(Default) = "%System%\iconhandle.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFA7E78-CF7E-4550-829F- 2C786A0070BF}]

(Default) = "seticon Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}\TypeLib]

(Default) = "{581F1707-4AD0-4B7B-AD6E-057DB8F686F3}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72397142-9352-4A45- 99AD-2EF143072AC0}]

(Default) = "Iseticon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}\TypeLib]

(Default) = "{5A0063A5-F6E9-4947-9D1C-9300CE1BB342}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78D814F1-9774-4F37- B7F9-CD8F88558B53}]

(Default) = "Ih"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shellEx\IconHandler]

(Default) = "{AEFA7E78-CF7E-4550-829F-2C786A0070BF}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0\0\win32]

(Default) = "%System%\iconhandle.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0\HELPDIR]

(Default) = "%Windir%\system32"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{581F1707-4AD0-4B7B-AD6E- 057DB8F686F3}\1.0]

(Default) = "iconhandle 1.0 ï¿½ï¿½ï¿½Í¿ï¿½"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0\0\win32]

(Default) = "%System%\webad.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0\HELPDIR]

(Default) = "%Windir%\system32"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A0063A5-F6E9-4947-9D1C- 9300CE1BB342}\1.0]

(Default) = "ad 1.0 ï¿½ï¿½ï¿½Í¿ï¿½"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h\CurVer]

(Default) = "ad.h.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h\CLSID]

(Default) = "{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h]

(Default) = "h Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h.1\CLSID]

(Default) = "{73EF2588-E4D1-4623-9B45-E0BBD6B65E9C}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ad.h.1]

(Default) = "h Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon\CurVer]

(Default) = "iconhandle.seticon.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon\CLSID]

(Default) = "{AEFA7E78-CF7E-4550-829F-2C786A0070BF}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon]

(Default) = "seticon Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon.1\CLSID]

(Default) = "{AEFA7E78-CF7E-4550-829F-2C786A0070BF}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iconhandle.seticon.1]

(Default) = "seticon Class"

ແລ້ວມັນຍັງ copy ຕົວເອງໃສ່ USB Drive ແລະໃສ່ຊື່ດຽວກັບ Folder ແຕ່ແມ່ນ .EXE ແລ້ວກໍ່ Hidden folder ເຮົາໄວ້

Re:

Wed, 01 Jul 2009 11:44:06 -0400

Virus ''Thyet Myo Hacking Day" how to kill it?

Re:

Thu, 02 Jul 2009 15:29:33 -0400

>File System Modifications
-c:\explorer.exe
-%ProgramFiles%\explorer.exe
-%ProgramFiles%\{17350501621331}.exe
-c:\RECYCLER\explorer.exe
-%Windir%\BackUp\explorer.exe
-%Windir%\BackUp\autorun.inf
>Registry Modifications

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

explorer = "%Windir%\BackUp\explorer.exe"

so that explorer.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion]

{17350501621331} = "C:\explorer.exe"

Re:

Thu, 09 Jul 2009 11:30:52 -0400

ສະບາຍດີທ່ານ
ຊ່ວຍແດ່ ບໍ່ຮູ້ເປັນຫຍັງ ເວລາໃຊ້ຄອມໄດ້ປະມານ 20 ກວ່ານາທີ ມັນຈະມີຄຳເຕືອນຂື້ນມາວ່າ
Explorer.exe-application Error
The instruction at"0x191c0000"referenced memory at"0x000000", The memory could not be"written"
Click on OK to terminate the grogram
Click on CANCEL to debug the rogram
ແລະ ເຂົ້າໃຊ້ໂປແກມບາງຢ່າງບໍ່ໄດ້
ຊ່ວຍບອກວິທີແກ່ແດ່ເດີທ່ານ

ຂໍຂອບໃຈ

Re:

Fri, 10 Jul 2009 06:47:53 -0400

ສະບາຍດີ
ຂ້ອຍມີບັນຫາ virus ມັນເຮັດໃຫ້ຄຳສັງ Show hidden files and folders ບໍ່ເຮັດວຽກ
ເວລາເຂົ້າໄປໃນ Tools\folder Options\View ແລ້ວເລືອກເອົາ show hidden files and folders ແລ້ວກົດ OK ມັນກໍ່ຍັງບໍ່ show hidden files.
ເຂົ້າໄປເບິ່ງບ່ອນ folder options ມັນຍັງໝາຍຢູ່ບ່ອນ do not show hidden files and folders ຄືເກົ່າ.
ບໍ່ຮູ້ວ່າຕິດ virus ຫຍັງ? run virus scan ກໍ່ບໍ່ພົບ
ຢາກຮູ້ວ່າຈະຂ້າ virus ຕົວນີ້ໄດ້ແນວໃດ?
ຂອບໃຈ

Re:

Fri, 10 Jul 2009 07:41:24 -0400

ຂ້ອຍມີ snapshot file ຂອງເຄື່ອງຂ້ອຍໃຫ້ທ່ານເບິງນຳ ຊ່ວຍແກ້ໃຫ້ແດ່
ສ່ວນທ່ານວ່າໃຫ້ download Registry repair ຢູ່ web ໃດ?
Thanks

Re:

Fri, 10 Jul 2009 10:16:04 -0400

ສະບາຍດີ
ຂ້ອຍມີບັນຫາ Lao AV ມາຖາມ
ຂ້ອຍພະຍາຍາມຕິດຕັ້ງ Lao AV ບໍ່ໄດ້ຈັກເທື່ອ ຫລັງຈາກທີ່ຕິດຕັ້ງແລ້ວມັນກໍ່ຟ້ອງວ່າ Unspecified errorແລະ ລາຍງານຂໍ້ຜິດພາດຂອງໂປແກມຄື ໂປແກມອາດຈະມີຂໍ້ຜິດພາດແລ້ວໃນຖານຂໍ້ມູນຂອງໂປແກມ.

ຂ້ອຍໄດ້ attchment error file ໃຫ້ທ່ານເບິ່ງນຳ

ຂອບໃຈ

Re:

Fri, 10 Jul 2009 12:49:18 -0400

+File System Modifications
c:\autorun.inf
c:\vn.cmd
%System%\kva8wr.exe
%System%\bgotrtu0.dll
%System%\uweyiwe0.dll
+Memory Modifications
iexplore.exe
kva8wr.exe
+Registry Modifications

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

kvasoft = "%System%\kva8wr.exe"

so that kva8wr.exe runs every time Windows starts

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue = 0x00000000

Please Download Remove tools for Kill kva8wr.exe in this website

Re:

Tue, 21 Jul 2009 09:47:59 -0400

ໄວລັດໂຕນີ້ໄປບອກ Network ບໍ່ໄຫ້ແຊຂໍ້ມູນໄດ້ແຕ່ເວລາ Ping ຫາເຫັນ ປິດ ໄຟວໍ ແລ້ວ ຕັ້ງກຸບດຽວກັນລະ ວີທີແກ້ເຮັດແນວໃດບອກແດ່ ຫລືມີໂປແກຮມຫຍັງແນະນຳແດ່ ໝາຍເຫດເວລາ Restart ມາໄໝ່ລະເຂ້າໄດ້ແຕ່ປະດົນແລ້ວເຂົ້າບໍ່ໄດ້ຄືເກົ່າ

Re:

Wed, 22 Jul 2009 06:21:44 -0400

ສະບາຍດີທ່ານ
ຂ້າພະເຈົ້າຢາກຖາມວ່າ ໂຟນເດີຊື່ MSOCache ນີ້ມັນແມ່ນຫຍັງ ປະກົດວ່າມັນຈະມາເອງ ຢູ່ຊ່ອງ C,D ກະມີ ແລະ ມັນກໍ່ກີນເນື້ອທີ່ຮາດດິດຫລາຍສົມຄວນ, ເວລາຄິກເຂົ້າໄປມັນຈະເປັນໂຟນເດີທີ່ເປັນຕົວເລກ ແລະ ຟາຍສ່ວນຫລາຍຈະເປັນນາມສະກຸນ .CAB ບໍ່ຮູ້ວ່າມັນສຳຄັນບໍ່. ປະກົດວ່າ Delete ແລ້ວມັນກໍ່ກັບມາຄືນ.
ຊ່ວຍບອກແດ່ເດີທ່ານ.

ຂໍຂອບໃຈ

Re:

Wed, 22 Jul 2009 12:45:45 -0400

Malware ທີ່ມີຊື່ວ່າ System Security ເປັນ Malware ຕົວໃໝ່ລ່າສູດທີ່ອອກມາໃນຮູບແບບຂອງໂປຼແກຼມAntivirus ໂດຍຜ່ານການດາວໂຫຼດ ແລະຕິດຕັ້ງຜ່ານInternet ໂດຍພຶດຕິກຳຂອງ Malware ປະເພດນີ້ຄື ຖ້າຫາກວ່າເຍື່ອຫລົງເຂົ້າໄປໃນເວບໄຊທີ່ມີ Malware ພວກນີ້ອາໄສຢູ່ມັນຈະ Popup ໜ້າຕ່າງຂື້ນມາເພື່ອແຈ້ງໃຫ້ເຫຍື່ອປະມານວ່າດຽວນີ້ຄອມຂອງທ່ານຕິດໄວຮັດ
ຊະນິດຮ້າຍແຮງຢູ່ມີພຽງແຕ່ໂປຼແກຼມ System Security ເທົ່ານັ້ນທີ່ສາມາດຂ້າໄວຣັດ ແລະປ້ອງກັນທ່ານໃຫ້ປອດໄພຂາກ virus ແລະ spyware ໄດ້ ຫາກເຫຍື່ອຫຼົງເຊື່ອກໍ່ ຈະກົດ OK ເພື່ອດາວໂຫຼດເອົາfile ດັ່ງກ່າວມາຕິດຕັ້ງ ຫຼືຕັວໃຫ້ Scan ຜ່ານ Internet ແລະເມື່ອທຳການດັ່ງກ່າວແລ້ວມັນກໍ່ຈະເຂົ້າມາເປັນກາຝາກ ແລະກວນໃຈທ່ານໂດຍທີ່ທຸກຕັ້ງທີ່ເປີດຄອມມັນຈະScan ຕົນເອງ ແລະກໍ່ກວນຢູ່ຫັນ ແຫລະ ບອກໃຫ້ສັ່ງຊື້ລາຍເຊັນ ບາງຕົນສັ່ງຊື້ລາຍເຊັນລຽບລ້ອຍແລ້ວກໍ່ຖືກພວກ Hacker ສວຍໃຊ້ທາງດັ່ງກ່າວເພື່ອລັກເອົາເງີນ, ບາງຄົນຊື້ໄປຕັ້ງຫຼາຍເທື່ອກໍ່ຍັງຖາມຢູ່
ພວກເຮົາຈື່ງຂໍຕັ້ງຊື່ວ່າ Malware ຫຼອກລວງເດີພີ່ນ້ອງ

ດ້ວຍຄວາມຫວັງດີຈາກ KKCOM gfu

Re:

Tue, 11 Aug 2009 15:59:29 -0400

ສະບາຍດີ ທ່ານ Adam ຂ້າພະເຈົ້າມີແນວມາຂໍຮ້ອງທ່ານອີກແລ້ວ
ຄືວ່າຂ້າພະເຈົ້າໃຊ້ວິນໂດວິດຕາ ແລ້ວມັນຕິດໄວຣັດຕອນໃດກະບໍ່ຮູ້ຈັກ
ແຕ່ວ່າປະຈຸບັນນີ້ເວລາເປີດຄອມຂື້ມາແລ້ວ ມັນຈະຖາມວ່າຈະລຶບຟອນເດີ້ນີ້ຫຼືບໍ່ ຫຼື ເວລາເປີດຟາຍໃດຂື້ນມາມັນກະຈະຖາມແບບດຽວກັນ
ຂ້າພະເຈົ້າຍາກຊິບມັນມາໃຫ້ທ່ານຊ່ວຍສ້າງໂຕລີໂມບໃຫ້ ແຕ່ກໍ່ບໍ່ມີຄວາມສາມາດເນື່ອງຈາກວ່າ ຄອມມັນບໍ່ໃຫ້ຊິບ ແລະ ບໍ່ໃຫ້ເຮັດຫຍັງເລີຍ ມີແຕ່ຖາມວ່າຈະລຶບຫຼືບໍ່
ບໍ່ຮູ້ວ່າທ່ານພໍມີປະສົບການກັບໄວຣັດໂຕນີ້ເດ່ບໍ່ເນ໋າະ ວ່າຈະສາມາດແກ້ໄຂໄດ້ແນວໃດ

ຂໍຂອບໃຈທ່ານລ່ວງໜ້າ

Re:

Wed, 19 Aug 2009 11:53:00 -0400

ສະບາຍດີທ່ານ
ຂໍຖາມແດ່ ຄືວ່າ ຕາມປົກະຕິເຮົາດັບໂບຄີກໃສ່ file ເອກະສານ word ມັນຈະເຫັນໜ້າເອກະສານເລີຍ ແຕ່ໃນທີ່ນີ້ມັນບໍ່ເຫັນ ມັນຈະຂື້ນມາແຕ່ໂປແກມ word ບໍ່ເຫັນໜ້າ window word ເຮົາຕ້ອງໄດ້ໄປເປີດຢູ່ file > open ຈີ່ງເຫັນ ບໍ່ຮູ້ວ່າມັນເປັນນຳຫຍັງ ຊ່ວຍບອກແດ່ເດີທ່ານ.

ຂໍຂອບໃຈ
ຢາກສົ່ງຮູບໃຫ້ເບີ່ງ ບໍ່ຮູ້ເຮັດ

Re:

Fri, 21 Aug 2009 05:00:54 -0400

How can I delet folder " Recycler and Systemvolume infomation

Re:

Mon, 24 Aug 2009 11:20:04 -0400

Dear Sir,

I woulk like to use Lao Language for typing e mail or type Lao in website
How can I do ? Now I use office 2007 and setup Lao script 7.03 which download from Laoav here, but I don't know how to use Lao language
please advise me

Thank you very much

Re:

Mon, 24 Aug 2009 18:17:11 -0400

ຂໍລົບກວນທ່ານຜູ້ຮູ້ທັງຫຼາຍ ຂ້າພະເຈົ້າມີບັນຫາກ່ຽວກັບDriverສຽງ ບັນຫາກໍ່ມີຢູ່ວ່າ ຂ້າພະເຈົ້າ ໄດ້ຟໍແມັດເຄື່ອງແລ້ວລົງ ວິນໂດໃໝ່(Xp Sp3) ເມື່ອເວລາລົງໄດຣເວີ້ໂຕອື່ນໆແມ່ນສາມາດລົງໄດ້ ໝົດ ຍັງເຫຼືອແຕ່ໄດຣເວີ້ສຽງຢ່າງດຽວທີ່ລົງບໍ່ໄດ້ ມັນເຕືອນວ່າ The Installing Driver is Failure!ທັງໆທີ່ໃຊ້ໄດຣເວີ້ຕົວເກົ່າທີ່ເຄີຍໃຊ້ຜ່ານມາ ມັນເຮັດໃຫ້ຂ້າພະເຈົ້າງົງໆບໍ່ຮູ້ວ່າເປັນຍ້ອນ ຫຍັງ ຈິ່ງມາຂໍຄຳແນະນຳຈາກບັນດາທ່ານທີ່ມີໄອເດຍດີໆ.

Re:

Fri, 04 Sep 2009 04:40:34 -0400

ຄອມຂ້າພະເຈົ້າບໍ່ສາມາດກ໋ອບໂຟເດີໄດ້ ມັນບອກວ່າຊື່ຍາວເກິນໄປແຕ່ກ່ອນກະຍັງເຮັດໄດ້ ຜູ້ຮູ້ຊ່ວຍອະທິບາຍວິທີແກ້ໄຂໃຫ້ຂ້າພະເຈົ້າດ້ວຍ
ຂອບໃຈລວງໜ້າສຳລັບການຊ່ວຍເຫຼືອ

Re:

Mon, 07 Sep 2009 11:10:19 -0400

+File System Modifications
c:\a1agmur.cmd
c:\autorun.inf
%System%\nmdfgds0.dll
%System%\nmdfgds2.dll
%System%\olhrwef.exe
+Memory Modifications
olhrwef.exe
iexplore.exe
+Registry Modifications

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

cdoosoft = "%System%\olhrwef.exe"

so that olhrwef.exe runs every time Windows starts

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Advanced\Folder\Hidden\SHOWALL]

CheckedValue =

Re:

Sun, 13 Sep 2009 09:36:02 -0400

ອາການ:
ຈະເຮັດໃຫ້ເຂົ້າ Window ບໍ່ໄດ້ ຫຼື ບໍ່ກໍ່ ເປັນໜ້າຕ່າງ Windows ແລະຖາມຫາ Pass ແຕ່ເມື່ອ key ໃສ່ແລ້ວກັບເຂົ້າບໍ່ໄດ້ຄືເກົ່າ
ສາເຫດ: ເພາະ file ໃນ Windows ເສຍເຊັ່ນ:
Userinit.exe,Comres.dll,advapi32.dll,Run32.dll,kernel32.dll,. . . . . file ຈຳພວກດັ່ງກ່າວເມື່ອໄວຣັດເຂົ້າໄປຈະໄປລົບfile ດັ່ງກ່າວຖີ້ມ
ເຮັດໃຫ້ເຂົ້າ Windows ບໍ່ໄດຄືດັ່ງກ່າວ

ວິທີແກ້ ຄື: ໃຊ້ Hiren boot ຫຼື Super boot ຫຼື Windows PE ເຂົ້າໄປໃນ C:/windows/System32 ແລ້ວCopy File ທີ່ເສຍດັ່ງກ່າວ ໄປແທນທີ່ ແລ້ວກໍ່ສາມາດ ເປີດເຂົ້າໄປໃນ Windows ໄດ້ແລ້ວ ບໍ່ຈ້ອງໄປລົງ Windows ໃໝ່ໃຫ້ເສຍເວລາ

ຫັຼງຂາກເຂົ້າໄປໃນ Windows ໄດ້ແລ້ວຢ່າລືມ Update Laoantivirus (ກໍລະນີ ຄົນທີ່ໄຊ້ Laos Antivirus)

Re:

Fri, 25 Sep 2009 10:23:28 -0400

+File System Modifications

c:\autorun.inf

%AppData%\control.exe
%AppData%\Microsoft\CD Burning\Mp3.exe
c:\Temp.pif
%Windir%\Loikaw.exe
%System%\extramain.exe
%System%\Iexplorer.exe
[file]
%Windir%\%UserName%.exe
%DesktopDir%\Virus Information.txt
%AppData%\Microsoft\CD Burning\autorun.inf
+Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\soesoe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\soesoe\DefaultIcon
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\s ystem

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8- 08002B30309D}\DefaultIcon]

(Default) = "%System%\winlogon.exe,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\soesoe\DefaultIcon]

(Default) = "%System%\mshearts.exe,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

load = "%Windir%\Loikaw.exe"
ï¿½*ï¿½ = "%AppData%\control.exe"

so that Loikaw.exe runs every time Windows starts
so that control.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]

NoFind = 0x00000001
NoFolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ system]

DisableTaskMgr = 0x00000001
DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)
to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

The following Registry Value was deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8- 08002B30309D}\DefaultIcon]

(Default) = "%SystemRoot%\Explorer.exe,0"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat]

(Default) =

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd]

(Default) =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit =

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]

NoDriveTypeAutoRun =

Re:

Thu, 01 Oct 2009 07:26:52 -0400

ສະບາຍດີທ່ານ ຂ້າພະເຈົ້າມີບັນຫາມາລົບກວນທ່ານອີກແລ້ວ ບັນຫາກໍ່ຄືວ່າ folder option ຂອງ My computer ຫາຍໄປ ແລະ ບໍ່ສາມາດເຂົ້າໄປແກ້ໄຂ show ແລະ Do not show ລະບົບຕ່າງໆຂອງວິນໂດໄດ້ ຂໍຂອບໃຈກັບຄຳຕອບຂອງທ່ານຫລາຍໆ ຈາກຂາປະຈຳ forums

Re:

Tue, 06 Oct 2009 12:43:25 -0400

ຢາກຮູ້ວິທີຕັ້ງ php comment script ໃນ 00webhost.com ຕ້ອງເຮັດແນວໃດ ຂອບໃຈ

Re:

Wed, 07 Oct 2009 08:11:51 -0400

ຂໍລົບກວນທຸກໆທ່ານ ຊ່ວຍບອກແດ່ວ່າ NAO Virus ແມ່ນ Virus ແບບໃດ? ມີໜ້າທີ່ຮັດຫຍັງ?

Re:

Fri, 30 Oct 2009 07:26:53 -0400

Deare lao antivirus team
could you recomment the removetool of kllsxz.exe

best regard

Re:

Thu, 19 Nov 2009 12:17:05 -0500

ເຖີງທ່ານຜູ້ຮູ້: ຄືວ່າ ຄອມ ຂອງ ຂພຈ ບໍ່ສາມາດອອກສູ່ອີນເຕີເນັດໄດ້ເລີຍ ແບບວ່າ ຖ້າເອົາສາຍແລນມາສຽບໃສ່ຍາມໃດແລ້ວແມ່ນວ່າຄອມທຸກໆໜ່ວຍ (ທີ່ຢູ່ LAN ດຽວກັນ) ຈະບໍ່ສາມາດເຂົ້າ internet ໄດ້ທັງໝົດເລີຍ -ຈາກນັ້ນ router ຈະ hang - ຂພຈ ຖອດສາຍແລນໂຕບັນຫາອອກ ແລ້ວ ລີສະຕາດrouterໃໝ່ ຈື່ງຈະໃຊ້ໄດ້ປົກກະຕິ. ບໍ່ຮູ້ວ່າເປັນນຳຫຍັງ ແລ້ວບັນດາທ່ານເດ ວ່າຈັ່ງໃດ...

Re:

Tue, 24 Nov 2009 13:54:05 -0500

จะว่าบังเอิญก็น่าจะใช่นะ สำหรับการเข้าในเว็บไซต์ของท่าน

พอดีผมมีปัญหาเกี่ยวกับไวรัส ตัวหนึ่ง ปกติแล้วผมก็ใช้โปรแกรม

kaspersky anti virus อยู่แล้ว แต่พอติดไวรัสตัวหนึ่งเข้า

โปรแกรมก็ไม่สามารถลบได้เลย ไม่รู้เป็นอย่างไร?เหมือนกัน

ไวรัสตัวที่ว่า นี้คือ adware not virus win32

ก็รู้สึกดีใจ ที่สามารถแก้ไขได้แล้ว...ขอบคุณมากครับ สำหรับความรู้

และเครื่องมือกำจัดไวรัส ตลอดถึงตัวแก้ไข ค่า registry ต่างๆ

และ ทำให้คอมพิวเตอร์สามารถใช้งานได้ตามปกติ

ปล. ขอโทษด้วยนะครับ ที่ไม่สามารถพิมพ์เป็นอักษรของท่านได้
(ภาษาลาว)
จะให้เขียนเป็นภาษาอังกฤษผมก็ไม่เก่งอีกล่ะ...

ขอบใจหลายๆๆ

Re:

Sat, 05 Dec 2009 01:49:40 -0500

ຊ່ວຍກວດເບິ່ງຟາຍນີ້ໃຫ້ແດ່ວ່າຊີ້ໃຊ້Tool ໂຕໃດຂ້າ
http://laoupload.com/I1OOPORURLVQ/LavSnapShot-NZN- E69ED451E74.txt.html

ທ່ານ ອາເລັກໄຊຣ ຂ້າພະເຈົ້າຢາກໃຫ້ທ່ານຊ່ວຍສ້າງTool ມາຂ້າໄວສ໌ຣັດປະເພດ (.bat, .cmd) ເພາະມັນເຮັດເສັ້ນຂ້າພະເຈົ້າຕະຫລອດ ແລະຖ້າຕິດໄວສ໌ຣັດພວກ ນີ້ເມື່ອໃຊ້Kaspersky Scan ມັນປ່ຽນຊື່ຟາຍເອງຕະລອດເລີຍ...ຂ້າພະເຈົ້າລອງ ໃຊ້ແຕ່ລະTool ກາຍັງບໍ່ຕາຍ

[blink]www.ep-computer.110mb.com[/blink]

Re:

Sat, 12 Dec 2009 07:59:33 -0500

ຊີ້ໃຊ້Tool ໂຕໃດລົບ

http://laoupload.com/543VY1W2148H/LavSnapShot-NZN-962C47E1E65- 20091212.7z.html

Re:

Thu, 24 Dec 2009 04:37:27 -0500

ລະວັງ AntiVirus-AntiSpyware ຂອງປອມລູ່ມນີ້ ຫ້າມ Download ແລະ
ຕີດຕັ້ງເດັດຂາດ
1. System Adware Scanner 2010

2.TheDefend

3. SysDefence

4. GuardPcs

5. Internet Security 2010

6. Personal Guard 2009

7. Safety Anti-Spyware

8. Personal Security

9. Antivirus Pro

10. Control Center

11. Eco Antivirus

12. Alpha Antivirus

Re:

Tue, 29 Dec 2009 05:21:59 -0500

ຊ່ວຍບອກໂປແກມຂ້າໄວລັດໂຕນີ້ໃຫ້ແດ່ TR patched. Gen

ຂອບໃຈລ່ວງໜ້າ

Re:

Tue, 05 Jan 2010 07:13:59 -0500

ວິດໂດວິສະຕ້າ ບໍ່ສາມມາເປີດ ຢູດເຊີເອັດມິນ ໄດ້ ເປັນຍ້ອນຫັຍງ ຂ້ອຍໃຊ້ຄຳສັ່ງ secpol.msc ຢູ່ Run ຊ່ວຍບອກວິທີແກ້ໄຂໃຫ້ແດ່

Re:

Mon, 18 Jan 2010 06:03:19 -0500

+File System Modifications
%Temp%\E_N4\cnvpe.fne
%System%\13E92A\cnvpe.fne
%Temp%\E_N4\dp1.fne
%System%\13E92A\dp1.fne
%Temp%\E_N4\eAPI.fne
%System%\13E92A\eAPI.fne
%Temp%\E_N4\HtmlView.fne
%System%\13E92A\HtmlView.fne
%Temp%\E_N4\internet.fne
%System%\13E92A\internet.fne
%Temp%\E_N4\krnln.fnr
%System%\13E92A\krnln.fnr
%Temp%\E_N4\shell.fne
%System%\13E92A\shell.fne
%Temp%\E_N4\spec.fne
%System%\13E92A\spec.fne
%Programs%\Startup\AA2E5E.lnk
%System%\13E92A\RegEx.fnr
%System%\1CB5AD\AA2E5E.EXE

The following directories were created:

%Temp%\E_N4
%System%\038840
%System%\13E92A
%System%\1CB5AD
%System%\52682A

Download Remover in this site [Kill Recycle.exe]

Re:

Wed, 20 Jan 2010 11:36:06 -0500

- ລະບົບທີ່ມີການປ່ຽນແປງ
%USERPROFILE%\local settings\temp\3ymh6jjy.exe

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tdlserv\

imagepath = \??\c:\windows\temp\16.tmp
type = 1

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\

pendingfilerenameoperations = \??\c:\docume~1\admini~1\locals~1\temp
\17.tmp

Re:

Wed, 20 Jan 2010 11:39:41 -0500

-ລະບົບທີ່ມີການປ່ຽນແປງຈາກ Trojan-Downloader.Win32.Geral

%USERPROFILE%\Local Settings\Temp\mst47.tmp
%Program Files%\Common Files\PushWare\cpush.dll [detected as AdClicker-BJ]
%Program Files%\Common Files\PushWare\Uninst.exe
%Windir%\Fonts\iexplo.exe [detected as Downloader-CCG]
%Windir%\Fonts\lcn.ini
%Windir%\system32\drivers\npf.sys
%Windir%\system32\360traj.exe [detected as Generic Dropper.ex]
%Windir%\system32\Packet.dll
%Windir%\system32\WanPacket.dll
%Windir%\system32\wpcap.dll
%Windir%\Tasks\pPuSpm4tUTwyj3JpjJV.ico
%Windir%\Tasks\Wfayv6njQnCsg.inf [detected as PWS-OnlineGames.ek]
%Windir%\MICROSOFT\winsys.dll
%USERPROFILE%\Local Settings\Temp\abb3.tmp [detected as potentially unwanted program Adware-Cinmus!j]
%USERPROFILE%\Local Settings\Temp\abb9.tmp [detected as AdClicker-BJ]
%USERPROFILE%\Local Settings\Temp\abbD.tmp [detected as New Malware.aq]
%USERPROFILE%\Local Settings\Temp\nnn1.tmp [detected as Downloader-CAM]
%USERPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\8WEL7ODI\3[1].exe
%USERPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\I65VJICG\ne[1].exe [detected as Downloader-CCG]
%USERPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\I65VJICG\ry[1].exe [detected as New Malware.aq]
%USERPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\IHMZKI89\2[1].exe
%USERPROFILE%\Local Settings\Temporary Internet Files\Content.IE5\JWHQEFD2\cc[1].exe [detected as Generic Dropper.eb]

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{012AA32F-36E6-405F-9F3F- 588E0AA73FBB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43- E09E9351CE16}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1C7-FB22-4D17-8834- 064E2BA0A6F0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11- 73552EE9631A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748- 13F5DDB5781C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04- 8660-FB1F36BC2DC0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewBopoMediumPop.PopBopo
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NexoAdPopup.DOLogc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{296AB1C7-FB22-4D17-8834-064E2BA0A6F0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IDSCNP
HKEY_LOCAL_MACHINE\SOFTWARE\cpush

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{012AA32F-36E6-405F-9F3F- 588E0AA73FBB}\InprocServer32\: "C:\WINDOWS\Tasks\Wfayv6njQnCsg.inf"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43- E09E9351CE16}\InprocServer32\: "C:\Program Files\Common Files\PushWare\cpush.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{296AB1C7-FB22-4D17-8834- 064E2BA0A6F0}\InprocServer32\: "C:\WINDOWS\MICROSOFT\winsys.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748- 13F5DDB5781C}\InprocServer32\: "C:\Program Files\Common Files\PushWare\cpush.dll"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npf\ImagePath: "\??\C:\WINDOWS\system32\drivers\npf.sys"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\qianm\ImagePath: "\??\C:\WINDOWS\fonts\qianm.sys"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf\ImagePath: "\??\C:\WINDOWS\system32\drivers\npf.sys"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qianm\ImagePath: "\??\C:\WINDOWS\fonts\qianm.sys"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRunKiller.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Frameworkservice.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GuardField.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASARP.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nod32kui.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.EXE\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.KXP\debugger: "ntsd -d"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.EXE\debugger: "ntsd -d"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Hidden\SHOWALL\CheckedValue: “0x00000002”

%Program Files%\Common Files\PushWare
%Windir%\MICROSOFT
%SystemDrive%\sa.exe

Re:

Wed, 20 Jan 2010 11:42:54 -0500

-ລະບົບມີການປ່ຽນແປງຈາກ Worm.Win32.Prolaco
%WinDir%\system32\wmimngr.exe

%WinDir%\system32\wpmgr.exe
%WinDir%\oracle.ocx (Hidden)

HKEY_USERS\S-1-5-21-1454471165-926492609-839522115- 500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\Profile5
HKEY_USERS\S-1-5-21-1454471165-926492609-839522115- 500\Software\Microsoft\WAB
HKEY_USERS\S-1-5-21-1454471165-926492609-839522115- 500\Software\Microsoft\WAB\Profile5

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{IY5PT2EV-C68O-F6ER-1U30-C8N4T42W4OAP}\]
"StubPath:" = "%WinDir%\system32\wpmgr.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Paramet ers\FirewallPolicy\StandardProfile\AuthorizedApplications\List\]
"%WinDir%\system32\wfmngr.exe:"="%WinDir%\system32\wfmngr.exe:*: Enabled:Explorer"

[HKEY_USERS\S-1-5-21-1454471165-926492609-839522115- 500\Software\Microsoft\Windows\CurrentVersion\Run\]
"Java micro kernel:" = "%WINDIR%system32\wpmgr.exe"
[HKEY_USERS\S-1-5-21-1454471165-926492609-839522115- 500\Software\Microsoft\Windows\CurrentVersion\Run\]"Windows Management:" = "C:\WINDOWS\system32\wmimngr.exe"
[HKEY_USERS\S-1-5-21-1454471165-926492609-839522115- 500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\]
"Java micro kernel:" = "%WINDIR%\system32\wpmgr.exe"

HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Security Center]
“UACDisableNotify” = “ 0x00000001”
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies \system]
"EnableLUA:" = "0x00000000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\System Restore\] "DisableSR:"="0x00000001"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc\]
"Start:"= "0x00000004"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\]
"Start:" = "0x00000004"

Re:

Tue, 26 Jan 2010 08:50:26 -0500

+ໄຟລຕິດໃນລະບົບ

%Windir%\567788.bat
%Windir%\ld11.exe

+ສ້າງຄ່າໃນ Registry

The following Registry Keys were deleted:

HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Default

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

sysldtray = "%Windir%\ld11.exe"

so that ld11.exe runs every time Windows starts

The following Registry Values were deleted:

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Default ]

(Default) = "%SystemRoot%\media\Windows XP Start.wav"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current ]

(Default) = "%SystemRoot%\media\Windows XP Start.wav"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating]

(Default) = ""

Re:

Thu, 26 Feb 2009 10:56:46 -0500

ຖາມ ທ່ານ admin ຈະດາວໂລດwindow live ໄດ້ຢຸ່ໃສ ຫຼືມີຂາຍບໍ
window live ສາມມາດເຮັດຫຍັງໃດແດ່ please

Re:

Tue, 03 Mar 2009 06:06:02 -0500

ສະບາຍດີ
ຂ້າພະເຈົ້າ ຢາກໄດ້ Access Point ທີ່ສາມາດ ສົ່ງສັນຍານໄດ້ໄກເຖິງ 10 - 15 km ມົນທົນ, ຖ້າທ່ານໃດຮູ້ ຫລື ມີຂາຍກະລຸນາບອກແດ່.
ທ່ານສາມາດໂທມາທີ່:0205613849
Thanks

Re:

Fri, 06 Mar 2009 02:18:28 -0500

- ຄອມໜູ່ຂ້າພະເຈົ້າເອົາມາໃຫ້ແປງ ສະເປຮ ມັນແມ່ນ Pentinum III,Ram
128 and harddisk 40 GB ແລະເວລາລົງໄປກຳລັງ Copy file ຫຍັງບໍ່
ທັນຮອດຂັ້ນຕອນ format ແລ້ວມັນມັກຂຶ້ນຈໍສີຟ້າຕະຫລອດ ແລະຂ້າພະເຈົ້າ
ບາງເທື່ອລ້ອງລົງວິນໂດຮ ລຸ້ນເກົ່າໆກະຫຍັງບໍ່ໄດ້.ຂ້ອຍຄິດວ່າຖ້າ Ramມີບັນ
ຕ້ອງລົງບໍ່ໄດ້ເລີຍ.

Re:

Wed, 11 Mar 2009 01:33:47 -0400

1. ເລື່ອງ Windows PE ເປັນຫຍັງເວລາເຮົາ Boot ເຂົ້າ notebook ສ່ວນຫລາຍບໍ່ເຫັນ Hard disk ຖ້າເປັນຕອມຕັ້ງໂຕ້ະແມ່ນເຫັນບໍ່ຮູ້ວ່າທ່ານພໍຈະມີ
file ໃດມາເສີມບໍມັນຈຶ່ງຈະເຫັນ.

Re:

Thu, 12 Mar 2009 02:02:07 -0400

ຄຶວ່າ:ຂ້າພະເຈົ້າໃຊ້ LaoScript v7.03 ແລະຂ້ອຍມີ Crackຢູ່ເທິງຮູບ
ມັນມີຂໍ້ຄວາມແບບນິ້: Site Licence #41609
                             Registered to:
                      Option: 26 (Licence sever)
                                uild 7.0.3.2
ແລະຂ້າເຈົ້າລອງປ່ຽນຮູບກະຫຍັງຄຶເກົ່າແຕ່ໃຊ້ປົກກະຕິ,ຂ້ອຍຢາກລົບ
ຂໍ້ຄວາມອອກ.ບໍ່ຮູບວ່າທ່ານພໍຈະມີວິທີລົບອອກໄດ້ບໍ

Re:

Sat, 14 Mar 2009 04:19:11 -0400

ເປັນເປັນເຄື່ອງມືຫລືໂປຣແກຣມຊວ່ຍຕ່າງໆທີ່ແກ້ໄຂບັນຫາຄອມທີ່ຕິດໄວຣັສແລ້ວ

ດາວໂລດ

Re:

Sat, 14 Mar 2009 12:47:17 -0400

ຄຶວ່າ:ມືຖືຂອງຂ້າພະເຈົ້າຕິດໄວຮັດສ໌ເມື່ອເວລາຄົນອືນສົ່ງຂໍ້ຄວາມເຂົ້າມາ ແລະຫຼັງ
ນັ້ນມັນຈະສົ່ງອອກ Autoເອງ ຫາໜາຍເລກທີ່ສົ່ງເຂົ້າມາ ແລະບໍ່ຮູ້ວ່າຈະແກ້ແນວ
ໃດ.

Re:

Sun, 15 Mar 2009 09:43:24 -0400

ຄຶວ່າ:ບັນຫາແມ່ນເມື່ອເຮົາເປີດຂຶ້ນມາແລ້ວມີໄຟແດງຢູ່ສອງປຸ້ມ ແລະຂ້າພະເຈົ້າເຄີຍ
ເຄຍPrinter Epson photo R230 ແມ່ນໃຊ້ໂປຮແກຮມ
SSC Service Utility v4.30 ແລະກໍສາມາດເຄຍໄດ້ແຕ່ຂ້າພະເຈົ້າມາເລືອກ
ລຸ່ນແລະເຄຍພັດບໍ່ໄດ້ມັນຂໍ້ຄວາມນິ້ຂຶ້ນມາ:
This function isn't supported in current printer state.
ໍພິນເຕີຂອງຂ້ອຍແມ່ນຕໍ່ ອິນແທງ ແລະມີເທື່ອໜື່ງພິນເຕີຫນູ່ຂອງຂ້ອຍແມ່ນລຸ້ນ
Epson Photo R230 ເມື່ອເວລາເຄຍ ມັນກະຟ້ອງຂໍ້ຄວາມແບບຢູ່ຂ້າງເທີງ.

Re:

Fri, 20 Mar 2009 05:37:07 -0400

ຖາມທ່ານ Admin ວ່າຕັງ window ແນວໃດ ຈ່ີງຈະມີສຽງ ໃນກໍລະນີ ບໍ່ມີ ແຜນ driver ຂອງ Mainboard ແລະບ່ໍໄດ້ ເຊື່ອມຕໍ່ອີນເຕີເນັດ

Re:

Fri, 20 Mar 2009 06:03:56 -0400

ໂຮງຣຽນຂ້າພະເຈົ້າທຸກບາກຫຼາຍ ມີຄອມ 10ກວ່າໜວ່ຍ ນັກຮຽນ ຫ້ອງໜ່ືງ 50-60 ຄົນມັນບໍ່ພໍໃຊ້ ໄດ້ຍີນຂ່າວວ່າ ຖ້າມີ ຄອມແລ້ວຊຸດນ໋ືງສາມາດ ຊື້ຈໍ ມາ
ເພື້ມອີກໜ່ວຍໜ່ືງແລວ້ສາມາດໃຊ້ໄດ້ ໝາຍຄວາມວ່າ caseໜ່ວຍດຽວສາມາດ ໄຊ້ ໄດ້ສອງເຄືອງ ໂດຍອິດສະຫຼະໃຜມັນ ຢາກຖາມທ່ານວ່າ ມັນແມ່ນແທ້ບໍ ຢາກປືກສາ
ມີແມ່ນແທ້ກະລຸນາ ບອກວີທິແດ່ ແລະມີອຸປະກອນເສີມແນວໃດ ຂໍໃຈລ່ວງໜ້າ

Re:

Tue, 31 Mar 2009 13:34:03 -0400

Notebook Toshiba M300 ຂ້າພະເຈົ້າໄດ້ລົງວິນໂດຮ໌ Vista ແລະ
mouse ເມື່ອເວລາຄິກໂປຮແກຮມ ຫຼຶຟາຍຕ່າງ.ມັນໄດ້ກົດແຕ່ປຸ້ມກົດ
ບ່ອນດຽວ ແລະບ່ອນແປ້ນຂອງ mouse ມີແຕ່ຍ້າຍໄດ້ ພັດຄີກບໍ່ໄດ້
ບໍ່ຮູ້ວ່າ:ຈະປົດລັອກຢູ່ໃສ່

Re:

Mon, 06 Apr 2009 13:22:46 -0400

ເຖິງ ທ່ານ admin.
ເປັນຫຍັງຄອມຄືບໍ່ມີLocal users & Groups ( ເວລາເຂົ້າ computer Management)
ບໍ່ຮູ້ວ່າທ່ານພໍມີຄຳແນະນຳແນວໃດບໍ່ເນ໋າະທ່ານ, ອັນນີ້ແມ່ນມັນຖືກໄວຣັດເຊື່ອງບໍ່ເນ໋າະ ຫຼື ວ່າເປັນຍ້ອນຄອມ ເພາະຄອມໂຕນີ້ແມ່ນຍີ່ຫຍໍ້ Lenovo ນະທ່ານ.

ຂໍຂອບໃຈ

Re:

Tue, 07 Apr 2009 11:11:49 -0400

ສະບາຍດີ ຂ້ອຍຢາກໄດ້ໂປຣແກມ Ativirus ມືຖືໃຜມີແດ່ມ ລຸ້ນ Nokia N95...

Re:

Tue, 07 Apr 2009 11:52:54 -0400

ສະບາຍດີ
ຂ້ອຍມີບັນຫາກ່ຽວກັບ openoffice
ຄືວ່າຂ້ອຍຕິດຕັ້ງ openoffice ໃສ່ windowsXP ແລະມັນກໍ່ເຮັດວຽກໄດ້ດີສາທາດ save ໃສ່ local computer ໄດ້ ແຕ່ເມື່ອຂ້ອຍຕ້ອງການຈະ save ໃສ່ windows server2003 ທີ່ເຮັດໜ້າທີ່ເປັນ domain server ແລະ com ຂ້ອຍກໍ່ເປັນ client ຂອງມັນ ແລະ ບໍ່ສາມາດ save ໄດ້ມັນຟ້ອງວ່າ the object cannot be accessed due to insufficient user rights
ຖ້າຜູ້ໃດຮູ້ຊ່ວຍບອກແດ່
ຂອບໃຈ

Re:

Sat, 18 Apr 2009 19:47:03 -0400

ສະບາຍດີທ່ານ ອາເລັກໄຊ
ຂ້າພະເຈົ້າມີເລື້ອງຈະຂໍລົບກວນທ່ານຊ່ວຍສ້າງໂຕ repair savemode ສຳລັບ windows server 2003 ໃຫ້ຂ້າພະເຈົ້າເດ່ໄດ້ບໍ່ເນ໋າະ ແຕ່ວ່າຂ້າພະເຈົ້າບໍ່ແນ່ໃຈວ່າໂຕ repair savemode ທີ່ທ່ານມີໃຫ້ໂລດນັ້ນສາມາດໃຊ້ໄດ້ກັບ windows server 2003 ໄດ້ຫຼືບໍ່ເນ໋າະ (ໄດ້ຫຼືບໍ່ໄດ້ ກະລຸນາທ່ານຊ່ວຍຕອບເດ່ເນ໋າະ) ເພາະຄອມມັນບໍ່ສາມາດເຂົ້າsavemode ໄດ້ ພໍຈະໃຊ້ savemode ເທື່ອໃດ ມັນກໍ່ລີສະຕາດໂລດແລະຈາກນັ້ນກໍບໍ່ສາມາດເຂົ້າໜ້າຕ່າງຂອງ ວິນໂດ ໂດ້ ຈະເຂົ້າໄດ້ກໍ່ຕໍ່ເມື່ອລີແພ້ວິນໂດ ແຕ່ຫຼັງຈາກລີແພ້ໄດ້ແລ້ວ ກະຍັງບໍ່ສາມາດເຂົ້າ savemodeໄດ້ຄືເກົ່າແລະກໍ່ກັບມາເປັນຄືເກົ່າຄືບໍ່ສາມາດເຂົ້າໜ້າຕ່າງວິນໂດໄດ້ . ຖ້າລີແພ້ວະນໂດໄດ້ແລ້ວມື້ຕໍ່ມາກໍກັບມາເປັນຄືເກົ່າແບບວ່າຕ້ອງໄດ້ລີແພ້ທຸກມື້ ເລີຍນະທ່ານ ຮືໆໆໆໆໆ
ຂໍຄວາມກະລຸນ່ທ່ານໃຫ້ຊ່ວຍເດ່ເດີ້ທ່ານ
ຂໍຂອບໃຈລ່ວງໜ້າ

Re:

Wed, 22 Apr 2009 07:02:06 -0400

ເຖິງທ່ານ admin
ຂ້າພະເຈົ້າລົບກວນຂໍໂຕ tool ສຳລັບ safemode windows sever 2003 ແດ່ໄດ້ບໍ່ເນ໋າະທ່ານ
ຂອບໃຈຫຼາຍໆໆໆໆໆ

Re:

Tue, 21 Apr 2009 13:57:58 -0400

ສະບາຍດີທ່ານ, ຂໍຄວາມຊ່ວຍເຫຼືອແດ່ ເລື່ອງມັນມີຢູ່ວ່າ printer ຂ້າພະເຈົ້າບໍ່ຮູ້ເປັນຫຍັງເວລາ print ເອກະສານທີ່ໃຊ້ font Saysettha lao ລະຕົວອັກສອນມັນອອກມາເປັນລວງນອນໝົດເລີຍ ແຕ່ຖ້່າເປັນ Saysettha OT ຫຼື font ອື່ນໆລະປົກກະຕິດີ
ຊ່ວຍແນະນຳແດ່ທ່ານ

Re:

Mon, 04 May 2009 15:19:35 -0400

ຄອມພິວເຕີຂອງຂ້າພະເຈົ້າຕິດ Virus ເມື່ອຂ້າພະເຈົ້າສະແກນໄວລັກແລ້ວໂຟເດີຕ່າງໆກໍ່ຫາຍໄປໝົດ ແລະ ກໍ່ໄດ້ໄປຕັ້ງຄ່າຕາມນີ້

ແຕ່ມັນບໍ່ອານຸຍາດໃຫ້ເຮົາຕິກທີ່ເຄື່ອງໝາຍຖຶກທີ່ໜ້າ Hidden ອອກ
ຂໍລົບກວນທ່ານໃດເຄີຍພົບບັນຫານີ້ຂໍແນະນຳໃຫ້ແດ
ຂອບໃຈລ່ວງໜ້າ

Re:

Mon, 18 May 2009 12:22:12 -0400

ປົກກະຕິ ຍາມເຮົາໃສ່ shared key ຂອງ AP ຢູ່ໃນເຄື່ອງ Mac ມັນສາມາດໂຊເບິ່ງ password ຂອງ AP ໄດ້
ເຮັດແນວໃດຢາກບັງ password ຂອງ AP ຢູ່ເຄື່ອງ Mac ເໝືອນກັບ windows?
help
Thanks

Re:

Thu, 21 May 2009 06:15:38 -0400

ສະບາຍດີ
ຢາກຈະຂໍຖາມວ່າ WinXP Home Edition ສາມາດ Joint Domain Server 2003 ໄດ້ບໍ່?
ຖ້າໄດ້ແມ່ນເຮັດແນວໃດຊ່ວຍບອກແດ່?
ຂອບໃຈ

Re:

Thu, 28 May 2009 16:21:00 -0400

ຊ່ວຍແດ່ ເລື່ອງການນຳເອົາ Hiren’s Boot CD v 9.2 ລົງໄປໃນ USB ແລະໃຫ້ສາ
ມາດນຳໃຊ້ USB ນັ້ນແທນແຜ່ນ Hiren’s Boot cd ໄດ້

Re:

Mon, 15 Jun 2009 13:30:30 -0400

http://laoupload.com/W89TVI6ITAI7/Calculator.rar.html

Re:

Sat, 04 Jul 2009 09:01:06 -0400

ອາການຂັ້ນທຳເມື່ອFlash ແລ້ວໃຊ້ປະມານ2 ວັນ ແລ້ວມື້ທີ່3 ເລີຍທີບັນຫາເລີຍ ແລະຂ້າພະເຈົ້າລອງລົງWindows ເຮັດຫຍັງບໍ່ໄດ້ເລີຍ
ບໍ່ຮູ້ວ່າພໍຈະມີວິທີແກ້ບໍ່?
Link Video :
http://laoupload.com/XBZA6R5JR18G/000_6402.3gp.html

Re:

Sat, 11 Jul 2009 05:07:35 -0400

ເພາະວ່າຂ້າພະເຈົ້າໄດ້ສ້າງເວັບແລ້ວຢາກ register ຫຼຶທ່ານບອກວິທີສະໝັກທີ່ ເວັບ www.co.cc ໃຫ້ແດ່ເອົາແບບລະອຽດເດີພ້ອມວິທີອັບໂລດເດີ
ເອົາແບບຟີຮເດີ.

ຂອບໃຈລວງໜ້າ.....

Re:

Sun, 09 Aug 2009 05:12:24 -0400

- ຄຶວ່າຂ້າເຈົ້າມີ Notebook Compaq Presario CQ40 ແລະມີບັນເມື່ອເວ ລາລົງວິນໂດຣພໍເມື່ອບູດໄປແລະມີຂໍ້ຄວາມຟ້ອງPress any Key to boot from CD ແລ້ວມັນກໍຄ້າງເລີຍ ແລະຂ້າພະເຈົ້າລອງທຳລົງວິນໂດຣ XP pack 2 ເວີສັນໃຫມ່ໆກໍບໍ່ຜ່ານຈັກເທື່ອເພາະຕອນຊື້ມາທຳອິດເຂົາເຈົ້າລົງXP ມາໃຫ້ ແລະຂ້ອຍໄດ້ລອງລົງVista ແມ່ນໄດ້ບໍ່ຮູ້ວ່າຊີ້ລົງ XP ລຸ້ນໃດຈຶ່ງຈະໄດ້ ຊ່ວຍບອກ ແດ່...
- ຢາກຮູ້ວິທີສ້າງຟາຍ Boot Logon Screen ຊ່ວຍບອກແດ່ວ່າເຂົາເຈົ້າໃຊ້ໂປຣແກຣມໃດສ້າງຖ້າມີຊ່ວຍເອົາມາໃຫ້ໂຫຼດແດ່

ຂອບໃຈລ່ວງໜ້າຫລາຍໆເດີທ່ານ

Re:

Thu, 03 Sep 2009 09:57:46 -0400

ສະບາຍດີ
ຂ້າພະເຈົ້າມີບັນຫາເລື່ອງການພິມພາສາລາວອອກຢູ່ເຄື່ອງພິມ HP Laserjet P1005 and P1006 ມັນບໍ່ສາມາດພິມ font saysettha lao ໄດ້ມັນພິມອອກເປັນຕົວໜັງສືລາວທັບກັນສະຫລຸບແລ້ວແມ່ນອ່ານບໍ່ອອກ.
laoscript ທີ່ໃຊ້ກໍ່ເປັນ version 7.03.
ຖ້າໃຊ້ version 5.30 ບໍ່ມີບັນຫາ.
ໃຜຮູ້ວິທີແກ້ໄຂບັນນີ້ກະລຸນາບອກໃຫ້ຮູ້ແດ່ ຂອບໃຈ

Re:

Fri, 25 Sep 2009 07:45:35 -0400

ສະບາຍດີທ່ານຜູ້ຮູ້ ຂ້າພະເຈົ້າມີເລື່ອງຢາກຖາມທ່ານແດ່, ຄືວ່າຂ້າພະເຈົ້າຢາກລົງ ວິນໂດວໃຫມ່ແຕ່ບໍ່ມີ CD ROM ຈະຕັ້ງໄດ້ຈາກ USB HANDY DRIVE ຈະໄດ້ບໍ່ ແລະ ເຮັດແນວໃດ ຂໍຂອບໃຈຫຼາຍໆ

Re:

Tue, 29 Sep 2009 06:27:03 -0400

ສະບາຍດີທ່ານ ຂ້າພະເຈົ້າຢາກຮູ້ວ່າເຮົາສາມາດອັບເກຣດກາດຈໍຂອງແລັບທອ໋ບ ACER ASPIRE 4520 ຈາກ 512 ເປັນ 1gb ໄດ້ບໍ່ ແລະ ຈະໃຊ້ຫລິ້ນເກມໄດ້ດີບໍ່ ເພາະຕອນນີ້ມີ 512 ມັນຊ້າຫຼາຍ ຂອບໃຈ

Re:

Fri, 02 Oct 2009 02:41:20 -0400

ບອກວິທີແກ້ທີ່ regedit ຫຼຶບ່ອນອື່ນໆ ໃຫ້ຄອມ shutdown ໄວໆແດ່ທ່ານ

Re:

Fri, 02 Oct 2009 05:50:00 -0400

+Windows Vista Default Boot Screen

+Aurora Boot Screen

Here is how you can enable the Aurora Boot Screen in Windows Vista:

click on the start orb and type in “MSCONFIG” in the searchbox and press Enter
once the System Configuration tool loads, click on the Boot tab
under Boot Options check “No GUI boot”
click apply and then OK and restart your computer to see the new boot screen.

Credit:www.johntp.com

Re:

Sun, 04 Oct 2009 18:06:22 -0400

- PE Explorer v1.99 R5

- Resource Tuner v1.99 R2 Or v.199 R3

ຂ້າພະເຈົ້າເໝື່ອຍຊອກລະຈັງໃດກະບໍ່ໄດ້ ຊ່ວຍແດ່....

Re:

Thu, 15 Oct 2009 06:55:03 -0400

ai alex tha file " NTDLR" and "NTDETECT.com"
tha mun sia ja kae neo dai doi thi bor tong long windown mai

Re:

Fri, 16 Oct 2009 06:47:00 -0400

ຢາກພິມຊື່ Folder ເປັນພາສາລາວຕ້ອງເຮັດແນວໃດ?ຊ່ວຍກະລຸນາບອກແດ່?

Re:

Thu, 22 Oct 2009 09:32:58 -0400

ສະບາຍດີທ່ານ ອາເລັກໄຊ ແລະ ທ່ານຜູ້ຮູ້ທັງຫຼາຍ.
ຂ້າພະເຈົ້າຂໍຖາມທ່ານ ແດ່ໄດ້ບໍ່ວ່າ: ເວລາຂ້າພະເຈົ້າສັ່ງພີມເອກະສານໃດນື່ງອອກມາແລ້ວປະກົດວ່າໂຕໜັງສືເປັນລະບຽບເຊັ ່ນວ່າ: "ສາທາລະນະລັດ ປະຊາທິປະໄຕ ປະຊາຊົນລາວ" ແຕ່ເວລາພີມພັດເປັນແບບນີ້ "າສາທະລະນດັລ ະປາຊິທະປ”ຕໄ ະປາຊນົນຊວາລ" ມັນບໍ່ເປັນລະບຽບ ອ່ານກະບໍ່ອອກ ຂ້າພະເຈົ້າໄດ້ລຶບ ແລະ ລົງ printer ໃໝ່ແລ້ວແຕ່ກໍ່ຍັງເປັນຄືເກົ່າຢູ່ ຂ້າພະເຈົ້າບໍ່ຮູ້ວ່າຈະແກ້ດ້ວຍວິທີໃດ. ຂໍຄວາມກະລຸນາຈາກທ່ານຊ່ວຍບອກວິທີແກ້ໃຫ້ ຂ້າພະເຈົ້າແດ່. ຂໍຂອບໃຈ.

Re:

Wed, 28 Oct 2009 10:54:23 -0400

ທ່ານ adminຊ່ວຍບອກແດ່ມີໂປຼມແກມຫັວງຫຼຶເທັກນິດແນວໄດ? ທີບ່ໍໃຫ້ຜູ້ອື່ນລົງໂປແກຼມໃສ່ຄອມເຣົາໄດ້
ແລະບ່ໍອະນຸຍາດໃຫ້ເຂົາໃສ່ USb

Re:

Tue, 10 Nov 2009 02:02:32 -0500

ຂ້າພະເຈົ້າຢາກ Ghost Windows 7 ຊ່ວຍບອກວິທີແດ່+Restore
ໃຊ້ໂປຣແກຣມໃດ? www.ep-computer.110mb.com

Re:

Sun, 15 Nov 2009 10:40:16 -0500

ດຽວນີ້ຂ້າພະເຈົ້າມີdomain man ທີ່ເປັນ.110mb ແລະຂ້າພະເຈົ້າ ຕ້ອງການໃຫ້ເປັນ.Co.cc ສະແດງວ່າເຂົ້າໂຕ.co.cc ແລ້ວແລ່ນມາໂຕທີ່ .110mbເລີຍຊ່ວຍບອກເອົາວິທີທີ່ລະອຽດເດີທ່ານ...

Re:

Wed, 25 Nov 2009 17:30:09 -0500

ຂໍລົບກວນເດ່ທ່ານວ່າ ຄອມຂອງຂ້າພະເຈົ້າໄດ້ອັບເກດຈາກ IE5 ມາເປັນ8 ແລ້ວເວລາເຂົ້າໜ້າຕ່າງທີ່ມີພາສາລາວແລ້ວມັນບໍ່ອອກເປັນພາສາລາວ ມັນເປັນຕາກະໂລ້ໝົດເລີຍ ບໍ່ຮູ້ວ່າຕ້ອງໄດ້ໄປແກ້ຄ່າໃໝ່ແນວໃດເດ່ເນ໋າະ

Re:

Mon, 30 Nov 2009 14:20:28 -0500

ສະບາຍດີທ່ານອາເລັກ ຢາກຖາມວ່າ chip ຕົວໃໝ່ຂອງ
xero c110b ມີຂາຍບໍໃນບ້ານເຮົາ
ລາຄາເທ່ົາໃດ? ຫຼືຕ້ອງການreset ເທົ່າໃດ ກີບ?
ເພາະວ່າ ຂ້ອຍຊື້ແພງຫຼາຍ ຕົວໜ່ືງ700ບາດ
4ຕົວ 2100ບາດ
ຊວຍແນະນຳຮ້ານແດ່.please!
thank you beforehand.

Re:

Wed, 16 Dec 2009 04:33:42 -0500

ເວລາເປີດຄອມຂີ້ນມາ ມັນປະກົດ Genmuine Microsoft Software"You may be victim of soft...
ຈະແກ້ແນວໄດ
ມັນເປັນvirus ບໍ?

Re:

Sat, 19 Dec 2009 10:26:50 -0500

อยากรู้วิทืกานเรัด link ในเวับไชท่านช่วยบอกแด่
และ บอกวิทืเขืยนพาสาลาวในเวับแด่
ขอบใจ

Re:

Sat, 26 Dec 2009 12:32:52 -0500

http://www.monavista.com/webboard/showthread.php?t=23344

Re:

Tue, 29 Dec 2009 01:46:40 -0500

ຂ້າພະເຈົ້າຢາກຖາມກ່ຽວກັບ Windows Live Messenger
Example der:
ສົມໝຸດເມື່ອຂ້າພະເຈົ້າອອນໄລຍ, ມີເພື່ອນອອນໄລຍ ຢູ່5ຄົນ ແລະຂ້າພະເຈົ້າຕ້ອງການຢາກໃຫ້ເຮົາສາມາດ z ບາດດຽວແລ້ວໄປຫາໝົດ ທຸກຄົນເລີຍ ລັກສະນະທີ່ຂ້າພະເຈົ້າເວົ້ານີ້ແມ່ນເປັນແບບ Shoutbox ທີ່ມີຢູ່ຕາມເວັບໄຊສ໌ຕ່າງໆ.ຊ່ວຍບອກວິທີອດ່ທ່ານວ່າຊີ້ເຮັດຈັງໃດ...

Re:

Fri, 08 Jan 2010 12:14:51 -0500

ເບິ່ງໃບຫຼັກສູດການຮຽນ

ຂອບໃຈທີ່ເຂົ້າເບິ່ງ

Re:

Fri, 22 May 2009 06:16:12 -0400

ເຈົ້າສະບາຍດີ

ຂ້ອຍເອົາ ຮາດດິດມາເພີ່ມໃສ່ຄອມອີກນຶ່ງໜ່ວຍ ດ້ວຍດານຟໍເມັດໃໝ່ ແຕ່ເວລາເອົາເອກກະສານລົງແລະໃສ່ຊື່ໂຟດເດີ້ ກໍ່ເປັນສີຟ້າທັງໝົດ ຖາມວ່ານີ້ແມ່ນ ໄວຣັດ ຫຼືບໍ່

Re:

Mon, 25 May 2009 06:00:26 -0400

ສະບາຍດີ ທຸກໆ ທ່ານ

ໃຜຮູ້ ຫຼືເຄີຍແກ້ປັນຫານີ້ ລົບກວນທ່ານຊ່ວຍບອກວິທີແກ້ໃຫ້ແດ່ ຂ້ອງໄດ້ລອງແປງ registry ແຕ່ກໍຍັງໃຊ້ບໍ່ໄດ້ ຝາກໃຫ້ທ່ານຜູ້ຮູ້ຊ່ວຍແດ່ເດີ້,,,ຂອບໃຈ

Re:

Sun, 21 Jun 2009 11:29:53 -0400

WinDowsRegdit.rar - 13.9 Kb

http://laoupload.com/EVC4W0WT5NF4/WinDowsRegdit.rar.html

ແຕ່ຍ່າລືມຕີດຕັ້ງ net.framwork 2.0 ກ່ອນນະ

Re:

Mon, 02 Mar 2009 13:51:09 -0500

ຂ້າ virus ແລ້ວ ເປີດຄອມຂື້ີນມາ ເຫັນແຕ່ຮູບ ໃນ desktop icon ບໍ່ໂຊ ແລະ task bar ໂຊ
ເຮັດແນວໃດ ທ່ານ Admin ເອີຍ ຂໍລົລກວນແດ່

Re:

Thu, 05 Mar 2009 12:30:59 -0500

ສະບາຍດີທ່ານ ອາເລັກໄຊ
ຂພຈ ຢາກຖາມທ່ານວ່າ: ຝາຍນີ້ Thumbs.db ແລະ Desktop.ini ແມ່ນຝາຍຫຍັງ? ລືບອອກກໍມາໄຫມ່

ຂອບໃຈລ່ວງໜ້າສຳລັບຄຳຄິດເຫັນ ແລະຂໍ້ແນະນຳ ທຸກທ່ານ

Re:

Tue, 26 May 2009 06:14:57 -0400

ຢາກຖາມວ່າຄອມຂ້ອຍມັນຕິດ ໄວລັດຫຍັງ ເວລາ shutdown ເຄື່ອງ restart ໃໝ່ຕະຫລອດ. ມອດບໍ່ໄດ້ ກາລຸນາຊ່ສຍຂ້ອຍແດ່ບັນດາ ທ່ານຜູ້ຮູ້ທັງຫລາຍ, ຂໍຂອບໃຈໃນຄວາມຊ່ວຍເຫລືອລ່ວງໜ້າ.

Re:

Fri, 29 May 2009 07:14:43 -0400

ສະບາຍດີອ້າຍໄດ້ລູກລະ ຈື່ຂ້ອຍບໍ ໂຈໄອທີຄອມ office ເຂົ້າ tool ແລ້ວປິດໂປຮແກຣມເອງໄວຣສໂຕໃດ ແລະ ເຂົ້າ run ບໍໄດ້ມັນຈະປິດເອງ ຂອບໃຈລ່ວງຫນ້າ

Re:

Thu, 25 Jun 2009 12:18:39 -0400

ນ້ອງຢາກຂໍຖາມກຽ່ວກັບ Driver ສຽງຂອງ Notebook IBM thinkpad t42ທຳອິດແມ່ນ Notebook ຂອງນ້ອງບໍ່ມີ Driver ນ້ອງເລີຍເອົາ windows Dark V.6 ທີວ່າມີ All Driver ມາພ້ອມ, ເວລາທີນ້ອງເປີດເພງເປັນຫຍັງສຽງມັນຈື່ງກະຕຸກ ຄ້າຍຄືກັນກັບແຜ່ນຊີດີເປື້ອນທຳອິດນ້ອງຄິດວ່າເປັນນຳ file ເພງແຕ່ນ້ອງໄດ້ທົດລອງເບິ່ງແລ້ວໂດຍການເອົາໄປເປິດຢູ່ເຄື່ອງອື່ນແຕ່ກະບໍ່ເປັນຫ ຍັງ? ພໍທີຈະມີວິທີຊ່ວຍນ້ອງໄດ້ບໍ່.

Re:

Thu, 25 Jun 2009 12:24:32 -0400

ບັນດາທ່ານທັງຫລາຍ ຄອມພິວເຕີຂ້າພະເຈົ້າ ຕິດໄວຣັດ s.exe ແອນຕີໄວຣັດລາວ ບໍ່ສາມາຂ້າໄດ້ ຊ່ອຍຫາວິທີແກ້ຊ່ອຍແດ່

ຂອບໃຈ ລ່ວງໜ້າ

Re:

Wed, 01 Jul 2009 11:42:36 -0400

Thyet Myo Hacking Day

Re:

Fri, 17 Jul 2009 11:38:56 -0400

ສະບາຍດີ ທ່ານ, ຂ້ອຍມີປັນຫາເລື່ອງໄວຣັສ ຕົວໃຫມ່ ຊື່ວ່າ FUvirus, ມີວີທີຂ້າບໍ່ ຊ່ອຍແດ່

Re:

Sun, 02 Aug 2009 09:06:11 -0400

I have virus problem on my notebook and I used Lao antivirus scan it, then I click delete all, finally my datas was disapear, is there any way to recover the datas back ?

Thanks...

Re:

Tue, 04 Aug 2009 13:46:56 -0400

ສະບາຍດີທ່ານ
ຂ້າພະເຈົ້າຂໍຖາມແດ່ ລາວແອນຕີ ມັນໝົດອາຍຸ ຕາມປົກະຕິແລ້ວ ຖ້າມັນໝົດອາຍຸການນຳໃຊ້ແລ້ວ ເຮົາລີມູບອອກ ແລ້ວມາຕັ້ງໃຫມ່ມັນກໍ່ໄຊ້ໄດ້ອີກ 60 ວັນ ແຕ່ຕອນນີ້ ລີມູບອອກຫລາຍຄັ້ງ ແລະ ກໍ່ ເປີດຄອມໃຫມ່ ແລ້ວຕັ້ງໂປແກມທີ່ດາວໂດດມາໃຫມ່ໆ ມັນກະຍັງຈຳຄືເກົ່າ expire date ຂ້າບໍ່ໄດ້
ຂໍຄວາມຊ່ວຍເຫືລອແດ່ເດີ ທ່ານ

ຊໍຂອບໃຈ

Re:

Fri, 07 Aug 2009 05:36:47 -0400

ຢາກຮູ້ວ່າ ໂຕ update ຂອງ laoav ທຸກໆ version ທີ່ໃຫ້ download ແລະ ສາມາດ update ໂດຍບໍ່ຕ້ອງ online ນັ້ນຄືບໍ່ມີແລ້ວ?

Re:

Tue, 08 Sep 2009 16:25:34 -0400

ສະບາຍດີອ້າຍ, ອ້າຍມີວິທີຂ້າໄວຣັດ system volumໄດ້ບໍ່
ແລະໄວຮັດ Recycle.bin ມັນບໍ່ສາມາດລົບໄດ້ ໄຊ້ຫລາຍໂປແກມຢູ່

Re:

Thu, 10 Sep 2009 16:45:57 -0400

ເອົາອ້າຍ ລົບກວນອີກແນ່ຫນ້ອຍຫນຶ່ງ ອັນໂຕວ່າ RECYCLE.BIN and syste volum information ບໍ່ແມ່ນໄວຮັດເປັນຫຍັງມັນ
ຄືລົບບໍ່ໄດ້
ມັນມີລັກສະນະເຮັດໃຫ້ເຄື່ອງຊ້າ
ວັນກ່ອນນ້ອງໃຊ້ Remove tool ຊ່ວນໃນການກວດແລະຂ້າສາມາດກວດພົບ ແລະກໍ່ຂ້າໄດ້ສຳເລັດ ແຕ່ມາເປິດເຄື່ອງ ຮີສະຕາດໃຫມ່ ກໍ່ບໍ່ເຫັນ ແຕ່ມາກວດໂດຍເປີດ Folder option ແລະhidden hide ກໍ່ຍັງເຫັນຄືເກົ່າ

ຖ້າອ້າຍມີວິທີແກ້ບອກນ້ອງແນ່

                                      ຈາກພູທອງ
                             ດ້ວຍຄວາມນັບຖືຢ່າງສູງ
                                      ບ້ານ ສະຜ່າຍ ເມືອງຊະນະສົມບູນ ແຂວງຈຳປາສັກ

Re:

Thu, 10 Sep 2009 20:57:20 -0400

ສະບາຍດີ ທ່ານ, ຂ້າພະເຈົ້າມີແນວຂໍລົບກວນຖາມທ່ານເດ່ວ່າ
ວ່າເວລາຂ້າພະເຈົ້າເປີດຄອມມາທຳອິດ ມັນຈະຟ້ອງວ່າ to help protect your computer, windows has closed this program ພໍເວລາກົດອອກແລ້ວມັນກໍ່ຖາມມາອີກອັນໃໝ່ວ່າ Generic host process for win32 services..... ຂ້າພະເຈົ້າຄິດວ່າແມ່ນໄວຣັດ ທ່ານພໍມີໂຕລີໂມບອອກ ຫຼື ວ່າ ມີວິທີແກ້ໄຂແນວໃດທີ່ຈະແນະນຳໃຫ້ຂ້າພະເຈົ້າເດ່ຈະໄດ້ບໍ່ເນ໋າະ ຂໍຂອບໃຈທ່ານຫຼາຍໆໆ

ຂ້າພະເຈົ້າattachedຮູບມາໃຫ້ທ່ານເບິ່ງດ້ວຍ

Re:

Tue, 15 Sep 2009 05:16:14 -0400

ຊ່ວຍແດ່ອ້າຍ, ເມື່ອສຽບ USb ເຂົ້າໄປບໍ່ວ່າຈະລົງໂປແກມໃດກໍ່ແລ້ວແຕ່ໂປຼແກມລາວແອນຕີໄວຣັດຈະກວດສອບການຕັ້ງຄ ່າ Autorun ແຕ່ຫລັງຈາກນັ້ນເມື່ອ restart ຄອມພິວເຕີຄັ້ງທຳອິດ ໂປແກມລາວແອນຕີໄວຣັດຈະແຈ້ງວ່າໂປແກມນັ້ນລະບົບfileຖືກມີການປ່ຽນແປງ ໝາຍເຖິງ Lao antivirus ເສຍຫາຍ ແຕ່ຖ້າ start ເຄື່ອງອີກເທື່ອໜຶ່ງ ຈະບໍ່ສາມາດເປີດເຄື່ອງໄດ້ອີກເລິຍ ເປີດ ແລ້ວກໍ່ດັບຄ້າຍຄືກັນກັບໄຟດັບນີ້ແຫຼະ ຕ້ອງລົງວິນໂດວໃໝ່ຖຶງໄດ້. ນ້ອງບໍ່ຢາກ format usb ນ້ອງເພາະມີຂໍ້ມູນສຳຄັນຢູ່ ສິມີວິທີແກ້ໄຂແນວໃດ. ຊຶ່ງໄວຣັດນີ້ອາໄສ ຢູ່ file ຂອງວິນໂດວ ຊ່ອງ system32 ຊື່ kernel (ບໍ່ແນ່ໃຈ)ທີ່ສັງເກດຈະທຳລາຍສະເພາະ ວິນໂດວ XP ສ່ວນ window vista ບໍ່ເຫັນມີບັນຫາ ຊ່ວຍແດ່ເດີອ້າຍ!

Re:

Tue, 29 Sep 2009 06:42:09 -0400

ສະບາຍດີ ຂ້າພະຈົ້າພົບໂປຣແກຣມໜຶ່ງ ຂະນະທີ່ກຳລັງເປີດຊອກຫາ laoscript 7.03 crack ຢູ່ ມັນ popup ຂຶ້ນມາແລ້ວບອກວ່າຄອມທ່ານຕິດໄວຣັສ ແລະ ໃຫ້ດາວໂຫລດມັນເພື່ອປ້ອງກັນ ເມື່ອດາວໂຫລດແລະຕິດຕັ້ງແລ້ວສະແກນພົບ ແຕ່ບໍ່ສາມາດຂ້າໄດ້ ຕ້ອງໄດ້ສັ່ງຊື້ກ່ອນ, ແລະເມື່ອຈະ uninstall ອອກກໍ່ຖາມຫາ key ແລະ ບໍ່ສາມາດເອົາອອກໄດ້. ດັ່ງນັ້ນຂ້າພະເຈົ້າຈຶ່ງເຕືອນມາຍັງທຸກທ່ານ ເພື່ອລະວັງດ້ວຍ

Re:

Fri, 09 Oct 2009 11:59:29 -0400

ມາແລ້ວພີ່ນ້ອງ ທະວິດສເຕີ້ລາວ twitterlao ລອງຫຼິ້ນນຳກັນເບິງຕາມລິງລຸຸມ່ນີ້
www.kavao.co.cc

Re:

Thu, 22 Oct 2009 11:06:49 -0400

ເລື່ອງກໍ່ຄືວ່າຂ້າພະເຈົ້າໄດ້ດາວໂຫຼດເອົາໂປຣແກຣມແອນຕີໄວຣັສ
2009 ຂອງທ່ານອາເລັກໄຊມາໃຊ້ກໍ່ຫຼາຍວັນຈວນຈະໝົດກຳນົດໃຊ້ແລ້ວ
ສະນັ້ນ, ຂໍຮຽນມາຍັງທ່ານອາເລັກໄຊແດ່ວ່າຜູ້ຂ້າຈະລົງທະບຽນໃຊ້ແບບດົນໆນັ້ນ
ມັນມີວິທີການ ແລະ ຂັ້ນຕອນຫຍັງແດ່?
ຂໍໃຫ້ທ່ານຈົ່ງຊ່ວຍຊີ້ແຈ້ງຖະແຫຼງໄຂແດ້ເດີທ່ານເອີຍ, ຂໍຂອບໃຈ

Re:

Fri, 23 Oct 2009 05:05:05 -0400

ເລື່ອງກໍ່ມີຢູ່ວ່າ: computer ຂອງຂ້າພະເຈົ້າຕິດໄວລັດສ໌ ເວລາເປີດຄອມຂື້ນມາມັນຈະ ແລ່ນເຂົ້າໄປຫາ folder ທີ່ຂ້າພະເຈົ້າສ້າງຂື້ນມາໂລດ ເວລາປິດມັນອອກບາງເທື່ອກະໄດ້ ແລະ ບາງເທື່ອກະປິດບໍ່ໄດ້, folder option, windows Task Manager ແລະ ປຸ່ມ search ກະເຂົ້າບໍ່ໄດ້. ຂ້າພະເຈົ້າວ່າຕ້ອງແມ່ນໄວລັດສ໌ Autorun ແທ້ໆ.ຂໍໃຫ້ທ່ານຊ່ວຍບອກວິທີແກ້ໃຫ້ຂ້າພະເຈົ້າແດ່.
ຂໍຂອບໃຈ.

Re:

Fri, 30 Oct 2009 11:06:23 -0400

ບັນຫາເກົ່າຍັງບໍ່ໝົດມີບັນຫາໃໝ່ອີກລະ ຄືວ່າຄອມຂອງຂ້າພະເຈົ້າບໍ່ຮູ້ວ່າເປັນຫຍັງໂຕເລກຢູ່ທີ່ Local Area Connection Status ເພີ່ມຂື້ນເລື້ອຍໆ ຈົນບໍ່ຢຸດບໍ່ເຊົາ ເວລາບໍ່ໄດ້ຫຼີ້ນກະຄືກັນຖ້າຫາກວ່າໄດ້ເຊື່ອມຕໍ່ກັບອິນເຕີເນັ ດແລ້ວມັນກໍ່ຈະເພີ່ມຂື້ນຕະຫຼອດ ດັ່ງຮູບລຸ່ມນີ້. ຂ້າພະເຈົ້າໄດ້ລອງໃຊ້ program “Net-Worm.Win32.Kido killer” ມາ sacan ແລ້ວແຕ່ກໍ່ຍັງເປັນຄືເກົ່າ ແລະ ຂ້າພະເຈົ້າໄດ້ລົງ windows ໃໝ່ກະຍັງເປັນຄືເກົ່າ ບໍ່ຮູ້ວ່າເປັນອີ່ຫຍັງ.!

Re:

Tue, 17 Nov 2009 08:40:13 -0500

Sa bay dee Mr Alexai,
i have problem with recovery picture my hard disk already formatted one time whether can recover back or not? if can please assist to give the steps or program which program can recover back.

Many thanks.....

Re:

Thu, 19 Nov 2009 07:08:32 -0500

ສະບາຍດີ ທ່ານ ອາເລັກ ແລະ ທ່ານຜູ້ຮຽນຮູ້ທັງຫຼາຍ

ຂ້າພະເຈົ້າຂໍຖາມບັນດາທ່ານແນ່ວ່າ ມີໂປຼແກມໃດບໍ່ທີ່ສາມາດກູ້ folder ໃນ computer ໄດ້ ຂ້າພະເຈົ້າເຄີຍໃຊ້ໂປຼແກມ recovery ຫຼາຍໆ ໂປຼແກມແລ້ວແຕ່ກໍ່ບໍ່ສາມາດທີ່ຈະກູ້ຟາຍທີ່ເປັນ folder ໄດ້.

ທ່ານໃດຮູ້ຊ່ວຍບອກຂ້າພະເຈົ້າແນ່

ຂໍຂອບໃຈ!

Re:

Mon, 30 Nov 2009 08:35:57 -0500

ຄອມພິວເຕີ ບໍ່ສາມາດຫຼີ້ນ Messenger ໄດ້ເປັນຍ້ອນສາເຫດອັນໃດ ກະລຸນາຊ່ວຍບອກຂ້າພະເຈົ້າດ້ວຍ ຂໍຂອບໃຈ.

Re:

Sat, 12 Dec 2009 12:33:45 -0500

Lao-Antivirus ກັບ Kaspersky,Nod32,Avira, Panda...... ຄວາມສາມາດເທົ່າທຽມກັນບໍ?? ຕ້ອງຂໍອະໄພຫຼາຍໆເພາະວ່າຢາກຮູ້ຈີງໆໆໆ
ຂໍຂອບໃຈ

Re:

Thu, 17 Dec 2009 06:14:35 -0500

ໄວຣັດ dj-dn.exe ແລະ dj-apple.exe ລົບກວນຖາມວິທີຈັດການກັບໄວຣັດພວກນີ້ແດ່ ຕອນນີ້ມັນຮັກຂ້າພະເຈົ້າຫຼາຍ
ລົບກະບໍ່ໜີໄລ່ໜີກະບໍ່ໜີ ຂອບໃຈທ່ານທີ່ຈະໃຫ້ທິດທອງ

Re:

Fri, 18 Dec 2009 14:43:19 -0500

อยากรู้ว่า lao av สามาดลงกับ windows vista ได้บ่อ
และ อยากรู้วิทีลบ ลูกสอน shortcut อยู่ปุ่มไอคอนเทิงหน้า desktop
ช่วยบอกแด่ thank you

Re:

Wed, 23 Dec 2009 06:00:43 -0500

ຄອມພິວເຕີ ບໍ່ສາມາດປ່ຽນ workgroup ໄດ້ ແລະ ບໍ່ສາມມາເຂົ້າວົງເນັກເວີກດ່ຽວກັນ ຜູ້ຊ່ວຍບອກທາງແກ້ໄຂ້ໃຫ້ແດ່
ຂອບໃຈລ່ວງໜ້າ

Re:

Sat, 09 Jan 2010 09:01:07 -0500

ຂໍ Lao antivirus version ໃໝ່ແດ່ໂຕທີ່ໃຊ້ກັບ windows vista - windows seven ໄດ້ ຂໍແດ່ທ່ານ

Re:

Wed, 20 Jan 2010 08:33:33 -0500

ຢາກຮູ້ຈັກ processes ທີ່ໄວຮັດເຮັດວຽກເຮົາຈະສັງເກດແນວໃດ ແລະຈະຮູ້ໃດ້ແນວໃດວ່າໃວລັດຕົວໃດທີ່ກໍາລັງຢູ່ໃນເຄື່ອງຕອນນີ້ ຕົວທີ່ມັນບໍ່ສະແດງອາການຫຼືສະແດງຕົວຕົນ
ແລະມີອີກໜຶ່ງຄໍາຖາມເຮົາເວລາເຮົາກອບປີ file ທີ່ເປັນ.exe
ຈະໃປ setup ກັບຄອມບາງໜ່ວຍ ແລ້ວມັນເປັນ file ແບບໄວລັດ ເປັນ exe ຢູ່ແຕ່ເວລາໃປຄິກເພື່ອຈະ setup ແລ້ວມັນຈະບໍ່ run ໃຫ້ ເຮົາຄວນຈະໃປປິດ processes ໂຕໃດ ຂອບໃຈ

Re:

Thu, 21 Jan 2010 09:26:08 -0500

ທ່ານອາເລັກທີ່ນັບຖື
ຄອມມັນເຕືອນວ່າມີ worm/confivk.164228 ຂຶ້ນມາ
ຕະຫຼອດ, ທ່ານມີວິທີການແກ້ໄຂແນວໃດ, ຊ່ວຍແດ່
ຂໍຂອບໃຈ, ຂ້າພະເຈົາໃຊ້ Avira 9 pro

Re:

Tue, 09 Feb 2010 05:22:45 -0500

+ມັນກອບປິຕົວເອງ
• %SYSDIR%\drivers\BSmBT.exe
   • %drive%\RECYCLER\%CLSID%\BSmBT.exe
ແລ້ວສ້າງໄຟລ
– %WINDIR%\logfile32.txt
– %drive%\autorun.inf
– %drive%\RECYCLER\%CLSID%\Desktop.ini
+ສ້າງຄ່າໃນ Registry
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Microsoft Driver Setup"="%SYSDIR%\drivers\BSmBT.exe"
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
   Run]
   • "Microsoft Driver Setup"="%SYSDIR%\drivers\BSmBT.exe"

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   New value:
   • "EnableFirewall"=dword:0x00000000

Worm ຕົວນີ້ຍັງປິດໂປຣແກຣມທີ່ມີຊື່ດັ່ງນີ້

VIPRE.EXE; ISSDM_EN_32.EXE; P08PROMO.EXE; K7TS_SETUP.EXE;
      AVINSTALL.EXE; WITSETUP.EXE; TrendMicro_TISPro_16.1_1063_x32.EXE;
      VBA32-PERSONAL-LATEST-ENGLISH.EXE; CCSETUP210.EXE; FSMB32.EXE;
      FSGK32.EXE; FSAV95.EXE; FSAV530WTBYB.EXE; FSAV530STBYB.EXE;
      FSAV32.EXE; FSAV.EXE; FSAA.EXE; FPROT.EXE; FP-WIN.EXE; FNRB32.EXE;
      FIH32.EXE; FCH32.EXE; FAST.EXE; FAMEH32.EXE; F-STOPW.EXE;
      F-PROT95.EXE; F-PROT.EXE; AFMAIN.EXE; SPIDERUI.EXE; SPIDERNT.EXE;
      ALERTMAN.EXE; RAVMOND.EXE; MAKEREPORT.EXE; BOXMOD.EXE; 360SAFE.EXE;
      360RPT.EXE; 360HOTFIX.EXE; 360TRAY.EXE; NSVMON.NPC; NSAVSVC.NPC;
      NPCGREENAGENT.NPC; PUSCAN.EXE; AYSERVICENT.AYE; AYAGENT.AYE;
      CMDAGENT.EXE; CPF.EXE; VSMON.EXE; ZLCLIENT.EXE; NSUTILITY.EXE;
      NSPUPDT.EXE; NAVQSCAN.EXE; NSPMAIN.EXE; NSPUPSVC.EXE; NSPSVC.EXE;
      MKSADMINCONSOLE.EXE; MKSUPDATE.EXE; MKSPC.EXE; MKSFWALL.EXE;
      MKSVIRMONSVC.EXE; MKS_SCAN.EXE; MKS_MAIL.EXE; MKSREGMON.EXE;
      KAVPFW.EXE; KASMAIN.EXE; KAV32.EXE; KPFWSVC.EXE; KISSVC.EXE;
      KWATCH.EXE; KPFW32.EXE; KAVSTART.EXE; KVSRVXP.EXE; KVOL.EXE; KVXP.KXP;
      KVMONXP.KXP; CAVASM.EXE; CMAIN.EXE; ARCABIT.CORE.LOGGINGSERVICE.EXE;
      ARCABIT.CORE.CONFIGURATOR2.EXE; TASKSCHEDULER.EXE; UPDATE.EXE;
      NETMONSV.EXE; FILEMONSV.EXE; ABREGMON.EXE.EXE; ARCACHECK.EXE;
      ARCAVIR.EXE; AVMENU.EXE; A2HIJACKFREE.EXE; A2SERVICE.EXE; A2START.EXE;
      A2SCAN.EXE; A2GUARD.EXE; VRFWSVC.EXE; HFACSVC.EXE; VRMONSVC.EXE;
      HPCSVC.EXE; HSVCMOD.EXE; VRMONNT.EXE; MKSTRAY.EXE; VBA32ADS.EXE;
      VBA32LDR.EXE; FILELOCKSETUP.EXE; TSCFCOMMANDER.EXE; TMPROXY.EXE;
      TMPFW.EXE; TMBMSRV.EXE; UFNAVI.EXE; UFSEAGNT.EXE; TISSPWIZ.EXE;
      SFCTLCOM.EXE; TNBUTIL.EXE; DEFWATCH.EXE; RTVSCAN.EXE; SBAMSVC.EXE;
      SBAMUI.EXE; SBAMTRAY.EXE; SAVADMINSERVICE.EXE; SAVSERVICE.EXE;
      SCFSERVICE.EXE; SCFMANAGER.EXE; RAVTASK.EXE; CCENTER.EXE; ULIBCFG.EXE;
      RAVLITE.EXE; PCTAV.EXEPCTAVSVC.EXEPXCONSOLE.EXEPXAGENT.EXERAV.EXE;
      PCTSAUXS.EXE; PCTSTRAY.EXE; PCTSSVC.EXE; PCTSGUI.EXE; AVGAS.EXE;
      PAVBCKPT.EXE; WEBPROXY.EXE; PAVSRV51.EXESRVLOAD.EXE; PSIMSVC.EXE;
      PSHOST.EXE; AVENGINE.EXE; PSKMSSVC.EXE; PAVPRSRV.EXE; PAVFNSVR.EXE;
      PSCTRLS.EXE; TPSRV.EXE; NOD32M2.EXE; NOD32CC.EXE; NOD32.EXE;
      NMAIN.EXE; NOD32KUI.EXE; MSASCUI.EXE; MSMPENG.EXE; MCUPDATE.EXE;
      MCSHIELD.EXE; MCVSSHLD.EXE; MCVSRTE.EXE; MCAGENT.EXE; KAVSVC.EXE;
      KAV.EXE; K7TSMNGR.EXE; K7SPMSRC.EXE; K7RTSCAN.EXE; K7PSSRVC.EXE;
      K7FWSRVC.EXE; K7EMLPXY.EXE; K7TSECURITY.EXE; K7SYSTRY.EXE;
      VIRUSUTILITIES.EXE; GUARDXSERVICE.EXE; GUARDXKICKOFF.EXE; AVKWCTL.EXE;
      AVKTUNERSERVICE.EXE; AVKSERVICE.EXE; GDFWSVC.EXE; AVKPROXY.EXE;
      GDFIRE~1.EXE; AVKTRAY.EXE; GDFIREWALLTRAY.EXE; FSAUA.EXE;
      NOD32KRN.EXE; FSMA32.EXE; FSDFWD.EXE; FSGK32ST.EXE; FSM32.EXE;
      FPWIN.EXE; FPAVSERVER.EXE; FPROTTRAY.EXE; INICIO.EXE; UMXPOL.EXE;
      UMXFWHLP.EXE; UMXAGENT.EXE; UMXCFG.EXE; PPCLTPRIV.EXE; SVCPRS32.EXE;
      ITMRTSVC.EXE; CCPROVSP.EXE; MDMCLS32.EXE; CAGLOBALLIGHT.EXE;
      CAPFUPGRADE.EXE; CAPFASEM.EXE; CAFW.EXE; CFGMNG32.EXE; CCTRAY.EXE;
      CLAMTRAY.EXE; CLAMWIN.EXE; ALSVC.EXE; ALMON.EXE; DRWEBSCD.EXE;
      SPIDERML.EXE; DRWEB32W.EXE; ACS.EXE; STRTSVC.EXE; OP_MON.EXE;
      SENSOR.EXE; QHFW332.EXE; CATEYE.EXE; ONLNSVC.EXE; EMLPROUI.EXE;
      UPSCHD.EXE; SCANMSG.EXE; SCANWSCS.EXE; EMLPROXY.EXE; ONLINENT.EXE;
      ASWCLNR.EXE; BDAGENT.EXE; VSSERV.EXE; LIVESRV.EXE; XCOMMSVR.EXE;
      UISCAN.EXE; BDSS.EXE; AVGUI.EXE; AVGUPD.EXE; AVGSCANX.EXE; AVGEMC.EXE;
      AVGUPSVC.EXE; AVGAMSVR.EXE; AVGWDSVC.EXE; ASHWEBSV.EXE; ASHMAISV.EXE;
      ASWUPDSV.EXE; ASHSERV.EXE; ASHDISP.EXE; AVCENTER.EXE; SCHED.EXE;
      AVIRARKD.EXE; AVGNT.EXE; AVGUARD.EXE; AHNSDSV.EXE; ACAIS.EXE;
      ACALS.EXE; ACAEGMGR.EXE; ACAAS.EXE; QOELOADER.EXE; APVXDWIN.EXE;
      QUHLPSVC.EXE; 123.EXE; RAVP.EXEMBAM.EXE123.COM; UNLOCKER1.8.7.EXE;
      UNIEXTRACT.EXE; SYSANALYZER_SETUP.EXE; STARTDRECK.EXE; SPF.EXE;
      REGX2.EXE; REGSHOT.EXE; REGSCANNER.EXE; REGISTRAR_LITE.EXE;
      REGCOOL.EXE; REGALYZ.EXE; PROJECTWHOISINSTALLER.EXE; PROCMON.EXE;
      CUREIT.EXE; FIXBAGLE.EXE; PGSETUP.EXE; OBJMONSETUP.EXE; NETALYZ.EXE;
      KILLBOX.EXE; INSTALLWATCHPRO25.EXE; AVENGER.EXE; IEFIX.EXE;
      HOSTSFILEREADER.EXE; FIXPATH.EXE; FILEFIND.EXE; FILEALYZ.EXE;
      EULALYZERSETUP.EXE; A2HIJACKFREESETUP.EXE; DLLCOMPARE.EXE;
      CPROCESS.EXE; CPORTS.EXE; ASVIEWER.EXE; APT.EXE; APM.EXE;
      WIRESHARK.EXE; SPYBOTSD.EXE; TEATIMER.EXE; SPYBOTSD160.EXE;
      PROCESSMONITOR.EXE; PROCDUMP.EXE; PG2.EXE; LORDPE.EXE; ICESWORD.EXE;
      REANIMATOR.EXE; ROOTKITNO.EXE; RKD.EXE; HACKMON.EXE; UNHACKME.EXE;
      ROOTKIT_DETECTIVE.EXE; AVGARKT.EXE; FSB.EXE; FSBL.EXE;
      ROOTKITREVEALER.EXE; PSKILL.EXE; TASKMON.EXE; TASKLIST.EXE;
      TASKMAN.EXE; PROCEXP.EXE; MSNFIX.EXE; HIJACKTHIS_V2.EXE;
      HIJACKTHIS.EXE; HIJACKTHIS_SFX.EXE; HJTSETUP.EXE; HJTINSTALL.EXE;
      OLLYDBG.EXE; NETSTAT.EXE; PORTMONITOR.EXE; PORTDETECTIVE.EXE;
      FPORT.EXE; APORTS.EXE; PAVARK.EXE; DARKSPY105.EXE; HELIOS.EXE;
      ROOTKITBUSTER.EXE; ROOTALYZER.EXE; BC5CA6A.EXE; SEEM.EXE;
      DELAYDELFILE.EXE; DUBATOOL_AV_KILLER.EXE; SUPERKILLER.EXE;
      KAKASETUPV6.EXE; BUSCAREG.EXE; MSNCLEANER.EXE; SRESTORE.EXE;
      BOOTSAFE.EXE; SUPERANTISPYWARE.EXE; CCLEANER.EXE;
      REGUNLOCKER.EXETSNTEVAL.EXEXP_TASKMGRENAB.EXE; CF9409.EXE; GMER.EXE;
      CATCHME.EXE; SDFIX.EXE; COMBOFIX.EXE; SRENGPS.EXE; AUTORUNS.EXE;
      TASKKILL.EXE; REGEDIT.EXE; REG.EXE; MYPHOTOKILLER.EXE;
      KILLAUTOPLUS.EXE; FOLDERCURE.EXE; REGEDIT.SCR; REGEDIT.COM; MMC.EXE;
      TCPVIEW.EXE; LISTO.EXE; GUARD.EXE; NTVDM.EXE; COMMAND.COM;
      COMBOFIX.COM; COMBOFIX.SCR; COMBOFIX.BAT; REGMON.EXE;
      OTMOVEIT.EXEMBAM-SETUP.EXE; JAJA.EXE; AVZ.EXE; MBAM.EXE;
      MBAM-SETUP.EXE; PENCLEAN.EXE; ELISTA.EXE; HJ.EXE;
      WINDOWS-KB890930-V2.2.EXE; MRTSTUB.EXE; MRT.EXE; HIJACK-THIS.EXE;
      VIRUS.EXE; SAFEBOOTKEYREPAIR.EXEOTMOVEIT3.EXEHOSTSXPERT.EXEDAFT.EXE;
      ATF-CLEANER.EXE; COMPAQ_PROPIETARIO.EXE; egui.exe; ekrn.exe;
      SRENGLDR.EXE; HOOKANLZ.EXE

Re:

Sat, 27 Feb 2010 05:43:11 -0500

how to kill autorun on my usb?

Re:

Tue, 02 Mar 2010 04:26:20 -0500

-ເມືອຕິດມັນແລ້ວຈະສ້າງໄຟລ
%System%\sysinfo.exe

%System%\SYSINFO.BAT
-ສ້າງຄ່າໃນ Registry

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wnetwiss
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wnetwiss\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wnetwiss
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wnetwiss\Security

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services]

Start = 0x00000002
Type = 0x00000020

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wnetwiss\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wnetwiss]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\sysinfo.exe"
DisplayName = "Windows netware work information system setup"
ObjectName = "LocalSystem"
Description = "Provide security by Windows netware work system information "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Start = 0x00000002
Type = 0x00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wnetwiss\Securit y]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wnetwiss]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\sysinfo.exe"
DisplayName = "Windows netware work information system setup"
ObjectName = "LocalSystem"
Description = "Provide security by Windows netware work system information "

Re:

Mon, 15 Mar 2010 13:58:46 -0400

TODAY I HAVE Program for scan your usb. this program is can kill folderEXE ,kill Autorun ..and easy to install..You can download this program in this link: Wait ...

http://www.4shared.com/file/245872838/f3feb574/DLRS_2010.html

or

http://rapidshare.com/files/366174273/DLRS_2010.zip.html

Thank you for read.

Re:

Tue, 16 Mar 2010 09:38:23 -0400

ສະບາຍດີ Admin.
ມີເລື່ອງການຂ້າໄວຣັດ ມາຂໍຄວາມຊ່ວຍເຫຼືອນຳທ່ານອີກແລ້ວ

ໄວຣັດ Trojan.Win32.VB.ukk ມັນສ້າງ folder.exe ບໍ່ສາມາດຂ້າໄດ້

ຂ້າພະເຈົ້າລອງໃຊ້ Zita ແລ້ວແຕ່ບໍ່ໄດ້ຜົນ
folder ທຸກອັນທີ່ມັນສ້າງຂື້ນມາຈະມີຂະໜາດ 136 kB ຄືກັນໝົດ

ຂໍຄວາມຊ່ວຍເຫຼືອຕື່ມອີກແດ່ ຄວນຈະເຮັດແນວໃດ?

Re:

Sun, 21 Mar 2010 10:16:25 -0400

ຂ້ອຍລົງ office 2010 Beta ແຕ່ໃຊ້ໄປ 1 ເດືອນມັນຖາມລະຫັດ
ບໍ່ຮູ້ລະຫັດໃສ່ ທ່ານທັງຫຼາຍຊ່ວຍບອກແດ່ຖ້າໃຜມີ

THANK

Re:

Mon, 22 Mar 2010 12:33:44 -0400

I can't write Lao on forums. I buy new USB I save folders and files help! when I open any data I save is Lose all. I play song on my USB is stuck & can't resume but my old USB can play, open files, folder & song that I save I don't Know How to doooooo! help help help.thank you so much der!

Re:

Thu, 01 Apr 2010 07:41:54 -0400

ข้าพะเจ้าบ่อหมั้นใจว่าตนเองพบไวรัสปะเพดใดเข้าไปแล้วเพาะว่าเวลาที่มันติดแล้วพอเราเปีดเคื่องใหม่จะเข้าสู่หน้าจอปกกะติบ่อได้ อีก หมายความว่าบ่อมีไอคัอนหยังหมด แต่ก่อนหน้านั้นมันจะถามหาค้ายกับเวลาที่เราติดไวรัส
Flasy คือถามหาละหัดแต่อันนี้บ่อได้ใส่ละหัดหยัง แต่มันแปกอยู่บ่อนว่า พอ ENTER เข้าไปแล้วบ่อเป็นแบบที่เราหวัง มันบ่อมีไอคัอน มันบอกว่า RUNDLL32.DLL as an app และ Explorer บ่อสามาดเข้าเถิงได้ ข้าพะลงวินโดวใหม่ย้อนบ่อรู้หลายคั้งแต่2-3 มื้อหลือบ่อฮอดช้ำก็เป็นอีกแล้ว ใน USB ของข้าพะเจ้า Format หลายเทื่อแต่ก็ยังเห็นอยู่ขะหนาดใช้ WinPE เ้้ข้าไปช่วยแต่บ่อได้ผนมันกับคืนมาให้เห็น และ จำลองฟายชื่อเดียวกันกับที่เราเปีดใช้งานอีกแต่มีนามสะกุนเป็น *.EXE คื สมมุดว่าเวลาเราเปีด ลาวแอนตี้ไวรัสขิ้นมาUSBของเราจะมีเอกะสานที่ชื่อ ลาวแอนตี้ไวรัส.EXE เป็นตัวพิมใหย่หมด แล้วตามด้วย ฟาย Autorun.ini จุดพิเสดก็คือมีไอคัอนแบบเดียวกับไอคัอนของ RUNDLL32.DLL ของวินโด ต่างแต่มีสีจางกว่าเท่านั้นเอง
ขอความช่วยเหลือจากท่านผู้รู้ กะลุนาหาทางออกช่วยข้าพะเจ้าแด่ท้อนเมื่อยนำมันหลายจนปันยาแท้จนปันยาว่า

Re:

Thu, 01 Apr 2010 19:01:12 -0400

ມັນກໍມີຢູ່ວ່າ
ເປີດຄອມດີໆ ກະມີ Notepad ຂຶ້ນມາເອງ
ເຮົາຄິດຕ້ອງໄວລັດແທ້ໆ
ເພາະຕ້ອງເບິ່ງຫນັງມັນກະຄ້າງໆກະຕຸກໄປໆ
ຄອມຊ້າໄປອີກ- -
admin ພໍມິໃຫ້ຂ້າບໍ່?

Re:

Fri, 02 Apr 2010 09:21:05 -0400

ສະບາຍດີ ຂ້າພະເຈົ້າເຈິໄວຣັສ FolderData.exe ມັນຈະເຮັດໃຫ້ເຮົາບໍ່ສາມາດ ໂຊ hidden file ໄດ້ ແຕ່ Folder Option ແມ່ນຍັງເຫັນແລະເຂົ້າໄດ້ ແຕ່ພໍເລືອກໃຫ້ໂຊ Hidden folder ແລ້ວ OK ມັນກໍ່ກັບໄປ Don't show hidden file ຄືເກົ່າ ແລະ Antivirus ທີ່ໃຊ້ຢູ່ກໍ່ຖືກປິດໄວ້ບໍ່ສາມາດເຮັດວຽກໄດ້ , ກະລຸນາບອກວິທີ່ຂ້າມັນແດ່ ຂອບໃຈ

Re:

Wed, 07 Apr 2010 12:03:51 -0400

Worm ຕົວນີ້ມັນລອກລວງດ້ວຍການໃຊ້ Icon ຂອງຮູບ

ເພື່ອໃຫ້ເຮົາຫລົ້ງເປິດມັນ
+ຄອມທິ່ຕິດມັນສ້າງໄຟແລະ Rigistry ດັ່ງນີ້:

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sm2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm2File
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm2File\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm2File\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm2File\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm2File\shell\open\command
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\E xplorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\S ystem
HKEY_CURRENT_USER\Software\Microsoft\Windows Script
HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile]

InfoTip = "Size: 7.24 MB"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sm2]

(Default) = "sm2File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm2File\shell\open\command]

(Default) = "%System%\drivers\etc\services.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sm2File\DefaultIcon]

(Default) = "%System%\SHELL32.dll,1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Lao Antivirus = "%Windir%\NOTEPAD.EXE"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

Window Title = 0x00000009

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer]

NoRun = 0x00000001
NoFolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer\Run]

Explorer = "%System%\Explorer.sm2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ System]

DisableRegistryTools = 0x00000001
DisableTaskMgr = 0x00000001

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)
to prevent users from starting Task Manager (Taskmgr.exe)

[HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings]

JITDebug = 0x00000000

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08- 00AA002F954E}]

LocalizedString =

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]

(Default) =
InfoTip =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Shell =

Re:

Sat, 24 Apr 2010 12:47:30 -0400

หลายท่านคงจะเคียภืกใวลัดโฟเดีเข้าUSBเชี่งก่มีหลายชะนีด.เชี่งข้อยเองก่เ คียถืกมาหลายแล้วจื่งใด้
พัดทะนาโปแกมมาเพื่อกำจัดใวลัดนื้เพื่อให้เข้าโฟเดีใด้โดยปาดชะจากใวลัด แต่ถ้าคอมเจ้าถืกใวลัด
เข้ายู่แล้วอาดจะบ่ใด้ผนเพาะถ้าท่านใช้ข้าแล้วมันก่จะCopyตนเองมาใส่อีก สะน้นควนจะป้องกันใวก่อนจื่ง
เข้าUSBทุกเทื่อ.และโปแกมนื้ยังสามาดข้าและส้างโฟเดิเพื่อป้องกันใวลัดAut orunใด้อีก
วีทีใช้ก่คืกับโปแกมท่วใป. ดาวโลดใน Link นื้.
http://www.4shared.com/file/IpNS0uhj/Folder_EXE__File_Hidden_Fix.html"
หลื
http://rapidshare.com/files/379537973/ Folder_EXE___File_Hidden_Fix.rar.html

Re:

Tue, 27 Apr 2010 11:29:57 -0400

ເປີດ USB Drive ແລ້ວພົບ japan.exe, DotA editor.exe, explorer.exe, MonsterHunter_Freedom_3G_easda_9re292j92.jpg.exe ແກ້ແນວໃດ?

Re:

Fri, 30 Apr 2010 18:12:08 -0400

Lao antivirus 2010 ສາມາດຟື້ນຟູໄຟຮທີ່ຕິດໄວຮັສໄດ້ບໍ່

Re:

Tue, 04 May 2010 11:46:46 -0400

ເພື່ອນຂອງຂ້າພະເຈົ້າ ໃຊ້ Lao Antivirus ແລະ ໄດ້ລົງທະບຽນຮຽບຮ້ອຍແລ້ວ
ແຕ່ເມື່ອນຳມາສະແກນ computer ແລ້ວມັນເຫັນໄວຣັສ໌ ຫລາຍຕົວ ຫລັງຈາກສະແກນ
ສຳເລັດແລ້ວ ມັນຖາມວ່າຕ້ອງການລົບບໍ່?
ເພື່ອນຂ້າພະເຈົ້າບໍ່ເຂົ້າໃຈເລີຍສັ່ງລົບ ແຕ່ພໍ Start ເຄື່ອງໃໝ່ ເຂົ້າ ວິນໂດ ບໍ່ໄດ້ເລີຍ

ຮຽນເຖິງທ່ານ Admin ຊ່ວຍອະທິບາຍວິທີການລົບ ແລະ ສັງເກດ Files ທີ່ Lao Antivirus ສະແກນເຫັນ ແລະ ສາມາດລົບໄດ້ ເພື່ອຄັ້ງໜ້າຈິ່ງຈະບໍ່ໄປລົບ ຈົນບໍ່ສາມາດ
ເຂົ້າວິນໂດ ໄດ້
ຂອບໃຈ.

Re:

Wed, 12 May 2010 13:07:40 -0400

http://www.seasondl.com/index.php?topic=7125.0

DOWNLOAD ຕາມລິ້ງເທິ່ງນີ້ພ້ອມວິທີ່ໃຊ້ງານ

Re:

Sun, 23 May 2010 04:27:27 -0400

ຄຶວ່າຈັງຊີ້ທ່ານ ຂ້າພະເຈົ້າກາບໍ່ຮູ້ວ່າອາການທີ່ຈະເວົ້າຕໍ່ໄປນີ້ແມ່ນໄວສຣັດ
ໂຕໃດ: ໄວສຮັດໂຕນີ້ສ່ວນແມ່ນມັກພົບດີພໍສົມຄວນ ຖ້າຕິດໄວສຮັດໂຕນີ້
ອາການມັນເມື່ອເຮົາ ຄຣິກຂວາ ແລ້ວເລື່ອນເມົາມາຫາບ່ອນ Sent to
ຫັນແລ້ວມັນເຮັດໃຫ້ຄອມຄ້າງເລີຍຈົນໄດ້ມອດເປີດໃໝ່...ຊ່ວຍໃຫ້ຄຳແນະ
ນຳແດ່ ຄັນດີທີ່ສຸດແມ່ນຢາກໃຫ້ທ່ານສ້າງTool ມາຂ້າໃຫ້ແດ່ເພາະມັນມັກ
ພົບຫຼາຍ.....

Re:

Wed, 09 Jun 2010 11:27:31 -0400

[+] Running processes
C:\windows\wain.exe (2060288 bytes)

[+] Registry startups
Value: Win32
Data: C:\windows\wain.exe
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

[+] Files created/modified 
C:\WINDOWS\nvsvs.exe (1033216 bytes)
C:\WINDOWS\wain.exe (2060288 bytes)
C:\WINDOWS\wilps.exe (806400 bytes)

Re:

Wed, 16 Jun 2010 12:54:46 -0400

What is it Please tell me

D:\I Love You\cstrike.exe,W32/Troj.00433949 (Troj)
---------------16/6/2553 16:39:20---------------
Found: D:\Grams\Antivirus\avira_premium_security_suite_en.exe,W32/ Troj.82F4CB10 (Troj)
---------------16/6/2553 16:39:20---------------
Found: D:\Grams\For Internet\dap91.exe,W32/Troj-Toolbar. (Troj)
---------------16/6/2553 16:39:20---------------
Found: D:\Grams\For Internet\MSN.exe,W32/Troj.4A6CA7F2 (Troj)
---------------16/6/2553 16:39:21---------------
Found: D:\Grams\For Internet\Metin2_20080811.exe,W32/Troj.E2059570 (Troj)
---------------16/6/2553 16:39:21---------------
Found: D:\Grams\For Internet\pal_install_r1261.exe,W32/Troj.45BE563C (Troj)
---------------16/6/2553 16:39:21---------------
Found: D:\Grams\For Internet\Paltalk 9.8.exe,W32/Troj.45BE563C (Troj)
---------------16/6/2553 16:39:22---------------
Found: D:\Grams\Photo\NoisewareProPlugin4205.exe,W32/Troj.48EFCDCD (Troj)
---------------16/6/2553 16:39:22---------------
Found: D:\Grams\General\WinRAR.v.3.7.Beta.7.Corp.exe,W32/Troj.161754 (Troj)
---------------16/6/2553 16:39:22---------------
Found: D:\Grams\General\smarttranslator.exe,W32/Troj.3CE1015C (Troj)
---------------16/6/2553 16:39:22---------------
Found: D:\Grams\General\lswin604.exe,W32/Troj.3A5B1B81 (Troj)

I'm dn't know What is it all In my Drive D LAV Found all Virus ??

Re:

Wed, 23 Jun 2010 07:26:44 -0400

+File System Modifications
%Temp%\$$c1.tmp
%Temp%\$$c1.tmp.bat
%ProgramFiles%\Windows Media Player\svchost.exe
%System%\PDLL.dll
+Memory Modifications
svchost.exe
PDLL.dll
+Registry Modifications

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit =

Re:

Tue, 03 Aug 2010 05:10:57 -0400

ຶBigbang.makelove.exe ແມ່ນຫຍັງ ແລ້ວຫາວິທີຂ້າແນວໃດ

Re:

Fri, 20 Aug 2010 07:00:41 -0400

ທ່ານ ໃດເຄີຍພົບບັນຫານີ້ ( Run ຫາຍ) ແລະ ມີວິທີ່ແກ້ຊ່ວຍບອກແນ່ຈະເປັນພະຄຸນຢ່າງສູງ
ທ່ານໄດ້ມີວິທີດີໆກະລຸນາແນະນຳດ້ວຍ ຂອບໃຈລວງໜ້າ

Re:

Fri, 27 Aug 2010 08:53:52 -0400

Avast Internet Security 5.0 Valid Licens 2011 | 49.62 MB

Re:

Sat, 27 Feb 2010 16:10:51 -0500

ຂ້າພະເຈົ້າຍາກຮູ້ວິທີhack password win7+Vista ເພື່ອວ້ແກ່ໄຂ້ເມື່ອມີບັນຫາ...ຊ່ວຍບອກວິທີແດ່

Re:

Sun, 28 Feb 2010 14:07:15 -0500

ເມື່ອຄອມເຮົາເປີດບໍ່ຂື້ນເຮົາຄວນໃຊ້ໂປຮແກຼມໂຕໃດໃນການ backUp driver
ແລະ ຊ່ວຍບອກຂັ້ນຕອນແດ່ ???????

Re:

Fri, 12 Mar 2010 11:44:20 -0500

Beware of imitation Kingston flashdrive, i bougth a Kinston flashdrive 4 GB from a computer shop on 3/3/2010 on event sale on KhamphengMaueng Road, i just save file for two time, it's popup message: The disk cannot be written to because it is write protected." please remove the write protection from the volume G in drive\Device\Harddisk1\DR11." i try many ways to remove write protect, but it's cannot untill i know it's fake Kingston so i don't want any one to be vitim of like me. i have picture to compare between true and fake attach here.

Re:

Wed, 17 Mar 2010 15:21:16 -0400

ຄຶວ່າ: ມີ USB ອັນໝື່ງຂອງພິ່ນ້ອງທີ່ມີເອກະສານword ແລະເພີ່ນຫລົງລົບຂໍ້ມູນ
ໄປໄດ້ປະມານ1ມື້ນີ້ແຫລະ ແລະຂ້າພະເຈົ້າພະຍາຍາມກູ້ດ້ວຍຫລາຍໂປຮແກຮມແລ້ວ
ສ່ວນຫຼາຍແມ່ນເຫັນແຕ່ເອກະສານເກົ່າເປັນປີລະ ແລະເອກະສານໂຕໃໝ່ພັດບໍ່ເຫັນ
ຂ້າພະເຈົ້າຢາກໃຫ້ທ່ານຊ່ວຍບອກໂປຮແກຮມໃດທີ່ສາມາດກູ້ໄດ້ ແຕ່ສິ່ງທີ່ສຳຄັນ ແມ່ນຢາກກູ້ເອົາແຕ່ຟາຍ Word+Excel ເປັນເອກະສານທີ່ຈຳເປັນທີ່ສຸດ.....

Re:

Wed, 24 Mar 2010 07:28:08 -0400

ຄຶວ່າຂ້າພະເຈົ້າມີຢາກໄດ້ Driver modem For winphone 2000.
CDMA2000 1X...
ຂອບໃຈລວງໜ້າ....

Re:

Wed, 24 Mar 2010 10:53:36 -0400

ກ່ອນອື່ນໝົດກໍ່ຂໍສະບານດີບັນດາທີມງານໝົດທຸກຄົນ, ບັນຫາຂອງຄອມພີວເຕີຂອງຂ້າພະເຈົ້າມີດັ່ງນີ້:
ຈະເກີດມີການຄ້າງຢູ່ຕະຫລອດເວລາເຊັ້ນວ່າ: ຂັ້ນຕອນການຕິດຕັງos, ຂັນຕອນການຳໃຊ້...ໃນຕອນທຳອິດຂ້າພະເຈົ້າຄິດວ່າ ຮາກດິດ ຕິດແບດເຊັກເຕີ ຂ້າພະເຈົ້າກໍ່ໄດ້ມີການເຄຍໄໝ່ໝົດ ແຕ່ກໍ່ຍັງມີອາການຄືເກົ່າ, ປ່ຽນແລມໃໝ່ກໍ່ຍັງຄືເກົ່າ ໃຫ້ພວກທ່ານຊ່ວຍແກ້ບັນຫານີ້ໃຫ້ແດ່ຂໍຂອບໃຈຫລາຍໆ.

Re:

Tue, 30 Mar 2010 04:58:59 -0400

ເລື່ອງມີຢູ່ວ່າ: ຂ້າພະເຈົ້າໃຊ້ເຄື່ອງພິມ canon LBP5000 ມາກໍ່ດົນສົມຄວນ
ແຕ່ພໍປ່ຽນແທ້ງມຶກໃໝ່ກໍ່ມີອາການສີບໍ່ເຂົ້າກັນແບບວ່າ: ເວລາເຮົາປຣິນສີແລ້ວສີດຳກັບສີອື່ນຈະບໍ່ທັບກັນ
ມັນເປັນເໝືອນເງົາ, ທ່ານໃດມີວິທີການກໍ່ຂໍຄວາມກະລູນາຊ່ວຍແດ່
ຂໍຂອບໃຈ

Re:

Thu, 29 Apr 2010 06:51:53 -0400

774GJ-X3942-9GTKT-FWYJ9-KM77K
GCBKQ-XD3M6-9PX9D-WGFT7-3TRTX
MBGPK-BTFT8-XCB4T-X39FG-4CCK6
MJVW8-679XG-YKG33-TGHTB- 3CF64
YWQBT-2F28H-278XB-9Q6HT-7YGRH

ວິທີ່ລົງແມ່ນຕ້ອງລົງ key ທາງອິນເຕີເນັດ ຈຶ່ງຄ່ອຍໄດ້
ຖ້າໃຜມີຂໍ້ສົ່ງໄສ ສົ່ງມາຖາມໄດ້ເດີ
nook_noy@live.com

Re:

Mon, 05 Apr 2010 07:05:07 -0400

ຊ່ວຍເເດ່ ຄອມພິມເຕີຂ້ອຍມີ Ram 4GB ບາດເບິ່ງນຳຄອມມີແຕ່ 3GB, ຖ້າໃຊ້ Win Vista ສິເຫັນເປັນ 4 GB, ຖ້າໃຊ້ XP ສິເຫັນແຕ່ 3GB, ລືມບອກຄອມຂ້ອຍແມ່ນ Notebook Dell VosTro 1720

Re:

Sun, 04 Apr 2010 15:44:39 -0400

ຄຶວ່າ: ເວລາເຮົາສັງພິມເອກະສານທຸກຄັ້ງມັນພິມກາຍຕາຫລອດເຊັ່ນ: ສົມມຸດວ່າ
ເຮົາສັງພິມແຕ່ໜ້າທີ1 ເມື່ອມັນພິມອອກມາໜ້າທີ1 ແລ້ວລະພັດມີໜ້າທີ2 ອອກ
ຕາມມາທັງໆທີ່ບໍ່ໄດ້ສັງ ໜ້າທີ2ນັ້ນຈະເປັນຂໍ້ຄວາມກ່ຽວກັບເອກະສານໂຕນັ້ນໆ
ມັນຈະບອກທີ່ຕັ້ງຂອງເອກະສານ-ຂໍ້ມູນລາຍລະອຽດເອກະສານ

ຊ່ວຍບອກແດ່ວ່າຊີ້ແກ້ໄຂບັນໄດ້ຈັງໃດເພື່ອບໍ່ຢາກໃຫ້ມັນ
ພິມໜ້າທີ່ເຮົາບໍ່ໄດ້ສັງນັ້ນອອກໃຫ້ອອກແຕ່ໜ້າທີ່ສັງນັ້ນ

Re:

Sun, 25 Apr 2010 17:34:45 -0400

ເຊິ່ງມັນຟ້ອງດັງຮູບ
http://img.laoupload.com/images/56173055914579550504.png

Re:

Sun, 25 Apr 2010 17:40:46 -0400

ຂອບໃຈລວງຫນ້າຫລາຍໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆໆ

Re:

Tue, 11 May 2010 07:25:47 -0400

ຂໍຄວາມຊ່ວຍເຫຼືອແດ່ ຂ້າພະເຈົ້າຢາກຮູ້ວິທີ Downlaod File ທີ່ເປັນ YouTube

Re:

Wed, 19 May 2010 13:33:08 -0400

ສະບາຍດີທ່ານ..

ບໍ່ຮູ້ຈະໄປຊໍບ່ອນໃດ ກະເລີຍມາທີ່ນີ້, ຄືວ່າຢາກໄດ້ Ebook ວິທີ back up data. ແບບຕັ້ງໄວ້ back up Auto ເລີຍ
ຊ່ວຍບອກແດ່ເດີທ່ານ.

ຂໍຂອບໃຈ

Re:

Fri, 21 May 2010 18:30:05 -0400

ຊ່ວຍບອກເວັບໄຊໂຫລດໂປຮແກຼມ Adobe Photoshop cs5 ແດ່

ຂອບໃຈ

Re:

Tue, 01 Jun 2010 19:21:33 -0400

ຂໍຖາມກ່ຽວກັບ ການຕໍ່ອິນເຕີເນັດ
ຂ້ອຍຢາກຕໍ່ອິນເຕີເນັດແບບ ເບີໂທລະສັບຕໍ່ເຂົ້າກັບ USB ໂມເດັມ
ແຕ່ບໍ່ຮູ້ກ່ຽວກັບຂໍ້ມູນ

ຂ້ອຍໄດ້ຍິນວ່າເບີຂອງໄທຕໍ່ເຂົ້າກັບ USB ໂມເດັມ ສາມາດຕໍ່ອິນເຕີເນັດມາຮອດລາວຫວາ
ສັນຍານເນັດ 4M ຂອງໄທຫັນນາ ສັນຍານຮອດແຖວສີໄຄບໍ່ ຍາກຮູ້ ?

Re:

Mon, 14 Jun 2010 06:59:43 -0400

ຂ້າພະເຈົ້າຢາກຮູ້ກ່ຽວກັບ ການຕິດຕັ້ງ theme ໃສ່ windows vista
ທ່ານຊ່ວຍບອກແດ່
ພ້ອມຮູບປະກອບເດີ

Re:

Fri, 02 Jul 2010 05:33:58 -0400

ຂໍຖາມແດ່ວ່າ ຄຮີລັດປ່ຽນພາສາອັງກິດ ເປັນ ໄທ ຢູ່ແທບທູນບາ ດ້ານລຸ່ມ ມີຄຮີຫຍັງແດ່ ?

Re:

Thu, 17 Jun 2010 03:00:11 -0400

AVL AND AVL ໃຊ້ຖານຂໍ້ມູນອັນດຽວກັນບໍຶ??

Re:

Mon, 05 Jul 2010 10:41:14 -0400

ສະບາຍດີ ທຸກໆ ທ່ານ, ມີປັນຫາກ່ຽວກັບການ shutdown Windows Dark ບໍ່ໄດ້, ບໍ່ຮູ້ວ່າເປັນເພາະຫຍັງ ຊ່ວຍຕອບແດ່

ຂໍຂອບໃຈ

Re:

Sun, 01 Aug 2010 07:20:18 -0400

ຫ້າມສຽບ USB ເດີ
ເນື່ອງຈາກວ່າຄອມພິວເຕີຂອງຂ້ອຍມີຄົນມາສຽບ USB ຫຼາຍ
ຂ້ອຍເລີຍຢາກຮູ້ວິທີກັນ ບໍ່ໃຫຄົນເອົາ USB ມາສຽບໃສ່ຄອມ
ໂດຍການໃສ່ລະຫັດ

THANK !!!”!!!

Re:

Thu, 29 Jul 2010 06:44:04 -0400

ຄືວ່າດາວໂລດ linux i386.iso ມາແລ້ວແຕ່ບໍ່ຮູ້ວິທີລົງ ຮິຮິ

Re:

Thu, 29 Jul 2010 13:24:26 -0400

ໃນການຊື້ USB ເຮົາຕ້ອງກວດເບິ່ງວ່າເປັນຂອງແທ້ ຫຼື ຂອງປອມ
ເພື່ອທີ່ຈະບໍ່ຖືກຫຼອກຈາກຜູ້ຂາຍ

เว็ปไซค์ : Overclockzone.com

Re:

Thu, 29 Jul 2010 14:56:46 -0400

Homepage - http://www.internetdownloadmanager.com/
ດາວໂຫລດລຸ່ມນີ້ເດີ

Re:

Mon, 02 Aug 2010 12:04:35 -0400

ึคิว่าข้าพะเจ้าต้องกานโปรแกรมที่เอาปะไว้ใช้ตั้งเวลา,วันทีเดือนปี, แล้วให้มัน Run ฟายที่เราต้องกานเอง Automatic...หลักๆแม่นให้ Run จำพวกฟายที่มีนามสะกุน .exe, .bat, .com

ช่วยแนะนำแด่ว่าใช้โปรแกรมใด------ขอบใจล่วงหน้าเดี้...

Re:

Sat, 07 Aug 2010 11:17:31 -0400

How I Can Read Lao Language In Google Chrome ?
I'm Using Laoscrip 6 But Not Work I can Read Only In Firefox And IE But I Need To Read In Chrome
Thank You

Re:

Thu, 12 Aug 2010 05:17:43 -0400

Avira Premium Security 9.0.0.415 | 24MB

Requirements:
� Computer: Pentium or higher, at least 133 MHz
� RAM: 192 MB / 512 MB RAM for Windows Vista
� 40 MB free memory on the hard disk (more if quarantine is used)
� 100 MB temporary memory on the hard disk
� Administrator rights are required for the installation

Homepage:http://www.avira.com/en/products/avira_premium_security_suite.html

Download:

Hotfile

Deposit Files

Re:

Thu, 12 Aug 2010 10:36:15 -0400

Notebook Compaq Presario A900 ຂອງຂ້າພະເຈົ້າ Driver ສຽງບໍ່ໄດ້
ຂ້າພະເຈົ້າເລີຍລົບກວນທ່ານຊອກຫາ Driver sound ໃຫ້ແດ່ ?
ຂອບໃຈລ່ວງໜ້າ

Re:

Sat, 14 Aug 2010 06:03:17 -0400

------------------Microsoft Office 2010 Keys----------------------------------
                **************************
Office Professional Plus 2010 Retail Keys
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

2K79J-DVFWG-MJT2Q-BX82R-T9PDV

6QFDX-PYH2G-PPYFD-C7RJM-BBKQ8

BDD3G-XM7FB-BD2HM-YK63V-VQFDK

YHDT7-WPQX9-BCYDM-6VJ9K-KRDMW

Office Standard 2010 Retail Keys
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

4DDJ8-DM67D-GJPT2-32H93-9MMWK

82DB6-BXG6H-QKBT6-3G42H-PPWM3

D34M3-3279D-HHPB3-DQPPQ-JHHFX

24PR2-JW928-QPKTK-CPD26-RYV3C

4JPCP-DJF9V-WX7PT-B9WX2-R47C6

7TF8R-933DG-MCBQR-TXPM7-G4JRM

6R7J3-K4CB9-PG7BR-TVDBG-YPGBD

HXJQ4-VT6T8-7YPRK-R2HQG-CYPPY

4G66W-HC3BK-HP397-XM3QQ-X73DC

Q7CR2-2VQMW-QKTMG-B2X22-944HP

Office 2010 Volume Keys
^^^^^^^^^^^^^^^^^^^^^^^

Office Professional Plus 2010       VYBBJ-TRJPB-QFQRF-QFT4D-H3GVB

Office Standard 2010                V7QKV-4XVVR-XYV4D-F7DFM-8R6BM

Office Home and Business 2010       D6QFG-VBYP2-XQHM7-J97RH-VVRCK

Access 2010                         V7Y44-9T38C-R2VJK-666HK-T7DDX

Excel 2010                          H62QG-HXVKF-PP4HP-66KMR-CW9BM

SharePoint Workspace 2010           QYYW6-QP4CB-MBV6G-HYMCJ-4T3J4

InfoPath 2010                       K96W8-67RPQ-62T9Y-J8FQJ-BT37T

OneNote 2010                        Q4Y4M-RHWJM-PY37F-MTKWH-D3XHX

Outlook 2010                        7YDC2-CWM8M-RRTJC-8MDVC-X3DWQ

PowerPoint 2010                     RC8FX-88JRY-3PF7C-X8P67-P4VTT

Project Professional 2010           YGX6F-PGV49-PGW3J-9BTGG-VHKC6

Project Standard 2010               4HP3K-88W3F-W2K3D-6677X-F9PGB

Publisher 2010                      BFK7F-9MYHM-V68C7-DRQ66-83YTP

Word 2010                           HVHB3-C6FV7-KQX9W-YQG79-CRY7T

Visio Premium 2010                  D9DWC-HPYVV-JGF4P-BTWQB-WX8BJ

Visio Professional 2010             7MCW8-VRQVK-G677T-PDJCM-Q8TCP

Visio Standard 2010                 767HD-QGMWX-8QTDB-9G3R2-KHFGJ

Visio And Project 2010 Keys
^^^^^^^^^^^^^^^^^^^^^^^^^^^

Project Professional 2010     GB9CQ-38GPG-4QK3K-YYBJT-M9KR7

Project Professional 2010       HWXJY-BV6PG-W3HCW-XWHGG-68WY3

Visio Professional 2010         7MXWK-Q7W73-8YJW8-7BT67-FDF87

Visio Professional 2010         H4F7B-FQVBX-RRWMB-6MFRR-BB2BW

Project Standard 2010             7PQJR-RH7PX-QFB2F-QPGW4-Q377V

Visio Standard 2010             228H4-T92MF-Q8PQJ-CGWRG-8KW92

Visio Premium 2010             C383V-HPHMC-Y6KWM-BDBHM-MK97G

Visio Premium 2010              PQCFB-YGXGC-TXB66-DH3VW-GCGYQ

Office 2010 Beta & RC Keys
^^^^^^^^^^^^^^^^^^^^^^^^^^

Office Professional 2010        MWHKH-MJ63P-VV2J2-T33VP-M92RV

Office Professional 2010        JY2TW-K7Y6G-F29CM-XQC2F-8P3Q3

Office Professional 2010        2PWHY-KT4X6-96PYW-XQR7V-HW2W9

Office Professional 2010        RBYC3-69PHF-836PF-XD2FF-9T4G3

Office Professional 2010        MJVW8-679XG-YKG33-TGHTB-3CF64

Office Professional 2010        3XCBH-MCHTM-X4HY2-VRCYJ-FCMVD

Office Professional 2010        6CX3T-KBWRV-GMD2F-8WV2V-4G8BT

Office Professional 2010        H3BHV-GKGM9-YFMXH-DGW7Q-YW962

Office Professional 2010        MBGPK-BTFT8-XCB4T-X39FG-4CCK6

Office Professional 2010        TV9PW-6RP6V-FDVP9-9GC78-Y4B4X

Office Professional 2010        7XD2X-JWJ94-BCHBW-W9WXP-J2WPT

Office Professional 2010        22HGX-728MX-BBWX9-7BB8X-J96B4

                               Other Office Keys
                               *****************

MICROSOFT OFFICE 2007 PROFESSIONAL PLUS EDITION

MTP6Q-D868F-448FG-B6MG7-3DBKT
WCRWK-Y637K-4MRCB-2YQXY-4BGWW
TT3M8-H3469-V89G6-8FWK7-D3Q9Q
VB48G-H6VK9-WJ93D-9R6RM-VP7GT
HCFPT-K86VV-DCKH3-87CCR-FM6HW
MTP6Q-D868F-448FG-B6MG7-3DBKT
WCRWK-Y637K-4MRCB-2YQXY-4BGWW
TT3M8-H3469-V89G6-8FWK7-D3Q9Q
VB48G-H6VK9-WJ93D-9R6RM-VP7GT
HCFPT-K86VV-DCKH3-87CCR-FM6HW

Office Ultimate 2007

T8RQ2-XTH2T-7CHTM-YGGDJ-RHBMB
DX4MW-77FBJ-34V3P-B8R9W-C77YB
FP29Y-YDBVF-GB4FV-MW4HX-YFDDY
CXMTT-QYBV6-TFT7Q-2MFYP-HF9QY
CJ9GX-94YWY-29WTK-86R2F-3DMMB
BDVWR-GRM69-T6VP2-3RKT2-QFT3Y
H6TTY-M2F23-HGKMB-YGMBM-X947M
QV6Q8-4VG9H-VV6WD-PBHCQ-KXT3Y
VBGV6-HBQ9Q-4CMMY-VH83T-CDXQY
T94DB-CBDHT-92272-FM7FK-VHRBB
QJRJK-J2VGB-G7DFK-GHPHX-2YVYB

Office Professional 2007

TBMFM-QXMQX-G8FVP-BFH9J-X9PHM
FHH8R-7WC4H-BH696-VBV6D-VCBMB
RHT43-PDJWT-JMKPB-8WTW7-WWG3Y
QG7TR-DHG94-W2YKQ-MY6VK-PK9QY

MICROSOFT OFFICE 2007 ENTERPRISE

JT3M4-C7F3Q-42XRT-PYMP3-D4MYJ
XP6X8-4G4HK-H2D3R-CTVW9-QRX38
CKX77-9C3TY-YFR68-M8KTB-6MDQ8
Q783C-XBHDT-4K3HD-WKF34-M9THW
RHF9V-PMVP6-C7TKC-RKKRC-FMVD8
VC3TY-M9FCT-YDFT9-XB2GK-PHJ7W
CHF3Y-HR8MH-V9M3Y-Y4W9G-7G938
MMCGV-RXK9R-2HTCW-FJWTV-DDBYJ
CMG9R-7BCPX-6CTXJ-CX8V2-CFHD8
KKDQD-YVYXR-G3VD9-F96WM-XKMYJ
FRDRK-X7GT8-6PYX8-RFGXF-PRMYJ
BBDFT-MXDY9-QFHW4-QRQW8-KDW7W
WV4H7-CCKRW-PJRWD-W3V8M-QHFMJ
WY6M2-2PYKJ-M3KQC-YB2YM-F8K38
GJGGF-HRD8B-72G24-FQM7D-6RTHW
DWR2Y-WMQRJ-7V3RK-HH7QD-BRHD8
VDCFP-P2V2V-G46YQ-WTCG7-GVWBJ
FM43K-688MP-VVYDW-BY38W-CVWBJ
XKKHD-HRG4J-K4HTF-X296T-TJW7W
G66FV-7DDKB-3DBV9-YXWBG-3TVD8
VPPQG-KJQPR-BTMWF-79CH9-H88BJ
PCG64-M8CF7-TGCJV-YH6GF-MYPVW
C6R6F-HFRYY-9RGH9-K6HBC-8QGHW
WJMT4-P3TWY-Q2FDY-648F4-294MJ
DY9MH-68PK6-BDTVP-TTFTJ-MXX38
V7MF8-7VBPV-FQQ4G-DPRJ2-DCWBJ
WKT4B-BPM48-QW7CK-2CQV3-WMDQ8
HJ9WD-XTWYM-8J6TF-KGF27-BJGHW
MCF4X-HYB49-9G9H7-44P9B-WDRMJ
J39WR-PW3TV-66JBF-YQHBV-8VQQ8
THFJ8-WP826-FK8PM-PWK9J-XJBYJ

MICROSOFT OFFICE 2007 HOME & STUDENT EDITION

MHCC4-WV74B-FTWPV-YM9JR-W3VWD
HBC66-D6YR7-CRP7H-T8VP4-99PMW
QXMDH-CRYFM-QFR87-HB783-T7RFQ
P37JV-FYJ32-YHH3T-KX7GX-7BJY3
HRMGX-K8WKJ-7FBGW-FTBCY-DWCM3
RCFMT-WFT7M-R779R-BJQMB-M2KWD
T9HJX-4C3BM-MG2R6-WC933-RCBRT
BTT7P-9HBFP-6QHM7-RFHDV-X8XWG
HWMMV-7H4DT-J2PJ6-YB8X4-VQCM6
JM2QC-KMVTP-VR8GV-HJRKQ-YWXWG
BHD34-K6BT7-T6PXP-BXKT4-X3G8D
DDH8T-C2JGD-G6MWW-6CYBV-BDTB6
B4MKP-KP9YP-7TBQ4-7T4XF-MTGWY
HBC66-D6YR7-CRP7H-T8VP4-99PMW
JWR9T-HFR92-74RQ7-3FRMB-CY676
DDY79-433JV-2RXGX-MQFQP-PFDH8
WRGJQ-2J2HB-8XP8D-6J2YK-BMFFD
HX2HC-MJM6Q-4487F-23FMP-9VKV8
HX2DJ-36TJX-CRVRJ-C72Q8-CJTBQ

MICROSOFT OFFICE 2007 STANDARD EDITION

CTKXX-M97FT-89PW2-DHKD3-74MYJ
KD3RD-TKY7Y-6QDP8-WXKX6-24BF3
B7MTR-PBJVD-47GWX-RJXTG-268PJ
JY46M-9BV6V-JJ2YH-JM6T8-2TR2D
QX8VX-QVF3W-MJ49F-6436K-PJ6WQ

Hope you would all enjoy this,i will be releasing more if i get it,Also If anyOne need Office 2010 Professional Plus MAK Key with
More than 25000 activations just for 20$

contact me: pkajeesh123@gmail.com

Re:

Sat, 21 Aug 2010 05:59:41 -0400

ສົມມຸດວ່າເຮົາຫລົງລຶບກ່ອງຂີ້ເຫຍື້ອອອກຈາກໜ້າຈໍ
ເຮົາຢາກຈະໃຫ້ມັນກັບຄືນມາເຮົາຄວນເຮັດແນວໃດ ???
ທ່ານຊ່ວຍບອກແດ່ ??

Re:

Sun, 22 Aug 2010 13:35:47 -0400

ใผกะได้ช่วยข้อยแด่ คิว่าลง windows แล้วผิดพาดพัดใปหลงลงใส่ช่อง D แล้วข้อมูนหายหมดเลีย ช่วยบอกโปรแกรมดีๆให้แด่ ที่สามาดกู้ได้หมดทุกรูบแบบฟายเดี หลักๆแม่นฟาย Excel 2007 (.xlsx) เอาโปรแกรมที่สามาดกู้แบบ Format เดี!!!!!!

Re:

Tue, 26 Jan 2010 14:46:07 -0500

LAOAV 2010 ມີຫຍັງໃໝ່ນະ?

Re:

Sat, 30 Jan 2010 09:45:48 -0500

Lao antivirus ຈະມີຈຳໜ່າຍຢູ່ໃສ ແລະ ລາຄາເທົ່າໃດ

ຢາກຮູ້?????

Re:

Tue, 02 Feb 2010 10:47:22 -0500

ສະບາຍດີ ອາເລັກ

ຊ້າພະເຈ້າມີບັນຫາກັບ ໄວຣັສ ຊື່ວ່າvirus Worm.Win32.Huhk.c

ມັນຈະຕິດ File Explorer.exe, setup.exe, office.exe or other.

ບໍ່ຮູ້ຈະຂ້າມັນແນວໃດຈີ່ງຈະໝົດ ທ່ານພໍມີວິທີໃດແດ່ທີ່ຈະກຳຈັດມັນໃດ້ ຊ່ວຍແດ່ເດີ

ຂໍຂອບໃຈ

Re:

Sat, 13 Feb 2010 07:49:24 -0500

ຖ້າເຄື່ອງຄອມພິວເຕີລົງ ANTI 2 ໂຕຈະເປັນຫຍັງບໍ່

ເຊັ່ນ ລົງ AVG 9.0 ກັບ Antivirus Lao 2010

ຂໍຖາມແດ່ ??????

Re:

Sat, 13 Feb 2010 07:52:06 -0500

ຂໍຖາມແດ່ວ່າມີ AntiVirus ໂຕໃດແດ່ທີ່ອອກມາໃໝ່ໃນປີ 2010

Re:

Sun, 14 Feb 2010 07:53:22 -0500

ແມ່ນໄວຮັສຫຼືບໍ? ເພາະວ່າຫາກໍລົງວິນໂດສໄຫ່ມໆມາເປັນຫຍັງພົບໄວຮັສຫຼາຍໂຕແທ້
ລາຍລະອຽດມີດັ່ງນີ້ ທ່ານຊ່ວຍກວດເບີ່ງວ່າແມ່ນຫຍັງແທ້

Found: C:\Program Files\WinRAR\UnRAR.exe,W32/Troj.204800 (Troj)
---------------2/14/2010 11:05:36 AM---------------
Found: C:\Program Files\WinRAR\UnRAR.exe,W32/Troj.204800 (Troj)
---------------2/14/2010 11:05:39 AM---------------
File moved to quarantine: C:\Program Files\WinRAR\UnRAR.exe,W32/Troj.204800 (Troj)
---------------2/14/2010 11:05:42 AM---------------
Found: C:\System Volume Information\_restore{064D8648-C271-4C21-B76E-2A0586441E3E} \RP6\A0000716.exe,W32/Troj.204800 (Troj)
---------------2/14/2010 11:05:45 AM---------------
File moved to quarantine: C:\System Volume Information\_restore{064D8648-C271-4C21-B76E-2A0586441E3E} \RP6\A0000716.exe,W32/Troj.204800 (Troj)
---------------2/14/2010 12:09:08 PM---------------
Found: D:\Photoshop8\Crack\kgcsce.exe,W32/Troj.011009141129 (Troj)
---------------2/14/2010 12:09:35 PM---------------
Found: D:\Grams\Antivirus\avira_premium_security_suite_en.exe,W32/ Troj.82F4CB10 (Troj)
---------------2/14/2010 12:09:35 PM---------------
Found: D:\Grams\For Internet\dap91.exe,W32/Troj-Toolbar. (Troj)
---------------2/14/2010 12:09:37 PM---------------
Found: D:\Grams\For Internet\Metin2_20080811.exe,W32/Troj.E2059570 (Troj)
---------------2/14/2010 12:09:39 PM---------------
Found: D:\Grams\Photo\Kodak.exe,W32/Troj.328107 (Troj)
---------------2/14/2010 12:09:39 PM---------------
Found: D:\Grams\Photo\NoisewareProPlugin4205.exe,W32/Troj.48EFCDCD (Troj)
---------------2/14/2010 12:09:40 PM---------------
Found: D:\Grams\General\WinRAR.v.3.7.Beta.7.Corp.exe,W32/Troj.161754 (Troj)
---------------2/14/2010 12:09:40 PM---------------
Found: D:\Grams\General\lswin604.exe,W32/Troj.3A5B1B81 (Troj)
---------------2/14/2010 12:09:56 PM---------------
Found: D:\System Volume Information\_restore{064D8648-C271-4C21-B76E-2A0586441E3E} \RP6\change.log,Maybe New Virus File
---------------2/14/2010 12:11:07 PM---------------
Found: D:\F\New Folder\item\lswin604.exe,W32/Troj.3A5B1B81 (Troj)
---------------2/14/2010 12:16:58 PM---------------
Total Folder: 3965
Total File: 24245
Total Time Scanned: 73:21:01 Minutes
Total Virus Found: 11
---------------2/14/2010 12:45:13 PM---------------
File Killed: C:\Documents and Settings\All Users\Application Data\Lao Anti-Virus\Quarantine\A0000716.exe.LBK
---------------2/14/2010 12:45:13 PM---------------
File Killed: C:\Documents and Settings\All Users\Application Data\Lao Anti-Virus\Quarantine\UnRAR.exe.LBK

Re:

Sun, 14 Feb 2010 08:55:11 -0500

ຢາກຮູ້ວິທີລົງ Lao script version 7 ໃນ windows vista ແລະ seven
ແດ່ ຂະນ້ອຍລົງແນວໃດກາບໍ່ໄດ້

Re:

Wed, 17 Feb 2010 05:32:18 -0500

how to remove virus ".jpg.exe"
help please !

thank you,

Re:

Thu, 11 Mar 2010 07:34:37 -0500

ຄອມຂ້ອຍສົງໃສຕິດໄວຣັສ ເປີດໂປຣແກຣມຫຍັງກະບ່ໄດ້ ເປີດເອັກເຊລກະປິດເອງ ເຂົ້າສະຕາດ ຣັນ ກະບ່ໄດ້ MSN ກະເປີດບ່ຂື້ນ ໃຜຮູ້ວິທີແກ້ຊ່ວຍບອກແດ່
ຂອບໃຈ

Re:

Tue, 23 Mar 2010 04:45:23 -0400

ເວລາຂ້ອຍສັງປຣີ້ນແລ້ວບໍ່ສາມາດໃຊ້ການໄດ້, ເມື່ອຂ່ອຍaddໃນ Printer & fax ແລ້ວມັນຈະໂຊຂໍ້ຄວາມ ດັ່ງທີ່ຂ້ອຍໂຊໃນນີ້. ຂ້ອຍເຄີຍລົງwindowໃຫມ່ແລ້ວ ກະໃຊ້ໄດ້ຊ່ວງໃດນຶ່ງ ແລ້ວກໍໍໍເກີດບັນຫາເກົ່າຂຶ້ນອີກ, ຕອນນີ້ຂ້ອຍສັ່ງປຣີ້ນບໍໄດ້ເລີຍ, ຂ້ອຍບໍ່ຍາກລົງwindowໃຫມ່ ນະ, ກະລຸນາຫາວິທີ່ແກ້ໄຂ້ຊ່ວຍດວ້ຍ ທ່ານຜູ້ຮູ້ທັງຫລາຍ
ຂອບໃຈລວ່ງຫນ້າເດີທຸກທ່ານ...

Re:

Wed, 07 Jul 2010 06:47:14 -0400

ແມ່ນໄວລັດບໍ່ ເວລາສຽບ USB, External ແລ້ວບໍ່ຂື້ນເປັນຍ້ອນຫັຍງ ຫຼືໄວລັດ ທ່ານຜູ້ຮູ້ຊ່ວຍບອກວິທີແກ້ໄຂໃຫ້ດ້ວຍ.
ຂອບໃຈລວງໜ້າ

Re:

Thu, 08 Jul 2010 10:38:10 -0400

ຂ້ອຍຢາກໄດ້ Sever Eset Smart Security 4.2.40.0 ແມ່ນໃຜມີ
ຂໍແດ່ ????

ຂອບໃຈໄວ້ລ່ວງໜ້າ

Re:

Thu, 15 Jul 2010 11:26:19 -0400

ຂ້ອຍຍາກຮູ້ວ່າ Laptop msi EX460 ຂອງຂ້ອຍລົງ windows 7 ໄດ້ບໍ່ ເພາະວ່າໄດຮ໌ເວີຮອງຮັບແຕ່ windows vista ຢ່າງດຽວ
ແລະ ຂ້ອຍເຄີຍເຫັນ Laptop ທີ່ ໄດຮ໌ເວີ ບໍ່ຮອງຮັບ Window 7
ແຕ່ເຂົາສາມາດລົງ Windows 7 ໄດ້ ແລະ ໄດຮ໌ເວີກໍ່ຮອງຮັບ
ຢາກຮູ້ວ່າເຮັດໄດ້ແນວໃດ ຈຶ່ງລົງ windows 7 ໄດ້ ???

Re:

Fri, 23 Jul 2010 10:18:14 -0400

ລົງລາວແອນຕີໄວຣັສແລ້ວແຕ່ມັນເປີດບ່ໄດ້ ມັນປິດໂປຣແກຣມເອົາເອງ ມີວິທີໃດແກ້ໄຂໄດ້ແດ່
Thank

Re:

Fri, 23 Jul 2010 12:17:55 -0400

ຂອບໃຈ

Re:

Fri, 23 Jul 2010 15:39:50 -0400

maen phai me activating code sum lup Lao antivirus nae......please send it to 77999229
Jark Ty
Kopchai lai222222

Re:

Sat, 24 Jul 2010 07:34:21 -0400

clixdoo_clientid = 711; clixdoo_width = 300; clixdoo_height = 25

NortonTM AntiVirus 2010
โปรแกรมพื้นฐานที่คอมพิวเตอร์ทุกเครื่องควรมี – การปกป้องจากการเข้ารหัสที่เป็นอันตราย

ประสิทธิภาพการทำงานของ Norton AntiVirus 2010
• การตรวจจับมัลแวร์ที่มีประสิทธิภาพและแม่นยำ เหนือกว่าเทคโนโลยีตรวจจับที่อิงจากพฤติกรรมและเอกลักษณ์เฉพาะตัวของแฮ็ก เกอร์ ด้วยรหัสความปลอดภัยรูปแบบใหม่ที่เรียกว่า Quorum
• สกัดกั้นไวรัส, สปายแวร์, บอทซ์ (bots) และอีกมากมาย
• ใช้เทคโนโลยีอัจฉริยะเพื่อการสแกนที่เร็วกว่า, จำนวนน้อยกว่า และใช้เวลาสั้นกว่า

Norton TM Internet Security 2010
โปรแกรม ประสิทธิภาพสูงที่เหมาะสำหรับท่องโลกอินเตอร์เน็ต
ประสิทธิภาพการทำงาน ของ Norton Internet Security 2010
• การตรวจจับมัลแวร์ที่มีประสิทธิภาพและแม่นยำ เหนือกว่าเทคโนโลยีตรวจจับที่อิงจากพฤติกรรมและเอกลักษณ์เฉพาะตัวของแฮ็ก เกอร์ ด้วยรหัสความปลอดภัยรูปแบบใหม่ที่เรียกว่า Quorum
• สกัดกั้นการโจรกรรมข้อมูลส่วนบุคคลบนเครือข่าย, ไวรัส, สปายแวร์, บอทซ์ (bots), โทรจัน และ
อีกมากมาย
• ประสิทธิภาพแอนตี้สแปมระดับมืออาชีพ
• Norton เพิ่มคุณสมบัติ OnlineFamily เพื่อความปลอดภัยของครอบครัวออนไลน์
• Norton Safeweb โปรแกรมที่ช่วยให้คุณท่องเว็บไซต์ได้อย่างปลอดภัยที่สุด พร้อมทั้งสกัดกั้นเว็บไซต์ปลอมและยืนยันเว็บไซต์ที่เชื่อถือได้

http://www.upload.tc/download/58376/norton-antivirus-setup_wyverorm.rar.html

Re:

Sun, 25 Jul 2010 09:07:31 -0400

ຊ່ວຍບອກວິທີແດ່ ????

Re:

Wed, 28 Jul 2010 15:35:07 -0400

ແບບວ່າ Notebook ຂອງຂ້ອຍຕິດຕັ້ງສັນຍານວາຍເລັດເຂົ້າ
ແຕ່ບໍ່ຮູ້ລະຫັດເພາະໃຫ້ຊ່າງຕັ້ງໃຫ້
ຂ້ອຍຢາກຮູ້ວ່າເຮົາສາມາດກວດເບິ່ງລະຫັດສັນຍານວາຍເລັດຄືນໄດ້ບໍ່
ວ່າມັນມີລະຫັດໃດແດ່ ??

ຂອບໃຈລ່ວງໜ້າ

Re:

Thu, 05 Aug 2010 04:55:35 -0400

ຂອບໃຈລ່ວງໜ້າທີ່ເອົາໃຫ້

Re:

Wed, 04 Aug 2010 19:55:23 -0400

ຂອບໃຈທີ່ມີເວັບລາວນີ້ເພື່ອຖາມຕອບກັນ

Re:

Sat, 07 Aug 2010 07:28:20 -0400

ຂໍວິທີຕິດຕັ້ງ D-Link Wireless N 150 Home Router DIR-600 ແດ່ ?

Re:

Fri, 13 Aug 2010 11:29:04 -0400

ເລື່ອງມີຢູ່ວ່າ : ຄອມພີວເຕີ ຂພຈ ຫລີ້ນອີນເຕີເນັດໄດ້ ແຕ່ ເນັດເວີກບໍ່ເຫັນກັນ ຄິກ view workgroup computer ບໍ່ເຫັນຫຍັງຂື້ນມາ ມິດຈີ່ລີ່ຢູ່ ແຕ່ເຂົ້າ DOS Ping ຫາກັນໄດ້ ເພາະ ຂພຈ ຢາກແຊ່ Printer ນຳກັນ

ຂອບໃຈລວງໜ້າ