Boot in safe mode. The reason for this is that in safe mode there is not much processes running. You need this setup in step 9 below as this virus is a nasty one.
Open up windows explorer and go to Tools -> Folder options .
a. Make sure the following are TICKED -> Show hidden files and folders
b. Make sure the following are UNticked -> Hide Extensions for known file types
Go to the following directories (this is for vista home premium):
C:\Program Files\Internet Explorer
C:\Users\user\AppData\Local\Temp
And you will see there a file called wmpscfgs.exe. Delete them.
Open up your task manager, make sure the ’show all processes’ is ticked and look for the same process. If it is running. Kill it.
Starting this part, steps needs more technical experience. If you are not comfortable in doing the below steps, look for someone that can help you.

Open up regedit and go to: HKLM->Software -> Microsoft -> Windows -> CurrentVersion –> Run
Look for Adobe_reader entry with data: “%ProgramFiles%\Internet Explorer\wmpscfgs.exe“. Delete it. For me from this point almost all of the things written in the NET currently don’t have the steps below. And its the reason why this virus keeps coming back.
Hopefully you dont have much applications under “HKLM->Software -> Microsoft -> Windows -> CurrentVersion -> Run”. Because you have to visit each one of them literally because this virus hijacks almost every application in the RUN list above.
Basically it renames the old exe file from say “mcagent.exe” to “mcagent .exe”. With a space between the filename and the “.exe” or extension. It will then create a copy of itself with the same filename as your executable file so that when someone executes your file, the virus will be executed first then your file. It will do this for every apps you have in your Run list.
Thus if you go to the location of say of McAfee mcagent.exe application you will see two to three files with almost the same filename:

mcagent.exe -> which is a 39 KB file, and very recently created and which is the virus that keeps adding back that wmpscfgs.exe file.
mcagent .exe -> the original mcagent file, renamed.
mcagent.exe.delme -> delete this one as well. I don’t see this occurring every time, but i have seen some apps with this file in them and very recently created.
You first need to kill the corresponding process of the infected file if they are running in task manager, manually remove the existing .exe file which is around 39KB only and rename back your old executable file to its former filename. Repeat this for every application you have in your Run list above. The only thing that i saw this virus didn’t infect was the windows defender application. The rest in my Run list were screwed. Uninstalling and reinstalling them doesn’t help as well as the former Trojan exe file will be retained in the application directory.
This is the reason why Microsoft Security Essentials was complaining that your startup executable files are viruses.

Once you have verified that each application in your run list has been restored. To be fully sure that you don’t have any such files lingering in your system, do a drive search for any file that has 39KB size and has just been recently created and examine each one carefully if they are just copies of your original executable file. Follow step 7 for each occurrence of it. So far, i only saw this virus attach itself into executable files.
If you want to be 100% sure, next thing you need to do is double check every process running in your task manager if they are legit. Some process specially those started by system wont be able to take you to its process file, its ok, but most of them if you do a right click in them, you should see an option there called “Open File Location”. Then follow steps 7 above.
Reboot and that’s it!

Just as I’m about to leave for Mobile World Congress, an interesting video caught my attention that seems to be more timely than ever considering Microsoft’s upcoming announcements about its future mobile strategy.

The video by Barton Smith, a designer from Australia of all places, appears to be a prototype UI for a conceptual “Locus OS” which is described as a “location-based operating system”. What makes it special is that it appears to be Microsoft branded, however without any background information I can’t say for certain if this was commissioned by Microsoft or not.

The video itself presents some very interesting concepts, the main focus of which is a multiple “desktop” arrangement that is location-aware – giving you flexibility in the widgets and applications you see based on your location and what you might be doing. Although some elements of the UX appear inspired by the iPhone, Palm Pre and Android, the designer points out that this was created in 2008 making many of the ideas original at the time. Nevertheless, definitely worth a look.

Without a doubt, Microsoft has set its eyes on the consumer mobile space this year. Unless you’ve been hiding under an iPhone, you might have noticed excitement has been building around the mobile event of the year, Mobile World Congress 2010 where Microsoft is expected to reveal the much anticipated Windows Mobile 7 platform, among other things.

Join Tom Warren from Neowin.net and I as we will attempt to capture the live Ballmer and co. experience for all of you using the magic of capturing light and the English language in a group liveblog of the scheduled Microsoft Press Conference at MWC 2010.

Please check back on Monday, 15th of February from 3-4pm Central European Time (UTC+1) (find out when that is in your local timezone here). Alternatively for the organized among us, download the iCal.

Disclosure: I am attending Mobile World Congress as a guest of Microsoft Australia.

Is negative feedback an issue and how does it compared to the culture of praise on Flickr and similar?

Let me set the picture: You know your interests are a bit leftfield (unusual) and that what you are really interested in photographing isn’t mainstream interest. The feedback is largely positive but you occasionally get some negative feedback; some pretty scathing – how should you feel, and how should you react?

Flickr

Flickr is a great website; and one that I probably use most frequently to discover new work from a worldwide audience but also as a gallery for my own work. It also is a forum for critique and feedback but it is patently obvious that little negative feedback is posted (and you can argue why should it) and a lot of back patting is going on; some very justified, some dubiously so.  It is easy to get used to positivity so it would seem that where negative feedback arises a very knee jerk spat can come out, or a defensive attitude. Sometimes it just results in what is negative feedback going to achieve.

We have all in some way, become accustomed to positive feedback over negative feedback.

YouTube

 I put a short slideshow together on YouTube to show a range of pictures I was exhibiting two weeks ago at the Open University. It seems fairly well received for what is essentially my rather (as the mainstream would have it) dull subject of suburbia and a town called Milton Keynes. Today I received some negative feedback, which the author seems to have deleted but I still had the email notification. The nub of the criticism was that it was a waste of five minutes of their life.

So how should you react?

Instinctively, the natural reaction is to defend yourself. And a good measure of that is no bad thing in my book. Without some defence of the self, where is your self integrity going to go? But should you feel that perhaps you’re not cut out to take pictures, or that your project is a doomed idea?

Of course not. The best way to take it is actually for what one person has said, that my pictures were a waste of time for somebody. It’s also worth taking on board that a lot more people will have seen my pictures and have brushed over them and have been bored by them, found them dismal or indeed just bad pictures.

This is a fact.

I myself don’t like every photograph I see, or every piece of music I hear, nor every painting. So neither should I expect any different about my work.

So your attitude to negative feedback should be to take it on board if there is useful criticism; but if one person or a few are dulled by what they see of their work; don’t give up. Reflect, look at your work and ask yourself whether it works for you. If it does, keep going but don’t be adverse to taking on people’s points of view, they may have some very useful to suggest to you; ways in which you can improve.

I believe in my Milton Keynes project. It’s very much leftfield, it’s perhaps rather dull to some people (maybe even most people) – but I’m, not giving up on it, because I know I may push this project as much as I can and it may never go anywhere. But I’m getting satisfaction from it and I’m enjoying it. It is worth hanging on to this because at least you’ll have a finished article you are pleased with.

So the message is, expect criticism, expect savage criticism, and be prepared to take some onboard. But also be prepared to stand up for yourself where you honestly feel you can. If you can’t stand by your favourite work, then who will? If you like one of your pictures but no one else does, it doesn’t really matter, does it?

“Need a vBscript to Query Active Directory for old accounts and disable them”

At which point I immediately pointed out “Powershell” as the quicker and more direct solution.

He in return sent back the specs to what he needed.

• Go through and disable accounts over XXX days
• Go through and delete accounts older than yyy days
• Accounts which are flagged with key words in the “Description” field should NOT be deleted

This, in Powershell with the Quest Active roles commandlets is like a walk in the park.   Really it IS!

In Active Directory, there is a field for “LogonTime” which is the last time you successfully logged in.  And we can very easily compare that with the CurrentDate.

Quest has a command let built right into disable users.  It’s just

DISABLE-QADUSER identity

Where identity is the name you’re disabling in Active Directory

You can also EASILY remove Objects in Active Directory with the Quest Cmdlets too.  Remember, everything (OU’s, computers, users) is just an Object in A/D so to pull that little miracle off just run a

REMOVE-QADOBJECT identity

Where identity is the name of the object you are removing.  Careful with this CmdLet.  I ALWAYS run it (and any other destructive ones) with a –WHATIF parameter to make sure it’s going to do what I want.  If you mistype, you can delete a LOT of things easily.

In the Active Directory Notes field (Typically under the “Telephones” tab) We’re going to put in the word ***OVERRIDE*** to indicate the account NEVER gets deleted automatically (unless we remove those words from the Notes Field)

Also in Active Directory under the Description we’re adding the words “On Leave Until" to indicate the user is gone for a specified period of time.   This will allow us to have a script that can look and shut things down without us doing anything.  

In this rendition I’ve left in the –WHATIF parameter to cover the bases of “Murphy”

It also echoes to the screen the status of Each account that is potentially going to be deleted or not.  Accounts to be disabled are just disabled without notice

Let me know how this works and be VERY VERY VERY VERY careful using it.  I highly recommend practicing this on a TEST domain or TEST OU at the VERY minimal before going production.

A special shout out goes to my buddy @moldor in Australia for which this script would NOT have existed.  He created the need and the requirements.  If you’re looking for a great Mac/Linux guy who’ll even work with Windows in Australia?  Give him a shout!

----------------------------------------------- AutoCleanADUsers-Stale.PS1 -------------------------------------

# Uses Quest Active Roles
# Free to download http://www.quest.com/powershell/activeroles-server.aspx
#
# Get all users in that have not logged on within
# XXX days in "Active Directory" and Disable them
#
# Get the Current Date
#
$COMPAREDATE=GET-DATE
#
# Number of Days to check back.  90 days
#
$NumberDays=90
#
# Number of Days to check for REALLY Stale accounts
# Our sample here is taking "OldAccounts" and pumping up
# 30 more days.  Therefore 120 days old accounts that haven't
# logged in should be purged
#
$DeleteDate=$NumberDays+30
#
# We have certain "Override fields" that bypass a delete
# happening.  If the "Notes" field in A/D contains the
# EXACT Override phrase ANYWHERE (in this case it is the
# word ***OVERRIDE*** and it IS case sensitive
# The account will NEVER be deleted (unless of course you remove
# Word from the Notes field
#
#$OverRide='***OVERRIDE***'
#
# The other override field is if
# the OnLeave details are in the Description
# Field in A/D.  this allows for a User who is
# Not gone (IE: Contractor / Student) but may
# Return to have the account disabled and
# Left alone until they return.  The words here are
# simple On Leave Until and can be ANYWHERE in the
# Description Field in A/D
#
$OnLeave='On Leave Until'
#
# Organizational Unit to search – This is in the fictional domain of
# ‘Contoso.local’ in the OU of Users under the Business OU on the Root
# of the Contoso A/D
#
$OU='Contoso.local/Business/Users'
#
# Get all users not active within the specified range and disable the accounts in Active Directory
#
# We store them away as a variable since we're going to examine the list a few times.
#
$LISTOFACCOUNTS=GET-QADUSER -SearchRoot $OU | where { $_.LastLogon.AddDays($NumberDays) -gt $CURRENTDATE }
#
# Any account not logged in within the short range gets Disabled in AD
#
$LISTOFACCOUNTS | DISABLE-QADUSER -whatif
#
# Pull up a new list.   Really old accounts
#
$LISTOFPOTENTIALDELETES=$LISTOFACCOUNTS | where { $_.LastLogon.AddDays($DeleteDate) –gt $CURRENTDATE }
#
# Secondary compare is more interesting.  If the accounts are VERY stale, they get deleted UNLESS special keywords
# are in place
#
#
#
FOREACH ($USER in $LISTOFPOTENTIALDELETES)
{
    IF (($USER.Notes -notlike '*'+$OVERRIDE+'*') -and ($USER.Description -notlike '*'+$OnLeave+'*'))
    {
        REMOVE-QADOBJECT $USER.Name -whatif
        WRITE-HOST $USER.Name 'Deleted'
    }
    ELSEIF ($USER.Notes -like '*'+$OVERRIDE+'*')
        {
            WRITE-HOST $USER.Name 'Not removed due to Administrative Override'
        }
        ELSE
        {
            WRITE-HOST $USER.Name 'Not removed - Presently on Leave'
        }
}

----------------------------------------------- AutoCleanADUsers-Stale.PS1 -------------------------------------

The ATI Radeon HD 5450 will cost less than $60 (USD) for a 512MB memory configuration and supporting DirectX 11 making it one sweet deal if you’re looking for a DirectX 11 graphics card for your Windows 7 PC.

The Radeon HD 5450 offers entry level performance and ultra-low power consumption and also supports AMD’s multi-monitor technology called ATI Eyefinity and their ATI Stream technology. There will be variations of this card depending on partner offers including passive cooling models or whisper-quiet, single slot fan-cooled models.

This graphics card is perfect for someone putting together a home theater PC (HTPC) with Windows 7 as it comes with features like HDMI 1.3a with Dolby TrueHD and DTS-HD Master Audio.

For a complete list of specs on the ATI Radeon HD 5450, click here.

You’d have so many clients with their own Active Directory setups and each time you’d have to go directly to the Small Business Server to manage it, or try to have a machine dedicated to that purpose.   Plus you might have tools you’d want to copy to the server to help in that process.

A real pain in the you know what.  But Along came Powershell and Quest ActiveRoles Management Shell; and My life changed for the better.  You see Powershell can connect to a Domain Controller on it’s own terms, you just need to validate against it once before you do so.  Which makes things far far easier.

For example here he have a small simple script that let’s you connect to a Domain Controller called ‘dc.contoso.local’ and unlock a user account called John.Smith

------------------------------------------------------

# Note uncomment line below if you need to add in the Snapin for Quest ActiveRoles

# (Software is installed but not part of default Powershell Profile)

#

# ADD-PSSNAPIN Quest.ActiveRoles.ADManagement

#

# Popup and get Credentials for Domain

#

$CREDS=GET-CREDENTIAL

#

# Connect to Domain Controller dc.contoso.local with

# Provided Credentials

#

Connect-QADSERVICE ‘dc.contoso.local:389’ –credential $CREDS

#

# Now that you are in the domain, unlock the User

#

UNLOCK-QADUSER john.smith

------------------------------------------------------------

In truth this is a VERY simple script but the point you need to understand that it takes nothing to edit the name of the DC to be an IP address of a different domain on different site. 

The “GET-CREDENTIAL” commandlet does not know or even CARE about the name of the other domain.  All it does it ask you to provide the credentials.  These credentials take the standard format of a UPN or the traditional DOMAIN\Username. It will generate the keys. 

Once the CONNECT-QADSERVICE Commandlet talks to the other domain controller it provides those credentials through the –credential parameter.

Active Directory on THAT Domain takes that information, processes it and accepts it (because ID and password and provided Domain are valid) or not.  There is no magic to it!

Once you have done this process you (as long as that shell is open) are managing THAT domain.   Or at least you are as far as the Quest Active Roles are concerned.

Even if your computer is a member of DOMAIN “ABC.FABRIKAM.COM” and you’re trying to manage the “CONTOSO.LOCAL” domain, it doesn’t matter!  You can create, delete, unlock or Query the Active Directory for whatever information you need.   Isn’t it nice when life is simpler?

When faced with a buggy piece of software, most users probably work-around the problems in silence, others might voice the issue at the developers, but there’s also a growing minority who whip out their development tools and attempt to fix it themselves.

In the case of the broken Adobe Reader 9.0 PDF preview and thumbnail handler on 64-bits versions of Windows 7 and Windows Vista, Leo Davidson did just that.

For the past two years, Adobe has neglected a simple issue with Adobe Reader that broke the default and extremely useful file thumbnail and file preview features in Vista and 7 under 64-bit. The problem also extends onto other applications that use the preview APIs such as Office Outlook, throwing out the window what would have been an elegant and streamlined PDF viewing experience, especially since you can scroll within the PDF without awakening the beast that is Adobe Reader.

After some detective work by Leo, not only did he pinpoint the root cause of both the preview and thumbnail issues, but today released a dead-simple fix in a neat executable package that fixes both problems faster than you can say “what the hell Adobe”.

%Documents and Settings%\All Users\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.ico
%Documents and Settings%\All Users\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.mkv
%Documents and Settings%\All Users\Start Menu\Programs\Antimalware Defender
%Documents and Settings%\All Users\Start Menu\Programs\Antimalware Defender\Antimalware Defender.lnk
%Documents and Settings%\All Users\Start Menu\Programs\Startup\ca84c702-c758-4421-974e-b02662e76d7c_6.lnk
%Program Files%\Antimalware Defender
%Program Files%\Antimalware Defender\Antimalware Defender.dll
%WINDOWS%\system32\ca84c702-c758-4421-974e-b02662e76d7c_6.avi
%WINDOWS%\system32\ca84c702-c758-4421-974e-b02662e76d7c_6.ico
%UserProfile%\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.avi
%UserProfile%\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.ico
%UserProfile%\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.mkv
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antimalware Defender.lnk
%UserProfile%\Desktop\Antimalware Defender.lnk
%UserProfile%\Local Settings\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.avi
%UserProfile%\Local Settings\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.ico
%UserProfile%\Local Settings\Application Data\ca84c702-c758-4421-974e-b02662e76d7c_6.mkv
%UserProfile%\Start Menu\Programs\Antimalware Defender
%UserProfile%\Start Menu\Programs\Antimalware Defender\Antimalware Defender.lnk

%Documents and Settings%\[UserName]\Application Data\av.exe
%Documents and Settings%\[UserName]\Application Data\WRblt8464P

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1?

The quick launch bar was available in Vista, XP, and Windows 2000.

Here it is a shot of it under Windows XP:

There is probably a good reason for them to remove it. With the complete redesign of the explorer interface, there are probably better ways of accomplishing the same thing.

I am stuck in my ways, and I like the quick launch. I found a way to get it back in Windows 7.

Right click on the task bar. Go to toolbars, and then click on new toolbar:

It will popup a folder selection box. The folder you select will become the source for your quick launch. In my case, I created a folder under my user profile called “Quick Launch”:

Now…we need to make some changes. First unlock the task bar by right clicking it and unchecking that option:

Then right click on the new tool bar and uncheck show text, and show title:

Now, you have a quick launch. Move it over to the left (You can since you unlocked the task bar) Just drop shortcuts into the folder you selected, and they will show up:

Lock the task bar again, and you have a quick launch bar in Windows 7.

There are many reasons people choose which browser to use. Most people want to know and trust the company behind their browser. And people are looking a browser that protects them – and their privacy online. In an August 13th, 2009 post on the IEBlog, we announced Internet Explorer 8’s SmartScreen Filter had hit over 80 million malware blocks. But that was back in August. As of today, Internet Explorer 8 has done over 350 million malware blocks. You can see Internet Explorer 8’s SmartScreen Filter in action in this blog post. Internet Explorer 8’s SmartScreen Filter blocks malware over 2 million times a day.

Phishing is a very serious threat to people browsing the Internet today – a criminal attempt to secure people’s personal information online, generally spread through email directing unsuspecting consumers to fake websites and asking them to enter sensitive information . With Internet Explorer 7, we introduced the Phishing Filter, and have continued to improve on it in Internet Explorer 8. Together, Internet Explorer 7 and 8 have blocked a total of over 125 million phishing sites.

You may have recently heard about organizations including Google recommending that people update their browsers and move off older versions, such as the nearly decade-old Internet Explorer 6.  Think about what technology and the Internet were like in the year 2000 – and consider how they’ve evolved since then. In 2000, “phishing” was something that happened at the lake, not online. There was no social networking, no RSS feeds, and no real blogs. It was a different time – and people’s browsing needs were different. Today’s Internet calls for more.

We support this recommendation to move off Internet Explorer 6. Modern browsers such as Internet Explorer 8 bring benefits for customers and developers alike. We realize there are some customers today who depend on Internet Explorer 6, and while we continue to support them through the lifecycle of the product, we are also investing in the tools and training to help them upgrade as well.

The M11x can be configured with (and up to) the follow specs:

• Windows 7 Ultimate 64-bit
• Processor: Up to Intel Core2 Duo SU7300 (1.3GHz, 800 MHz, 3 MB)
• Graphics: NVIDIA GeForce GT 335M - 1GB GDDR3
• Memory: Up to 8GB - DDR3 1066MHz
• Hard Drive: a 500GB 7200RPM hard drive or a 256GB Solid State Drive (SSD)
• Network: 802.11 b/g/n & Optional Internal WWAN
• Ports: HDMI / VGA / 3 USB / Media Card Reader / FireWire

The keyboard integrates back lit keys which are fully customizable through the exclusive Alienware Command center, featuring AlienFX software. The Alienware M11x will be available in 2 color options: Cosmic Black or Lunar Shadow (Silver).

You can order the Alienware M11x today starting at $799. Dell is working to bring this PC to international markets, including South Asia. Look for Dell to announce more details when those plans are finalized.

If you’re a gamer and want a PC with some impressive specs yet retains a great deal of mobility – the Alienware M11x is the perfect PC to take a look at!

You can add “Copy to” and “Move to” buttons in right click. After that you can move or copy any file from one location to another location from right click menu.

1. Go to Start > Run > Notepad.

2. Paste the following:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOTAllFilesystemObjectsshellexContext

MenuHandlers]

[HKEY_CLASSES_ROOTAllFilesystemObjectsshellexContext

MenuHandlersCopy To]
@=”{C2FBB630-2971-11D1-A18C-00C04FD75D13}”

[HKEY_CLASSES_ROOTAllFilesystemObjectsshellexContext

MenuHandlersMove To]
@=”{C2FBB631-2971-11D1-A18C-00C04FD75D13}”

3. Save it as add.reg

3. Double click the file, it will ask you if you want to add the information, select yes.