MangalMan's Perspective.

link to download the entire result
1)
http://www.mediafire.com/?m2cxmrxnjyp
File size 3.8 MB
File format text
2)
http://www.mediafire.com/?namxbmgxhej
File size 501.17 KB
File format Rar compressed use Winrar or similar compressing/decompressing software to extract and view.

I have been so frustrated not being able to download from the rapidshare site for so long. Various tricks were working before the major update by rapidshare people. But after the update nothing worked.The damn cat and dog thing was so evil.It was a evil trick to ward off the free users. Make there experience so worst that they won't try there hand at it any more and buy the premium account.But no more guys there seems to be a way to get around the catchpa and the download limit thing as for now.There is a program called cryptloader.New update of this program does the magic

"CryptLoad is a free software that can download from RapidShare as a free user as if they were a premium user. There is no need to wait to continue downloading the next file and also there is no need to enter the confusing CAPTCHA codes as it is recognized and entered automatically."

quoting Raymond's blog.

Download CryptLoad form here

People still use Internet Explorer heavily to surf the net.So i think this is useful.This runonce thing appears first time you try surfing internet using Internet explorer and also every time You change the setting of your internet explorer browser from tools>Internet Options >Advance Tab.The real reason behind Runonce page is to let you customize some settings like choosing default search provider,Enabling or disabling auto phishing filter and so on.

If one does not complete the runonce customization page it will load every time until you do that and regardless of what your IE homepage is set to.Which can be annoying at times.The tool i have created solves this problem.Just download unzip to a folder and double click NoRunOnceIE.exe



I just created this taking cues from http://raymond.cc/blog.
Download RunOnceRemover

I just compiled something to kill kinza/isetup.The batch file solutions floating around in the web did not completely clean the virus.So i thought why not to write something.So i did.You can get it from bottom of this post.

I did a bit of research into how this particular virus acted.Apparently there are at least 3 known variant of this virus in the wild.Anti Virus programs detect only a portion of its installed or rather implanted files.Also they don't reverse the registry key changes.

In my case some memory corruption was also observed because of this virus in ctfmon.exe and explorer.exe processes.
I got messages like

"The instruction at "0*00a4143d" referenced memory at "0*00a4143d".The
memory could not be read ".

Whenever i wanted to shutdown.Clicking ok did let me shutdown though.

Warning:(This needs restart)

You have to run this AntiKinza file twice to completely get rid of the virus if you are running in Normal mode.In the first run you will have to restart your computer.Second run won't need
restart.Run this in safe mode to remove the virus without restart.

Please save all your important documents and file and close all the running applications before running this program.
I won't be responsible for any damages caused by your actions.

Read carefully.
Steps to be followed.(important:-Follow Step no.5 strictly in normal mode)

1)Double click AntiKinza.exe
You will be presented with this prompt.


2)Click OK if you're done as it says.

3)Second prompt tells you wheather or not your computer has the virus in your system

Click Yes if you want to clean it.Click No to exit.If Your computer does not have virus then another prompt will show up telling you that you don't have virus and if you want to disable your autorun feature?



Clicking here will disable autorun.Which is a recommended thing to do.Because increasing number of the viruses are resorting to use this path to get into your computer.

4)If you computer has virus and if you click yes in step 3) Virus cleaning willstart.

5)Next prompt will ask you if you are running antikinza for the first time in Normal mode.If this is the case click Yes.This will restart your computer.After restart you will have to run the antikinza one more time to completely remove kinza/isetup if you running it from Normal mode. Click no if you are running antikinza for the second time in normal mode.



6)Running antikinza from the safe mode would completely get you rid of thevirus in one run.Click No if you are running antikinza from safe mode.


Your IE homepage will be set to back2mangalman.blogspot.com if you agree to run this program.Do you think i should be hanged for doing this? Please comment.I had to spend
a lots of time come up with this.

Today i went to a cyber for some work.I could not find firefox so i installed it well sort of tried to but the thing went haywire.Messege box appeared out of nowhere and started to scream that i was not allowed to run mozilla firefox.


Extact text was " USE INTERNET EXPLORER YOU DOPE,I DNT HATE MOZILLA BUT USE IE `r OR ELSE... "


It would not close even if i try to.So i fired up the process explorer and noticed two processes named svchost.exe .The legitimate svchost.exe do not run like that so i killed both the processes and the firefox installed like butter.I found it quite funny so i decided to investigate on the subject at home.Reaching home i disabled my nod32 antivirus and then plugged in my pen device sure enough there was a hidden file named MicrosoftPowerPoint.exe and a autorun.inf in it.


I was about to deleberately infect my computer with this malware.I don't have any important file that if computer crashes would kill me. Don't try to infect yourself just because i did.

When i double clicked the MicrosostPowerPoint.exe it immiditely changed to svchost.exe.Ahha these were the ones i killed back at the cyber cafe.Lets see what else do they do.


It creates a folder named MicrosostPowerPoint in %temp% folder.Folder contained six files.Namely


2.mp3
drivelist.txt
Install.txt
Icon.ico
pathlist.txt
svchost.exe


Also it created a folder named heap41a in the c drive.This folder had the following files


drivelist.txt
2.mp3
Icon.ico
script1.txt
reproduce.txt
std.txt
drivelist.txt
svchost.exe


and a folder offspring in it file
autorun.inf
MicrosoftPowerPoint.exe exist.


What does it do?


It runs in the background as two svchost.exe process using your 2.2 Mb of memory.You can see them in action using Task Manager as it shows up as user initiated s vchost.exe processes.It scans for removable drives to reproduce.Changes three registry entries


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\Run\winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\Run\status
HKLM\Software\Microsoft\Windows\CurrentVersion\CurrentVersion\Explorer\
Advanced\Folder\Hidden\SHOWALL\checkedvalue


When one tries to run firefox it displays error messege saying USE INT ERNET EXPLORER YOU DOPE,I DNT HATE MOZILLA BUT USE IE `r OR ELSE... with evil laugh and then terminates the firefox.


Also when you try to open youtube or orkut it says "ORKUT/youtube IS BANNED,Orkut/youtube is banned you fool`,The administrators didnt write this program guess who did??`r`r MUHAHAHA!!" this with same evil laugh and closes the Internet Explorer.


Now steps to get rid of it (Solution).


1)Open task manager/process explorer


2)Click Processes tab in task manager.


3)Look under Image name for svchost.exe with User Name user
and not the ones with SYSTEM/Network Service/Local Service as User Name
and terminate those 2 processes.


4)If you don't get no 3 download process explorer unzip it open it look for pair of svchost.exe with AutoHotKey in description section (pink ones in the picture.)





5)open regedit.exe from run and navigate to


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curren tVersion\policies\Explorer\Run\winlogon


right click winlogon and click delete also look for the entry named status and delete it as well.


6)Navigate to
HKLM\Software\Microsoft\Windows\CurrentVersion\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL\checkedvalue


right click the checkedvalue click modify and change the value from 0 to1.


7)Open My computer->Tools->Folder Options click View tab look for Hidden Files and folders click Show hidden files and folders radio button uncheck Hide extensions for known file types also uncheck Hide protected operating system files (Recommended) click apply and ok.


8)Don't double click your drives to so that the autorun.inf won't execute.Instead use start menu->run->type c: and click enter.


9)delete the folder named heap41a


10)type %temp% in start menu->run and hit enter then delete folder named MicrosoftPowerPoint


11)It is a good idea to disable the autorun feature altogether
do this by copy pasting line below saving it as whatever.reg and than double clicking it.


REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"


12)Look for and delete autorun.inf and MicrosoftPowerPoint.exe from all your pen/flash drives.


This particular malware seems to be created using AutoHotKey.

Minimum requirment:-A gprs enabled mobile with mero mobile sim card

This is not a post about how to enable internet in mero mobile.You go look here for that.This post is about sharing some knowledge about mero mobile internet.

Mero mobile is private mobile service provider in Nepal.It's network is considered good quality wise but a bit expensive then the government mobile service provider Nepal telecom.Ok lets get started now

Did you know that you can still be surfing the wap sites even if you have few paisa in your account as long as your account is not suspended? Is it something mero mobile people don't know or is it something they cannot control i don't know and i don't want to know as long as it serves me well.

It seems that anything less than 5kb opens.If it exceeds 5kb while you don't have money transfer of data stops with some messege.Mig33 messenger works well in these condition very well with some occassional connection error messages.Chat sessions continue smoothly.This messenger supports msn/yahoo/google and you can send email from it too.

This also means free sms to mero mobile.As you can send sms in the form of email in mero mobile network.How do you do it? Well you send email to +977980#######@sms.spicenepal.com which your friend or whoever you wish get as a sms.Just replace the # with the intended numbers.

Also get yourself a opera mini browser.Disable the pictures to minimize the data transfer many of the site can be opened from there.

Downloads can not go ahead with out the money though so i would suggest a 50 rupees recharge to down these stuffs first.

Some goon changed a line or two of a virusremoval.vbs script the infamous suijn script and made this a new one shyam.com.np. It had been on the circulation from probably few months though i was not aware of it.

Following are the changed lines in the script by this goon.

'Program developed by
'Shyam Uprety
'http://shyam. com.np
'shyamuprety@gmail.com

Shells.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\StartPage","http://shyam.com.np/"


Good news is my antisujin tool seeks and destroys this shyam.com.np thing.No more resource hijacking.Get rid of this browser hijack. Password is back2mangalman

Your home page will be changed to my blog which is totally reversible from Internet Explorer's properties.Some people might complain i do this but i had to put something other than sujin.com.np or in this case shyam.com.np. Would you be happy if i place google.com or yahoo or msn there? But i think that these are empires why should i be promoting internet empires?

Instead i choose to promote my individual no value blog. Love me or hate me just trying to help.I don't earn big buck from my blog.

And i would like to thank kingshuk for the comment here. For it made me investigate the problem.

Update:Even safyway.blogspot.com is the same thing get it removed from here.

I have been asked this question several times so a post had to be pushed for this. I must warn you people that editing registry has some risk involved so be sure about what you are doing before middling with the registry stuff.

Click start menu then run now type regedit and hit enter.
Navigate to this place

HKEY_CURRENT_USER -->Software -->Microsoft -->Internet Explorer -->Main

Look at right pane for "Window Title".Right click it and then click "modify"
This will present you with a box.You can enter what ever you want there and hit ok. This would change your Internet Explorers windows title to what ever you just typed in.

or alternatively you can press Ctrl+F once the registry Editor opens and type "Windows Title" without quote and then right click and modify it.




In case you are not able to open Registry Editor and you end up with the
message which says "Registry editing has been disabled by your administrator"
then either you have logged on from an account which does not have administrative privilege or your computer has some form of malware running.

Third possibliity would be that your computer might have had contracted a malware and cleaned but the changed brought by the malware persists.

Because i have been encountering a lots of computers with this virus these days i am compelled to write about it.I beg for your pardon for this one is not as organized as i would have liked it to be.

If you notice change in your pendrive or flash cards icon from the normal one to the one that resembles the "explorer.exe" or the "My computer" then you are infected with the virus. Ok lets get started.

It is a good idea to clean up temp files and turn off system restore for a while. I use ccleaner

If you have the virus running you won't be able to use task manager so i would recommend a download called process explorer and autoruns .Both are safe apps from sysinternals now accquired by microsoft.Just google search for it here on the box.

Extract it from zip file and double click "procexp.exe" .Now we will kill some processes.
Look for "wscript.exe" and right click then click kill process tree.kill any of these processes below if they are running just like you killed wscript.exe.

Very interesting xss injection in search feature of our very own trusted website
ntc.net.np which if you are dumb enough this can make you divulge your hotmail address and password. This is a complete rip off from nepali security google group. I am in no way the author of this particular exploit.

Just reporting the issue.This particular example highlights the need of awareness about xss amongst internet users.

click to see the xss at work.

If you people want to play safe please download firefox browser to surf the
internet and then install a extension to your browser called "noscript".One can
never expect 100% safety in online world but this move will make you
considerably safer and you won't regret it i promise.

You can download this addon either from extensions page from mozillla
http://en-us.add-ons.mozilla.com/en-US/firefox/2.0.0.14/extensions/
or from http://noscript.net.Its a freeware and will stop the xss injected link if the authentic looking link tries to trick you.

here goes the link to see what you have entered.

After a lot of delays the much talked about adsl service from Nepal Telecom has finally been started from today. The price of internet in Nepal can only go down from this point onwards. Very good news for everyone who have been paying unreasonably high price for the service till date.

You can get and fill up the form here.They will charge you Rs 500 as activation charge.
Lets do a quick price analysis.They have initially rolled out 2 data schemes.The first one at 128kbps and another one 256kbps.128kbps would be charged at Rs900 per month in prepaid basis the the other one at RS1500 this is excluding taxes.Now lets tax them to know the actual price a customer has to pay.

Rs900+900*10%=Rs990 (10% TSC)
Rs990+990*13%=Rs 1118(13% VAT)

This is my initial guess. I might be wrong here.Can anyone confirm?

Noticed something funny? Yes Nepal Telecom taxes the tax.First they tax you 10% TSC add it up and then again Tax the sum with 13% VAT.
You work out the second ones price.
Besides this price every adsl customer has to do a initial investment on buying adsl modem(ATU-R) the customer premises equipment and the splitter. I have no idea about these equipments local market price.Any idea?

Some very related and relevant links you guys might want to explorer
http://back2mangalman.blogspot.com/2008/03/nepal-telecom-says-adsl-coming-soon.html
http://back2mangalman.blogspot.com/2008/03/adsl2-what-is-fuss-about.html
http://back2mangalman.blogspot.com/2008/03/general-knowledge-about-dsl-and-adsl-in.html

Use the following information wisely. The information i am about to share is related to sms bombing hapless and clueless Nepal Telecom SIM card holder. Don't over do it.This is not my original. Passed on to me by my friend this information has been in forum for quite a long time.
Ok the link goes like this
http://crbt.ntc.net.np/colorring/randompwd.action?usernumber=9841XXXXXX&colorringtype=0

All you people have to do is copy paste the link in your browser, replace the XXXXXX with the desired ntc number hit enter and hit F5. 1min of pressing would yeild about 200 sms to the victim. If your connection is broadband then victim will get more than 700 SMS. Not good is it.

I have always wanted to try linux for a change. I came to know about ubuntu from my friend Shital. He told me that ubuntu comes free. They even ship it free yes you heard me right totally free. I asked him to get me some and some he did. Back then Ubuntu used to come as 2 cds. First one was leveled live cd and second was installation cd. I did not have any idea about which way is up back then. So tentatively inserted the live cd on to my cd player and let it boot. Because it was the first time ever i was getting something other that XP run in my box i was completely at sea.Fiddled around with the menus and nothing more. After few months of inactivity i thought what the hell and i installed it. I duel booted both the ubuntu and XP. But i never got the hang of this thing called ubuntu. After few days I wiped the partition out using partition magic. And that was it then. I did not know nor did i wanted to know how to fix the grub thing though and ended up wiping the whole Hard disk and reinstalling XP again. To be fair this adventure ended due to my lack of interest to learn.

This time around I have a Hard disk that is disintegrating by the day and I got hold of a new Ubuntu 7.10 cd in my hand.A perfect recipe i guess but there was a little problem. With the time my box has grown a few years old lost its youth days. I wondered if i could get this new one linux distro to mate my old pal box. Some Viagra yeah that was the answer to my problem a dose of viagra but can u buy one with empty pocket? Viagra in this case would be increment of memory in the slot. I have a 256Mb of ram but the cd says

"To use the live Cd, you must have a PC with at least 384MB of RAM. To install Ubuntu, you should have at least 4 GB of disk space."

I put the cd in and booted but this led to nowhere blank screen for 10 minutes and i got impatient and pressed the reset button. Tried it again and again after few more trials a finally got into the ubuntu desktop.Tried to install but everything was so slow.I then turned to google for the help(had to switch back to my XP installed hard disk).Typed in "installing ubuntu in a low ram machine" and hit the jackpot. The first article talked about how creating a swap partition in the pen drive would solve this porblem. Well i will try to explain what i did to get the ubuntu running.

First of all I booted from the CD and then inserted my pendrive into the usb port. Soon my pendrive was shown in the desktop.

Then i pressed Ctrl+Alt+F1 to get to the command line environment.

After that i become root by typing "sudo su -" without quote and with space.

You can type "free" without quote to view your memory and "mount" to view which drives are mounted.

Then I create a 200MB file on the USB stick:(Here MangalMan is the name of my drive change it to your drives name)

cd /media/MangalMan

dd if=/dev/zero of=swap bs=1M count=200

After that I turn this file into swap by typing

mkswap swap

And finally activate it by typing

swapon swap

here if you type "free" again you will notice addition of swap space.

I pressed Ctrl+Alt+F7 to get back to the Desktop and then double clicked the install icon the installation went without a hitch this time.Now I am using Ubuntu as operating system these days. There are limitations because of my low ram. I can't change the visual effect to aesthetically pleasing one that is perfectly all right for me though. Next in my priority is to get my existing modem to work with Ubuntu system. I have made it work with my netodragon (smlink chipset) but the connection gets disrupted way too often. I don't think this is because of the drivers rather it might be because my ISP does not like ubuntu to be connected to their server.

Nepal telecom is deploying ADSL2+ shortly. Dial up is bad. It is expensive. It is slow. Surfing the net in dial up is getting increasingly difficult as the amount of data to be downloaded while doing so is increasing. Try watching a youtube video off a dial up connection and you will the get the idea. ADSL is Asymmetric Digital Subscribers Line over the loop. That means we can get this type of connection over our normal telephone line. Our telephone line has a pair of copper wire underneath the plastic cover. Our telephone line is also known as POTS as in Plain old telephone service. This POTS uses 0 to 3400 hertz of frequency range to exchange voice over the wire. However copper wire has lots of frequency left unused in it. In ADSL this unused frequency is deployed to carry the data. With an ADSL modem in place one can use the telephone as well as internet at the same time.

I have taken this picture from Nepal telecom's website

Asymmetry means the downstream data rate in this type of connection is far greater that the upstream data rate that means one can download stuffs from internet in much faster pace than one can upload say pictures or videos. All the DSL systems have had this problem of being distance dependent though. As the distance between telecom switching station and customer grows the quality of connection degrades. The difference between cable and ADSL is that cable does not have that problem. However with ADSL you can get dedicated connection directly from the switching station and the quality of connection is always maintained by the DSLAM device at telecom office end and the Customer premises device (ATU-R). Internet Service providers offering cable internet most of the times divide the whole connection amongst several users assuming that no single user uses all the bandwidth allocated. So 128 Kbit/sec internet connections are not actually as they say it is. ADSL2+ is latest ADSL technology increasing the capability. With it on, the distance covered by the System as well as the speed increases nearly three folds.

For ADSL2+ to work in our home one needs a ADSL2+ modem a splitter to split the voice and the data frequency from the copper wire and ADSL internet account from Nepal Telecom in Nepal's context or what ever your Telecom/Internet service provider is. ADSL2+ modem is not actually a modem because it does not modulates/demodulates as the dial up modem does.Signal are digital all the way in ADSL or any other DSL variant systems. Rather it does the handshaking with DSLAM device in switching station and later on works to maintain the quality of service through out the connection session.

NTC's adsl faq link

हुन त यी त्यति पत्यार लाग्दा कुरा होइनन् तर पनि भनि हालुँ नेपाल टेलिकमले ADSL2+ इन्टरनेट सेवा सुरु गर्न लागेको छ रे। नेपाल टेलिकमले ADSL सुरु गर्न लाग्दै छ भन्ने थाहा पाएको र लगत्तै साथीहरु माझ यो खबर दिएको पनि १ बर्ष भै सकेछ। सुरुमा ६४ सालको माघ महिना देखि प्रारम्भ गर्ने भनिए पनि पछि सर्दै गएर चैत्रको मध्यबाट अर्थात April बाट सुरु हुने प्रचार गरियो यो सेवा। माघमा सम्पन्न "Can infotech " मा NTC को stall रूङ्नेहरु नेपाल टेलिकमका कर्मचारी नै हुन भन्ने assumption लाई आधार मान्ने हो भने र जिम्मेवार कर्मचारीले सहि बोल्छन् भन्ने पत्याउने हो भने अप्रिल १ को दिनको आसपासबाट यो सेवा सुरु हुनु पर्ने हो। मैले त्यहाँ उनै कर्मचारीलाई सोधेको थिएँ के यो पनि हामी मुर्ख ग्राहकहरुलाई फेरि अप्रिल फूल बनाउने काम त होइन भनेर तर उनको सहज उत्तर थियो "होइन"। यस सेवाको tariff को बारेमा जान्ने प्रयासहरुबाट NTC का कर्मचारी "हाल सम्म तय भएको छैन" भन्ने उत्तरका साथ उम्किए पछि सँगै गएको मेरो साथीले यहि प्रश्‍न कुटनितिक तरीकाबाट राख्यो उसको प्रश्‍न थियो "मैले हाल घरमा साँझ ८ बजे देखि बिहान ८ बजे सम्म ६४केबि/sec को ईन्टरनेट महिनाको रु ५०० तिरेर चलाउँछु। के यो सेवा मैले तिर्ने रकम भन्दा कम हुन्छ? यो प्रश्‍नको उत्तर पनि सकारात्मक आएको थियो।

म डायल ईन्टरनेटको unreasonably high rate को भारले दबिएर र प्रबिधि विकाशका घटनाक्रममा केहि interest भएको कारणले यस सँग सम्बन्धीत news development लाई follow गर्दै आइरहेको छु। मेरो सुचनाको almost exclusive स्रोत भनेको नेपाल समाचारपत्र हुने गरेको छ। नेपाल टेलिकमबाट यस सम्बन्धी सुचना चुहिने बित्तिकै मैले ईमेल मार्फत आफ्नो सुझाव पनि पठाएको थिएँ। त्यसबेला ADSL को कुरा हुँदै थियो। मैले ADSL होइन ADSL पुरानो भईसक्यो अब नयाँ प्रबिधीमा लगानी गर्नु पर्छ त्यसकारण ADSL2+ तिर नेपाल टेलिकमको सोच पुगोस् भनि लेखेको थिएँ। मेरो ईमेल पढियो भन्ने कुरा त मैले त्यसको जवाफ पाए बाट पुष्टि भएको थियो सायद मेरो सुझाव पनि मनन गरिएछ।

यस सम्बन्धी लेटेस्ट समाचारका अनुसार नेपाल टेलिकम ADSL2+ सन्चालनको अनुमति लाईसेन्सको लागि proposed tariff का साथ नेपाल दुरसंचार नियमन संस्थामा पुगेको छ। त्यो भन्दा नयाँ खबर भनेको नेपालका १७ वटा ISP(ईन्टरनेट सर्बिस प्रोभाइडर) हरु मिलेर Nepal telecommunication authority मा उजुरी हालेका छन्। उनीहरुका अनुसार नेपाल टेलिकमले टेलिफोनबाट कमाएको नाफालाई ADSL सस्तो बनाउन प्रयोग गर्दैछ र ADSL सस्तो भए पछि निजी सेवा प्रदायकहरुको महँगो cable/wireless ईन्टरनेट सबैले लिनछोड्नेछन्। जसको कारण private ISP हरुको धरासायी हुनेछन्।

अब मेरो बिचार। ईन्टरनेट सेवा सस्तो हुनु नराम्रो होइन। बरु यी ISP हरुले आफ्नो सेवा सस्तो पार्न तिर पो लाग्नु पर्छ।हाल ईन्टरनेट सेवा महँगो हुनमा स्याटलाइटबाट bandwidth लिनु पर्नु,भारतले बनाईदिएको पूर्ब पश्‍चिम अप्टिकल फाइबर लाइनमा नेपाल टेलिकमको मात्र एकाधिकार रहनु आदि कारणहरु रहेको कुरा स्वयम् ISP हरुलेनै भन्दै आईरहेका हुन्। बरु यी कुरामा Nepal telecommunication authority लाई दबाब दिनुपर्छ ISP हरुले। त्यस्तै ADSL को बेलायती मोडललाई पनि फलो गर्न सकिन्छ कि त? U.k मा ब्रिटिस टेलिकम को टेलिफोन नेटवर्क अन्य ISP हरुले पनि प्रयोग गर्न पाएका छन् आफ्नो ADSL network का लागि।

सिद्धान्त: ADSL2+ बाट 24 Mbit/sec download achieve गर्न सकिन्छ तर Reality के पनि हो भने नेपाल टेलिकम ले त्यो स्पिडको ईन्टरनेट १० जना लाई दिँदा नदिँदै उसले किनेको Indian ISP बाट किनेको bandwidth सकिन्छ। र अन्त्यमा नेपालमा WiMAX नेटवर्क स्थापना गर्न एक युरोपियन कम्पनीले चासो देखाएको कुरा पनि बाहिर आएको छ। WiMAX लाई नेपालको सन्दर्भमा गाउँ सम्म ईन्टरनेट पुर्याउने बिकल्पको रुप हेरिएको छ।

Merry Christmas fellas .This winter I bring you Ma Dog's Winter Collection
Enough about computer viruses I sick & tired of 'em. How about Dog fashion for a change? This is My Dogs Winter Collection. Well my father’s idea actually. And I used my dog for a model but we had to pay him with rice and meat. (मासु भात) He he he
(Model-Dallae my canine companion)
We used cotton for fiber for the Cloth above.And the second one below is jeans as you can see. Oh and when the dog walks in the sun with this outfit on the cloth glitters like silver.

And yes we are accepting orders. Email me if you want this for your dog. Well not exactly the same thing as my dog would die of cold if I give away these and because size of the dog has to be taken into account. You don’t want your dog to pee in the pant do you?

E-commerce shoved down your Esophagus What do you think?

Well i call it Antisujin 2.0
fixed issues
-Now it says whether or not your computer has the virus
-It completely removes all traces of this virus from your computer

So i would advise you to re-download the file one more time and double click Antisujin.bat file.
from here

Update: 12:00 PM Nepali Time

It seems that in the heat of excitement I released the AntiSujin 2.0 packed inside three folders all named AntiSujin how can I be so dumb? Did you notice that in the file produced by unzipping? Sorry for that. I fixed that + a performance upgrade.

So it’s AntiSujin 2.1 now.

Well there were 3 VBScript files before all glued together by a batch file now there are only two. Just unzip the AntiSujin2.1.zip file and double click the AntiSujin.bat file. Password is back2mangalman download from here

1) Click tools option of the My computer menu and then click Folder option their look for view tab and click show hidden files and folders radio button, also uncheck the boxes which says" Hide extensions for known file type" and " Hide protected operating system files (recommended)" ignore that warning which says bla bla bla and press yes.

2) Open task manager kill the wscript.exe by hitting “end process” button.

3) make sure you have killed all wscript.exe as more than one instance of the program might be operational.

4) Click Start-> run->

5) Type system32 in the run box and hit enter.

6) Find “Virusremoval.vbs” and delete it holding both the shift and delete key simultaneously.

7) If you have pen drive or floppy inserted don't double click to open it. Instead double click the "My computer" icon when it opens press F4 button from your keyboard now find your pen drive or what ever you have to open and click it

8) Find and delete file named " autorun.inf " and " Virusremoval.vbs " if it exists there.

Now you are a clean. But to clean up the registry mess created by this sujin virus. You have to download this file here and double click . Which would put things back to normal. This tool is also useful to clean up the mess created by other viruses other than sujin as well.

I don't personally trust this tool but here goes the link to sujin virus removal tool from worldlink web site Scanner.exe from the same guy who created the virus

Computers around Katmandu are these days infected by a nasty resources eating virus which does nothing but scare people. If your internet explorer address bar shows Sujin.com.np and your home page point you to "sujin.com.np" then your computer is infected by sujin virus. Don't be scared though. Apart from eating your computer's 9mb memory for wscript.exe, changing your ie address bar and home page this virus does not do any harm. I mean no secret is going to be stolen from you.
I advice you not to believe the news report coming out in the paper which claim this virus steals your password and sends it to the virus coders. Being a Computer science student I know a little about codes. I have seen the code of the virus (It does not requires any expertise-believe me) and there is nothing in it which suggest it steals password.
There is no doubt that it's a lie. This guy sujin whoever he is only wants to get some publicity. This virus is written in VBScript so the code can be seen through notepad.

You get to see this messege if you open the file through notepad

('******************************************************************
'********************* Virus Removal VBScript *********************
'************************** Version 1.00 **************************
'******************************************************************
'This antivirus program is intended to repair your computer from
'any sorts of virus attacks.
'This program is exactly like a normal virus but it repairs things
'rather than destroying them.
'******************************************************************
'******************************************************************
'Program developed by
'Sujin Joshi
'http://Sujin.com.np
'sujinjoshi@gmail.com)

He claims that this is an "antivirus program" is intended to repair your computer. Some of his claims are true as it deletes the "ravmon.exe", "winfile.exe","run.wsh","sxs.exe","killvbs.vbs” which are all known viruses. It resets the registry & taskmanager back to normal. But these are not all the viruses in the world. This is no match for aViruses with polymorphic properties. Remember the "New folder.exe" virus which copies itself to every folder with different folder name. Don't fall for it this is no good of a program

This script makes changes in your registry by attaching itself ("Virusremoval.vbs") to userinit.exe which makes his file execute every time we open computer and log on. More over this script scans for removal storage device like floppy and pen drive every 10 seconds to propagate. If you have a floppy drive you can hear it scanning you floppy drive every 10 seconds with annoying sound.
Also it makes an "autorun.inf" file with following lines in these devices if it finds them inserted
("[autorun]"
"open=wscript.exe VirusRemoval.vbs"
"shell\open=Open"
"shell\open\Command=wscript.exe VirusRemoval.vbs")

This virus eats up your memory resources to spread itself. Blood sucking parasite don't you think? Other thing it does is it Changes your Internet explorers address bar with
–sujin.com.np and home page to sujin.com.np which is not working right now.

Now for the getting rid of the virus part (Manual method)
Apparently mercantile the company where this guy registered his domain name was providing an antidote for this sujin virus. I went their and downloaded the program it did clean my virus but when I checked at the about section of that program I was horrified to find same name "Sujin joshi" as programmer. आफैं बोक्सी आफैं धामी????? (both witch and the witch hunter are the same person?)
It further strengthened my previous hunch that this guy is no more than a script kiddie looking for instant fame and I suspect that the same guy planted the news story into some of the newspapers of Nepal. To them I have to say plz plz plz verify first what ever you are publishing. No false information please.
Would you trust this persons program??? I would not!!!! You should not. Sorry for deviating from the issue but I am angry with these newspapers

To clean this VBScript from your computer(Manually)
1) Open >task manager> look for process "WScript.exe"> click on it and then click end process. If it says warning and bla bla bla ignore it and click yes. Now make sure there is no more "WScript.exe" running in task manager if yes repeat the process above i.e. hitting the end process button.
2) To Open command prompt type "cmd" without quotes at >start >run
3) Type "cd.." without quotes and press enter
4) Repeat 3) this would bring us to the drive c: or d: or whatever yours is
5) Now type cd windows\system32 and hit enter
6) Type "attrib -s -h -r Virusremoval.vbs" without quotes and hit enter
7) Now Type "del Virusremoval.vbs" without quotes and hit enter
8) Now if you have pen drive or floppy inserted don't double click to open it. Instead double click the "My computer" icon when it opens press F4 button from your keyboard now find your pen drive or what ever you have to open and click it.
9) Click tools option of the My computer menu and then click Folder option theiràlook for view tab and clickàclick show hidden files and folders radio button, also uncheck the boxes which says" Hide extensions for known file type" and " Hide protected operating system files (recommended)" ignore that warning which says bla bla bla and press yes while doing it.
10) Find and delete file named " autorun.inf " and " Virusremoval.vbs " if it exists.

11) If it is not working for you plz check no 1) again if there is wscript.exe running in the task manager you have to repeat everything again. So please be sure that wscript.exe is not running.

Update:
And lastly
in order to fix up the registry alteration done by this sujin virus please download this VBScript file. Here and double click. This particular Script is also useful if you are infected by other viruses other than sujin
(ask me if you encounter problem) i am always ready to answer.
:Update:
goto this link to get anti sujin tool 2.1
Here