Irvin's exploration

If you have opened the Windows Task Manager or used Hijackthis to track down a problem, you have probably run across a file called CTFMON.EXE. Disabling it from MSCONFIG doesn't make it go away and it definitely feels like a virus, so what exactly is this file?

It turns out that CTFMON.EXE is a file that is installed with Office XP applications. It activates the Alternative User Input Text Input Processor and the Language Bar.

How to Disable the Language Bar and Remove CTFMON.EXE

1) Open the Control Panel
2) Double-click on Regional and Language Options (if you are in Classic View)
Regional and Language or Double-click on Date, Time, Language, and Regional
Options in Category View
3) Click on the Languages tab, then click on Details
4) Click on the Advanced Tab
5) Finally, place a checkmark in the box "Turn off advanced text services"
and Click Ok

"Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)"

1) Close all open programs
2) Click on Start, Run, and type REGEDIT and press Enter
3) Click on the plus signs (+) next to the following folders

* HKEY_LOCAL_MACHINE
* SYSTEM
* CurrentControlSet
* Control
* Class
* {4D36E965-E325-11CE-BFC1-08002BE10318}

4) This folder is the DVD/CD-ROM Drive Class Description in the registry. Look for any of the following names in the right hand column.

* UpperFilters
* LowerFilters
* UpperFilters.bak
* LowerFilters.bak

5) If any of the above keys shown in step 4 are listed, right-click on them and choose Delete

6) After deleting the keys, close the Registry Editor

7) Reboot your computer

8) Open "My Computer" and check to see if your CD or DVD drives have returned. You may also want to open Device Manager and verify that the yellow exclamation and error code on the CD or DVD drive is gone.

Manual Method

If you already know the path to the file, please skip to Step 7

1. Click on Start, Search, All Files and Folders
2. Type the name of the undeletable file in the box shown
3. Make sure the Look In box shows the correct drive letter
4. Click Search and let the computer find the file
5. Once the file is located, right-click on it and choose properties, make a note
of the file location. Usually this is something similar to
c:\windows\system32\undeleteablefilesname.exe
6. Close the search box
7. Click on Start, Run, and type CMD and Press Enter to open a Command Prompt window
8. Leave the Command Prompt window open, but proceed to close all other open programs
9. Click on Start, Run and type TASKMGR.EXE and press Enter to start Task Manager
10. Click on the Processes tab, click on the process named Explorer.exe and click on
End Process.
11. Minimize Task Manager but leave it open
12. Go back to the Command Prompt window and change to the directory where the file
is located. To do this, use the CD command. You can follow the example below.

Example:
to change to the Windows\System32 directory you would enter the following
command and Press Enter

cd \windows\system32

13. Now use the DEL command to delete the offending file.
Type DEL where is the file you wish to delete.

Example: del undeletable.exe

14. Use ALT-TAB to go back to Task Manager
15. In Task Manager, click File,
New Task and enter EXPLORER.EXE to restart the Windows shell.

16. Close Task Manager

To open the Task Manager, you normally would do one of the following:

* Press CTRL-ALT-DEL on the keyboard
* Press CTRL-SHIFT-ESC on the keyboard
* Right-click on a blank area on the start bar and choose Task Manager
* Click on Start, Run and type TASKMGR in the run box and press Enter

registry modification methods for correcting this problem

Method 1 - Using the Group Policy Editor in Windows XP Professional

1. Click Start, Run, type gpedit.msc and click OK.
2. Under User Configuration, Click on the plus (+) next to Administrative Templates
3. Click on the plus (+) next tSystem, then click on Ctrl+Alt+Delete Options
4. Find Remove Task Manager in the right-hand pane and double click on it
5. Choose the option "Not Configured" and click Ok.
6. Close the Group Policy Window

Method 2: Change the Task Manager Option through the Run line

1. Click on Start, Run and type the following command exactly and press Enter

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

Method 3: Change Task Manager through a Registry REG file

1. Click on Start, Run, and type Notepad and press Enter
2. Copy and paste the information between the dotted lines into Notepad and save it to your desktop as taskmanager.reg

------------------------------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
-------------------------------------

3. Double click on the taskmanager.reg file to enter the information into the Windows registry

Method 4: Delete the restriction in the registry manually

1. Click on Start, Run, and type REGEDIT and press Enter
2. Navigate to the following branch

HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies\ System

3. In the right pane, find and delete the value named DisableTaskMgr
4. Close the registry editor

Method 5: Download and Run FixTaskManager program
http://www.taskmanagerfix.com/

I'm sure everyone using Windows XP has seen a small file in some directories called thumbs.db. This file is a cache of the thumbnail pictures in a directory. It speeds up the showing of thumbnails when you are viewing a folder in Thumbnail view.

Solutions

To turn this feature off, do the following:

1) Open My Computer
2) Click on Tools
3) Click on Folder Options
4) Click on the View Tab
5) Place a check in the option "Do not cache thumbnails"
6) Click Ok
7) Close My Computer

Now follow the next steps to remove the thumbs.db files from your hard drive

1) Click on Start
2) Click on Search
3) Click on All Files and Folders
4) Type the following in the section called "all or part of the file name" thumbs.db
5) In the Look in box, make sure Local Hard Drives is chosen
6) Click Search
7) A long list of thumbs.db files should appear, click on Edit, Select All
8) Click on File, and choose Delete
9) Close the Search Results window

The MSBLAST.A worm infects machines via network connections. It can attack entire networks of computers or one single computer connected to the Internet. The worm exploits a known windows vulnerability that is easily patched, however few systems seem to have this patch installed. It attacks Windows 2000 and Windows XP machines and exploits the DCOM RPC Vulnerablity.

You can disable this shutdown by following the steps below during the countdown

1. Click on Start, Run
2. Type in CMD and press ENTER
3. Type in the following command and press Enter

SHUTDOWN -A
This will terminate the shutdown, however in most cases the system may be to unstable to try to recover and may need to be rebooted anyway.

1) Run Registry Edit (regedit)
2) Find this location
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
3) Right click on the Explorer folder and select New > DWORD Value.
4) Name the registry NoDrives
5) Double click on NoDrives which is in the right page.
6) In the DWORD Value window, select Decimal.
7) In this case I want to hide drive D, so I must fill 8 in Value data.
The number you filled varies with drive you want it to be hidden.
If you want to hide the other drives, you must put the drive-related
number like below,

A=1 | B=2 | C=4 | D=8 | E=16 | F=32 | G=64 | H=128 | I=256 | J=512 | K=1024 | L=2048 | M=4096 | N=8192 | O=16384 | P=32768 | Q=65536 | R=131072 | S=262144 | T=524288 | U=1048576 | V=2097152 | W=4194304 | X=8388608 | Y=16777216 | Z=33554432 | All drive=67108863

This action will require you to edit your Host file. Your host file is a computer file used to store information on where to find a node on a computer network.

1. Click Start->All Programs->Accessories->Command Prompt.
2. Click Command Prompt This will open a DOS command window.
3. Type: notepad C:/Windows/System32/drivers/etc/hosts
4. Locate the line 127.0.0.1 localhost
5. To block the website google.com for example,
just add this text under 127.0.0.1 localhost:

127.0.0.1 google.com
127.0.0.1 www.google.com

You can add as many sites any site, However you will need to prefix it with "127.0.0.1".

6. Save the file. Google will now be blocked in all web browser. This is an advanced but easy method on how to blow a website.