Jump to content

wildman424

Malware Hunters
  • Posts

    1,679
  • Joined

Posts posted by wildman424

  1. Hello guys n gals,

    I found this tutorial on the net and wanted to share it. I tried to put it in the PC Self Help Articles and Guides forum figuring that's were something like this belongs but it seem I don't have permission to post there :) so I'll just put it here and you guys can move later it if ya want :) Enjoy

    Taking screen shots with Microsoft Paint on Windows Operating Systems

    **This article tells you how to take screenshots of your internal computer problems, so that the people at Microsoft and other troubleshooting services can help you solve your problems much faster and more efficiently

    NOTE - This trick applys to Windows XP, Windows Vista, Windows 7 (excluding Home Basic versions) (- an edit may be required if it does let me know so I can edit my copy this)

    NOTE - This trick works on all newer versions of Windows. However if you are running a Windows 7 or a

    Windows Vista, you can also use the "Snipping Tool" method mentioned below.

    -Windows XP

    1. Press the "Prnt Scrn" button.

    NOTE- Laptop users and some keyboard users may find their "Prnt Scrn" shared with another key read

    Tips section below for more information.

    2. Open Microsoft Paint. To do this, click Start > All Programs > Accessories > Paint. Click inside the

    white part of the screen.

    (shortcut- launch run command start > Run > type "mspaint" )

    (shortcut- launch run command press windows key & R >type "mspaint" )

    3. Go to the Edit menu and click Paste or you can press and hold "Ctrl" and tap V. Then you may crop if

    you like.

    4. Click File > Save As. In the box that pops up, change the "Save As Type" to PNG or JPG. Type in a

    filename for your image. Choose a place to save, like the Desktop, and click save.

    5. You have now successfully taken a screenshot! If you want to send your image to somebody, simply attach

    the .png file that you just saved to an email and send it along. Alternatively, you can upload it onto

    the internet

    -Windows Vista or Windows 7

    1. In Windows Vista or Windows 7 (except in Vista Home Basic), there is a tool called the "Snipping Tool".

    * To open it, click on the Start button and in the box in the bottom of the Start Menu, type snip,

    then hit enter (Windows Vista\Windows 7 updates the search results as you type each letter).

    2. Click on Snipping Tool.

    3. The Snipping Tool opens, and a white mask is applied on the screen. In the drop-down menu for the 'New'

    button, choose from a free-form snip, rectangular snip, window snip, or full-screen snip.

    4. In free-form snip mode, draw around the area you want to be captured. Drag a rectangle in rectangular

    snip mode. For window snip mode, select the window you want to capture. In full-screen mode, just

    selecting it from the drop-down menu makes the capture.

    5. The snipped image is then opened within the Snipping Tool, but is also copied to the Windows clipboard

    for use in other applications.

    Tips

    -If you want to take screenshot of just the active window (usually the one that's in front of all the

    others and activated), press "Alt - Print Screen". This means, you should hold down the Alt key and then

    press the Print Screen key.

    -A quicker way of accessing Microsoft Paint can be achieved by pressing the Windows key (Between "Ctrl"

    and "Alt" on many keyboards") and "R", then typing 'mspaint' in the box that appears.

    -Many laptops, to conserve keyboard space, have mapped the "PrtSc" key as a primary or secondary function

    on a shared key. To take a screenshot with "PrtSc" mapped to a key as a secondary function, you will need

    to locate your notebook's function key (usually labeled "Fn" and located along the bottom row) and engage

    it before touching "PrtSc."

    -Depending on your version of Windows, Paint will allow you to save the screenshot in different formats

    * BMP is the default option (a lossless uncompressed format)

    * PNG is a lossless compressed format

    * JPEG is a lossy, compressed image format, specifically developed for photographic images. For these

    images, it allows for the smallest file size. When used for non-photographic images, file size is

    larger than e.g. PNG and GIF and the image has a lower quality.

    * GIF is good for applications windows with a limited number of colors

    -If you plan on putting your screenshot on a website, be sure it does not exceed a suggested size limit

    -It is also possible to pause an internet video and make a screenshot of it. In this way you can create a

    still from a video, e.g. from youtube.

    -As a rule your video player allows to make the video full screen and high quality, and to stop at the

    frame you want.

    -This capturing method may not work if you play the video from version 11 or newer from Windows Media

    Player.

    -You can use additional software to simplify process of screenshoting. For instance free tools [Light Shot]

    can capture any area as shown here to clipboard with one click. Another suitable software is [snagIt]

    however please note that SnagIt is a commercial tool.

    Warnings

    -Saving a screenshot in some file types (such as bitmaps) will result in a very large file.

    -Some people will be annoyed if you email them a large attachment, remember to crop and convert

  2. Ive had this on my ignore list for some time I use Spybot Search and Destroy & its advanced options as most of you know in advanced mode Spybot has tools one of those tools is IE tweaks the lock IE start page option is being detected by Malwarebytes as

    HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0)

    Those detections are not actually false\positives or actual infections but rather settings which you have made and in some cases, malware also makes. So we scan those sections of the drive for changes which differ from default settings

    hello again sorry I haven't been able to reply I've been busy,OK I understand what your telling me about this being a setting that Malwarebytes monitors for changes and with malware also making this change I understand why you detect it, but in this specific case I consider this a false positive as this change was made by me using a legitimate anti-spyware app so is there a way we can determine how this setting is changed could we develop a way to determine the difference between a legit setting changes and a setting changes made by malware I'm very interested to hear your responses you have a great product and I'd like to see continued improvements to it

    Thanks again,

    Wildman424

  3. hello again,

    :) Ive had this on my ignore list for some time I use Spybot Search and Destroy & its advanced options as most of you know in advanced mode Spybot has tools one of those tools is IE tweaks the lock IE start page option is being detected by Malwarebytes as

    HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0)

    Iv'e just ran a Malwarerbytes full scan in developer mode and have attched the log to this post

    Malwarebytes' Anti-Malware 1.45

    www.malwarebytes.org

    Database version: 4002

    Windows 5.1.2600 Service Pack 3

    Internet Explorer 8.0.6001.18702

    4/17/2010 1:47:32 PM

    mbam-log-2010-04-17 (13-47-32).txt

    Scan type: Full scan (C:\|D:\|E:\|)

    Objects scanned: 218606

    Time elapsed: 54 minute(s), 49 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 1

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> No action taken. [42E51292444A0DB1F8CD3F5AE1316142]

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

  4. This key controls the warning you get about your antivirus software (out of date , not installed .....) . If the value is set to 1 you wont get any of these warnings and multiple malicious applications do this to prevent you from knowing that they have disabled your antivirus software .

    Do you have this disabled for a specific reason ? Also if you have kind of reg guard software it might be preventing the changes we are attempting to make .

    The keys themselves tell you exactly what they do :

    FirewallDisableNotify -> If set to 1 then do not show windows firewall disabled warnings .

    UpdatesDisableNotify -> If set to 1 then do not show the warning indicating that automatic updates are disabled .

    AntiVirusDisableNotify -> If set to 1 then do not show anti-virus disabled warnings

    If you are seeing these with no other signs of infection then it is far more likely that your 3rd party security software has disabled these warnings to prevent duplicate security warnings and in these cases telling MBAM to ignore them once will forever solve the issue .

    * please note *- IF YOUR NOT SURE WHAT CAUSED THESE SETTINGS TO CHANGE ASK SOMEONE THAT DOES BEFORE PUTTING THEM ON YOUR IGNORE LIST

    hello everyone

    I seen this thread and thought I'd tell you bout a recent repair I did were I discovered the same detections this thread is about

    I recently repaired a PC that had McAfee installed on it McAfee had disabled these security notifications

    the PC I repaired had an infection that McAfee had missed, I used Malwarebytes and Spybot Search And Destroy to clean the infection while I was working on it I noticed Malwarebytes detected these registry data infections

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) ->

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) ->

    I knew what these setting were but wasn't thrilled McAfee (I wasn't sure what disabled them at first but after doing some research I figured out it was McAfee ) had disabled them I re-enabled them in the security center and rescanned with Malwarebytes (searching for any remaining infection) and these detections were gone as was the infection I was removing. after the machine was completely repaired I double checked the security center notifications and they were still on,and I rescanned the machine with everything I had available no further problems were found and McAfee was up to date and working fine it seems that McAfee did not change the settings back they haven't changed since I re-enabled them and I haven't had any other complaints from my client

  5. Thanks for the possible reasons, but I'm already aware of them :)

    Does someone here know a good (free) programs for fixing the registry?

    **as you know improperly modifying the Windows Registry could damage the system leave it unstable or even unusable**

    **its not advisable to modify the registry unless you know what you are doing**

    if you do have to modify the registry make a backup of it before you start you also should also use your system restore to make a backup point to restore from if you have to later on, any good program that works on registry issues should in include a backup option, there are a lot of programs out there that swear up n down there the greatest thing ever don't fall for there advertisement tricks do your research,know what you are using,I also recommend looking through Microsoft's Knowledge Base Articles for references about the registry and modifying it properly

    Windows registry information

    How To Backup And Restore The Windows Registry

    ( these are just a couple of the articles )

    I've had fairly good results using CCleaner's registry tool I use it about once a month or so and I can tell a big difference in performance when I do

    Piriform software Ccleaner

    Microsoft has an online scanner with a feature that scans for registry errors Windows Live OneCare Safety Scanner

    ***IMPORTANT***

    ***Before you go modifying the registry or doing anything else by yourself I recommend you follow the instructions left for you by exile360 and post that log here if your getting help from a helper and you go off by yourself doing things on your own it may conflict with what your helper is trying to do for you

    Good Luck

  6. hey there

    is the sndvol32.exe file in your system32 directory if it is not have you tried a system file check ?? System File Checker gives an administrator the ability to scan all protected files to verify their versions. If System File Checker discovers that a protected file has been overwritten, it retrieves the correct version of the file from the cache folder (%Systemroot%\System32\Dllcache) or the Windows installation source files, and then replaces the incorrect file. You must be logged on as an administrator or as a member of the Administrators group to run System File Checker. If the cache folder becomes damaged or unusable, you can use the sfc /scannow, the sfc /scanonce, or the sfc /scanboot commands to repair its contents. out of a command promp type: sfc/scannow close all programs and open windows and let the system sit idle while it runs the check it will create a folder in the Windows directory called LastGood and populate it with files from cache folder (%Systemroot%\System32\Dllcache) copy em were they belong when its done

    Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)

    Description of the Windows File Protection feature

    let me know if this helps you out

    good luck

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.