CBT Bazar

Hello friends. In my previous article, I introduced you to the basics of Hexing to bypass antivirus detection. As a reference to that post, I am writing this article to inform you about how Hexing is actually done using Dsplit. Dsplit is a software used to detect virus signature. Hexing is very much important for us to evade antivirus detection. If you will learn how to bypass antivirus by Hexing, you don't have to search for FUD keyloggers and trojans. You can hex files to make them FUD.

I will be using Dsplit as virus signature detector and Ice Gold Freezer as virus over here. You can use any other virus containing file you want.

Download these two files over here:
1. Avira antivirus (Because I've used it in tute).
2. Ice Gold Freezer
 and Dsplit.exe program (used for detecting virus signature).

The downloaded file is zipped and password protected. Click here to get the password.

Hexing Ice Gold Freezer using Dsplit:

First of all, let me tell you that Ice Gold Freezer is detected as "SPR/Tool.Freezer.8" virus (actually malware as Avira.com says) by my Avira antivirus which I use on my computer
. So, I will be telling you how to bypass Avira detection for Ice Gold Freezer. So, lets start.

1. Download Avira antivirus, Dsplit and Ice Gold Freezer from links provided above. Extract Dsplit folder to desktop.

3. Scan Ice Gold Freezer.exe file you've downloaded with antivirus. My Avira says its "SPR/Tool.Freezer.8" malware. So, lets work on it.

4. Copy IceGoldFreezer.exe to Dsplit folder.

5. Now, open Command Prompt (Start ->Run -> cmd ->OK). Change directory to Dsplit folder. So, enter

cd "Replace with your path to Dsplit folder"

and hit Enter.


So, find out your path and enter it accordingly. You can refer first line in the command prompt image below for more information.

6. Now, type in this command:
dsplit.exe 0 max 1000 IceGoldFreezer.exe



dsplit.exe startbyte endbyte numberofbytesinbetween target

7. Now, Dsplit.exe will create around 234 files in current directory. Now, scan all these 234 files created with Avira antivirus. Avira will detect all files from 8000.exe to 233472.exe as virus. So, there is something (virus signature) in 8000.exe which is not present in 7000.exe. Thus, 7000.exe lacks virus signature and hence not detected by Avira, while 8000.exe has virus signature.


                                              Click on image to see enlarged view


Delete all files except 7000.exe, 8000.exe, Dsplit.exe and original IceGoldFreezer.exe.

8. Move on to command prompt and type this:
dsplit.exe 7000 8000 100 IceGoldFreezer.exe

and you'll get 10 files created in current directory. Scan all these 10 created files with Avira antivirus. Avira will detect all files except 7000, 7100.exe as virus. So, again we can say that there is something (actually virus signature) in 7200.exe which is not present in 7100.exe. Delete all files except 7100, 7200, Dsplit.exe and IceGoldFreezer.exe.

9. Now, type in command prompt:
dsplit.exe 7100 7200 10 IceGoldFreezer.exe

                                                Click on image to see enlarged view


and you'll get 10 new files created in current directory. Scan all 10 files with avira and avira will give all files except 7100.exe as virus. So, 7110.exe contains virus signature which 7100.exe doesn't have.

10. Now, comes the last step. Type in command prompt:
dsplit.exe 7100 7110 1 IceGoldFreezer.exe

Again scan all 10 files created with avira antivirus and avira will detect 7108, 7109 and 7110.exe as virus. So, 7108.exe contains virus signature which 7107.exe lacks. Since, these two files are just 1 byte different, this different 1 byte is actually the virus signature which is detected by Avira.

So, we have to change this one byte contained in 7108.exe to make it UD from Avira.

Finding virus definition is important so that we can change found virus definition and prevent antivirus from detecting our virus. The article below shows how to change virus offset to 
bypass antivirus detection and make our trojan undetectable from antiviruses.

Make Trojan undetectable:

To change virus definition we need to have a hex editor. Hex Workshop is one of the best hex editors, I found.

1. Free Download Hex Editor to make trojan undetectable.

2. The downloaded file is zipped and password protected. Click here to get the password.

3. Now, install Hex Editor on your computer.

4. Right click on 7107.exe (obtained from Hexing Part II) and select 'Edit with Hex Workshop'.

5. You will see something like this:



                                               Click on image to see enlarged view

6. Repeat this for 7108.exe.

7. Now, compare both files. You will see at the end 7108.exe will have offset "00" and 7107.exe does not have. So, we conclude that "00" is recognized as virus by antivirus. Note that offset. Here, offset is 0x00001BC3.


                                                  Click on image to see enlarged view


8. Now, open original IceGoldFreezer.exe in Hex Workshop and move to offset 0x00001BC3. Simply select the Dos Prompt of Hex Workshop corresponding to virus signature found in Step 6. and hit on space bar.



                                                 Click on image to see enlarged view

9. Save the file as IceGoldFreezer.exe and again run antivirus scan. Avira will not detect any virus. Also, run, IceGoldFreezer.exe on computer. It will run normally to indicate that we have made it undetectable from Avira antivirus....cheers. We have FUD freezer.

Update: Many readers had problems implementing this Hexing technique and hence I have written an article to solve those queries. If you have any problem, refer my article Hexing Queries Solved for more information.


Now, you can 
make any trojan undetectable from antivirus
using this trojan undetection technique. If you have any problem while using this method to make trojan undetectable from antiviruses, please mention it in comments.

Enjoy Dsplit to make trojan FUD... 
Enjoy Hexing to make trojan undetectable from antiviruses...

Looking for a quick way to scan all the Wifi networks in your area and seeing what channels they are running on? What about getting other info like the SSID, Mac address, signal strength, company name, etc? Nirsoft has released a new free tool called WifiInfoView
which will give you detailed information about all the wireless networks around you. When you download it, you can just double-click to run the program, there is no need to install it. This is really useful because you can copy it to a USB drive or upload it to your Dropbox folder and run it on any computer from anywhere.

The main interface will automatically start listing out all of the wireless networks that the program finds. As you can see, it’s got very detailed information and you can add more columns if you like. By default, you can see the SSID along with the signal strength in green bars, the MAC Address, the PHY Type (a/b/g/n), signal quality, frequency (2 GHz or 5 GHz), Channel, and Company (D-Link, Netgear, etc). You can also choose other columns including Router Model, Router Name, Security, First Detection, Last Detection and Detection Count.
Note that WifiInfoView will only work with Windows Vista, Windows 7, and Windows 8. It does not support Windows XP because it uses a new wireless API that does not exist in Windows XP. If you click on Options, you can also choose from Summary modes, which are come in very handy.
For example, if you go to Channels Summary Mode, the program will group all wireless networks into channels and then show you the count:

As you can see, there are 25 wireless networks running on channel 25, 10 networks on channel 11, etc, etc. If you feel there is some wireless interference from another network, you can also check to see how many other routers are running on the same channel as your router.
If you go to Companies Summary Mode, you can get a grouped listed by the company that manufacturers the router:

If you switch over to PHY Types Mode, you can easily see the number of networks running on wireless G or wireless N, etc.

Overall, it’s a very nice utility for quickly getting detailed info on all the wireless networks in your area. Enjoy!

Have you ever run into the problem where every time you start up Windows, you get the following message:

Setup is preparing your computer for first use

This happened to me on a Windows 7 machine. Actually, I had created an image of Windows 7 and then restored that image to a different machine. When I booted up the machine, I kept getting this message every time and it was really annoying.
You’ll probably only ever see this error if you tried to restore an image of Windows 7 to different hardware. In this article, I’ll mention a few possible solutions that hopefully will get rid of the message on startup.

Method 1 – Registry Keys

The solution that worked for me involved checking the registry for a few keys and making sure the values were correct. Navigate to the following key in your registry:

 HKEY_LOCAL_MACHINE\SYSTEM\Setup

Here you will see a few keys related to the system setup. The registry keys and their values should look like this:

“SetupType”=dword:00000000
“SystemSetupInProgress”=dword:00000000
“SetupPhase”=dword:00000000
“CmdLine”=”" (This field should be Blank )
“OOBEInProgress”=dword:00000000

Here is a screenshot on my computer of what the registry keys and their values should be. I have highlighted the important ones that cause this error:

If you’re having this problem, then you might have something like oobe/windowsdeploy in the CmdLine key. It should be blank like shown above. Also, SystemSetupInProgress and OOBEInProgress also should be set to 0, not 1.
Hopefully, this will fix the setup is preparing your computer for first use message on every startup. If not, there are a few other thins you can try, but your best shot is the registry edit.

Method 2 – Perform a Startup Repair

You can also try to perform a startup repair in Windows 7, which might be able to fix the setup problem. You can check out this article from Microsoft
on how to do a startup repair.

Method 3 – Do a Clean Boot

The only other way you could be getting this message is if there is a program or service that is causing it to occur. By performing a clean boot, you can quickly determine whether it indeed is a program or service. You can read the following post from Microsoft that details the steps to perform a clean boot
.
Hopefully, one of the above solutions fixes your problem. If not, post a comment here and let us know what you tried. Enjoy!

Yes, you can remove any version of windows 8 installed on your computer, irrespective it is windows 8 release preview, consumer preview or windows 8 RTM or Windows 8 final version. In order to do this you just need to follow some simple steps and you can get rid of windows 8 without affecting data either on windows 8 or any other OS running on some other partition on the same computer.

Backup Windows 8 Data Before Deleting

In case you would like to backup you user data and settings in windows 8, all the profile related customizations and data are by default backed up windows 8 if you are using a live or hotmail account in windows or in case you are using a local account or explicitly want to backup specific files you use the windows 8 file history feature, you can follow this guide to know how to do the same.

Other OS Data Backup Before Removing Windows 8

If you follow the guide given below, there will be no need to backup the data on other partitions on other OS drives like windows 7 or xp as these partitions will not be affected when you delete windows 8 from other partition.

Steps To Remove Windows 8 From Partition in Dual Boot

Please Note: This method applies when you have installed windows 8 on a separate partition without affecting the windows 7 or vista existing partitions.
First you will need to boot in any other OS which you have the same computer where you have installed windows 8, it could be windows 7, Xp or Vista and in order to boot you need to press the up and down arrow key so that you don’t miss the boot entry option in case by default your computer is booting in windows 8.
Useful Tip: Force PC Boot In Windows 7 After Installing Windows 8

Boot In Other OS Than Windows 8

1. Once you are booted in windows 7 or other os except windows 8, go to start menu >> run and type ‘msconfig’ without quotes and press enter, you will see the system configuration after this, click on boot tab and then click the entry where you see windows 7 or other OS listed and then click the button saying Set as default if it is not already – so that next time computer boots up and find the boot loader of your old operating system to boot which should remain intact.

2. Now you can select the windows 8 entry – it could be with following names Windows 8 Consumer Preview, Windows 8 Release Preview or Windows 8 – select the respective entry and then click the delete button. After deleting the windows 8 os boot loader this way now you can open disk management.
3. To start the disk management, Start Control Panel Administrative Tools Computer Management Double-click ‘Disk Management’ in the left pane

4. Under disk management make sure to select the windows 8 partition only and then right click it and select ‘Delete Volume’ – now should format this partition so that there are no file left behind after the removal of windows 8 and this is also to make sure that you do the clean removal of windows 8. Now you will create a new partition which will be empty and now you can either use it for data or in future can again install windows 8 on it.
5. Reboot your computer, the windows 8 boot loader will be gone and you will boot and see the older boot loader again which you used to see before installing windows 8 and windows 8 is gone now.

Steps To Remove Windows 8 From Partition in Single OS or Boot Configuration

This method applies to those cases when you have installed only one OS that is windows 8 on a computer, in such case you just need to first backup windows 8 data and files on other drive on the same computer or to a portable drive. Once you have backup files you can easy boot the computer with a OS DVD or CD of your choice and during install – you can format the existing windows 8 os and install older or newer version of windows on the top of it by simply deleting the existing OS on that drive.

If you like this article or this article helped you, please clikc the +1 Button below to recommend this article.

If you’re running Windows 8 with Internet Explorer 10, you probably have realized by now that there are two different versions of IE: one that is a full-screen Metro app and one that is just a desktop version that we’ve always had for years and years.
Normally, if you go to the Start screen, you’ll see the Internet Explorer 10 tile, which will load the Metro full-screen version of IE:

Now let’s say you install Google Chrome and you set Chrome as your default browser:

If you go back to the Start Screen after doing this, you’ll notice that the Internet Explorer tile has a slightly different version of the logo on it! That’s because it’s now the desktop version of IE instead of the metro version.

Now whenever you click on the IE 10 tile on the start screen, it just keeps opening the desktop version! Grrrr. I thought it was a bug or something and it took me forever to figure out what the actual problem was. Since I had made Google Chrome the default browser, Windows 8 decided to replace the tile with the desktop version. I have no idea why it would do this or how it makes any sense, but that is what Windows 8 does.
If you want to get back the immersive IE 10 full-screen metro app, you will have to set IE 10 as the default web browser on your Windows 8 machine. You can do that by going to the Start Screen and typing Default Programs. This will automatically bring up the search charm for you.

Then click on Set your default programs.

Scroll down to Internet Explorer and then click on the Set this program as default at the bottom of the right-hand pane.

That’s it! Now when you do this, if you go back to the Start Screen, you will see that the IE 10 logo has changed back to the Metro full-screen version. If you click on it, you will get the full-screen version of IE.

As of right now, I can’t figure out a way to make Chrome my default browser and still get IE to load in the full-screen version. If you have found a solution to this, please let us know in the comments!
This is definitely not very intuitive and will confuse people even more once they start using Windows 8 and Internet Explorer 10. Two versions is already confusing enough, but disabling the Metro version just because you set another browser as default really makes no sense. Feel free to vent in the comments! Enjoy!

This guide will show you how to change the Windows 7 “Login Screen” background wallpaper to the image of your choice.

The default wallpaper for the Windows 7 sign in screen (also known as the “Lock Screen”) can get a little boring after you’ve seen it a thousand times. This brief tutorial will show you how to change it to a different picture, using a small, safe and free Windows program.

1. Head over to the Windows 7 Logon Background Changer download page, and click the Download button towards the bottom of the page (it’s below the Change log section).
2. Once the download has completed, open the .zip file and run the program Win7LogonBackgroundChangerSetup


3. Select I Agree on the License Agreement screen, then click the Next button. The rest of the installation is just as straight forward – keep clicking Next until you’re done.


4. Launch Windows 7 Logon Background Changer from your Start Menu (it can be found by selecting All Programs and then scrolling through the list).


5. Now you’ll be presented with the main interface.

click to enlarge

6. The bar at the bottom of the screen has a list of “included” images that you can use. The main Window will display your current Windows Login screen, and then ‘preview’ what it will look like when you select a new image. Try selecting one of the included example pictures, and you’ll see a preview of what it would look like.

click to enlarge

7. To set your own picture as the background, click the Choose a Folder button from the top menu.


8. Navigate to the folder that contains the image you want to use, select it, then click the OK button.


9. The bar at the bottom of the screen will now display all of the pictures in the folder you selected. Choose the image you want to use from the lower bar by clicking on it once.


10. The main window will now give you a (basic) preview of what your new background will look like. Click the Apply button if you’re happy with it (or even just want to try it out – you can change the wallpaper/image at any time, as many times as you want).

click to enlarge

11. The screen will flash momentarily as the program applies the change.

click to enlarge

12. To check out your new background, click the Start Button, then the small ‘arrow’ next to the Shut down button, and finally Lock .


13. Ta-da! Your new Windows Login/Lock screen!

click to enlarge

14. If you’re unhappy with the results, just log back in and try another picture :)

If you have started using Windows 8, you must have noticed that Windows 8 does not allow to Hibernate in almost all new installations as default. In fact, in Windows 8 there is a special feature called Fast Startup which is usually enabled by default and it makes Windows 8 boot up really fast compared to Windows 7 and older versions by saving some of the kernel and drivers of Windows in a hibernate like file. This allows quick boot times as its faster to read the information from a file than to load all driver and kernel from scratch. But if you prefer to hibernate your Windows PC and you are annoyed by missing Windows 8 hibernate option or you don’t see Windows 8 hibernate option at all in power options, we will help you to fix the problem right away in very simple steps.


Pleas follow the below steps to make sure hibernate option is restored back in your Windows 8 PC.
Step1: Locate command prompt in all apps, right click on it and select the option which says “Run as administrator”. This will launch the command prompt in administrator mode.

Step 2: On command prompt, type the below command and press enter:

powercgf /hibernate on

Step 3: Open Control Panel > Power Options

Step 4: On the power options Window in the left side pane, click on “Choose what the power buttons do”

Step 5: On the next Window, click on “Change settings that are currently unavailable”

Step 6: Now scroll down on the same Window and you will see “Shutdown settings” under these settings, simply check the “Hibernate” check box and click on the “Save changes” button on the bottom of this window.

This is it, the above changes bring Hibernate option to Windows 8 Power button settings.

Hope you find our tutorial simple and easy to follow, do share the same with your friends.