วินโดว์ (Windows)

1. เพิ่มภาษาไทย
- Control Panel, Regional and Language, Language, Install files for complex
- .. Details, Add thai, Language Bar...
2. กำหนดโปรแกรมที่จะทำงานเมื่อเปิดเครื่อง
- msconfig, startup, none
3. ปิดการทำงานของ MSN Messnenger
- เปิด Windows Messenger
- Tools, Options, Preference, not start
4. ยกเลิก Restore
- Control Panel, System, System Restore, Turn off System Restore
5. เลือกใช้ Classic
- change Start menu to Classic Start menu
6. ทำให้ใช้ Grave Accent (`) เปลี่ยนภาษา
- Control Panel, Regional and Language, Advanced, Select Thai, Apply, Restart
- Control Panel, Regional and Language, Languages, Details, Key Settings, Change Key Sequence
7. แสดงรายชื่อแฟ้มที่ซ่อน และนามสกุล
- Explorer, Tools, Folder Options, View
- Click Show hidden files and folders
- Click Hide extensions for known file types
8. ยกเลิก Login Page
- Control Panel, User Accounts, Change the way users log on or off
- Click Use the Welcome screen
9. กำหนดรหัสผ่านสำหรับห้องที่ Share
- DOS Prompt>net share (ดูรายชื่อ folder ที่เรา share)
- Explorer, Tools, Folder Options, View
- Uncheck : Use simple file sharing (Recommended)
- เลือก Permission เพื่อกำหนดคนที่จะเข้ามาใช้
10. Network
- Right Click on My network Places, Properties
- Right Click on Local Area Connection, Properties
- enable on Show icon in notification area when connected (Show how fast)
- Advanced, enable on Protect my computer (For Firewall)
11. IE configuration
- Internet Option, Use Blank
- Internet Option, Content, AutoComplete, None
12. Control Panel
- Power Options, Disable hibernation
- Display, Themes, Windows Classic
- Display, Desktop, None
- Display, Screen saver, None
- Display, Screen saver, Power, Turn off, never
- Display, Settings, Medium (16 bit)
13. ยกเลิก Updating from Microsoft
- netstat -an .. to check
- found ESTABLISHED to 207.46...:80 , 445, 443
- Control Panel, Automatic Updates, .. or Turn Off
- or Control Panel, System, Automatic Updates, .. or Turn Off
14. ยกเลิก Automatically synchronize with an Internet time server
- Double Click on time
- Select Internet time
15. สำหรับการใช้ Add To Favorites
- Make available offline, Customize, Next, Yes, Next, Next, Finish
- keep in c:\Documents and Settings\yourusername\Local Settings\Temporary Internet Files
16. ติดตั้ง hijackthis ไว้ตรวจสอบ spyware
- download จาก http://www.spywareinfo.com/~merijn/programs.php

สีแดง ผมสั่งปิดไป เพราะไม่ได้ใช้
(msconfig, services)
(Start, Control Panel, Administrative Tools, Services)
(net start)
- Antivir Scheduler
- Automatic Updates (x แม้ปิดใน Control Panel แล้ว ตัวนี้ก็ยัง run อยู่ สั่ง Manual Stop ได้)
- COM+ Event System (Supports System Event Notification Service (SENS))
- Computer Browser (List of computers on the network)
- Cryptographic Services (Catalog Database, Protected Root Service, Key Service)
- DHCP Client (Manages network configuration)
- Distributed Link Tracking Client (Maintain NTFS)
- DNS Client (Resolve DNS)
- Error Reporting Service (Allows error reporting)
- Event Log (Cannot be stoped)
- Fast user Switching Computer (Provide multiple user environment)
- Help and Support (Enables Help and Support Center)
- IPSEC Services (Manages IP security)
- Logical Disk Manager (Detect and Monitors new hard disk)
- Network Connections 
- Network Location Awareness (NLA)
- Plug and Play
- Portable Media Serial Number
- Print Spooler
- Protected Storage
- Remote Procedure Call (RPC)
- Remote Registry
- Secondary Logon
- Security Accounts Manager
- Server
- Shell Hardware Detection
- SSDP Discovery Service
- System Event Notification
- System Restore Service
- Task Scheduler
- TCP/IP NetBIOS Helper
- Terminal Services
- Themes
- Upload Manager (Manage synchronous and asynchronous file transfers between clients and servers)
- WebClient (Enables Windows-based programs to manage Internetbased files)
- Windows Audio (Mange Audio Device)
- Windows Management Instrumention
- Windows Time (Synchronization in network สั่ง Stop ได้เพื่อปิด Port 123)
- Wireless Zero Configuration
- Workstation

Logfile of HijackThis v1.99.1
Scan saved at 8:00:27 AM, on 11/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 202.29.78.13:3128
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: yonoklog1.lnk = C:\WINDOWS\yonoklog1.exe

http://www.experts-exchange.com/Security/Q_20465657.html
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=0554

If you have lost the Administrator password, you must have the following to recover:

1. A regular user account that can logon locally to your Windows NT Workstation, Server,
     or PDC whichever you are recovering.

               If you already have an alternate install of NT, skip to The Process, Set 02.

2. The Windows NT CD-ROM and setup diskettes (winnt /ox to make them from the CD-ROM).
3. Enough room to install a temporary copy of NT (Workstation will suffice, even to recover on a PDC).
4. Your latest Service Pack.

The Process:

01. Install a copy of Windows NT as TEMPNT, on any drive. Install your latest Service Pack.

02. Boot the alternate install.

03. At a command prompt, type AT HH:MM /INTERACTIVE CMD /K where HH:MM is 10 minutes from now
     (or however much time you need to complete the remaining steps and logon to your primary installation).

04. Use Regedt32 to edit:

     HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Schedule

05. Double click Schedule and click the one sub-key.

06. Double click the Schedule value name in the right hand pane and copy the REG_BINARY string to the clipboard.

07. Select HKEY_LOCAL_MACHINE and Load Hive from the Registry menu.

08. Navigate to your original installation\System32\Config folder and double-click System.

09. At the Key Name prompt, type ORIGSYS.

10. Navigate to ORIGSYS\Select and remember the value of Current; i.e. n.

11. Browse to ORIGSYS\ControlSet00n\Services\Schedule and if Start is not 0x2, set it to 0x2.

12. With Schedule selected, Add Key from the Edit menu.

13. Type 001 in Key Name and click OK.

14. Select 001 and Add Value name Command as type REG_SZ and set the string to CMD /K.

15. Select 001 and Add Value name Schedule as type REG_BINARY and paste the string from step 06.

16. Select ORIGSYS and Unload Hive from the Registry Menu.

17. Use Conrol Panel / System / Startup... to make your original install the default.

18. At a CMD prompt:

     attrib -r -s -h c:\boot.ini
     edit c:\boot.ini and either change the id of the TEMPNT lines to Maint 4.0 on both entries
     if you intend to keep this maintenance install or delete them. attrib +r +s +h c:\boot.ini

19. Shutdown and restart your original install.

20. Logon as your user account and wait for HH:MM from step 03.

21. When the CMD prompt opens, it will be under the context of the Schedule user,
     either the System account or an administrative account.
     If this machine is the NOT the PDC, type MUSRMGR.EXE, if it is the PDC, type USRMGR.EXE.
     If you get an error, click YES and type your domain name.

22. Set the Administrator password and logoff.

23. Logon as Administrator. 

24. If you are deleted the TEMPNT entries in step 18, delete <Drive:>\TEMPNT

25. Promise to:

     never forget the Administrator password again
     implement physical security