Advanced Uninstaller is more than an application manager. With the capacity to soup up your Registry and spruce up your Start menu, this powerful organizer unclutters your PC. No matter how tidy a person you consider yourself to be or how vigilant you are at keeping your personal effects in good shape, it is likely that your PC is in a much less organized state.

You may believe your desktop to be a haven of tranquility, with its handful of icons all lined up neatly with the carefully-selected wallpaper background, but there is likely to be all manner of mayhem going on behind the scenes. You may be ever so careful about the programs you choose to download from the Web, but unless you have your firewall cranked right up, a few things may have side-stepped your vigilant eye and could be causing your machine to perform at a less than optimum pace. Every time you open a Web site, suspicious characters such as pop-ups, cookies and temporary files invite themselves onto your machine and take up a shadowy residence in the hope that you don't have the software or curiosity to chase them out.

Besides these more shady sorts are endless amounts of unused or expired program files, plug-ins, URL records and History records loitering about after your last time on the Web. In this tutorial, we're going to introduce you to Advanced Uninstaller – a system management application that helps you complete a range of standard computer cleansing tasks, wrapped up in one free download.

If you want to tackle the number of cookies installed on your system, give your computer a good defragment and generally spring-clean your startup application list. Advanced Uninstaller will prove to be a delight. It's a flexible, easy-to-use program geared to tackling these important tasks and a whole lot more besides, to make sure your system is running as efficiently as possible. It will pretty much guarantee that you'll receive no nasty surprises when innocently demanding your machine to perform another task. All of the program’s operations are aided by a very friendly wizard, who guides you through your chosen cleaning procedure, and the functions are all completed with a simple drag and drop.

So rather than wondering why your PC is running so sluggishly, just load up Advanced Uninstaller PRO, an easy to use suite for uninstalling applications and keeping your computer clean, fast and in its best shape. All features of Advanced Uninstaller PRO are designed to be both safe and easy to use.

You can easily uninstall programs by selecting the application from a list, or by dragging and dropping a file or shortcut on the Advanced Uninstaller PRO desktop icon.

The Startup Manager gives you control over the programs that are automatically started by Windows, and offers you detailed information about each one of them, including advice about what the program does and whether you should disable it or not. Advanced Uninstaller PRO includes a huge knowledge base containing startup program descriptions.

This new release contains a powerful registry cleaner, defragmenter and optimizer which will help you keep your registry fast, clean and easily accessible by all programs. A registry backup utility is also included.

The Quick Cleaner will allow you to perform a one step clean-up of your computer and to protect your privacy. It can safely delete the Internet visited pages history, the web addresses you typed, the Internet cookies and also the recently open files list for more than 100 applications, including Microsoft Office, Windows Media Player, ICQ, MSN, WinZip, RealPlayer, Kazaa, WinAmp, etc.

Advanced Uninstaller PRO also enables you to remove all not working Start Menu shortcuts, to hide and show them at your will and to alphabetically sort the entire Start Menu.

Some other important functions of Advanced Uninstaller PRO are: finding and deleting garbage and temporary files left behind by Windows, Internet Explorer and other applications, detailed Internet Explorer configuration by enabling or disabling its toolbars, plug-ins and BHOs, a nice and powerful font manager, a Control Panel manager and many, many more.

Advanced Uninstaller PRO is a suite which contains several tools and utilities. A very important tool offered by Advanced Uninstaller PRO is the Installation Monitor.

This tool can watch a program's installation, create an installation log containing information about everything that the setup of the program has done, and then later completely uninstall the program.

The installation monitor can monitor an application's installation and create an installation log. The installation log for the application will contain detailed information about all the additions and modifications that the application's installation (also called the application's setup) did to your system, including:

application files and folders added by the installation on your hard-disk
entries added to your registry
shortcuts added to your Start Menu and Desktop
files and folders that the application has renamed
INI files
etc.
The installation monitor can carefully watch an application's installation, and record all the changes it made to your system in an installation log. The installation log is stored in a file on your hard-disk.

Using that installation log you can later uninstall the application using Advanced Uninstaller PRO. This has several big advantages over the installation routines that are built into the programs you install, which appear in the Add or Remove Programs applet in your Control Panel:

You will be able to uninstall a program even if the program's uninstall routine doesn't work. How many times did you install a program, and later you found out that you couldn't uninstall it? If you monitor programs installation using our installation monitor, this problem will be gone for good!
When uninstalling a program with our installation monitor, that program will be completely gone from your system. No garbage entries will be left behind in your registry or on your disk after an uninstall. There will be no more dead shortcuts. This will happen because the installation log for an application contains information about all and every modification that a program has done to your system when you installed it. Because of this, our installation monitor is able to completely uninstall a program from your computer, leaving no debris behind.
As a result, if you properly use the installation monitor to install and uninstall software, your system will run faster, better and with fewer errors than before.
While using the installation monitor you can always press the F1 key or the Help button in order to see the built-in online help which accurately describes every function, window and control in the installation monitor.

Here is a complete, step by step manual about how to use the installation monitor:

How to monitor an application's installation ... learn how to install a program while the installation monitor watches the installation and records an install log.

What to do during installation monitoring ... important rules to follow in order to get an accurate, precise install log that you can later use to completely uninstall an application.

How to uninstall an application that you have monitored ... use the install log you have created in order to completely kick an application off your computer.

How to restore an application that you have uninstalled ... our installation monitor has some safety features. One of the most important is the ability to backup an application before uninstalling.. so if you want the application back, or if things don't go well after uninstalling, you can just restore the application from the backup, even if you don't have the original setup file that you used to install it.

Installation monitor settings ... all the things you can configure which affect the installation monitor.

Safety features in the installation monitor ... describes some of the safety features built into the installation monitor.

The Advanced Uninstaller PRO Installation Monitor can fully uninstall a program if you have monitored the program's installation and have saved the application's installation log created during monitoring. In order to uninstall an application for which you have an install log please right click on the System Tray icon and choose the Uninstall an application you have monitored menu item.

The uninstall wizard will appear. The steps of the wizard are:

Select an application to uninstall - in this step the Installation Monitor shows you the list of applications for which you have installation logs, and you can choose the application to uninstall.

Select uninstall options - in this step you choose the uninstall options: perform a full or custom uninstall, backup the application before uninstalling, etc.

The custom uninstall step - this step asks you to select which application items to uninstall and which application items to keep. This step appears only if the custom uninstall option was selected.

The progress step - appears when the program is reading the installation log and is processing the information necessary for showing the custom uninstall step or for uninstalling the program.

The common files step - appears if the uninstaller detects that some of the files it is about to remove are common files which may be used by other applications. If this step appears, we recommend you to unselect all the common files found, in order to be sure that all applications on your computer work properly after uninstalling the application you decided to uninstall.

Running programs - if the program that you are about to uninstall is running on your computer, this step will appear and will enable you to stop the program before uninstalling it.

The uninstall itself - this step removes the files, folders, registry entries, shortcuts, etc.

The final step - informs you about how the uninstall went, and shows how many items (files, folders, shortcuts, registry entries, etc) have been uninstalled.

If you have uninstalled an application using the installation monitor, and if you have checked the backup option in the uninstall options, then you have a backup of the application. You can use this backup to fully restore the application.

Let's say you want to restore an application from a backup created this way. Please right click on the installation monitor system tray icon to access the system tray menu:



In this menu, please select Restore an application from backup.

The restore wizard will appear. This wizard has the following steps:

Select backup - shows you the list of available backups. You can select a backup and press the Next button to restore it.

Restore options - in this step of the wizard you choose restore options such as: full or custom restore, whether to delete the backup after the restore, etc.

The custom restore step - shows you a list of items (files, folders, shortcuts, registry entries, INI file entries, etc) that are about to be restored and allows you to specify exactly which items you want to restore. This step only appears if you check the custom restore option in the Restore options step.

The progress step - this step appears when the restore wizard is reading the backup file and preparing to restore the application. It shows you progress information.

The restore step - performs the restore. That is, it extracts the files, folders, registry entries, shortcuts, etc, from the backup archive and installs them back on your computer, taking care that they are put back correctly, in the right order, and that everything is ok.

The final step - reports to you about how the restore went and shows you how many items of each type it has restored.

The main safety feature of the installation monitor is that when you uninstall a monitored application, it can create an application backup. This option is available in the select uninstall options step of the uninstall wizard.

If you later discover that you need that application, or that your system has some problems without that application installed, you can restore the application from the backup.

We recommend you to always select the backup file option. After a while, if your system and applications work ok, you can delete the application backup file.

If however you encounter some problems, you can just restore the application from the backup.


Home page URL : http://www.element5.com

» Read More...

Computer is also a machine and like all other machines it needs maintenance. Computers are not like ordinary machines but are intelligent machines. They require systematic servicing and maintenance. Computers performance can be affected badly and can even "break down" if not well taken care of and maintained. People maintain their automobiles because of the large investment they have made in them but most fail to maintain their computer systems despite the similar large investment.

Many people are not entirely familiar with the procedures of maintenance that must be performed in order to service computer systems properly, and most system technicians will agree that the necessary tools are not included in the operating system. Advanced System Optimizer is a complete collection of all the necessary tools to keep your system running smoothly, speedily, and error free.

Use Advanced System Optimizer regularly and we promise you will be amazed at the performance of your computer.

System Cleaner Group is responsible to clean your system from junk files and invalid entries.

Programs installed on your system write entries in the Windows Registry. When you remove your software these entries are not always removed completely as a result the Registry becomes more and more large. As windows often accesses registry, greater the size of the registry longer it will take to find and access the requested data.

Lot of unwanted data like temporary files, zero byte files, etc gets collected on the Hard Disk. These files occupy precious space on the hard disk and needs to be removed.

You might also want to customize the programs which are to be executed or not during Windows startup. This can be managed through Start Manager.

Windows applications create several files on your hard drive for temporarily storing the data. These files are supposed to be removed when application terminates. Often, they don’t because of a program error, sloppy architecture, your system gets reset or does not shut down properly, or another application locks up or crash. It is important to know that any file which is left behind in this manner will remain on your system unless you manually search and remove it. Over time, these junk and obsolete files can accumulate to megabytes of wasted hard drive space, as well as turn into potential error-producing cross-linked drive references. System Cleaner and Optimizer targets these specific types of files which are missed by common disk utilities like Uninstaller, Defrag and Scandisk etc.

Along with wasting space on your system, obsolete and junk files can produce very hazardous results if not properly cleaned from your drive on a periodic basis.

The symptoms that these garbage files can produce include:

Lost data.

Cross-linked drive references.

Sudden application lock ups.

Fatal Errors in your applications.

Virus like behavior.

Mysterious Reboots.

System Cleaner and Optimizer by removing these files eliminates such errors.

It has Wizard link interface consisting of steps:

Welcome

Select Drive

Select Junk Files

Other Options

Scanning Process

Report and Cleanup

Finish

Over time, windows database "the Registry" in which Windows and other applications store information can begin to hold data that is no longer valid. Such information links points to a location where there was a file, but now the file is no longer there. Often such invalid links occur because programs uninstalled do not completely remove their registry entries, programs were not correctly uninstalled by the user, a user views a file attached to email without saving them to disk first, and applications have been moved without uninstalling and reinstalling them. This invalid data eventually begins to clutter the system registry, slowing Windows down and causing other possible problems.

“Just like bad cholesterol gets accumulated in our body and can lead to serious medical troubles like Heart attack, similarly, Registry clutter can lead to serious troubles, like system crashes and reboots. So as doctors advice to exercise regularly to keep Bad cholesterol level down, Registry Cleaner is also recommended to keep the clutter out of the registry. It is beneficial in the longer run.”

The Registry Cleaner and Fixer will cleanup and streamline your Registry by finding and removing these invalid data references. Invalid links are common in system registry, and it is always a good idea to clean them out regularly.

It has Wizard link interface consisting of steps:

Welcome

Scanning Options

Scanning Progress

Scan Results

Report and Cleanup

Finish

There are certain programs that you want to execute when your system starts. In general users make a program execute at window startup by copying the executable file to the startup folder.

Startup Cleaner and Autorun Manager helps you to easily manage program execution at windows startup. Startup Cleaner and Autorun Manager is used to administer the programs executing on startup and the files to be loaded at start up.

With Startup Cleaner and Autorun Manager one can easily add programs which one wish to run once or every time the system starts.

Programs added to the startup folder can be easily viewed or removed by any one but Startup Cleaner and Autorun Manager provides you tool by which you not only can add programs in the startup folder but also in the Windows Registry and Win.ini file.

Adding programs to the Registry and Win.ini file protects the program.

It has a explorer like interface which displays all the registry folders on the left in a list view.

System Optimization category provides you with various system optimization utilities. Various default settings in Windows reduces the performance of your computer.

With the help of utilities provided under System Optimizer you can make necessary changes and can easily optimize your Windows performance.

Registry Optimizer and Defragger tunes up the system registry and defrags it for faster responses of queries.

Windows Optimizer lets you optimize and customize your windows settings.

Memory Optimizer optimizes the system memory in a regular interval so that each program receives its share of the memory appropriately.

What Registry Optimizer and Defragger does?

Registry Optimizer and Defragger eliminates the registry fragmentation. It gives you a fresh new registry with no holes, no redolent data.

Advantages of Registry Optimizer and Defragger:

Builds a brand new registry from the old one.

Improves System Response Time.

Saves Memory as smaller registry consumes less memory.

Privacy Protector. Removes the deleted data from the registry permanently.

Improves Application response time.

Improves boot time.

Prevents the registry corruption.

It has Wizard like interface consisting of steps:

Welcome

Defrag Process

Reporting

Finish and Reboot

The Windows Registry

The registry plays a key role in the configuration and control of Windows systems. It is the repository for both system wide and per-user settings. The data in the registry is stored in more than one file, each file called a hive.

Windows and most programs store their configuration data in the registry. Over time, as programs are used, installed and uninstalled, the registry becomes fragmented. Think of Registry Database as a chart with rows and columns in a big queue. When an entry is removed, the entry is converted into a blank entry with no data. It still occupies the same amount of space that it was occupying before. This is necessary so that the information below this entry is still in the same place. When new items are added to the registry, they are added at the bottom in a queue. So over time, the registry ends up with a lot of blank cells. This situation is similar to disk fragmentation, which occurs when the system creates and deletes files on the disk.

There are lot of programs installed on your system by you or when you install your windows which you use for your convenience. The appearance and working you set by the windows.

To make working on your system more interesting and according to your needs Windows Program Settings has been introduced.

Windows Optimizer helps you in Tweaking Windows Programs according to your requirement.

Windows Optimizer provides you various options to customize programs on your system.

All the options are divided into categories and sub categories. You just need to click on the respective settings.

There are many programs and services run at a time on your system and each of which require some amount of memory of the computer. As memory is allotted to each and every program and service on your system, a situation arises that the computer fall short of memory resources.



Why do you need Memory Optimization?

Slow program execution time.

Windows Hang up.

Windows Crashing.

Data loss.

Unwanted Shutdowns.

If you are facing any of these problem while working on your system then you need Memory Optimizer.

Memory Optimizer Optimizes the Memory Management of Windows. This results in best performance boots.

Memory Optimizer does not require any special configuration neither it will effect your system stability.

It has Wizard like interface consisting of steps:

Welcome

Memory Information

Optimize Settings

Program Settings

At startup the program will minimize to system tray. When you will right click on the system tray icon of Memory Optimizer a Popup window will appear with program options.

Options:

Show Main Window - It will display the main form of memory optimizer, displaying the wizard for memory optimization.

Optimize Now - It will optimize your system memory when you click on Optimize Now option.

There are a lot of files and folders on your system. Browsing these files and folders can be a tedious task.

System Tools provide you with easy to manage utilities for browsing and managing files and folders on your system.

It provides system information under System Informer Module.

Description of all the files and folders can be seen under Disk Informer.

Analyze your system and take advise about performance improvement of your system through System Analyzer and Advisor.

System Informer is a utility which lets you view at a glance all the details of your system. In a easy to use and user friendly interface, it provides you with complete information about your system.

System Informer helps you to know about your system more so that you work more efficiently.

System Informer has been divided into ten modules. Each module provides you with information about different aspects of your system.

File and Folder Information helps you to view at a glance all the folders, files inside them and the space occupied by them on your system.

This utility is an important tool with which you can organize your data and can easily view the Data on your disk.

You can also take print outs of the details shown by the Disk Informer.

It provides information about the drives on your system in extremely user-friendly and attractive way.

Features like changing Themes and Charts makes it attractive and color full.

It has a explorer like interface displaying all the available drives on your system on the left and all the folders along with there size and files on the right.

System Optimization category provides you with various system optimization utilities. Various default settings in Windows reduces the performance of your computer.

With the help of utilities provided under System Optimizer you can make necessary changes and can easily optimize your Windows performance.

Registry Optimizer and Defragger tunes up the system registry and defrags it for faster responses of queries.

Windows Optimizer lets you optimize and customize your windows settings.

Memory Optimizer optimizes the system memory in a regular interval so that each program receives its share of the memory appropriately.

» Read More...

Advanced PDF Password Recovery Pro (APDFPRP) is a program to decrypt protected Adobe Acrobat PDF files, which have user (open) and/or owner (security, master) passwords set, and to recover these passwords. Owner-level protection allows to prevent PDF file from editing (changing), printing, selecting text and graphics (and copying them into the Clipboard), or adding/changing annotations and form fields (in any combination); user-level one locks the file so the password is required to open/view the file. If only owner password is set, decryption is being done instantly; decrypted file can be opened in any PDF viewer (e.g. Adobe Acrobat Reader) without any restrictions -- i.e. with edit/copy/print/annotate functions enabled. Alternatively, owner password can be recovered using brute-force or dictionary attacks; for user password, these attacks are required in any case. Also, the program supports "key search" attack that allows to decrypt (in a reasonable time) PDF files with 40-bit security redardless the password length, guaranteed.

Requirements :
·Windows 95, Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP or Windows Server 2003
·about one megabyte of free space on hard disk

Please note that the program cannot (yet) work with some files created in Adobe Acrobat 6.0 (PDF 1.5 specification).

Adobe Acrobat features two levels of password protection.

Protecting document with access restriction ("owner", so-called "security" or "master") password does not affect a user's ability to open and view the PDF file, but prevents user from editing (changing) the file, printing it, selecting text and graphics (and copying them into the Clipboard), adding/changing annotations and form fields etc (in any combination). If the file is protected this way, you open it in Adobe Acrobat Reader (again, the password is not required for that) and select File | Document Security menu item (in Acrobat Reader 5.x or older) or File | Document Properties, Security, Show Details in Adobe Reader 6.x and 7.x, the following information is shown.

Fortunately, there is no need to recover that password at all: instead, we can remove it (decrypt the file), so the resulting document will not have any restrictions. That's exactly what APDFPRP does. However, such decryption possible only if "user" password (see below) is not set or known.

Also, there are "open" (so-called "user") passwords. If one is set, the file is encrypted with strong RC4 algorithm, and cannot be opened at all, if the password or encryption key is not known. APDFPRP can recover (try to recover) this password, too, but time-consuming dictionary and brute-force attacks are required. In addition, APDFPRP allows to run this attacks to recover "owner" password, because to decrypt the file, either "user" or "owner" password is needed. Even if both passwords are very long and complex, it is still possible to decrypt the file using Key search attack, which tries all possible 40-bit RC4 keys. It takes up to 30 days to complete (on a single PIII machine), but the success is guaranteed.

Note that when the file is being saved in Acrobat and the "user" password is set, the "owner" password is being set automatically to the same value (but can be changed manually, of course). That's because PDF file cannot have only "user" password: in any case, it has either "owner" password, or both "owner" and "user" passwords (which could be the same or different). Please take that in mind when selecting Advanced options.

Finally, PDF files can be protected using PDF Merchant and EBX digital rights management schemes or 3rd party plugins such as FileOpen, SoftLock etc. APDFPRP does not support such ones, i.e. cannot decrypt them at all.

Please note that Acrobat 5.0 and 6.0 can create PDF files with improved security level: 56..128-bit RC4 encryption (look at Complete new feature highlights document on Adobe server). For such files, "owner" protection can be recovered instantly as for Adobe Acrobat 4.0 (and older versions), but brute-force and dictionary attacks are much slower; and "key search" attack is not available at all.

When brute-force or dictionary atack starts, APDFPR provides additional information what kind of security handler is being used; log window will contain a record like:

05.04.2002 13:05:51 - File "C:My Documents\test.pdf" opened.
05.04.2002 13:06:14 - Handler: Acrobat Standard (Standard) 40-bit security v.1.

or

05.04.2002 13:05:51 - Handler: Acrobat Standard (Standard) 128-bit security v.2.

Just enter the name of the PDF document you'd like to get the password for. Use the "Browse" ("Load PDF file into the project...") button (or F3 key) to select it, or press the "recent files" button (with a small down arrow) to pick from the list (if you've used APDFPRP on your target document before). Alternatively, you can use drag'n'drop – just drag the file (with a mouse) from Windows Explorer, and drop it to the APDFPRP window.

If only "owner" password is set, or the "user" password is known, you can decrypt it immediately – press "Decrypt the document" button (just at the right of "Browse" one). If the "user" password is set, you'll be prompted for it. Please note that you can enter even the "owner" password there – APDFPRP can still decrypt the file with it, recognizing the type of the password automatically.

If the "user" password is set but now known, you have to select other options and start the attack – consult next chapters for more informations.

If the file is encrypted using any security method other than standard, APDFPR will display an error message (that this kind of encryption is not supported), and write a corresponding record to the log file, for example:

05.04.2002 13:08:59 - Handler: FileOpen Publisher (FOPN_fLock) 40-bit security v.1.

Instructs the program what characters have been used in the password. You can choose from all capital letters, all small letters, all digits, all special symbols and the space, or all printable (includes all of the above). The special characters are:

!@#$%^&*()_+-=<>,./?[]{}~:;`'|"\

Alternatively, you can define your own character set (charset). Just mark the "User-defined" checkbox and click on "Custom charset…" (at the right of the option). In the input window, enter all chars of your password range; for example: if you remember that your password was entered in the bottom keyboard row ("zxcv...") - your password range should be "zxcvbnm,./" (or in caps: "ZXCVBNM<>?"). You can also define both of these: "zxcvbnm,./ZXCVBNM<>?". In addition, you can load and save custom charsets, or combine them using the "Add charset from file..." button.

This option may help, for example, if you know the first character(s) of the password. For example, if you're sure that the small letters have been used (from 'a' to 'z'), the length is 5, and the password definitely starts with 'k', than type 'kaaaa' here. Please also note, that if you press the "Stop" button when APDFPRP is working, the program writes the current password to this window ("Start from password"). It can be used later to restart the program from the same point.

Please note that the program verifies the passwords according to the following character order:

· CAPITAL letters: 'A'..'Z'

· the space

· small letters: 'a'..'z')

· digits: '0'..'9'

· special characters: !@#$%^&*()_+-=<>,./?[]{}~:;`'|"\

You can also use End at field to set the password APDFPRP should stop at. It might be useful if you attack the same document on a few computers, and so can split the whole password range onto a few parts.

If you already know some characters in the password, you can specify the mask to decrease the total number of passwords to be verified. At the moment, you can set the mask only for fixed-length passwords, but doing this can still help.

For example, you know that the password contains 8 characters, starts with 'x', and ends with '99'; the other symbols are small or capital letters. So, the mask to be set is "x?????99", and the charset has to be set to All caps and All small. With such options, the total number of the passwords that APDFPRP will try will be the same as if you're working with 5-character passwords which don't contain digits; it is much less than if the length were set to 8 and the All Printable option were selected. In the above example, the '?' chars indicate the unknown symbols.

If you know that the password contains an occurrence of the mask character '?', you can choose a different mask character to avoid having one character, '?', represent both an unknown pattern position and a known character. In this case, you could change the mask symbol from '?' to, for example, '#' or '*', and use a mask pattern of "x######?" (for mask symbol '#') or "x******?" (for mask symbol '*').

This is one of the most important options affecting checking time. Usually, you can test all short passwords in just a few minutes; but for longer passwords, you have to have patience and/or some knowledge about the password (including the character set which has been used, or even better – the mask).

The minimum length cannot be set to a value greater than maximum length, of course.

If the minimum and maximum lengths are not the same, the program tries the shorter passwords first. For example, if you set minimum=3 and maximum=7, the program will start from 3-character passwords, then try 4-character ones and so on – up to 7. While APDFPRP is running, it shows the current password length, as well as the current password, average speed, elapsed and remaining time, and total and processed number of passwords (Program status). All of this information except average speed and elapsed time, which are global, is related only to the current length.

Simply select the desired dictionary file. In addition, you can select an option Smart mutations or Try all possible upper/lower case combinations – it may really help if you're not sure about the register the password has been typed in. For example, let's assume that the next word in dictionary is "PASSword" (the case, actually, doesn't matter here). With the second option enabled, the program will just try all possible combinations, like:

password
passworD
passwoRd
passwoRD
passwOrd
…
PASSWORd
PASSWORD

However, checking all such combinations takes a lot of time: in the example above, APDFPRP will check 2^8 words (i.e. 256) instead of one. With smart mutations, you can eliminate a number of "virtually impossible" combinations, and here are all the words which will be checked:

PASSword
(as is)

passWORD
(reversed)

password
(all lower case)

PASSWORD
(all upper case)

Password
(first uppercase, rest lowercase)

pASSWORD
(first lower case, rest uppercase)

PaSSWoRD
(elite: vowels in lc, others in uc)

pAsswOrd
(noelite)

PaSsWoRd
(alt/1)

pAsSwOrD
(alt/2)

So, it makes only 10 combinations for each word.

The Start line # option allows you to start an attack from a given line (in the dictionary); if you interrupt the attack, the "current" line number will be written there (and saved to the project file, of course).

A small but very effective dictionary is included into APDFPRP distribution: english.dic (about 27,000 words). An extended English dictionary (over 2,600,000 words), as well as the dictionaries for more than 20 other languages.

If the PDF file has both user and owner passwords and they are long and complex, you have nothing to do but try this attack. It tries all possible RC4 encryption keys until it finds the right one, and allows to decrypt the file using that key – the resulting PDF file will have no security at all. That method gives 100% success.

In PDF 1.2/1.3 files (Acrobat 4.x or older), the key length in 40 bits, and so the total number of keys is 2^40, or 1,099,511,627,776. All key space is divided into 65,536 blocks, with 16,777,216 in a block; it takes up to a minute (sometimes more, if you have a slow CPU) to process one block. So the whole recovery process takes about 30 days on PIII-450 computer, and the average is just 15 days.

You have to select the block to start from (Start from block input box) and ending block (End at block box); both values could be from 0 to 65536. During the attack, the program shows the number of the current block, time elapsed, average speed (in keys per second), number of keys already processed and the total number of keys. When the key is found, the program shows it and ask you to decrypt the file; if you already know the key, just put it into the Document key input box and press Decrypt button at the right.

If you you have more than one CPU in your system and SMP-enabled operating system (Windows NT, Windows 2000 or Windows XP), be sure to enable the Use multi-processor code option – recovery speed will be almost two times better (right now the system is optimized for two CPUs only, so if you have more, they will not be used).

Unfortunately, Adobe Acrobat 5.0 can create PDF files with improved security level: 56..128-bit RC4 encryption (PDF 1.4 specification; look at Complete new feature highlights document on Adobe server), and so that attack is not applicable to them (you will get an error message).

If you'd like APDFPRP to save its state periodically, please check the appropriate option, and select the time (in minutes) between saves. If you do that, APDFPRP will create and periodically update a restore file named "~apdfpr.axr" (that's the default – you can change it) in the same folder where your document is located (also by default; you can select any other folder to save that file to). This file is similar to one created when using the "Save setup" button. Even if your computer stops responding (or if power fails), you'll be able to restore breaking the password from the last saved state. Instead of using the default settings (the name of the file and the folder it will be saved to), you can also select your own settings. Enabling this option is strongly recommended.

Priority: background or high. If you want to start APDFPRP as a "background" process, which will work only when the CPU is in an idle state, you may select "Background". If you want to increase performance, select "High", but be aware that this will decrease the performance of *all other* applications running on your computer.

Minimize to tray: if this option is enabled, the program window will disappear from the Windows desktop when you press the "minimize" button in the top-right corner of the window (or you select an appropriate item in the system menu). The small icon will be created in the "tray" area of the task bar (near the system clock). Just double-click on that icon to restore the window.

Log to apdfprp.log: when enabled, the program saves all information displayed in the status window into the log-file (apdfprp.log).

Progress bar update interval: allows to set an interval (in milliseconds) between progress bar and status window updates; the default is 500 (a reasonable value). By selecting the higher value (3000, for example), you can get slightly better recovery speed.

Register: press this button to register your copy of APDFPRP (if you've got the registration code already, of course).

Update: press this button (when you're connected to the Internet) to see if there a new version of APDFPRP on our site. Note: the program uses Microsoft Internet Explorer proxy settings.

Language: the program has multi-language interface. Just select the appropriate language from the drop-down box. English is the default.

Search for: Any password, User password or Owner password. Select this option to instruct the program which particular password to search for; look at About PDF encryption chapter first. And here are a few recommendations for different cases:

· Your file is not encrypted at all. It doesn't matter what do you select: when you try to run the attack, the program will note you that it is nothing to do.

· Your file has only "owner" password set. You'll get a notification message that the file can be decrypted now, but you can still search for the original password. Select to search for Owner password only; you can also search for Any password, but the speed will be lower.

· Your file has both "user" and "owner" passwords set, and they're the same (typically, you don't know that in advance, but as noted above, the "owner" password is set to the same value as "user" one just by default). The best solution here is to search for User password only, as far as it is the fastest.

· Both "user" and "owner" passwords are set, but they're different. You can search for any of them, or for both at the same time. Please take in mind that searching for User password is the fastest, for Owner password – almost two time slower, and for Any password – the slowest. So that's up to you what to select. There is a chance that one of these passwords is much shorter/simpler than the other one, but again, you don't know that in advance. We'd recommend to set Any password first (for example, with the dictionary attack, and up to 4-5 chars with brute-force attack), and then look for User password, but in extended range (e.g. up to 7 chars).

Mask symbol: used for Mask attack.

Use code optimized for: (Non-MMX processors / Intel PII/PIII/Celeron / AMD Athlon / Intel P4 SSE2): force APDFPRP to use the code specially optimized for the given CPUs. The program detects your CPU and tries to select the proper code automatically, but you may want to play with that option if you've got any other CPU such as Cyrix, Transmeta Crusoe etc.


Home page URL : http://www.elcomsoft.com/apdfpr.html

» Read More...

Advanced PDF Password Recovery (or simply APDFPR) has been designed to decrypt protected Adobe Acrobat PDF files, which have "owner" password set, preventing the file from editing (changing), printing, selecting text and graphics (and copying them into the Clipboard), or adding/changing annotations and form fields (in any combination). Decryption is being done instantly. Decrypted file can be opened in any PDF viewer (e.g. Adobe Acrobat Reader) without any restrictions – i.e. with edit/copy/print functions enabled. Please note that APDFPR doesn't work with documents which have user-level passwords (preventing the files from being opened), if both user and owner passwords are unknown; or if the file is protected with any 3rd party security plug-in. All versions of Acrobat (including Acrobat 5.0) are supported. The program is also able to convert Kinko's Document Format (KDF) files to PDF files.

Requirements :
•Windows 95, Windows 98, Windows ME, Windows NT 4.0, Windows 2000 or Windows XP
•about one megabyte of free space on hard disk

Please note that APDFPR does NOT work on Mac computers with Virtual PC; unfortunately, it seems to be a problem of Virtual PC itself. However, APDFPR seems to be working just fine on SoftWindows from FWB Software; you can also try RealPC from the same company. Native Mac version is not available yet, as well as versions for other platforms.

Adobe Acrobat features two levels of password protection.

Protecting document with access restriction (“owner”, so-called “security” or “master”) password does not affect a user's ability to open and view the PDF file, but prevents user from editing (changing) the file, printing it, selecting text and graphics (and copying them into the Clipboard), adding/changing annotations and form fields etc (in any combination). If the file is protected this way, you open it in Adobe Acrobat Reader (again, the password is not required for that) and select File | Document Security menu item, the following information is shown.

Fortunately, there is no need to recover that password at all: instead, we can remove it (decrypt the file), so the resulting document will not have any restrictions. That’s exactly what APDFPR does. However, such decryption possible only if “user” password (see below) is not set or known.

Also, there are “open” (so-called “user”) passwords. If one is set, the file is encrypted with strong RC4 algorithm, and cannot be opened at all, if the password is not known. With APDFPR, you need to know this password to be able to decrypt the file protected this way. If you need to recover “open” PDF password, please use the professional edition of APDFPR, available on our site.

Finally, PDF files can be protected using PDF Merchant and EBX digital rights management schemes or 3rd party plug-ins such as FileOpen, SoftLock etc. APDFPR is not able to decrypt such files.

For more details about Adobe Acrobat PDF format and encryption used there, look at Acrobat 5.0 SDK Documentation.

Simply select the PDF file you want to decrypt: press the Open document... button and browse for your file (PDF or KDF). If the given file is corrupted, or used by another application, or not encrypted, or has a user-level password set – appropriate error message will be displayed (in the last case, you can still decrypt the file with APDFPR, but have to know either user or owner password). Otherwise, the program will will ask you do you want to remove the protection, and if yes, prompt you for the file name of decrypted file (you can select any one). Resulting file will not have any restrictions at all. The confirmation box also contain an option Open file in PDF viewer after decrypting – if selected, APDFPR will run default PDF viewer (the one associated with .pdf extension, typically Adobe Acrobat or Adobe Acrobat Reader) and load decrypted file into it (when/if the file will be decrypted successfully).

APDFPR allows to save the decrypted file under the same name as the source file, but asks do you want to save a backup copy or not. We strongly recommend you to have this option always enabled, verify the files after decryption, and delete backup files only when you’re sure that decryption has been done properly.

Please note that unregistered (trial) version of APDFPR decrypts only first 10% pages (but at least one page) of protected documents. All other pages are replaced with blank ones (just some watermarks and hyperlinks are being left).

If Adobe Acrobat Reader doesn’t show the menu and/or toolbar (and so you don’t see the Print item), you can simply press F7 to show menu and F8 to show toolbar.

If you get the message Unknown Encryption Handler, it means that the given file has been encrypted using some 3rd party security plug-in or some DRM (digital rights management) scheme. Unfortunately, APDFPR cannot process such files at all.

You can also process/decrypt PDF files (one at a time) by right-clicking on them in Windows Explorer, and selecting Decrypt with APDFPR from pop-up menu.

APDFPR is also able to convert Kinko's Document Format (KDF) files into PDF files (without any protection). KDF files can be created using Kinko's File Prep Tool (KFP), available free from Kinko's. Converted (by APDFPR) file has both KDF and PDF headers, so allowing to open it in Kinko's FilePrep Tool, if needed (Adobe Acrobat and Acrobat Reader just ignore the KDF header).

If you want to process (decrypt) a few PDF or KDF files at once, you can run the program with a command-line parameters.

If you need to extract contents from PDF files, read How to Extract Text and Graphics from PDF Files Using Acrobat Reader 5.0.5 article in Adobe Support Knowledgebase.

You can execute the program with command line parameters, like:

apdfpr.exe src_path [dest_path] [-b] [-q] [-p=xxx]

src_path Path for source file(s); wildcards are allowed.
dest_path The location of the folder to put decrypted files to (must already exist). If not specified, source path is used.
-b Create backup copies of files being decrypted. Ignored if dest_path is not equal to src_path.
-p=xxx If the program encounters the file which is locked from opening (with “user” password set), it tries to decrypt it using the given password (“xxx”).
-q Quiet mode; ignores the files with “user” password, if one specified in -p option doesn’t match, or -p option is not supplied at all.
-l=log_path Creates a log file (“log_path”; should be a file name).
-w Close program when all files are processed, main window is not being shown at all; last error is being returned (or just 0 if no errors occured).
If the extension of the source file is .PDF, it is being processed as Adobe Acrobat PDF file; if the extension is .KDF, it is being processed as Kinko's Document Format file. If the extension is neither .PDF nor .KDF, the program recognises file format by looking at the document header, and if it starts with %!KDF-, it is considered to be the KDF file (otherwise – PDF). Please note that KDF files, when processed by APDFPR (converted to PDF), still have the optional KDF header along with the PDF one, and .KDF extension, so you can further open them by both Kinko's File Prep Tool or Adobe Acrobat [Reader] – Adobe Acrobat will simply ignore KDF header. You can, however, safely rename processed files and give them .PDF extension.

The parameters enclosed in square brackets are optional; the only mandatory parameter is the source path.

If src_file starts with @ character, it is treated as a name of the file that contains a list of PDF documents to be processed (one per line).

If source or destination path contain spaces, it has to be included in double quotes.

The password may contain any special characters, but they have to be represented in hex form with % prefix. For example, the space is represented as 20 in hex, so if the password is “my pass”, the appropriate command line option would be:

-p=my%20pass

The % character itself should be replaced with %25.

-w option could be used if you would like to execute APDFPR from your own software, but want the main program window not to appear on the screen (please note that if -p or -q option is not specified, but file with user password will be encountered, the program will still prompt for the password). When all files specified in the command line will be processed, APDFPR terminates with an appropriate error code.

-l option instructs the program to create a log file (describing all the program is doing, error messages etc). If the file already exists, APDFPR appends to it (writes at the information at the end). If the path to the file contains spaces, it should be shielded with double quotes (see examples below). Please note that if you select src_path as *.*, log file could not be created in the same folder where the source file are, because the name of the log file will also match the given mask, and so APDFPR will try to process it as a PDF file. Just use the mask like *.PDF, and/or create the log file in a different folder.

Examples:
apdfpr.exe doc??.pdf
apdfpr.exe “c:\my documents\manuals\*.pdf” “c:\my documents\decrypted\” –q
apdfpr.exe @list.txt -b -p=LockSmith -w –l=”C:\Program Files\apdfpr_log.txt”

When there is a problem with PDF files you’re trying to decrypt, APDFPR shows some kind of error message which looks like:

Can't open file C:\My documents\report.pdf. Error 105

Here is the explanation of the error codes:


Error code Error description
0 PDFERR_OK No errors
1 PDFERR_NO_STARTXREF No reference to objects table
2 PDFERR_BAD_STARTXREF Invalid reference to objects table
3 PDFERR_NOREF No objects table
4 PDFERR_BAD_XREF Invalid objects table
5 PDFERR_NO_TRAILER No document trailer
6 PDFERR_BAD_TRAILER Invalid document trailer
7 PDFERR_NO_OBJ Cannot find object
8 PDFERR_BAD_OBJ Invalid object format
9 PDFERR_NO_ENDOBJ Cannot find the end of the object
10 PDFERR_UNEXPECTED_LEX Unexpected lexem encountered
11 PDFERR_NAME_EXPECTED No name
12 PDFERR_NO_TRAILER_DICT No trailer dictionary
13 PDFERR_NO_STREAM_DICT No stream dictionary
14 PDFERR_NO_STREAM_LEN No stream length
15 PDFERR_BAD_STREAM_LEN Invalid format of stream length
16 PDFERR_NO_ENDSTREAM Cannot find the end of the stream
20 PDFERR_NO_LEX Lexem not found
21 PDFERR_UNK_LEX Unknown lexem encountered
30 PDFERR_BAD_NUMBER Invalid number format
31 PDFERR_BAD_STRING Invalid string format
32 PDFERR_BAD_HEXSTR Invalid hexadecimal string format
33 PDFERR_BAD_NAME Invalid name format
34 PDFERR_BAD_KEYWORD Invalid keyword format
35 PDFERR_UNK_KEYWORD Unknown keyword
101 PDFERR_ALREADY_OPENED Document already loaded
102 PDFERR_CANT_OPEN Cannot open document
103 PDFERR_CANT_CREATE_MAP Cannot map file
104 PDFERR_CANT_MAP_VIEW Cannot view file map
105 PDFERR_NO_HEADER No PDF file header
1001 PDFERR_NO_ENCRYPT Document is not encrypted
1002 PDFERR_NO_PDEF Document is not loaded
1003 PDFERR_BAD_REF Wrong reference to Encryption Object
1004 PDFERR_BAD_OBJ Invalid Encryption Object
1005 PDFERR_WRONG_FILTER Unsupported Encryption Filter
1006 PDFERR_WRONG_VER Unsupported Encryption Version
1007 PDFERR_WRONG_REV Unsupported Encryption Revision
1008 PDFERR_WRONG_OWNER Invalid OwnerKey format
1009 PDFERR_WRONG_USER Invalid UserKey format
1010 PDFERR_WRONG_PERM Invalid Permissions format
1011 PDFERR_NO_ID Cannot find DocumentID
1012 PDFERR_BAD_ID Invalid DocumentID format


Home page URL : http://www.elcomsoft.com/apdfpr.html

» Read More...

Advanced Outlook Express Password Recovery (or simply AOEPR) is a program to recover server name, login and password for all mail and news accounts in Microsoft Outlook Express, as well as passwords to "Identities" (available in Outlook Express 5.x and 6.x). Passwords are recovered instantly, multilingual ones are supported. Works with all versions of Outlook Express.

Requirements :
•Windows 95, Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP or Windows Server 2003
•about 1 megabyte of free space on hard disk

There are three buttons on the program toolbar: to recover mail accounts, news accounts and identities, respectively.

For every mail and news account, AOEPR shows the server address, login and password; usually, last two fields are shown as for news, which means that no login/password is required to connect to the given server (however, it might be available only if you connect to the Internet from particular ISP). Also, the program shows the server type (NNTP for news accounts; and POP3, IMAP4 or HTTP for mail accounts) and Password Storage Type.

For Identities, AOEPR shows the list of name/password combinations.

Some information (describing what exactly the program is doing) is printed into the log window. You can select (with mouse) some events there, press right mouse button and copy selected lines into the Clipboard using appropriate item in pop-up menu.

Please note that all account/password information is stored in Windows Registry (in Protected Storage, to be exact), and being accessed by AOEPR using standard Windows API. That means that if you’ve re-installed (not upgraded) Windows, all your settings will be lost. Right now, AOEPR cannot extract it from binary Registry files – probably, it will be implemented in the next version.

All information shown by AOEPR (address, login password) can be save into the text file – use Save Report button.

If you experience any troubles when trying to get any passwords (for mail, news or identities), e.g. the program just crashes or does not show the password, you can use debug mode. To enable it, select Settings | Program Options menu item, check the Enable logging box, and select the path to log file (or just leave the default value). Then, try to recover the passwords again, and send us that log file. It does not contain your passwords, just some technical information (what does the program do: accessing particular Registry keys, reading and decryption data etc). It would really help us to locate and fix a problem.

Typically, Microsoft Outlook Express stores all passwords in the Protected Storage subsystem. All passwords are stored in system Registry in encrypted form. However, some old versions can store account passwords in a plain (unencrypted) form, or encrypted with weak algorithm (logical XOR operation). In some cases, AOEPR can show wrong passwords, for example if your system Registry is damaged, or you do not have enough rights (permissions) to access some keys in Registry, or Protected Storage subsystem is not installed on your computer. Displaying of Password Storage Types will help you to identify why some passwords are displayed incorrectly. Here is a brief description of Password Storage Types:

PS Password is successfully retrieved and stored in Protected Storage.
OL Password is successfully retrieved and stored in system Registry using "old-style" weak encryption algorithm.
NP Password was not found in Protected Storage, in some cases it indicates that user name is used as password, or Protected Storage subsystem is damaged.
UN Unknown Password Storage Type. You may use version of Outlook Express that is not supported by AOEPR, or your system Registry is damaged.
ER Error in password retrieving.
NR Password was not retrieved. You do not have enough rights to unlock the Protected Storage, or Protected Storage is not installed on your machine.
NO Password for this account is absent.


Home page URL : http://www.elcomsoft.com/aoepr.html

» Read More...

Advanced Office Password Recovery (AOPR) is ElcomSoft's comprehensive recovery suite supporting all versions of Microsoft® Office (including international versions) and all other Microsoft® software using the new encryption method based on Cryptographic Service Provider (CSP) file protection for Office XP and later.

Advanced Office Password Recovery requires the following system configuration to run properly:
· Pentium or higher CPU
· Windows® 95, Windows® 98, Windows® ME, Windows® NT 4.0, Windows® 2000, Windows® XP or Windows® Server 2003
· About four megabytes of free space on hard disk
· Some features may require Administrative Rights on Windows® NT, 2000, XP or 2003 Server

When AOPR is the active window pressing the function key F1 will give you AOPR's comprehensive help file. Alternatively go to the menu bar, select "Help | Help Contents".

Help for particular controls:

Right-click on any control to display a "What's This?" menu that leads to a description of the control. This works with menu items as well. This way, if you are uncertain about a control's function or impact help is at hand.

To select a file you want to recover the password(s) for simply press the "Open File" button (or select the "File | Open File" menu item) and browse for the appropriate file (or press on a small arrow at the right to load a file you have been working with recently).

File Format will be recognized automatically with corresponding message in the Log Window. If the specified File Format is not supported by AOPR, or it's corrupted, or used by another application – the appropriate error message will be displayed.

You can clear the Recent Files list selecting the "File | Clear Files History" menu item.

After the File selection, the dialog box with results will be displayed automatically. The following situations may occur as the result of the File Processing:

· All or some Passwords were recovered. The dialog box with passwords is displayed. Password fields may contain those auxilary messages:
· - the password is not set;
· - the password cannot be recovered instantly, you must select the Attack Options and Start the Attack to recover this password. You can Create a Project to save the Attack parameters to the file.
· - the password cannot be recovered, but can be changed or deleted. In this case a Dialog with results contains two additional buttons: "Change Password" and "Delete Password". You can change or delete the password simply clicking those buttons. Selected File must not be write-protected to complete this operation successfully.
· - the Password cannot be recovered by some reason. The possible reasons are:
· Selected File Format does not have such password
· Password that decrypts a document is not found yet
· - an error occured while Password Recovery process. The error message box is displayed to explain the error.
· - the Password is not supported by current version of AOPR.
· - the Password was found but its length exceeds the Trial Version Limitations. You must purchase AOPR License to see that Password.

Any found Password can be copied to the Clipboard. Simply press the "Copy to Clipboard" button located at the right of the corresponding Password. You can insert the copied Password to any field by pressing the "Ctrl-V" buttons combiantion (usually the Paste menu item is disabled, but the keyboard shortcut always works). Passwords which contains international symbols can be displayed incorrectly on Windows® 95, 98 and Me. These Windows® versions don't support Unicode and therefore we recommend to use Windows® NT, 2000 or XP to recover passwords with international symbols.

Path to the selected File is displayed under "File Path:" caption. You can open the File simply clicking the "Open..." button.

· File Format is not supported. This may occur when you're selecting file which Format is not supported by AOPR. Please see the "Supported File Types and Passwords" section to learn what File Formats are supported by AOPR.
· An Error occured. The Error message box is displayed.

Please examine the Passwords Manual to get more information about Document Passwords.

If you need to recover the "open" password for Word®/Excel® 97/2000/XP, PowerPoint® XP or Money 2002/2003/2004 document and this password cannot be recovered instantly, you may create a project. Project file contains all information about the source File, selected Options and Character Set. You can simply copy the Project File to another computer and you don't need to copy the source File -- the Project contains all information needed to recover a Password.

When you open the file for password recovery and this Password cannot be recovered instantly, the program creates a new Project automatically. Project files have an ".OPR" extension. By default the Project name is equal to the source File name. For example if you're opening the "test.doc" file, the Project name is "test.opr".

When the file is loaded, you can save your project -- all the changes you've made will be reflected in the project file. The name for the project is selected automatically based on the name of the file. If you want to give an alternative name – use "File | Save Project As..." menu item. If you don't want to change the name, just use the "File | Save Project" menu item.

If a Project was created and you're trying to quit AOPR, the Saving Project Prompt will be displayed. You can disable this Prompt unckecking the "Prompt if project was changed" checkbox at the Options tab.

If you have a document with password-protected VBA project, but for some reason the password cannot be recovered, or the password shown by AOPR cannot be entered (for example it contains non-English characters that cannot be entered using your keyboard), or AOPR only allows to change or remove that password (but you would not like to do that), you can use the "VBA backdoor" feature. It works for all applications which can create VBA projects in their documents, not only Microsoft® Office (for example, Corel WordPerfect Office and AutoCAD).

With that feature, the password is not being recovered at all. However, you're able to open a VBA project (to view/edit the code). Of course you should have the application (this document has been created with, or later version) installed.

Just press the "VBA Backdoor" button on AOPR toolbar (or select VBA Backdoor | Open file through backdoor menu item). The program will prompt you for the document file.

Here you set the additional Command Line parameters if needed. AOPR will run the application (with a special way) this document has been created with, and load your document into it. Now go into VBA properties (typically, it is under "Tools | Macro | Visual Basic Editor" or "Tools | VBAProject Properties". You'll be prompted for the Password. Enter ANY one (e.g., xyz), and it will be accepted!

If your document has been created in Microsoft® Office 97, you can use Office 2000 or Office XP, too. However, the reverse is not true: if you would like to unprotect Office 2000/XP document, but have only Office 97 installed, AOPR will still run it (with a warning message), but Backdoor will not work.

In addition (for example, in the case if the extension of the protected files is not registered in the system, so AOPR don't know what program to execute), you can just run the desired application (the one with VBA support: Word®, Excel®, FrontPage, AutoCad etc) using the same technology: select "VBA Backdoor | Launch application" menu item. Backdoor will be activated, and for all documents you will open in that application, any password will be accepted.

Please note that this backdoor is supported only for a limited number of versions of VBA engine (VBE.DLL or VBE6.DLL) – the ones that were available when current version of AOPR has been released (the latest one comes with Microsoft® Office 2003). When the application is executed, AOPR prints (into the Log Window) the size and version number of that DLL. If your one is not supported yet, AOPR uses "generic" patch, which may fail under certain circumstances.

You can use the Benchmark feature to estimate the speed of your computer and calculate the time needed to recover the Strong Password. Just press the appropriate "Calculate" button on the "Benchmark" tab. To determine the time needed to recover the password, simply divide the total number of passwords to the speed displayed in the Benchmark dialog. Total number of passwords is just the number of the characters in selected character set in a power of the password length.

If a Password cannot be recovered instantly you must use one of the Attack Types. The following Attack Types are available in AOPR:

· Brute-Force Attack. This Attack will try all possible characters combinations in the specified Range. The Range is defined by Password Length and Brute-Force Range Options.
· Brute-Force with Mask. This Attack is useful when you remeber a part of Password. For example if you remember that length of your password was 5 characters and password begins from "A", you can define the mask "A????" and save the time by trying 4 symbols instead of 5. A Password Mask must be defined to use this Attack.
· Dictionary Attack. This Attack verifies the words stored in the specified Dictionary File. The dictionary is just the text (ASCII file) with one work at a line; the lines are separated with line breaks. You can set additional Dictionary Options for this Attack. A Dictionary Attack is much more faster than Brute-Force so we recommend to run it first. AOPR has supplied with one small Dictionary File containing English words. Additional Dictionaries can be obtained on a CD with any Elcomsoft program.

To select the needed Attack Type click the corresponding radio button under "Type of Attack for Documents with Strong Encryption".

Preliminary Attack is the set of predefined Attacks which are tried when Password cannot be recovered instantly.

Preliminary Attack consists of four independed Attacks which can be enabled/disabled in program Options.

· Found Passwords Attack. This Attack is always available. It checks all Passwords that were found in the document prior to finding the current Password. For example Microsoft® Word® Files may have a VBA Project Password. This Password is checked first beacuse many users uses the same Passwords in different places.
· Password Cache Attack. This Attack checks the Password Cache (all passwords found in other documents by AOPR). This Attack can be enabled/disabled by "Password Cache Preliminary Attack" checkbox at the "Options" tab.
· Preliminary Dictionary Attack. Performs the Dictionary Attack by Default Dictionary with "Smart Mutations" Option. This Attack can be enabled/disabled by "Preliminary Dictionary Attack" checkbox at the "Options" tab.
· Preliminary Brute-Force Attack. Performs the Brute-Force Attack by several predefined Character Sets. This Attack can be enabled/disabled by "Preliminary Brute-Force Attack" at the "Options" tab.

Preliminary Attack may take several minutes to run. You can stop it at any time clicking the "Stop" button.

This is one of the most important options affecting checking time. You can check all 4-character (and shorter) passwords in a few minutes. But for longer passwords you have to have patience and/or some knowledge about the password (including the character set which has been used, or even better – the mask).

AOPR allows you to set a Password Length range by defining the Minimal and Maximal Length. These values can be set using the "Password Length" controls at the "Brute-Force" tab. The minimal length cannot be set to a value greater than maximal one. In this case the appropriate error message will be displayed.

If the Minimal and Maximal Lengths are not the same, the program tries the shorter passwords first. For example, if you set Minimal=3 and Maximal=7, the program will start from 3-character Passwords, then try 4-character ones and so on -- up to 7. While AOPR is running, it shows the current Password Length, as well as the current Password, Average Speed, Elapsed and Remaining Time, and Total and Processed number of passwords (some of these Parameters are displaying in the "Extended Statistics" Dialog. All of this information except average speed and elapsed time, which are global, is related only to the current length.

In MS Office documents passwords may contain the following Characters: latin letters (both small and capital), digits, special symbols (like @, #, $ etc) and national languages symbols. You can select these Ranges separately, or define your own Password Range. To define your own range, check the box "Custom charset" and press the "Custom charset…" button.

The Predefined Passwords Ranges contain the following Characters:

· "a - z": abcdefghijklmnopqrstuvwxyz
· "A - Z": ABCDEFGHIJKLMNOPQRSTUVWXYZ
· "0 - 9": 0123456789
· "!@..." (special characters): !@#$%^&*()_+-=<>,./?[]{}~:;`'|"\
· "All Printable": contains all Ranges defined above

If you already know some characters in the Password, you can specify the Mask to decrease the total number of passwords to be verified. At the moment, you can set the Mask only for fixed-length Passwords, but doing this can still help.

For example, you know that the Password contains 8 characters, starts with 'x', and ends with '99'; the other symbols are small or capital letters. So, the Mask to be set is "x?????99", and the charset has to be set to All caps and All small. With such options, the total number of the passwords that AOPR will try will be the same as if you're working with 5-character passwords which don't contain digits; it is much less than if the length were set to 8 and the All Printable option were selected. In the above example, the '?' chars indicate the unknown symbols.

If you know that the Password contains an occurrence of the Mask character '?', you can choose a different Mask Character to avoid having one character, '?', represent both an unknown pattern position and a known character. In this case, you could change the Mask Symbol from '?' to, for example, '#' or '*', and use a mask pattern of "x######?" (for mask symbol '#') or "x******?" (for mask symbol '*').

The Mask and Mask Symbol can be defined in the "Mask / Mask Character" control at the "Brute-Force" tab.

At first you have to select the desired Dictionary File. Click the "Select Dictionary File..." button at the "Dictionary" tab and select the needed file.

In that Attack the program will try all words from it as passwords for the selected Document. It really helps when the Password has some meaning, i.e. the whole word. You can select an option "Smart mutations" or "Try all possible upper/lower case combinations" – it may really help if you're not sure about the register the Password has been typed in. For example, let's assume that the next word in dictionary is «PASSword» (the case, actually, doesn't matter here). With the second option enabled, the program will just try all possible combinations, like:

password
passworD
passwoRd
passwoRD
passwOrd
…
PASSWORd
PASSWORD

However, checking all such combinations takes a lot of time: in the example above, the program will check 2^8 words (i.e. 256) instead of one. With Smart Mutations, you can eliminate a number of "virtually impossible" combinations, and here are all the words which will be checked:

PASSword (as is)
passWORD (reversed)
password (all lower case)
PASSWORD (all upper case)
Password (first uppercase, rest lowercase)
pASSWORD (first lower case, rest uppercase)
PaSSWoRD (elite: vowels in lc, others in uc)
pAsswOrd (noelite)
PaSsWoRd (alt/1)
pAsSwOrD (alt/2)

So, it makes only 10 combinations for each word.

The "Start line #" option allows you to start an Attack from a given line (in dictionary); if you'll interrupt the attack, the "current" line number will be written there (and saved to the Project File, of course).

Default Dictionary is used when the Preliminary Attack is running. To select the Default Dictionary click the "Select Default Dictionary..." at the "Dictionary" tab. Please note, this Dictionary Attack is running with "Smart Mutations" Option and a long Dictionary File may slow down the Preliminary Attack.


Home page URL : http://www.elcomsoft.com/aopr.html

» Read More...

Advanced Mailbox Password Recovery (or simply AMBPR) is a program to login and password information (stored locally) for most popular email clients: Microsoft Internet Mail And News, Eudora, TheBat!, Netscape Navigator/Communicator Mail, Pegasus mail, Calypso mail, FoxMail, Phoenix Mail, IncrediMail, @nyMail, QuickMail Pro, MailThem and MailThem Pro, Opera mail, Kaufman Mail Warrior, Becky! Internet Mail. Also includes POP3 and IMAP server emulator that allows to get POP3/IMAP password from any email client. Passwords are recovered instanly, multilingual ones are supported.

Requirements :
•Windows 95, Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP or Windows Server 2003
•about one megabyte of free space on hard disk

The program menu is located at the left of the main screen, just like in Microsoft Outlook: contains Recovery (automatic or manual, as well as mail server emulator: also automatic and manual), Options, Help and Exit button (to switch to appropriate pages).

Most interface elements (such as buttons, raws in the “list view” windows etc) have pop-up “tooltips” which gives more details about them – e.g. what action will be performed when pressing the button. “List view” elements also have context-sensitive menus appearing on right button click.

The program also supports keyboard hotkeys. Use CTRL- to select the high-level menu item, and ALT- to switch to low-level item under it:

CTRL-1: Recovery

ALT-1: Search for email clients
ALT-2: Automatic passwords recovery
ALT-3: Manual passwords recovery

ALT-4: Mail server emulator (auto mode)

ALT-5: Mail server emulator (manual mode)

CTRL-2: Options
ALT-1: Register the program
ALT-2: General options
CTRL-3: Help
ALT-1: Versions and compatibility
ALT-2: About
ALT-3: Help
CTRL-4: Exit
ALT-1: Minimize to tray
ALT-2: Exit to Windows

Scans your computer (hard disk and Registry) for supported email clients. The full list of clients that are supported by the current version is available on Help page. For every email client found, the program shows its full name, version and (sometimes) sender’s email, name and organization. You can hightlight the item you’re interested in and press the right mouse button for context menu to get more information about the given client, save/print/copy it, or just refresh the list of the clients.

Tries to recover all kind of passwords for all email clients found on your system. The program shows email client name, password type (POP3, SMTP, IMAP, account etc), mail server address (if available), login and password. Context menu (on right click) is available in that window, too.

To be used only when/if requested by our customer support department. Generally, you have to select (from drop-down box) the email client you need to get passwords for; enter the encrypted text (or browse for appropriate file); and press Decrypt.

If you have an email client that is not supported “directly” by the AMBPR, you can try the different approach: Mail server emulator.

In the best scenario, all you have to do is just press Connect button (the program emulates both POP3 and IMAP4 servers simultaneously). Now start your email client (if it was already running, you may need to restart it), and send/receive your mail there (actually, no mail will be received, because the client will connect to AMBPR instead of real mail server). Go back to AMBPR, and login and password (for POP3 or IMAP account) should be there.

There are some limitations, though. First, AMBPR should know what mail servers you connect to. It tries to retrieve the list automatically, but for some clients it may still fail to do that. So if your server is not in the list, press Add server to add it (you will be able to remove it when not needed anymore). Second, you can add servers by either name or IP address, but in the second case, emulation will work properly only if IP can be resolved to the name.

Please also note that this method works for regular authentication only; in other cases (e.g. if MD5 APOP authentication is being used) the password is not passed to the server at all, and so it cannot be captured.

By default, AMBPR uses port 110 for POP3 and port 143 for IMAP4; if your email clients has another port settings, you have to change them in AMBPR, respectively (in Options).

We'd recommend you to try Mail server emulator (auto mode) first – and only if it fails, use the "standard" one (as described in this topic). Here are the steps to perform:

• Select POP3 or IMAP emulation
• Click Connect button in AMBPR
• Run your email client
• Open account properties in the client
• Remember current incoming mail (POP3 or IMAP) server address
• Replace it with localhost or 127.0.0.1
• Save account properties
• Connect to the Internet (not required for some clients)
• Receive mail (in the client) for your account
• Go back to AMBPR and look at POP3 user/password there

Now go back to AMBPR and look at POP3 or IMAP user/password there. This method works for regular authentication only; in other cases (e.g. if MD5 APOP authentication is being used) the password is not passed to the server at all, and so it cannot be captured.

Unlike the automatic server emulator described above, this (manual) one works for only POP3 or IMAP4 at a time (according to the option selected), so if you’re not sure, try both of them separately.

Register the program: when/if you have purchased the program, enter your registration code into the input box, and press the Register button.

General options:

Language: select (from drop-down box) an appropriate language to be used for for program user interface (menus, messages etc); press Refresh button to update (after changing your selection).

Print entire windows instead of text: when enabled, AEBPR will print the contents of the current window (where the Print button exists) instead of text.

Warn under Windows NT/2000: not implemented (yet), reserved for future use.

Check for installed e-mail clients at startup: force AMBPR to search (on startup) your computer for [properly] installed email clients the program can recover the passwords for.

POP3 server port and IMAP server port: set port numbers for your email server; defaults are 110 and 143, respectively.

Versions and compatibility: contains information of supported email clients, and particular versions AMBPR has been tested on.

About: copyright information, and links to program home page in the Internet.

Help: online help (the one you’re reading now)

Minimize to tray: minimizes program to the tray on Windows toolbar (near the system clock). To restore the program to normal state, just double-click on its icon (which looks like an envelope) in the tray.

Exit to Windows: closes current session.


Home page URL : http://www.elcomsoft.com/ambpr.html

» Read More...

Advanced Lotus Password Recovery (or simply ALPR) has been designed for recovering the lost passwords for the documents/files created in the following IBM/Lotus applications (all versions):

· Lotus Organizer
· Lotus WordPro
· Lotus SmartMaster
· Lotus 1-2-3
· Lotus Approach
· Lotus Freelance Graphics

The Approach module can also decrypt the passwords set to external dBase/FoxPro (*.DBF) and Paradox (*.DB) files the Lotus Approach is working with (directly, i.e. without ODBC drivers).

Also, the program can decrypt passwords to ftp and proxy servers set in all Lotus SmartSuite components (if/when stored in the local system).

All passwords are recovered (decrypted) instantly; multilingual passwords are supported.


Requirements :

· Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP or Windows Server 2003
· less than 1 megabyte of free space on hard disk

Simply select the file you want to recover the password(s) for. Press the Open document button and select an appropriate file; file format will be recognized automatically with corresponding message in the Status window; if the specified file format is not supported by ALPR, or it's corrupted, or used by another application, or not password-protected – appropriate error message will be displayed. Otherwise, the password will be recovered immediately and shown in the message box (and written to the log window, too); for Approach databases, the program shows a new window with the file password, and passwords to all groups – from there, you can copy them to Windows Clipboard.

To recover passwords to ftp and proxy servers (managed from any SmartSuite component and stored in the local system), press the Lotus internet passwords button on the tool bar.


Home page URL : http://www.elcomsoft.com/alpr.html

» Read More...

Advanced Intuit Password Recovery, or simply AINPR, is a program to recover passwords to files created in Intuit Quicken (*.qdt, *.qdb, *.qdf), Quicken Lawyer (Portfolios, *.pfl and *.bfl) and QuickBooks (*.qba, *.qbw). Multilingual passwords are supported. Quicken versions 4 through 2005 and QuickBooks versions 3 through 2005 are supported. Note: for Quicken 2002 and QuickBooks 2003/2004/2005, only short passwords can be recovered, but passwords containing 4 or more characters can be instantly removed. For Quicken 2003/2004/2005, only brute-force and dictionary attacks are available.

Requirements :
· Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP or Windows Server 2003
· about four megabytes of free space on hard disk

Simply select the file you want to recover the password for: press the Open document... button and browse for it. If the given file is corrupted, or used by another application, or passwords are empty – appropriate error message will be displayed. Otherwise, the program automatically recognizes the file type and works accordingly.

For QuickBooks files (*.qba or *.qbw) created in versions of QuickBooks up to 2002 (incl.), password recovery is instant, but for some very large files the program may work a few seconds until the password(s) will be shown. If you have a slow CPU (like Pentium 200) and less than 32 megabytes of memory, the process may take up to a few munites.

Please note that starting from version 6/98, QuickBooks can have multiple "accounts", i.e. pairs of user name and password. AINPR recovers all of them, but may show the "phantom" accounts as well – the ones which don't actually exist (i.e. have been already deleted). Just ignore them. All you actually need is a password of "Admin" user, which is being recovered in any case.

In QuickBooks 2003/2004/2005, protection is much stronger – the passwords are not stored in the data file anymore. First, AINPR tries (using the brute-force approach) to find the short passwords (not longer than 3 characters; containg latin letters, digits and punctuation marks only) – it usually takes a few seconds. Then, for all users that have the rights to open the file, the program shows password information: either the password itself (if it is short), or if the given user has an empty password, or if password contains four or more characters. As already noted, long passwords cannot be recovered, but can be removed: to clear the password of any given user, highlight the user name and press Remove long password button at the bottom of the window. After confirmation, the password for that user will be removed, and the program will create a backup copy (*.bak) of QuickBooks file (you can remove more than one password during the session – multiple backup files will be created (*.bak, *.bak1, *.bak2 etc).

Password for any QuickBooks account can be copied into the Clipboard using Copy password to Clipboard button (and so you can paste that password into QuickBooks by pressing Ctrl-V or Ctrl-Ins).

Please note that the program has been tested on all US versions of QuickBooks, and some Australian, Canadian, German, New Zealand and UK versions. Support for all non-US versions is not guaranteed.

When Quicken file (*.qdi, *.qdb or *.qdf) is opened by AINPR, in most cases, the password returned by the programis not the same as the original one set in Quicken. That's just due to the nature of encryption algorithm used in Quicken, and we cannot do anything with that. However, the password returned by AINPR will work just fine on the given Quicken file. For your convenience, AINPR allows to copy the password (when found) into the Clipboard, and so use Ctrl-V or Ctrl-Ins to paste it into the proper place in Quicken. In addition, it is printed in the HEX form – that might be useful if it contains non-latin letters.

If the given Quicken file has the transaction password set, AINPR will show it as well (it is being encrypted the same way as the file password).

Note: for Quicken 2002 and 2003/2004/2004, the password encryption (and so program functionality) is different – please read next chapters for details.

Please also note that the program has been tested on all US versions of Quicken, German versions 2002 and through 2005, and some Canadian, Australian, New Zealand and Spanish versions. Support for other (non-US) versions is not guaranteed.

In Quicken 2002 (US and Canadian), protection has been seriously improved, and in most cases, password cannot be recovered at all in a reasonable time. For such files, however, AINPR allows to remove the password from the file, so Quicken will open resulting file without any problems.

Transaction password in Quicken 2002, however, is encrypted the same way as in older versions, so AINPR will recover it regardless the existance of file password.

For German, Australian and NewZealand versions of Quicken 2002/2003/2004/2005, protection is similar to one used in Quicken 2001 (US), so password can be still recovered instantly.

In Quicken 2003, 2004 and 2005 (US), protection is even stronger. Most of file's content is encrypted, and in order to decrypt it, valid password is supplied. The password itself is not stored in the Quicken file, even encrypted – instead, only password's hash is available. So in order to get access to the file, the original password must be recovered.

When AINPR opens password-protected file created in Quicken 2003/2004/2005, if offers to run brute-force and dictionary attacks on it – these are the only methods that could help to recover such strong passwords.


Dictionary attack is the most effective one. With itBrute-force attack, you may try every word in a dictionary or multiple-dictionaries until your password is found. This method is popular because it is well known that many people use common words as passwords. Dictionaries with hundreds of thousands of words, as well as specialist, technical and foreign language dictionaries are available, as are lists of thousands of words that are often used as passwords such as "qwerty", "abcdef" etc. Simply select the desired dictionary file (use the […] button to browse for it); also, you can select a Smart mutations option– it may really help if you're not sure about the register the password has been typed in. For example, if the next word in the dictionary is "PASSword", AINPR will try the following commonly-used modifications:

PASSword (as is)
passWORD (reversed)
password (all lower case)
PASSWORD (all upper case)
Password (first uppercase, rest lowercase)
pASSWORD (first lower case, rest uppercase)
PaSSWoRD (elite: vowels in lc, others in uc)
pAsswOrd (noelite)
PaSsWoRd (alt/1)
pAsSwOrD (alt/2)

In a brute force attack, the program tries to guess your password by trying every single combination of characters until your password is found. For example, the program might follow a sequence like this:

"aaaaaaaa"
"aaaaaaab"
"aaaaaaac" ...

until the password is found. Obviously, this method will take time, for an eight character lowercase alpha password there are 200 Billion combinations to be checked. But with modern computers this sort of attack doesn't take as long as you might think. The brute force attack is the slowest method of password attack, but can often be successful on short and simple passwords.

For brute-force attack, you have to select the character set (i.e. what symbols have been used in the password); you can choose from capital letters, small letters, digits, space and special symbols such punctuation marks. Besides, you should set the desired password length (minimum and maximum). If Autoincrement if failed option is selected, but the password will not be found in specified range, the program will automatically adjust the maximum length and continue the attack.

The status of brute-force attack is being saved automatically, so when/if you will restart the program or just the attack, recovery will be resumed from the point you stopped it on.

As already noted, Quicken 2003/2004/2005 uses really strong encryption. Always start Quicken 2003/2004/2005 password recovery with dictionary attack, trying different dictionaries and wordlists; and if it fails, try the brute-force attack (if both attacks are selected in the program, the program will run the dictionary attack first, and will continue with a brute-force one if the password will not be found on the first stage.

Recovery speed is not very fast – on Pentium 4 at 2.4 GHz, AINPR tries only about 1000 passwords per second. This is quite enough for dictionary attack even if very large wordlist is being used, but brute-force recovery time dramatically increases with the password length. The practical limit of brute-force attack is only 4-5 characters; but 6-character or longer passwords cannot be recovered with this attack in a reasonable time.







Home page URL : http://www.elcomsoft.com/ainpr.html

» Read More...