Under supervision

Never thought that air stewardess would be under supervision too. On my Airasia flight back from KL to Sibu just now, saw a pretty young stewardess, Nita. I think she must be new. Cos there was this lady kept asking questions and the she was like a bit unsure, laughing and smiling when answering questions. Reminded me of my students.
And those under supervision. Anyway wish all of them best of luck.

Should have taken her photo and post it here. :p

Formating mail merge in Word

Taken from http://wordprocessing.about.com/od/usingmailmerge/qt/NPFSwitch.htm

When using Excel spreadsheets in a mail merge process, many users frequently run into difficulty formatting the fields that contain number values. To ensure the data contained in the fields is inserted correctly, one must format the field, not the data in the source file; unfortunately, Word does not provide a way for you to change how many decimal places are displayed when working with numbers. While there are ways to work around this limitation, the best solution is to include a switch in the merge field.

To specify how many decimal places to display in your Word mail merge, you can use the Numeric Picture Field Switch (\#):


1. With the mail merge main document open, press Alt + F9 to view the field codes

2. The field code will look something like {MERGEFIELD “fieldname” }

3. Directly after the end quote around the field name type \# -- do not add spaces or quotes

4. Directly after the field switch you just entered, type 0.0x if you want to round the number to two decimal places, 0.00x if you want to round the number to three decimal places and so forth

5. Once you have added your field switch, press Alt + F9 to display the fields instead of the field codes


Your number will appear rounded to the decimal place you specify; if it does not display immediately, refresh the document by minimizing it to the toolbar and reopening. If the field value still does not display correctly, you may need to refresh the document again or close and re-open your document.

Jovana

Haven't blogged for a very long time. Guess I was too busy. And because of the change of environment this year.

Infected by a virus last week. Not sure how it happened. But it came from a handy drive. Called it the Jovana virus.
Because it creates a recycler folder called Jovana in each drive.

C:\documents and settings\administrator\application data\yjty.exe
C:\Documents and Settings\Administrator\csrss.exe

I tried to delete these file but the the process was still running. Killing it Process Explorer was also fruitless.
Then I tried Unlocker. Only then I was able to delete the file. Need to find the program.


Here is the content of the autorun file.
"sêË×ÄÑÀÊÄêÎ׊ÄÌäêëàñ×ÄÊËŒŠ×ÄÊËœš÷L?DAdlq?dw?nmkslakdl?l?wqdw?ÝÆÂÁôûÄâëáÝÆÖÁÂüëàñäæôûñüáìäæüæËÄÌÜÎÄÙÆËÛÂÕÙÖËâàëâôäæüñûôäÆÑüáûôäÆÑÜÁÔÛÄÑËÁÇÂÖÆÜâÖÆÄÉüáâæâÆÄËÎÛÔÆâëÆÔÜÛÄÆüáñÄÆëáâ÷ÙÂËÖÆüâÖÄÆëâëáÔÛÄÆìüáäæÛÔÌÁÔÛÄÆÁ×üëôÙÖÌÜÎÖÆÌÒÔÖÙÂËÔÆôûüÄÆÌÀÔÛËÂÝÆËÄÖÉÂÖÒÉàîÀÆö
open=JOVANA/pojatar.exe
action=Open folder to view files using Windows Explorer
icon=JOVANA/pojatar.exe
Shell\open\command=JOVANA/pojatar.exe
shell\open\command=JOVANA/pojatar.exe
USEAUTOPLAY=1

Then it created a lot of processes in the temp folder.
It also modifies the registry by creating a few startup entries.
Here is one of the entry created:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
"Shell"="explorer.exe,C:\\Documents"
The rest I forgot cause I deleted them as soon as it came out.
If the process is still alive, it will create all the entries into the registry. Only after I killed it that I was able to fully stop it from modifying the registry.



This is taken from ThreatExpert.com
JOVANA.EXE has been seen to perform the following behavior:

Writes to another Process's Virtual Memory (Process Hijacking)
Adds a Registry Key (RUN) to auto start Programs on system start up
This process creates other processes on disk
Executes Processes stored in Temporary Folders
This Process Deletes Other Processes From Disk
Executes a Process
Injects code into other processes
Copies files
JOVANA.EXE has been the subject of the following behavior:

Created as a process on disk
Executed from Temporary Folders
Has code inserted into its Virtual Memory space by other programs
Added as a Registry auto start to load Program on Boot up
Deleted as a process from disk
Terminated as a Process
Executed as a Process
Copied to multiple locations on the system

I'll be this Husband. I promise...

A nice video I saw in Facebook.