IM, MS Word threats, and NSA-ATT

So it has been some time since I posted howerver we do have several interesting revalations today...

Coming from our friends at Yahoo, a new work is infecting their IM (Instant Messaging) client known as Yahoo Messenger. This pesky work installs its own web browser and is engaging in spyware like activities. Ironically, the name of the insecure browsers it installs is called The Safety Browser. Check out some more about it here.

Late last week, word (ha!) surfaced on the internet the Microsoft's Word wordprocessor program has a exploit out in the wild. This exploit allows a hacker to take over your comptuer. The good news is that you need to use MS Word and open a document for the exploit to take place. Good thing only 99% of the PC world uses Word. Virus info here.

Finally, the NSA-ATT internet spying scandal is heating up. Today, Wired news/magazing published the 30-page affadavid and ATT documents describing the procedures and setup of the NSA spying equipment. Technically exciting, details things such as procedures, off-limit rooms, and fibre-splitting.

Undetectable "stealth" rootkits are infecting Windows XP SP2 Machines

From E-Week:

"In a rare discussion on the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Offensive rootkits, which are used hide malware programs and maintain an undetectable presence on an infected machine, have become the weapon of choice for virus and spyware writers and, because they often use kernel hooks to avoid detection, Danseglio said IT administrators may never know if all traces of a rootkit have been successfully removed."

Serioius IE Flaw...

Researchers at various secuirty sites have seen an escalation in attacks using an unpatched Internet Explorer (IE) flaw to steal users account names, passwords and personal financial information.

Microsoft acknowledged the previously undisclosed flaw in a blog posting earlier this week, in which it urged users to practice "safe browsing practices" -- such as only visiting trusted Web sites. I'd like to offer my two cents, which is that readers who use Windows consider downloading and using a different browser, like Firefox, Netscape or Opera.

If you do not want to believe these dangers are real, please check out this article on what the attackers are doing with your computer.

Now more than ever it is important to stop using IE on a daily basis and switch to an alternative browser. If your attached to IE for a specific websites functionality, please be sure to only use IE for that site.

Media wall...

So we started with one rack that was moved from upstairs in my house down to my newly finished basement. What a great way to finish that angled wall I put in to cover up some plumbing. This is the grey metallic color of the Benno CD/DVD tower from Ikea. Enjoy...

Access your comptuer from ANYWHERE

I found a great program/site for accessing your home comptuer when you are away from it. It is called LogMeIn and it works like Remote Desktop but without the hasstle of having to know your comptuers IP address or complicated setups through firewalls.

Visit the LogMeIn site and sign up for the free basic remote comptuer access program.

Online Word-Processor/Collaboration

From the you-don't-have-to-spend-a-grand on a word processor department, Writely (Beta) is a web based word processor. Great for simple to medium complex documents, this online, AJAX based application is a free product now owned by Google. When I read about the acquision of the product by Google I new it sounded famiar. I actually had an account already (which is good as new account requests are frozen until they move to Google's servers). Anyway, I found this to be great so try it out. You can actually collaborate on the same doc with others at the same time and all get the same changes. If you want an account let me know and I will invite you.

http://www.writely.com/

All Instant messengers, anywhere

Tired of corporate or school firewalls blocking you favorite IM program. Try Meebo. Slick easy to use interface in your web browswer.

http://www.meebo.com/

Bobby

Far too long...

So its been a long time of neglect for Trifster's Domain...lets see if I can get some good contenet back up here.

So for today, lets discuss the cool world of the Blackberry. Since RIM's patent dispute with NTP has been resolved we can not focus on the fun of being a blackberry addict.

The new breed of Blackberry devices have some awesome capability. With the built in web browser a world of web tools and Google awaits. Below is a sampling of my favorite programs for the blackberry with links (visit BlackberryForums.com for more great info):

UPDATED (3/12/2006):Opera Mini Web Browser

Blackberry Messenger
Use this cool tool to "PIN" message your fellow BB carriers.

Google Local
Download this program so you can have maps, satellite images, and directions right on you BB

Google Talk
Google Talk IM on the blackberry. Awesome

Google and Gmail
Access your personalized Google home or Gmail

AOL IM via RAMBLE
AOL IM on the BB. Great program.

Berry 411
Wireless Link: www.thebogles.com/berry411.jad
Desktop Link: www.thebogles.com/Berry411.htm
The best White Pages and Yellow Pages search software for the BlackBerry, this also has a built-in bonus of movie showtimes lookup and weather lookup!
.

BBToday
Wireless Link: blackberrytools.sourceforge.net/OverTheAir/bbtoday-1.5/BBToday.jad
Desktop Link: sourceforge.net/projects/blackberrytools
A very nice miniature PIM "Today Screen" that displays your appointments, number of missed phone calls, number of waiting new emails, as well as today's weather, as well as your favourite stock quotes.
.

BBReply
Wireless Link: blackberrytools.sourceforge.net/OverTheAir/bbreply-1.1/BBReply.jad
Desktop Link: sourceforge.net/projects/blackberrytools
Ever wish you have multiple different editable "Reply-To:" addresses when writing emails on the BlackBerry? This is the solution - you can now have customizable Reply-To: when writing emails on BlackBerry.
.

BBLight
Wireless Link: blackberrytools.sourceforge.net/OverTheAir/bblight-1.82/BBLight.jad
Desktop Link: sourceforge.net/projects/blackberrytools
Configures your BlackBerry light to stay always-on when out of holster. Or automatically turns on backlight when you hit a keypress (a problem on older BlackBerry models)! Be warned, this application affects battery life!
.

BBWeather
Wireless Link: blackberrytools.sourceforge.net/OverTheAir/bbweather-0.74/BBWeather.jad
Desktop Link: sourceforge.net/projects/blackberrytools
Display weather forecasts on BlackBerry on one button click, much faster than BlackBerry Browser. For entering a new city into this weather forecast application, you need an 8-character city code. (The city code is 4 capital letters followed by 4 numbers. Just grab those codes matching this pattern from inside the URL's when viewing weather forecasts at www.weather.com or www.theweathernetwork.com on your desktop PC, and save the 8 character code into the BBWeather software, and viola.)
.
QuickCompose
Wireless Link: www.marky.com/files/bb/QuickCompose.jad
Desktop Link: blackberryforums.com/showthread.php?t=25495
One hotkey access ("C" key) to immediately composing a blank new email message. Requires BlackBerryOS 4.1 or later. This readds the missing Compose icon from earlier BlackBerryOS software, while using the new convenient New Email interface of OS 4.1. Free utility written by Mark Rejhon (based on Ramble's version). To enable hotkeys, turn off "Dial From Home Screen" setting in Phone->Options. (You can press the phone hotkey before dialing, anyway). Hotkeys do not work on 71XX series, so you have to manually launch via icon. However, hotkeys works from PocketDay as an assigned key if you need hotkeys on the 71XX series.
.
QuickNote
Wireless Link: www.marky.com/files/bb/QuickNote.jad
Desktop Link: blackberryforums.com/showthread.php?t=25495
One hotkey access ("Q" key) to immediately jotting down notes that is automatically copied to the clipboard. Requires BlackBerryOS 3.6 or later. Free utility written by Mark Rejhon. To enable hotkeys, turn off "Dial From Home Screen" setting in Phone->Options (hotkey does not work on 71XX).

Spyware-Aurora/ABI/Nail and others removal

**NOTE**
This post is not complete, but cannot delay due to the threat that exist
**NOTE**

Hello. In this long overdue posting, its time to write a step by step approach to virus/spyware removal for the masses.

To begin, first some explanation. Let's define spyware (source):
Spyware is similar to a Trojan horse in that users unwittingly install the product when they install something else. A common way to become a victim of spyware is to download certain peer-to-peer file swapping products that are available today. Aside from the questions of ethics and privacy, spyware steals from the user by using the computer's memory resources and also by eating bandwidth as it sends information back to the spyware's home base via the user's Internet connection. Because spyware is using memory and system resources, the applications running in the background can lead to system crashes or general system instability. Because spyware exists as independent executable programs, they have the ability to monitor keystrokes, scan files on the hard drive, snoop other applications, such as chat programs or word processors, install other spyware programs, read cookies, change the default home page on the Web browser, consistently relaying this information back to the spyware author who will either use it for advertising/marketing purposes or sell the information to another party. Licensing agreements that accompany software downloads sometimes warn the user that a spyware program will be installed along with the requested software, but the licensing agreements may not always be read completely because the notice of a spyware installation is often couched in obtuse, hard-to-read legal disclaimers. Any software that covertly gathers user information through the user's Internet connection without his or her knowledge, usually for advertising purposes. Spyware applications are typically bundled as a hidden component of freeware or shareware programs that can be downloaded from the Internet; however, it should be noted that the majority of shareware and freeware applications do not come with spyware. Once installed, the spyware monitors user activity on the Internet and transmits that information in the background to someone else. Spyware can also gather information about e-mail addresses and even passwords and credit card numbers.
Now that that is settled, lets get into the nitty gritty. Visit here for the top spyware infections as listed by computer associates.

One of the latest threats is a spyware that is known as Aurora. This pop-up producing spyware behaves very much like a virus. It is very hard to remove as it invades Windows(r) Safe Mode as well as normal boot. Suprisingly, through careful test (use friends comps as guiena pigs), the fools responsible for the Aurora make a removal tool that is actually your easiest way out of their mess. I know the sketchy are leery, but post scans with the right tools show little ills.

So lets get started with our removal. I think a procedural approach is the best. So to outline the overall process, we will detect, quarintine/eradicate, re-detect, analye the unique, then be gone of the pests. Forward note, if your IE is so messed up you cannot get to the links above and below, print this

1. We need tools to do this. While manual deletion and registry editing may be needed, its more wise to let the professional tools do their job. We sometimes have to help them along with that task. The first is an updated and functioning antivirus solution. I highly recommend Symantec Antivrus products. However, whatever AV product you have, its worthless if not updated. Take the time to update the software and spend the few bucks for the virus updates; its chump change well spend.

Now with that AV all updated. Do a FULL SYSTEM scan of your comptuer. Virii and Adware/Spyware will be detected. Delete and/or Quarintine if possible. May take multiple scans. If the same ones get detected, don't fret, we will get to them. For now, lets move on to spyware

2. Again, tools tools tools. There are some great anti-spyware tools out there but no single one is the end all solution. Spybot, Webroot and MS Antispyware are my favorites. Get Microsoft AntiSpyware here. Do install, update, and run scan.

After the scan completes, you may have a list of threats that need to be addressed. I suggest going down the entire list and chooseing remove for all the threats. Continue with the removal of all threats. Now please run another scan and note any repeat offenders.

3. At this point we have a list of persistant threats from your AV and AS programs. Now we need to reboot into safemode to try better to rid ourselves of those problems. So reboot your comptuer. Before you get the Windows "splash"/logo screen during boot. Press F8 to get the boot menu. From there choose "Safe Mode" only. That means NOT safe mode with netowork or other options.

Yes your way into the diagnostic safe mode and choose Owner or Administrator if prompted with a login screen. Once in open your AntiVirus program and do a full system scan. Delete threats found and if you cannot delete the threats use quarintine on them.

Repeat with your Antispyware program. Also remove all threats where possible.

Do both again. Check to see whose left on your repeat offender list.

4. Now we need to address the repeat offenders. Visit http://www.symantec.com/avcenter/or the removal tool list for more help on your left over threats. For AS threats, google them for removal help. Many message boards have specific removal instructions. I will detail the one that was very hard for me the Aurora/ABInetwork/DirectRevenue spyware.

Reboot so we are in windows normal mode.

SurfSideKick Removal
Aurora/ABI/Nail.exe Removal
OR
http://www.mypctuneup.com/


5. Please post comments with your spyware names and links to removal resources!

More Spyware

I know I have covered Spyware in the past here in my blog, but an "old favorite" in the spyware category has been found to have even more sinister actions. The spyware known as "CoolWebSearch" has been known to take over your Internet Explorer and be a real pest.

Recently, from THIS article, researchers in the anti-Spyware field have uncovered a clever key stroke logger hidden deep inside "CoolWebSearch". Read that article and get a good spyware removal tool.

The Random Note...

Wow. So it has been a very long time since I have posted. Our other blog has been the focus of our attention with the birth of my son. Below is the random thing that happend this morning...

So a kinda funny thing happened this morning...

I got to the van this morning to ride the vanpool into work and found the attached note in the door handle. So I have been out for 2 weeks but speculation has run rampet as to who the attended target of the note its. There are 4 guys and 3 girls in the vanpool. 3 of us are married and one is virtually married. The assumption is that the person is female and likes one of the men.

For Sale: DELL TrueMobile 1150 802.11b Wireless Mini-PCI

Check out my auction for a DELL TrueMobile 1150 802.11b Wireless Mini-PCI.

How Xerox sucks...

So this post is 3 weeks in the making. More!! 4-Weeks now. We have a Xerox Workcentre M24 Color Copier that Prints and Scans. It's a $13,000 workgroup all-in-one. $13-freakin thousand dollars.

The copier has worked very well for its first 87,000 print/copy outs. That is basically max designed usage for this unit. We are getting our money's worth. Now we also pay about $300 month maintenance on this machine and it includes some important consumables. What Xerox calls a drum is needed to press the toner on the paper. There are 4 drums total, one for each color. So they provide the Drums, Waste toner container, fuser unit, etc.. We pay for paper, toner and staples.

So It started not processing print jobs and no matter what changes we made on our network and print servers it would not work. We called Xerox in only to be told over and over and over that it must be something on our network. So lets get into the details...

We started with standard service calls to Xerox and they dispatched Adrien the area support person. Nice guy but culprit number one on blaming our network. Despite 2 calls to level 2 networking support in which they agreed with me they did nothing to fix the issue. It was commented they probably just told me that to get me off the phone. After putzing around with an unsuccessful software upgrade they replaced the ESS board. Basically this is a motherboard for a copier. It has the RAM, CPU, NIC port and add-in card for security and MAC address. We learned that the MAC address of the copier is not on the motherboard where the NIC port is but rather on the security card (so you can't copy money). Prior to board change, our network guys found about 16,000 traffic errors coming out of the machine. After there were no errors but still no printing. After 3 visits from Adrien, who's hands are completely tied by Xerox bureaucracy, the idiots up in Rochester (His IT engineers at Xerox HQ) called in an Network Analyst.

Kyp, as he goes by in the working world, was a very thorough diagnostician. We removed the copier from our network and replicated the problem on his laptop to copier via portable switch. He still had issues printing. He was here late on a Friday and after changing a time-out setting and setting IP from DHCP to static the machine printed. Only it printed a little. The change may have let a few jobs come through but it didn't last. Monday morning the copier was exhibiting the same behaviors of not printing.

After giving him a call he dispatched Adrien to replace the HD in the unit. It comes with a 10GB Toshiba laptop HD. Nice as it handles the large print job spooling very well as well as PDF scan-to-email. Fixed, It was like night and day. Instantly the copier started performing much much better. Spooling upwards of 20 jobs from the print server and processing them properly.

Sadly, this all took over 3 weeks to resolve and shows extremely poor support from Xerox. They did not take ownership of the problem and did not accept responsibility for getting the unit back up in a timely manner. This should have been fixed within 3 days, not 3+ weeks. Their process is completely asinine. They rather send a $200/hr tech to fuck around with it for weeks than send a $100 HD, $100 motherboard to try and resolve the issue. I would still recommend our copier but when dealing with Xerox support, tell them what to do b/c they do not have a clue.

The view from my hotel room in the French Quater of New Orleans, LA. 

Upgrade of the WiFi

So after about a year of delay I have begun to upgrade my home wireless network from 802.11b to 802.11g. Basically I am going from 10mbps to 54 mbps in speed or an increas of about 5x. This is a major need not only b/c our cable modem has increased speed but also because the file traffic from servers and to/from laptops has incresed. Here is a breakdown of the hardware.

Wireless Router:
D-Link Wireless Cable/DSL Router 4-Port Switch - 802.11G - 54Mbps - DI-524
$19.99 after mail in rebate

Wireless Adapter Michelle's Notebook:
AT&T 6700G Wireless 802.11g PDMCIA WIFI Card
$22

Wireless Adapter Bobby's Notebook:
INTEL ProSet Wireless 2200 MINI PCI 802.11b/g (internal wifi card)
$28

Total network upgrade cost:
$70

Motorola T721 GSM Cell phone for sale...

Check out my auction for an Motorola T721 AT&T Wireless cell phone. You can pay $15 on the 'net to have it unlocked to work with any carrier that uses a GSM network.

Car Troubles...

So yesterday started off great, I woke up to 12" of snow on the ground and what amounts to a 3 hour delay. On the way down the mountain, I noticed after about 2 minutes of driving, an engine temperature of 190 degrees (normal engine temp) but no heat from the inside blowers. Well, about half way down Camelback road I stopped at the Village store with an engine temp of 240 degrees. I checked to find a low coolant resivoir. No sooner than that did the dashboard "light up like a christmas tree." The dash beeped with 2 warning lights. Good design VW. A red Water Temp light blinked and the yellow check-engine light came on and stayed. Now this car's temp stays at 190 like clockwork. Never has deviated from that reading the entire time owning the car. I know when it was high something serious was going on. I put some water in the coolant resivoir hoping it was just low but wasn't expecting much with all the sensor wizardry going on my dash. I would like to have those go on at about 210 - 230 degrees only because I think the car could give a little sooner warning. Also for a car with a washer fluid level light should have a (better) engine coolant level light.

After a little more driving, about 2 miles I pulled into my friend Dave's gas station, the Road Runner Sunaco. A call to AAA and 1:15h later I was on a flatbed to Halterman's VW in East Stroudsburg. This was the begining of the unpleasant portion of my experience. I already do not like their service center b/c I think they are overpriced in terms of hourly rate. However I think that is concistant at all VW's. They have an $85/hr labor rate. Compared to my Nissan, that's $20/hr. higher. They had 6 cars in front of me upon my arrival. Now I have no problem with them working on cars of other customers that are waiting. However, for cars dropped off I certainly expect to be bumped in front of them. Espically since I was a tow in emergency service they should have giving me a high priority. If you goto a hospital (excluding the shitty PMC) they don't put the heat attack behind the 6 paper-cuts who where there sooner. The more severe situations get helped sooner.

So thats bitch #1 with Haltermans VW in East Stroudsburg. My other bitch is they have only, only 2 VW mechanics working with a lot FULL of cars. Now, for those of you who have not been there, their service center is huge and georgous. A dual, High bay auto-garage door checkin lanes where you talk to a car-service rep/case worker. Here is an abobination of business efficency. They have 4 people on stools near wall mounted comptuers litteraly glorified secretaries sitting on their ass all day doing jack shit. That is in addition to a "garage foremen" who also sits on his ass at a much larger bar like desk. Those 5 people watched 4 (2 VW 2 Toyota) mechanics. WTF, no wonder their labor rates are sky high. That doesn't even begin to include the parts receptionist, parts "getter" and cashier. This isn't fucking wawa people. There wasn't a line to pay them. Why this gross excess of manpower. Who runs this place, do they have a college degree!

So back to my service. They said they probably couldn't get to it today and after a little talking with the "case worker" then the "garage forman" we agreed to revisit those chances in an hour. Working on the story I was stuck there I was hoping my physical presence would push them to get me infront of someone. Also I had nowhere to go. My wife's at home 10 months preggers and due 2 days prior. I had my laptop b/c I was on my way to work with some DVD's. So I watched iRobot. I was probably going to do that at home anyway so doing it there was no skin off my back.

After the movie, I went to hunt down some answers on the car. They were pretty stubborn not moving me in front of anyone, even people who dropped off their car. Now as a customer who often drops-off my car. I kind of expect my car to be worked on after in-store customers b/c thats the reason for dropping it off. So they can work on it at their convenience. But not this joint. So I had an idea, I called Young VW in Easton to see if they could look at it. Good news, it was their late night and would probably get to it. Now with that secure it was time to see if AAA would tow it down there. I was close but since I was at a shop, they didn't consider it within the scope of their towing services. Now if Halterman's was unable to do the repairs they would have towed it. Now I don't have a problem with AAA's answer. I did try and work them, 1. both tows within 100 miles 2. haltermans couldn't fix it today, Young could, 3. Wife's 10-months preggers but that was a stretch.

Now if it didn't cost so much to tow or it wasn't an overheat condition where its engine critical, I would have gone down there but Haltermans had me by the balls. So I left it and got a ride home from my sister who was done work mid afternoon. So for now on, I think I will go right to Young VW in Easton. They need to be more compeditive with a few VW's in the area unlike the Halterman's in East Stroudsburg who is "the only game in town."

Oh and the car, well they DID end up looking at it that day after all that shit. Broken water pump, under warrenty. Will be ready today at 16:30.

Snow Rant...

[RANT]

Fuck You weathermen!! Every last one of you. I love how 2-3" of wet snow has turned into 12" of heavy-wet-road-crippling-car-skidding SNOW! I know the weathermen don't order or create the weather but at least they could semi-predict it somewhere close.

Also to the asshole driving the $50,000 Range Rover Land Rover. Your vehicle can fucking tranverse the worst off-road condiditons of the Austrailian outback. Go faster than 10 MPH in the snow. And turn your flashers off, I can fucking see you.

[/RANT]

Some humor...

Ever wonder about store clerks and cashiers not even glancing at your signature when purchasing with Credit Cards. Well a gentleman did and we bring you the Credit Card Prank II.

So fucking left they are off the earth...

I am talking about CBS News. There is a very good reason the rest of the liberal press and the fair and balanced Foxnews pounced on Dan Rather for "memo-gate". Tonight I watched a piece on 60 Minutes (SUN) about an Albanian buying .50 Barrett Sniper rifles and "smuggling" them to his home country. Mind you he bought them legally and took them to Albania legally, CBS News, 60 Minutes and Ed Bradly placed a fantastic amount of biased liberal spin as this should be some kind of outrage. Lets review the facts, not the spin, of this news article. 1. US Citizen legally buys US weapons. 2. US Citizen legally flew with weapons to home country. 3. US Citizen legally bought .50 cal ammo. I spend a lot of time b/t NBC News (central to liberal) and Foxnews (central to right) and am very satisified with their reporting. This CBS trash just astounded me.