Archive for August of 2006

Beware the unpatched XP

August 29, 2006
One of the very few things I've managed to get my largely non-techy family members to grok is that “thou shalt always run anti-virus and firewall programs”, so when my brother's copy of ZoneAlarm started bitching about his Windows ME no longer being supported I was naturally the “go-to guy”.

Luckily I had a spare copy of XP lying around, so I gave that to him, along with a slipstreamed XP SP2 CD. Unfortunately, he ran into some issues and I ended up popping over for a visit to do the install for him.

As it turned out, the slipstreamed disc was buggered, so I upgraded from the official XP disc... which was bad because:
  1. The upgrade from ME to XP unbeknownst to me switched off the virus checker and the firewall
  2. There are evil people out there just waiting to pounce on fresh XP installs as soon as the connect to the Internets

By the time I'd got the Windows update page up there were thirteen Messenger spams (most suggesting the registry was corrupt and I should buy their product) up and an extra winiogon process running. By the time I killed that and disconnected, it was too late and some 200 executables were infected.

I've took his PC home to fix; I've copied all the data files onto CDs and reformatted. As a way of apology, I've stuck in a spare CD-R drive I had around, as well as some extra memory and an ethernet card.

But... damn, the speed that the PC was fucked was brutal. I've been running security systems on machines I've owned since I had an Amiga, so I guess I've missed out on the experience until now.

Filelight

August 19, 2006
This is a pretty cool program that displays how much space files on your computer are taking up as a kind of exploded pie-chart. I found it very useful for finding stuff that was just taking up space. Not available for Windows though... natch. (via)

Filez


I founded a virus!

August 09, 2006
A suspicious email...
Hello [something]@auzsoft.net.
Yesterday, I checked my E-Gold account and was really shoked to find about 200 gold ounces (100,177.90 USD) there. I have never had such a big amount of money available (the last balance of my account was only 177.90 USD) and I have no even a slightest idea about the origin of the money. Upon receiving the requested history of records I realized that the transfer had been made 2 hours before, and the Memo field contained your e-mail address:[something]@auzsoft.net. In a short run, while I was making the inquiries, the money and MY own savings of 177 USD disappeared. I changed my password immediately and now intend to clarify the situation and to investigate the people, who involved me in the unfair play. Fortunately I made a screenshot copy (document file), attached in this letter and compressed into zip file. Hope for your assistance in this matter. I feel a little bit scared and still hesitate to apply to E-gold support service.
Best regards,
Stephen Helgeson

I send the attachment to McAfee and to F-Secure.

McAfee replied with:
If possible, please send a sample of the original e-mail message you received, in either .MSG or .EML format. The file received is neither malicious in itself, nor is the link active in this format.

But F-Secure came back with:
The file is detected as Trojan-Dropper.MSWord.Lafool.m. Detection has been added as part of pattern database update starting 2006-08-08_04

And, true to their word, the latest virus sigs do catch it:

Mine!

Warp factor 4!

August 04, 2006
I've jumped ship from my old ISP. I was paying a horrendous amount for 1MB down 256KB up, largely on the basis that a relatively small ISP would keep the contention ratio low and be easy to reach if there was a problem. And initially, that was the case - when you called the help line at 11pm of whatever, you'd get the tech support guy at home watching TV - which was cool. But now they've gone legit and have a proper redirect-to-voicemail help. Plus, 1MB, even with a low contention ratio, is pretty sucky these days.

My cable company was offering some cheaper, faster deals so I went with the 4MB one (350KB up).

This brings a new wrinkle to the Auznet (temporary name until Skynet is free) though. Previously I ran a phone cable from the DSL line into the 2nd bedroom and had my study there. A wireless bridge allowed the Xbox and PS2 in the living room to “go online” - as the kids say - through the DSL router/access point. With the new cable-oriented setup, I'd have to drag a cable across from the living room, or try and get both the desktops to go wireless - which would mean three machines possibly using the same wireless space.

Then a friend clued me into the MIMO stuff. This, which is part of the next wireless standard 802.11n, allows for better signal strength and speed - even in occluded buildings - and, most importantly, allows multiple wireless clients to use the same access point without bogarting each other's bandwidth (or, alternatively, have up to 250MB bandwidth for one machine).

That just left the tricky issue of getting the Linux boxes to play nice with the existing 802.11g cards I had. As things turned out though, all I needed to do was swap the Broadcom-based card into the Ubuntu box, whilst the Gentoo one preferred the Texas chip. So, now I'm all wireless and can cancel the old DSL and BT line.