Tales from the Techside

Goobuntu Rumors Put to Rest

Earlier today I wrote about rumors that google was going to release an operating system and I also said while I believed this was merely a rumor that it would not be in Google'g best intrest to do so. Google apparently had enough with people asking them what was up and relesed a press statement stating that Google has no plans to release a Google flavored version of the Ubuntu linux client. Though Google did confirm that they do use Ubuntu internally. Oh well guess no cheap Google powered NAS devices anytime soon.

Google denies plans to distribute OS based on Ubuntu

Kamasutra Worm Manual Removal

To remove kamsutra worm/nyxem manually:

Using my SSQKit kill the following processes (double click each to autofind and add to the delete queue)

movies.exe
new winzip file.exe
rundll16.exe
scanregw.exe
update.exe
winzip.exe
winzip_tmp.exe
zipped files.exe
[randomname].exe 'This will be a randomly named exe ie. waflksdfsdj.exe

Next copy the following and paste in notepad and save as killkw.reg

REGEDIT 4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScanRegistry]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"WebView"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
"FullPath"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\096EFC40-6ABF-11CF-850C-08002B30345D]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\190B7910-992A-11CF-8AFA-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\2C49F800-C2DD-11CF-9AD6-0080C7E7B78D]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\4250E830-6AC2-11CF-8ADB-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\4D553650-6ABE-11CF-8ADB-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\556C75F1-EFBC-11CF-B9F3-00A0247033C4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\57CBF9E0-6AA7-11CF-8ADB-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\5F54E750-CE26-11CF-8E43-00A0C911005A]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\6FB38640-6AC7-11CF-8ADB-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\72E67120-5959-11CF-91F6-C2863C385E30]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\78E1BDD1-9941-11CF-9756-00AA00C00908]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\7C35CA30-D112-11CF-8E72-00A0C90F26F8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\899B3E80-6AC6-11CF-8ADB-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\9E799BF1-8817-11CF-958F-0020AFC28C3B]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\B1EFCCF0-6AC1-11CF-8ADB-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\BC96F860-9928-11CF-8AFA-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\DC4D7920-6AC8-11CF-8ADB-00AA00C00905]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\E32E2733-1BC5-11D0-B8C3-00A0C90DCA10]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Licenses\F4FC596D-DFFE-11CF-9551-00AA00A3DC45]

Finally using the ssqkit find and delete the following files from the

%systemroot%\system32 folder on most systems it will be c:\windows\system32\

movies.exe, new winzip file.exe, scanregw.exe, update.exe, winzip.exe, winzip_tmp.exe, zipped files.exe, [randomname].exe, sample.zip

Next using ssqkit delete from the %systemroot% folder on most systems it will be c:\windows\

rundll16.exe

After you are all done restart your computer and once satisfied delete the backed up files from c:\killit

Kamsutra BlackWorm Nyxem First Reports of Damage

F-Secure is reporting the first cases of damage to files and lost data due to the Kamsutra BlackWorm Nyxem virus as I reported yesterday if you are infected and don't clean your system you will lose files. Since the the worm is triggered by the internal clock on the computer this could happen at any time if you don't have your clock set correctly. F-Secure is offering a free removal tool to allow users to remove the virus from an infected system independant of any anti-virus or security suites which may have been compromised. So do yourself a favor download and run their tool it won't hurt anything and it is better to be safe then sorry.

Removal tool
Required virus definitions for the tool

F-Secure : News from the Lab

Goobuntu: Google needs to stick to search engines

Like a shotgun blast the releases from Google do not seem to be waning, everything from a search bar, to a welcome to the internet pack (uhmm the jury is out on this one) Google is spreading to every corner of the Internet market. Now if we are to believe the spec piece by the Register Google has its sights on our desktop, not for searching, but to provide its very own brand of operating system. This could and probably is the usual industry gossip but if it is true then Google needs to stop. The main reason I fell in love with Google as a search engine, a service, and company was their unwavering dedication to simplicity.

Their releases up until recently were compliments of the core technology which is their search engine. The search bar a natural extension of the technology, the desktop search again natural extension, Picassa search for photos great, gmail search your email inbox indexed really cool. But then the unrelated releases came such as Google talk (why do I really need a generic IM messenger / generic voip client), and the Google pack again why do I need this, now an operating system.

The question is why I would really want a Google branded Linux based OS when there are so many alternatives. Windows XP is made to be accessible to the masses and though Ubuntu is a great release it fails to reach the level of usability that Windows XP does. Now if Goobuntu is meant to be an extension or replacement for the Google mini or provide server applications and hosting with an integrated search engine technology that could be cool. But aiming for the pc market desktop I think that may be reaching and I would hate to see the innovation, energy, and resources that go into such a release go to waste.

So Google if you are working on such a project then please make it relevant or at least aim it for a niche where the technology and resources could be best utilized. Now using the Goobuntu desktop server to create a quickly searchable highly indexed home network-attached storage (NAS) solution for cheap would be an awesome use of your technology and I would be the first person in line for such a download.

Google at work on desktop Linux | The Register

Ouch so harsh the criticism ~ though justified

Sandi Hardmeier over at the spywaresucks blog who I have an immense amount of respect for has some pretty harsh words of criticism regarding the blog worm which is spreading via social networking across the internet. I agree with her conclusions that while Robin Schuil may have nothing but the best intentions in posting the blog worm it is irresponsible for people to trust Robin carte blanche. Say for instance Robin replaces the innocuous file with something that is way worse say a WMF file. Now take that a step further what if Robin's site got hacked and the picture were replaced without his knowledge. Or someone saw the distribution potential and attempted to capture the same effect except for malicious purposes. It is all simply a matter of trust just because something seems innocent doesn't mean it is, just think of the Greek's and the Trojan horse if you need a clearer example.

Just to clarify though Robin I think it is a cute idea I would however recommend that you provide a download link for people to host your image. The blog worm can still spread but it should be tamed.

Spyware Sucks : Today's "You're an IDIOT" award goes to...

Printers and Faxes Missing from Start Menu Heres How to get it Back

1. Right-click on the taskbar click properties
2. Click the start menu tab.
3. Click the customize button
4. Click the advanced tab
5. In the list of start menu items find the one that says printer and faxes and check the box
6. Click ok

Clean that old cell phone before selling it or giving it away

A couple of days ago I received an email from a friend who wanted to sell her old phone to trade up to a new cooler model and that got me thinking what about all the information she has her cell phone? Is she going to go through and delete all her contacts and information before selling her cell phone, knowing her, the answer is yes but I am sure other people aren’t so diligent.

That got me thinking even further, cell phones have become the de facto personal information managers for people and with the rise in newer smart phones that trend is sure to continue. If you use a cell phone you know what I am talking about getting all the information off your old cell phone is often a daunting task requiring patience, steady hands, and a whole weekend if done manually. But what if you want to delete said information there isn’t to my knowledge any button or procedure that is universal to delete the data from your cell phone so how do people remove that info. The simple truth is they probably don’t, with the continuing fall in cell phone prices they have become a disposable item. When they are done they toss it out with trash or give it away but rarely do people give a thought to the information stored on their old cell phone.

Stories abound on the internet about people who have traded in their old cell phones for refurbished ones and received cell phones replete with phone numbers, emails, contacts, passwords, and even pin numbers. Do people really take the time to figure out how to remove all call logs, clear the address books, contacts, emails, and personal data stores from their cell phone? No, and with good reason it is not well documented. Luckily there is hope if you go to http://www.wirelessrecycling.com/ they have a intuitive application designed to walk you through this process.

For example I have a Motorola T193 entering my manufacturer name and model of my cell phone I see that to erase all my data from my cell phone I need to do the following:

Master Reset:

1) Press MENU

2) Press down to Settings, press OK

3) Press (Phone Setup) OK

4) Press up to Phone Status, press OK

5) Press down to Master Reset, press OK

6) Enter 6 digit security code (default is 000000)

Master Cear:

1) Press MENU

2) Press down to Settings, press OK

3) Press (Phone Setup) OK

4) Press up to Phone Status, press OK

5) Press down to Master Reset, press OK

6) Enter 6 digit security code (default is 000000)

 

So if you are getting rid of your old cell phone do yourself a favor and visit http://www.wirelessrecycling.com/ and use their tool to ensure that your data is cleared out.

Cell Phone Eraser Direct Link: http://www.wirelessrecycling.com/home/data_eraser/default.asp

 

WinAmp Vulnerability Resolved Exploit Released Same Day

I wrote earlier today about an exploit that effects users of the Winamp software. Unfortunately a same day exploit that allowed for remote code execution was also released. To WinAmp's credit they have resolved the problem and released an update for their users.

To recap the vulnerability affected users of the WinAmp software who downloaded a malformed playlist with a file size to large or name that is over 1024 characters this flaw caused a buffer overflow that caused the WinAmp software to exhaust system resources eventually forcing a reboot. Exploit code which allowed a user to remotely execute code was also released today. Given that this effects current and older versions of WinAmp it is highly reccomended that if you use WinAmp you update as soon as possible.

WinAmp Update Released

Winamp, Shoutcast exploits released same day

Next Version of Windows SANS Anti-Virus

For the past year plus industry experts have gone back and forth arguing the likelihood and merits of an integrated ant-virus service with the latest version of Windows codenamed Vista. Today in an interview with Microsoft's Jim Allchin the co president of the platform development division put the rumors to bed with a clear to the point answer:

CRN: Is there going to be antivirus in Vista?

Allchin: No, there is not.

CRN: Why?

Allchin: It's a complicated answer as to why not.

CRN:  Was the decision based on technical concerns?

Allchin: It wasn't technical.

Well that's all folks no antivirus for Windows Vista. Now some will be happy some will be sad, I personally think an integrated anti-virus solution would have been a great security move for Microsoft but a poor business strategy. If they learned anything from their Internet Explorer antitrust, and MSN messenger client cases it is that while an all in one solution is good for the consumer it is anti-competition.

With companies scrabbling to sue for rights infringement it is likely that Microsoft wants to shield themselves from unnecessary exposure and I say good on them. Though with the quality of the recent security initiatives from Microsoft (safety.live.com, Microsoft anti-spyware, and other strategic acquisitions) I feel bad for the consumers. I am sure though that they will have the opportunity to purchase the MS anti-virus application through the integrated shopping cart, unless of course they remove that as well.

Allchin interview with CRN

Adware Punisher Removal

While surfing the user assistance boards I came across a plea for help regarding Adware Punisher. Adware punisher seems to be the latest in a recent blitz of rouge anti-spyware programs that infect your computer mask themselves as beneficial and then resist removal. Once installed on a users system Adware punisher will block access to websites, defed itself from removal, and let the user constantly know that their system is at risk. If the user runs the software the Adware Punisher program displays a number of false positives and also cause popups and other operating system issues to encourage the user to purchase their software.

To remove adware punisher:

Download and run hijackthis, in hijackthis check off the boxes next to the following and click remove

O4 - HKCU\..\Run: [Adware Punisher] C:\Program Files\AdwarePunisher\AdwarePunisher.exe
O4 - HKCU\..\Run: [Adware Punisher Monitor] C:\Program Files\AdwarePunisher\AdwarePunisher_monitor.exe
O2 - BHO: winapi32.MyBHO - {B439D5EB-0A61-4ED9-8C8F-EC4148BB23F7} - C:\WINDOWS\system32\winapi32.dll

Using my SSQKit kill the following processes (double click each to autofind and add to the delete queue)

adwarepunisher.exe
adwarepunisher_monitor.exe
intxt.exe
mswinb32.exe
paytime.exe
services32 .exe
shell386.exe

Next copy the following and paste in notepad and save as killap.reg

**after you have saved the killap.reg file double click the file to add the changes to the registry

REGEDIT 4

[-HKEY_CLASSES_ROOT\winapi32.Intelinks]
[-HKEY_CLASSES_ROOT\winapi32.MyBaner]
[-HKEY_CLASSES_ROOT\inapi32.MyBHO]
[- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.Intelinks]
[- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.MyBaner]
[- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.MyBHO]

Next using the SSQKit search for and unregister the following dll*
winapi32.dll

In the find section type the name of the dll and then right click on it once found and choose unregister

Finally using the ssqkit find and delete the following files and folders

C:\Program Files\AdwarePunisher

intxt.exe, mswinb32.exe, paytime.exe, services32.exe, shell386.exe, mswinb32.dll, mswinf32.dll, winapi32.dll

After you are all done restart your computer and once satisfied delete the backed up files from c:\killit

After deleting the files from the killit folder change your desktop wallpaper. To do so:

• Right-click an area on your desktop and choose "Properties".
• Select "Desktop" and   you'll find a list of images to use for wallpaper.
• Select the one you want and click "Apply"