Fake AV infections

Found and cleaned 3 infections in the last week of fake antivirus malware off windows machines. The last one I finally checked out what it was named: Rogue Security Suite. I was able to boot off a Linux CD to access the boot disk and remove the malware. It drops itself in Docs & Settings \ username \ Local Settings \ Application Data \ "something strange". The "something strange" is 8 to 10 characters that are meaningless. On one of the machines the hosts file was messed up, not sure if the malware did that, but I've been checking that on every machine (windows\system32\drivers\etc\hosts)

After doing a Google search, apparently it also sets up a proxy connection for IE - need to go back and check that on the machines I cleaned.

Firefox plugin check

Mozilla has a page to check your FireFox plugins for Java / Shockwave Flash / QuickTime and more. It's a real easy way to do a quick checkup on those pieces that are not so obvious to find version numbers or find a manual update button.

update acrobat --- again!

Last week Adobe released updates to Acrobat (again!!!) ... do the update drill in Acrobat: Help / Check for Updates. Do this until it tells you there are not more updates available.

A couple tips to make Acrobat more secure. From Edit / Preferences choose the category (from the left side menu):
* JavaScript then from the right side UNSELECT "Enable JavaScript". WARNING: this will make forms not work, so you will need to enable this to fill out forms
* Internet then from the right side UNSELECT "open PDF in browser"

Link to news story from Computer World

switch from triaining to taper

At last - done with 8+ months of training for marathon and have moved to taper to prepare for the race. Can't train any more - only rest, stay fit and not put on too much weight. Been working on stretching - try to loosen up as much as possible. Oh, and not hurt myself!

Ran hills on Tuesday (only 3 1/2 repeats instead of 5) and 1/2 mile intervals on Thursday (3 were over 3:10, 3 were under; best was 2:58!!!). Only 8 days to go ... PSYCHED!!!!

using VMs for security

started reading some notes on the updates to NoScript (add on for Firefox), found a link to hackademix.net, which pointed to an interview with Joanna Rutkowska on Tom's Hardware about using NoScript and virtual machines for security. Very interesting ideas on using a separate VM for accessing sites where you want to be sure there are no back doors, like bank sites. Every couple of months the VM can be replaced with the copy made after installation.

So I installed VirtualBox on Ubuntu. Installation of Windows 7 was extremely slow, looked like the HDD was thrashing for many hours. But after the installation, it runs ok. Thinking about tying ArchLinux next, or OpenSolaris. So many OS's, so little time.

best explaination - extra electrons

Aparently I haven't worked in IT long enought to "see it all" ...

a windows pc is having trouble talking on the network - not talking at all to the network. determine one wall jack is bad. ok, switch to the other one. It does pull an IP address from the DHCP server, but it is in the wrong range, so something is wrong. [we have a bunch of machines setup to reserve an address from the DHCP server so they always get the same address.] Call the network admin, get confirmation that the DHCP server is ok. Then he asks for the MAC address - now that's odd - the MAC address is D3-59-D3-59-D3-59. definately NOT the MAC address this PC had yesterday. Reboot - now it has a different MAC address, and again the first pair of number is repeated!! this is getting stranger and stranger. I'm thinking - maybe bad chip for the NIC (it is on the motherboard)? is windows infected with something to randomize the MAC address (auto-spoofing)?

boot a couple linux distros (live CD) and can't get the network to work, at all. Then one live CD doesn't shut down correctly and I have to power off the case (I had not done that yet, just warm boots). next live CD - network works and it pulls the correct IP address and had the correct MAC address. boot windows, and it has the correct MAC and IP addresses.

So maybe there was some extra electrons on the chip controlling the network that made it work strange. Remove the power, and it is back to normal.

sometimes you see the strangest things ...

good workouts

good workouts this week:

• tues: hills - 5 x 5:00 (2:00 up / 3:00 down)
• weds: cruches & planks (2 big sets) plus short swim (bit less than a mile)
• thurs: speed - 4 x 1 mile (6:54 / 6:33 / 6:25 / 6:34) with 4:00 rest between. Wanted to do something different from the 1/2 miles I had been doing.
• fri: crunches & planks (1 big set)

I'm beat! now I rest up for the big run - 22 miles (approx 3hrs 20 min) on Sunday!! Taper starts week from Saturday, marathon on Oct 10