Who iframed Easter Rabbit

In the last couple of days, a lot of threads were posted at several different forums where people were complaining about being infected via a trustworthy site.
What happened was, many of these sites were hacked and were injected with a malware embedded iframe. This iframe launched a javascript to infect the visitors of the site with a Trojan downloader.

It's still amazing how many people got infected with this, because this is actually an older exploit that was being used - the MS06-014 exploit - Vulnerability in the Microsoft Data Access Components (MDAC).
This means that MANY have not updated their Windows for years, since this was actually patched in april 2006 - almost 2 years ago!

So once again, I cannot stress enough how important it is to update your Windows - don't wait - update TODAY!

Time to draw again...

I currently don't have the inspiration to blog about Computer stuff, so let's add something else instead, reveal one of my other hobbies...



... one of the drawings I made.

I love to draw and used to draw a lot in the past, but unfortunately, I don't really find the time to draw anymore. I'm not *that good at it, but it relaxes me, so I guess I should start drawing again, because I really need a "computer break" once in a while :)

If you want to see some other drawings I made, look here.
Yes, I know, all dogs, that's because I love them. :)
I'll add more pictures there in the future.

Do, or do not. There is no try.

And now for something completely different - not computer or security related...
Some of you may recognise above quote (title). It's a famous quote from Star Wars - quoted by Yoda. (Yes, I am a Star Wars fan and yes, I know that sounds weird for a female :P )
Anyway, that's what this blogpost is about - about Jedi, the dog my mother is taking care of.
Since recently my mother has some serious health problems, so she can't take care of Jedi anymore. That's why we need to find a new home for Jedi.
Jedi is female, breed is American Staffordshire. She's now 6 years old. She's very social and smart.



Since I already have 3 dogs (also American Staffordshires), I can't have another one anymore.
Although I used to breed them, since I moved, I don't have the space and time anymore for a 4th dog.
That's why I thought that, maybe this blogpost may help to find someone who wants to adopt Jedi.
Since I live in Belgium (Bruges), it would be ideal to find someone nearby.

Keep in mind, a dog is for life - that's why I used "Do, or do not. There is no try." as the title of my blogpost here - this since you'll have to think twice before you make the decision to adopt/get a dog.
If you're interested and need more info about Jedi, contact me via my "dog"site or drop a comment below.
(Only serious candidates - the rest will be ignored)

UPDATE: I've found someone to take care of Jedi. I'm sure she'll be in good hands :)

Windows Vista - Backup pleasseeeee....

Even though Windows Vista is much more secure than XP (if UAC is enabled), people still allow many programs from dubious resources (p2p resources/crack-hacksites) and run/install it. Yes, people love to click the "OK" button even though it's not OK.
That was a bad idea.. wasn't it? So I hope you'll read the notifications/messages next time....
Anyway, if you indeed managed to install malware and the malware already compromised your system where it also damaged a lot - then the fastest and especially safest solution is a format and reinstall.
I actually do not really recommend a format and reinstall anyway, but in some cases, you really have no other option if you want to trust your system ever again..
Unfortunately, nowadays malware is more advanced and nastier than a couple of years ago.
After all, it would be irresponsible of me if I proceed with giving instructions for manual removal and tell the user afterwards his/her system is clean - because it is NOT! So in such cases, I always make the user aware of with what s(he) is dealing and let them decide what to do - a format and reinstall or manual removal. If they choose for the manual removal, then I will assist them, but make them aware that they may never trust this system anymore, it's compromised and many issues may still appear afterwards.

And that's where the problems start...
"Sorry, I can't do a format/reinstall, because I have so many important documents, pictures etc present that I don't want to lose"
And in most cases, the malware present already damaged so much > result > computer won't even boot anymore. Ofcourse there are still a lot of methods to access your important files in such cases anyway to back them up...

And that's why Windows Vista made it a lot easier for you.... By default, it contains the option to backup your important files. So if it's present by default? Why not use it? No need to install additional tools for this, just run the backup wizard.
Start orb > Control Panel > System and Maintenance > Back up your computer.
There you can select to create a backup of your files and folders and store them wherever you want.
Easy huh? So why don't you backup right now? Because you never know what the future may bring. After all, not only malware, but a corrupted program install/updates may cause a system unstable/unbootable as well.

MEDION AKOYA MD 96630 Premium - I'm impressed

I was already looking for a new laptop since last year, but couldn't decide which one to buy.
My current laptop Fujitsu siemens Amilo M1425 XP SP2 installed is great, but I needed an extra one with Windows Vista installed, because it's easier for me to properly troubleshoot Windows Vista issues when I have the operating system in front of me. I actually already had Windows Vista installed in a Virtual machine (Vmware), but since it needs so much resources, you can imagine that it was really crawling and I actually could have a cup of coffee while Vista was loading in Vmware.
I also could have a dual boot - one with XP, one with Vista, but then again, I'm a bit lazy and don't like to switch everytime :)

So, that's why I decided to buy a new laptop.....

Since the public release of Vista, many laptops were already preinstalled with Vista and there were still many incompatibility issues with other hardware and software installed. Most software - at that time - were not "vista ready" yet, so that's why I decided to wait a bit longer.

Nowadays, most software/hardware should be Vista compatible, so I've waited long enough, time to get myself a new OS, new laptop.

I was actually going to wait until april/may this year for the new laptop, this to make sure everything was REALLY Vista compatible (hardware related).
But I've changed my mind when I received a mail with this. Hmm Medion, I've heard some weird things about it....

Anyway,
699 euro.. I thought they were joking. So, I went to Aldi and bought it anyway, and guess what - it was no joke. I've uninstalled the preinstalled Bullguard and some other "goodies", reinstalled my "own" programs and everything works great and incredibly fast - even faster than my Fujitsu siemens Amilo M1425! (what do you expect with 3GB of ram) :)

So medion isn't so bad after all - on the contrary....

Malwarebytes' Anti-Malware - Recommended Malware Removal Tool

Marcin - aka RubbeR DuckY, the developer of Malwarebytes' Anti-Malware is a known person in the Anti-Malware field and is already developing malware removal tools and other tools for quite a while now.
Examples are AboutBuster (CWS.AboutBlank removal), E2TakeOut (E2Give/PTech removal), Qoofix (Qoologic removal), RogueRemover (Rogue Antispyware/Antivirus removal), StartUpLite (startupmanager), RegASSASSIN (deletes locked registry keys) and FileASSASSIN (deletes locked files)

And now his latest project: Malwarebytes' Anti-Malware
I've been betatesting Malwarebytes' Anti-Malware for a while and I am still very impressed with its detection and removal.
It detects and removes malware in general, which means it detects worms, trojans, rootkits, dialers, spyware...

Key Features:

* Support for Windows 2000, XP, and Vista.
* Light speed quick scanning.
* Ability to perform full scans for all drives.
* Malwarebytes' Anti-Malware Protection Module. (requires registration)
* Database updates released at least once every two days.
* Quarantine to hold threats and restore them at your convenience.
* Ignore list for both the scanner and Protection Module.
* Settings to enhance your Malwarebytes' Anti-Malware performance.
* A small list of extra utilities to help remove malware manually.
* Multi-lingual support. (English, Albanian, Dutch, French, German, Hungarian, Italian, Portuguese, Serbian, Slovenian, Spanish, Swedish.)
* Works together with other anti-malware utilities.
* Command line support for quick scanning.
* Context menu integration to scan files on demand.

For more info and download: http://www.malwarebytes.org/mbam.php
And for online support, visit their forum: http://www.malwarebytes.org/forums/

What's up with McAfee lately?

I am active at several different forums where people ask for help with malware removal. They start with posting a HijackThislog or other logs and then we give "step-by-step" instructions what to remove and how to remove it.
Malware is one of the most common reasons why a computer becomes slow and unstable - However, many people do believe that every computer problem is a malware related problem, so they post their logs and ask for help.
In 40% of the cases, there's no malware present, so we have to look somewhere else what is causing these problems...

In most cases, it's like searching for a needle in a haystack - but after a while, it's becoming obvious what is causing these problems if you're dealing with them everyday. And such example is McAfee.

Not sure what happened with latest McAfee, but many people are having A LOT of problems with it. The most common problem I notice with McAfee is a severly slowed down system. I did the test, installed McAfee Security Suite (1024MB memory) and after reboot, my system was crawling!!
That's why, If people are complaining about a slow computer/slow internet - if there are no traces of malware present and they do have McAfee installed, then the first step I ask is to uninstall McAfee and replace it with another Antivirus/Security Suite. 90% success!

But the slow down issue is not the only problem that McAfee may cause. Other problems I've noticed with McAfee as well are:

* Programs freezing
* Explorer crashing
* Internet Explorer crashing
* Outlook crashing
* Only able to boot in Windows Safe mode
* ..... you name it.

McAfee already made its own incompatibility list and I am sure it's still missing a lot of Products there. It's normal that you shouldn't have more than 1 Antivirus/Firewall installed, because they are not compatible with eachother, even though they are disabled. But if it's up to McAfee, people should uninstall the most commonly used Antispywarescanners as well, such as Ad-Aware and Spybot S&D. Hence, they even recommend to uninstall SpywareBlaster. Huh?
And even though you uninstalled them all.... the problem remains....

In general, if there are no traces of malware present and McAfee is installed - uninstall McAfee first and see if that solves your problem (whatever problem you are having). Believe me, in most cases, it is the solution!
In some cases, it's hard to convince people that McAfee is responsible for the problems they are having, they just won't believe it since it worked fine in the past. Reference here. The guy believed he had a terrible Virus causing all these problems and couldn't believe it was his McAfee causing all these problems. I already explained to him a couple of times that I was pretty sure his McAfee was the cause, it took me 2 pages to convince him... and he still wouldn't believe.. until he decided to uninstall it after all as a test. And guess what? :)

Ofcourse, there are also a lot of computers where McAfee runs smoothly - where there are no issues at all - but unfortunately, nowaday posts at forums show that McAfee just won't run properly on a lot of systems. That's why, if you want to use McAfee, use the trial first before you decide to purchase McAfee.

There are some other Security Products that may cause similar issues as McAfee, such as Norton Internet Security, Zonealarm, but I'll rant about that later :)

Local Disk icon turned into a red cross

Many people will recognise this "issue" in XP after being infected with latest Vundo/Virtumonde variant.
This one decides to change the Local Disk icon into a red cross - the "Windows delete icon".

What happened here is, an extra key "DriveIcons" was created under the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer key in the registry. The DriveIcons key is not a default key in Windows XP. This one is only created if you want to change your Drive Icons.

An export of the key shows this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\c]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\c\DefaultIcon]
@="%SystemRoot%\\system32\\shell32.dll,131"

In this case, it was set to the "Windows delete icon" (IconFile=shell32.dll,131)

To fix it, all you have to do is to delete the DriveIcons key in the registry.
To do this with a regfix:

Open notepad and copy and paste next in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons]

Save this as fixicon.reg Choose to save as *all files and place it on your desktop.
It should look like this:
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Then log off or reboot your computer to apply the changes.

Vista and the Instant Search Box - useful but.. be careful

People who are using Vista are already familiar with the embedded Instant Search box via the Start Menu.
Basically, you can run almost every application from there. Just type the name of the exe in the Search Box and hit enter.
If UAC is enabled, you'll get an extra warning first, where you have to allow the application to run.
If you want to run the application with administrator rights, then type the name of the application in the Instant Search box, but instead of enter, use CTRL-SHIFT-ENTER

Easy huh?

The only, although important issue I see here is the fact that the embedded box is called Search, but you can actually run applications from it.

Scenario:

A user gets infected...
UAC was not enabled in the first place.
Even in case if UAC was enabled - malware may disable it again.
User follows some online instructions where it is explained what files to delete.
Starts Taskmanager to end the badfile.exe process in case if it's running.
Then via the start > types the badfile.exe in the embedded Search Box and hits enter...


Whoops! It's running again and downloads everything again that was deleted previously (this in case if it's a bundled installer)

Yes, the Search Feature has much improved in Vista, but imho, as it says: "Search", it should search only, not execute if you hit enter.

Registry Cleaners and System Tweaking Tools

I am still wondering why so many people use Registry Cleaners and System Tweaking Tools while they don't even understand what the Windows Registry is, and/or don't understand Windows basics.

"Fix errors now!" and "Make your Windows fast again!", that's how all these tools are advertised.
People download and install it - click the "Fix it all" - Button (since many of these tools have such button available) and then notice that suddenly some programs won't work anymore, errors appear and in worst case, their Windows won't boot anymore...

Yes, I've seen it all... and many still won't believe that this may be a result of these tweaking tools, because after all, they are "supposed" to improve system performance, prevent errors and make a system more stable. Huh?
In most cases, people don't have any problems in the first place - but want to use these tools anyway.

I have to admit that there are some good "tweaking tools" around as well, but you shouldn't use these if you don't have basic knowledge about the registry and Windows in general. Only delete keys if you're certain that they can be deleted. Disable services if you're certain that you don't need them, let it set policies if you understand what they do etc..

Registry Cleaning won't really improve system speed anyway. Even though there are a lot of orphaned keys/values present, you won't notice a difference in system speed. The only difference you'll notice is when you actually search in your registry - but how many people do this?

On the contrary, as a matter of fact, if you "clean" the registry frequently, it actually becomes more fragmented after a while - and *that may* result in slower system performance, although you won't notice much difference.
I rather prefer to have a lot of orphaned keys in the registry, instead of keys/values that were deleted by a registry cleaner, which were not supposed to be deleted in the first place. And that's the risk of these Registry Cleaners, because many list keys/values as orphaned or unneeded while they are actually needed.
After all, a broken registry is a broken Windows.



The same goes for tweaking tools. Tools where you can select to disable certain services and add certain policies. The "Fix it all" button is also available in most cases, or an option where you can check/select several settings - and the more settings present, the more people believe that checking/selecting them all will result in a superfast computer...
Oh yes, check them all .... and complain aftwards:

* "Help! I'm having problems with Windows updates/Automatic Updates!"

Yes, because you disabled BITS, you disabled Automatic updates, or you have set some restrictive policies related with Windows update

"Help! My add/remove programs list is empty!"

Yes, because some Registry Cleaners unfortunately delete the Uninstall key in the registry - reference here. Only new programs installed will be listed there... (See picture above)

And so many more... Check out this thread for more opinions.
So, don't use them if you don't understand these tools.

After all, Don't fix when it ain't broken!