In between message...

One of my shortest blogposts ever...

Almost back... So stay tuned for some new "Security rants" - and some vacation pictures - maybe :-)

Q is good for you

Well, it really is! Nothing security related right now since I'm taking a break, but I wanted to share this with you...
If you're in Belgium and you really need a break, chill out, then you really should visit the Q-Beach House! http://www.q-music.be/beachhouse/



Q-Music is a popular radio station in Belgium and even though I don't live in Ostend, it's my place to be to chill out.
My afternoon starts with a Mojito - (the best I ever had) - then a Sangria Samba with pamperon Rum, then another Mohito and another Sangria....and.... well, I can assure you... a day you won't forget!



Great music in between - One - U2, This is the life - Amy Macdonald, Modern World - Anouk and so many others! Great view as well..



Alexandra Potvin, http://www.q-music.be/page/alexandra, one of the radiopresenters:



She's just great!
So if you really need a break, visit the Q-Beach House!
See you there!

More "holiday pics" will follow soon...

Vacation Time

It's finally vacation time - so time to take a break and stay away from my computer/laptop as much as possible.

Be back in 3 weeks.
Later!

Internet Explorer Options won't load in Internet Explorer 7

This is nothing malware/security related - but I'm sure it will interest people who encountered the same issue, or helped someone with the same issue.
So, for the uninterested ones, skip this section and read another blog. :-)

If I encounter Windows issues, I always want to figure out what's causing this, so I could learn from it. In this case, when you try to launch the Internet explorer options via IE > Tools menu, you get the hourglass, but nothing happens.
I've researched this issue via search engines and couldn't find a proper solution (most probably I've missed it).
This is not a policy related issue where the Internet Explorer options are disabled, otherwise you should get an error message.
The same is when you do this via start > control panel > Internet Options.
Also, when you enter inetcpl.cpl via start > run, (command prompt), you see the hourglass, but nothing happens.
And that's why I wanted to figure out what's causing this and how to solve it since this is actually a common issue in IE7 (since I've researched this via searchengines).
A solution I found was to replace the inetcpl.cpl file from the C:\WINDOWS\ie7 folder. So the inetcpl.cpl from the ie7 folder should be replaced with the one present in the system32 folder. It works, but doesn't make sense since the inetcpl.cpl file present in the IE7 folder is the previous version and shouldn't be used anyway.
Also, Windows Updates contains a lot of IE updates as well which patches the inetcpl.cpl file, so you should think that an update may fix this issue.... Well, it doesn't, since it's actually not an issue with inetcpl.cpl itself.
So, time to test what could cause this, launch inetcpl.cpl and see what other files are launched as well... and one of them was inetcpl.cpl.mui. This file is present by default in the %Windir%\system32\nl-nl (in case you have a dutch version of IE), or %Windir%\system32\en-US folder (in case you have an english version of IE), or any other language dependent subfolder there.
Reference thread here btw, http://support.bluemedicine.be/mybb/showthread.php?tid=2268&page=1 (Sorry, only Dutch).
And.. in this case, the inetcpl.cpl.mui file was missing.
I actually really had no clue that this could be the main cause, until I asked the user to replace/restore the file again and place it in the correct folder. After all, if you don't try, you won't know. And this actually worked! The Internet Explorer options could be launched again.

This helped in this situation, so not sure if that's actually the solution in general for the same issue (IE Options won't load - nothing policy related). So if anyone has encountered the same issue and above solution worked (inetcpl.cpl.mui was missing and you "restored" it), let me know. :)

Backup your data frequently!

I've already discussed the backup option in Windows Vista previously - However, I'm still amazed that many people don't backup their important data at all, including companies.
A Dutch company contacted me today and asked my advice about a file infector which infected 6 of the 10 computers present there. They have tried several Antivirus Scanners and none of them could properly disinfect the files. Some files were properly disinfected, other files were corrupted after disinfection and some files couldn't be disinfected at all.
2 of the 6 infected computers couldn't load Windows anymore because of the malware present and the damage it already caused.
So I recommended them to format and reinstall Windows - After all, this is still the fastest and safest solution, ESPECIALLY since these computers are used for work.
There was one big problem.... there were no backups present. All the important data, documents and programs they used were never backed up.. ever! This is not the first time that I've helped someone with a company owned computer, crippled with malware, and no backups ever being made.
That's why I can't stress enough how important it is that you backup your data frequently. As a matter of fact, not only companies, but everyone should invest in Backup Software and backup frequently.

There are 2 types of backup software. File Backup Software and Disk Imaging Software.

File Backup Software is designed to backup important files and folders on your computer such as documents, some programs, emails, pictures, music, etc.. Most of the File Backup Software has an option to backup your data automatically.
The File Backup Software I recommend are:

* Handy Backup
* Genie-Soft Backup Manager
* Double Image
* BackupNow!
* Acebackup

Disk Imaging Software is designed to be a complete system recovery solution. This one creates an exact copy of your hard disk, including programs installed, registry, all computer data etc. So in case of disk failure, you can restore it with the image you backed up.
Disk Imaging Software I recommend are:

* Acronis True Image
* Norton Ghost
* Paragon Drive Backup
* NovaBackup

Don't wait until it's too late, backup your data today!

Malware Removal - Where to draw the line

A little intro first...
As many of you know (or don't know), I guide people with removing malware from their computers, or help them with other Windows issues not related with malware. This mainly happens via forums and newsgroups. I used to guide people via mail as well, but quit that since I don't have the time for that anymore.
"Step by step" instructions are really needed since many people don't know much about computers and without detailed instructions, they could make things worse. Hence, even when detailed instructions are given, with screenshots/whatever included, some still have problems to perform the steps properly.
Yes, a lot of patience is needed in many cases.
Many already asked me why I am doing this, offering almost all of my free time as a volunteer to help other people online. Well, there are several reasons why I am doing this...

1st... My hunger for knowledge. I love to learn and want to learn something new everyday. Fixing computers is like solving a puzzle for me, to find the cause and try different solutions. It's always a challenge to find and understand the cause in the first place. Without a cause, you can't offer a proper solution either.
In case of malware removal - it's a challenge to find the loading points, what it changes/modifies, how it behaves in general - and based on that you can give the proper instructions how to remove it and restore whatever it has broken/modified.
Next time if you see the same problem again, then you already know how to deal with this - something you've learned and remembered.
I don't want to give instructions/solutions if I don't understand them in the first place, because that wouldn't make sense and I learn nothing from this.

2nd... As I said, many people still don't know much about computers. I don't really see this as a problem, as long as they know how to secure their computer. Unfortunately many don't know anything about this. They don't even know what an Antivirus/Firewall is, why it is needed and what the dangers of the internet are. Many don't take this serious either and always think that this won't happen to them - until it happens (sooner as they think).
Another lesson learned I hope. Some will never learn as I explained here - or don't see the need why to secure their computer as explained here.
Prevention is better than removal... and that's what I try to teach these people. If more people would take this more seriously, secure their computers and always be careful where they surf, what links to click and what they download, then I'm sure that the internet would be a bit more safer place for anyone.

3rd... I just love to help people in general. If they ask for help and I know how it can be solved or where to find the solution, why wouldn't I help them then? A simple "Thank You" afterwards, the appreciation you get already means a lot to me. I'm always glad that I could teach something and hope that they will learn from it as well.

Also, Budfred's Rant: Volunteers and Malware Criminals sums it up nicely with more reasons why I am doing this and as you'll also read there, volunteers don't always get the appreciation for what they are doing.

Through the years, malware has become more difficult to find (rootkits etc..), more stubborn to remove and more nastier in general. One click on a file or link can already download and install a huge malware bundle where many different infections are installed.
You see popups all the time, your desktop wallpaper has been changed with a "fake alert", displaying that your computer is infected (well, it IS infected, but these "fake alerts" ask to purchase their own product in order to remove the malware they installed in the first place).
Although the fake alerts and popups/advertisements you get is the most annoying part and look the worst, as a matter of fact, it's the least of your concerns. What is hiding in the background is a more serious issue. Trojans in general, such as backdoors, password stealers, keyloggers etc.. all have their own purposes and may damage a lot!
And as I said, all of the above can be installed via one single click on one link or file! Hence, I've even seen file infectors/worms/bots joining the party as well.
Problem is still, many are not aware what the other malware does, or is capable of - and are already satisfied if the annoying popups don't display anymore, their desktop background has been fixed etc..
Then they don't need further help anymore because they think that their issue is already resolved while the biggest problem is still present, silently doing its job in the background. They are not aware that their computer is still severly infected and badly compromised... and responsible for infecting other computers on top.
And what is worrying me the most is that some don't even care - as long as the annoying popups are gone.

Malware compromises/damages a lot, that's a fact - and especially in case of a severly infected computer, even if I clean the malware off the computer, I cannot guarantee that the computer will be clean afterwards, because these infections/bundles leave a lot of leftovers behind that most scanners won't even recognise and logs won't show.
Also, I cannot promise that I can repair all the damage it caused... Even after cleaning the malware, errors may still be present afterwards because of the damage. Solving these is not always possible since it will be searching for a needle in a haystack to find the right cause and solution. Although I love to solve puzzles, I'm sometimes wondering if it's really worth it in such cases.

That's the main disadvantage if you guide people via forums etc, because instructions should be followed asap - and this is not always possible. Also, Internet connection is needed to read the instructions and in case of severly infected computers, I recommend that they disconnect from the internet asap and use another computer to read the instructions from. Unfortunately, this is not always possible either since not everyone has a spare computer.
If I guide someone with cleaning a severly infected computer, it is my responsibility to make them aware of what state their computer is in, how severly infected/compromised it is, they should change passwords afterwards etc etc.... and I won't promise them a clean computer afterwards - because that would be a lie.
I've seen cases where volunteers are helping a user with a severly infected computer, this already for weeks....
And that's why in such cases, I throw in the towel more often and ask to backup important data, then format and reinstall Windows. Not because I give up, but rather because it's really not worth it to clean this mess up manually and then on top restore (if possible) whatever the malware has broken/modified. In such cases, a format and reinstall is the fastest and especially the SAFEST solution.
As a matter of fact, I think it would be irresponsible of me to guide people with manual removal in such cases, knowing that removing the malware from severly infected computers takes a lot of time, especially if you're doing this via online instructions and every single minute that this computer is connected with the internet, it may download more malware, spread more malware, collect more info, send more SPAM etc....
Also, if file infectors are game, in 80% of the cases, I recommend a format and reinstall anyway if an AntiVirus scanner is not able to disinfect the files (properly). Unless the person knows what files are corrupted and knows how to replace them with a clean one. But then again, it's no guarantee that everything will work properly again and the infection will be really gone.

Another article regarding this is:
When Should I Format, How Should I Reinstall.

That's why.... Where to draw the line? When to recommend a format and reinstall?

Dutch users Alert! - Beware of fake Tax forms - episode 2

This is a follow up to my previous blog post here http://miekiemoes.blogspot.com/2008/06/dutch-users-alert-beware-of-fake-tax.html
Thanks to Jan (who was infected with this one) for sharing the samples. Some were detected by most Antivirus scanners. Others weren't detected at all, so I've sent them the samples.
It is confirmed now.. This one spreads via IM (Messenger - Windows Live Messenger). And since this is a worm, a lot of others may be infected with this one as well.
I don't know via which url yet (will find out later)

Some of the files it drops:

%systemdrive%\svchost.exe and %systemdrive%\smss.exe

svchost.exe is already detected by most scanners as Backdoor.Win32.VB.bsf. The author is Dutch, that's for sure.
As a matter of fact, Roel (Kaspersky) already posted about a variant of this one earlier. See here:
http://www.viruslist.com/en/weblog?discuss=208187474&return=1

svchost.exe and smss.exe have several different loading points. The main ones are:

* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
C:\Windows\System32\userinit.exe,%systemdrive%\svchost.exe
C:\Windows\System32\userinit.exe,%systemdrive%\smss.exe

* HKCR\exefile\shell\open\command
%systemdrive%\svchost.exe "%1" %*

This means, the fileassociation for exefiles is replaced with the malicious file. So if the file is removed, the exeassociation will be broken en you won't be able to run exe files anymore.
To fix this, go to start > run > type "command.com" (without the quotes). In the command prompt, type: ftype exefile="%1" %*
This restores the default association for exefiles.

* HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Generic Host Process for Win32 Services=%systemdrive%\svchost.exe
Session Manager SubSystem=%systemdrive%\smss.exe

+ some extra policies:

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windowsupdate
DoNotAllowSPSP2=dword:00000001
DoNotAllowSPSP3=dword:00000001

In case you were infected with this one, please make sure you change all your passwords afterwards as they may be known.
As a matter of fact, make sure you don't get infected with this one in the first place - so always be careful with clicking links in IM, even when they come from friends. Verify with the sender first if the link was sent intentionally or not.

How to guide people with fixing their computers

Rule number 1: Always stay serious, don't try to laugh, no matter what.

Here's a collection of funny quotes or subjects from people who needed help with their computer. They were posted at several different forums and via chat support.
Most were collected from geekstogo forums, bleeping computers, SWI and some Dutch forums.

My favorite top 10:

10:

If I do get a new comp
Ill get windows 98
saves memory

Good idea!!

9:

Subject: "Problem with massages popping"

I wouldn't mind the massages.

8:

miekiemoes: Did you perform a scan or anything else before this happened?
user: brainscan

Guess what.. the brain was severly infected!

7:

Internet explorer was changed to pizza SLICE.

With extra anchovies, olives and mozzarella??

6:

Subject: "virus will not leave me alone!, please help me before my brain explodes!"

Please format and reinstall your brain asap!

5:

The 4 pins that are missing are around the edge of the 'gold triangle' in the corner of the CPU. I have tried replacing the pins by placing a piece of copper wire in the slot where the missing pins are but I think that might be the cause of my PC crashing so I have taken them out.

It would have been better if you used electrical wire.

4:

You know I hear something in the PC box going, like little dominos falling really fast all the darn time or like there is a bleeping little mouse in there playing a bleeping cadence on a bleeping little snare drum all the bleeping time...

3:
From a Dutch forum:

Heb een scan met verschillende progamma's gedaan maar niets gevonden. Als ik de pc opnieuw opstart krijg ik een soort alarm te horen wat een minuut lang blijft afgaan. Daarna wordt mn scherm zwart en verschijnt er een hele rij kaarsjes, die een voor een worden opgelicht....

translated:

I scanned my system with several different programs but nothing was found.
When I restart my computer, I hear an alarm for about one minute.
Then my screen goes black and afterwards, a row of candles appear on my screen which get enlighted one by one...

Happy NewYear!!

2:

I am also thinking of making my monitor black and white to make those
viruses and trojans think i have an ancient pc and not worh attacking.

Best prevention ever! Thanks for the tip!

And the Winner is:

1:

Today I tried to hide my lunch bar chocolates from my brother by taping them to the inside of the side panel of my pc(total disregard for PC components I know but no way was he getting me booty) Any how the tape didn't hold and the chocolate wound up in one of the fans(not a pretty sight) -sigh-. Pc is still fine though (thank God)

you forgot to add the milk for making the chocolate mousse

Feel free to add more in the Comments section below :)

Dutch users Alert! - Beware of fake Tax Forms

This is especially a warning for Dutch users (from the Netherlands). There's malware spreading where it changes your startpage to a random dutch site (.nl domain - which is a compromised/hacked site) , presenting you with this:



Full screenshot of the form:



NOTE.. This is NOT from the legitimate belastingdienst.nl site as they DON'T ask you for this info (PINCode etc).
Even though it says it's from belastingsdienst.nl, it's NOT. Only the template from belastingsdienst.nl was used here, not the form itself.
Also note the "Microsoft Certified" and "Comodo Hacker Proof" logo to make it look like a legitimate site.

This piece of malware is especially designed to target Dutch users in order to steal their banking info.

I found this out yesterday while I was helping a user with an infected PC. The PC was severly infected/badly compromised...
There was also a .bat file present, with the command to change the Internet Explorer startpage to a random .nl site with this fake tax form.
I'm still waiting for the samples and more info how this user got infected in the first place.
I guess this infection is spread via MSN, however, I cannot tell for sure yet. The samples and extra info should tell...

So beware when you see similar forms... especially when they ask to enter your PINCode.

Update... More info about the malware itself here:
http://miekiemoes.blogspot.com/2008/06/dutch-users-alert-beware-of-fake-tax_21.html

Protect your family and computer with Windows SteadyState

If you're having kids who use the computer frequently, then it may happen once in a while that important settings were changed, or malware and other unwanted software was installed.
That's why Windows SteadyState may be the ideal program for you.

Windows SteadyState is mainly Parental Control software, where you can create several different user profiles and for each of the profiles you can set restrictive policies.
Example of Windows Restrictions, Feature restrictions and Block programs:




Also, under the general tab, you can set how long your kid may use the computer and you can lock the user profiles in order to prevent that they are making important changes.


But the feature I love the most is the "Windows Disk Protection".
With this option enabled, you can make all changes back undone - it clears all changes that were made during the last user session and resets it to the condition it was in before. A simple reboot is needed to reset it. You can also modify the settings and set it to retain changes temporarily + adjust the date when it should revert itself to a previous condition.
Or you can select to retain all changes permanently.

This is ideal in cases when the computer gets infected, or important settings were changed, or a program is causing problems after install or update etc etc..
As a matter of fact - anyone could use this feature if you like to test several settings on your computer, install software to betatest or perform any important system change if you're not sure what the outcome may be. Just revert to a previous condition if it didn't work out or retain the changes.

Windows SteadyState is for *FREE
*only for genuine Windows XP / Vista