Security and Forensics Roundup: Heavy Version

I think I need a bigger lorry for this one.

New, Updated, and/or Free Utilities

Security Database Tools Watch - FireCAT 1.4 package released – For those who don’t know, FireCAT is a logical collection of security-auditing/pen-testing Add-on extensions for Mozilla Firefox. It is a really amazing work.  However, up until now, you’ve had to pick and choose, and manually download each one you wanted, one at a time. Now, pop over to Package de plugins FireCAT 1.4 (natively in French so here is the English Version a-la Google) and download the compressed file and install away.  Thanks Hurukan!

ProduKey v1.35 - (freeware) – NirSoft app that extracts the product keys from a Windows system.  Latest version now allows you to “…load the product keys of external Windows installations from all disks currently plugged to your computer. When using this option, ProduKey automatically scan all your hard-drives, find the Windows installation folder in them, and extract all product keys stored in these Windows installations. New Command-Line Option: /external “

ChromePass v1.05 - (freeware) – NirSoft app updated now has “…added support for recovering Chrome passwords from external drive. (In Advanced Options).”

Volatility - (freeware) - Memory forensics tool from Volatile Systems.  I see this as a really great tool not just for forensic investigators but also Windows Internals investigators who are digging deep into very specific troubleshooting and system analysis.

Overview

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. <snip>

Capabilities

The Volatility Framework currently provides the following extraction capabilities for memory samples

• Image date and time
• Running processes
• Open network sockets
• Open network connections
• DLLs loaded for each process
• Open files for each process
• Open registry handles for each process
• A process' addressable memory
• OS kernel modules
• Mapping physical offsets to virtual addresses (strings to process)
• Virtual Address Descriptor information
• Scanning examples: processes, threads, sockets, connections,modules
• Extract executables from memory samples
• Transparently supports a variety of sample formats (ie, Crash dump, Hibernation, DD)
• Automated conversion between formats

For some great examples on how it can be used, check out these posts from the MNIN Security Blog:

• Locating Hidden Clampi DLLs (VAD-style) – MNIN Security Blog
• Recovering CoreFlood Binaries with Volatility – MNIN Security Blog

Spotted via SANS ISC Handler’s Diary post Finding stealth injected DLLs.

NetWitness Investigator - (freeware) – I generally use WireShark for most of my packet-capture work, unless I need something quick and easy for which I turn to one of several other micro-sniffer tools.  However, from what I’ve read, NetWitness has a lot of specialized features that might make WireShark look more like a piranha.

Product Features:

• Captures raw packets live from most wired or wireless interfaces
• Imports packets from any open-source, home-grown and commercial packet capture system (e.g. .pcap file import)
• License supports 25 simultaneous 1GB captures - far exceeding data manipulation capabilities of packet tools like Wireshark
• Real-time, patented layer 7 analytics
       – Effectively analyze data starting from application layer entities like users, email, address, files , and actions.
       – Infinite, free-form analysis paths
       – Content starting points
       – Patented port agnostic service identification
• Extensive network and application layer filtering (e.g. MAC, IP, User, Keywords, Etc.)
• IPv6 support
• Full content search, with Regex support
• Exports data in .pcap format
• Bookmarking & history tracking
• Integrated GeoIP for resolving IP addresses to city/county, supporting Google® Earth visualization
• NEW! SSL Decryption (with server certificate)
• NEW! Interactive time charts, and summary view
• NEW! Interactive packet view and decode
• NEW! Hash PCAP on Export
• NEW! Enhanced content views

The only real issue is that is seems like you have to give a lot of valid and real information to register and use the product (on a per workstation basis), which might turn many otherwise great customers off a bit.  The install file does include a wonderfully detailed documentation guide in PDF format. I also turned up a nice review of it over at Decurity Blog you might want to check out as well.  Spotted over at the SANS-ISC Handler’s Diary post: New Tool: NetWitness Investigator.

Firefox 3 Forensic Examination Tools

It has been a while since I posted More Firefox "Forensics" Tools which outlined a number of NirSoft tools and Firefox browser structure background.

Turns out that Chrome/Chromium also uses a very similar structure in their SQLite files as well.

An anonymous commenter left a heads-up on that post recently which pointed to a new (to me) forensics tool specifically designed for Firefox 3

Firefox 3 Extractor - (freeware) - Firefox 3 Forensics offers this really clever tool which I like for a number of reasons. First, the author states they have worked on UK police force and performed special forensics work. As such it seems to be developed from a real-world application standpoint. Secondly it is very simple to use.  Download the file and extract. Then copy the target SQLite file from Firefox into the same folder and from the command line, run the command.  It executes in a batch-file prompt mode asking you to select a choice depending on what you want to accomplish.

What can f3e do?

f3e presently has the following features:

• Extract all data from Firefox 3 SQLite databases to CSV.
• Extract all data from Firefox 3 SQLite databases to CSV and decode dates and times.
• Create a CSV 'Internet History Usage Report' from 'places.sqlite'.
• Create a HTML 'Internet History Usage Report' from 'places.sqlite'. example
• Decode PRTime.
• Extract all data from Chrome SQLite databases to CSV.
• Extract all data from Chrome SQLite databases to CSV and decode dates and times.

I played with it using some of my own system’s Firefox 3 SQLite files and it worked very well.  I really liked having a number of different formats to output into.  The Chrome support is a bit “experimental” but seemed to work as promised to me.

Great program and it has been quickly added to my USB disk.

FoxAnalysis - (freeware) - Digital Forensic Software tool I stumbled upon while getting background information on the one listed above.  This is another forensics tool from our UK friends across the pond.  Unlike Firefox 3 Extractor, FoxAnalysis has a GUI format that some users might feel a bit more comfortable working in nowadays.

Features

• Extract data regarding bookmarks, cookies, downloads, form history and web history

• Analyse data by filtering and sorting it:
  • Filter by multiple keywords
  • Filter by date range
  • Filter by download status
  • Filter by website visit type
  • Filter by selection
• Convert UTC timestamps to any time zone (apply custom daylight saving settings)
• Save and load case files
• Export activity report to HTML or CSV (Excel) files

I ran out of time this weekend so I didn’t get a chance to go hands-on with this one, but it looks good and I hope to play with it this week if things are slow at work. (Like that will ever happen!)

Looks like they are also developing a Chrome version not yet released.

Anti-Virus News

Some quick points in the AV world:

Microsoft® Malware Protection Center : MSRT Review on Win32/FakeSecSen Rogues – Some interesting statistics on the spread of fake security applications that all all the rage now.

VirusTotal [Sunbelt] += CWSandbox – Notice that VirusTotal upload scan site now includes a tie-in to Sunbelt Software’s CWSandbox.  Basically the way this works is that if you upload a file to VirusTotal, and it comes back with a match to a previously submitted version to CWSandbox, you will be offered a link to view that behavior summary analysis.  How neat is that!

VirusTotal += McAfee+Artemis – Notice that VirusTotal doesn’t just now include McAfee scan engine, but also one that leverages the Artemis technology as well.  I hadn’t heard of Artemis before but some digging turned up interesting information:

• Artemis and VirusTotal - McAfee Avert Labs Blog
• McAfee Artemis Technology— Real Time Malware Protection - ReadersZone
• McAfee for Enterprise - McAfee

Basically (read the above posts for the full-meal-deal) Artemis provides “cloud-based” protection for emerging malware threats.  It runs on the client side and if a file is discovered that meets a certain behavior or heuristic then its fingerprint is uploaded to McAfee which does additional analysis and sends back a “block” or “allow” action order to the client software.  In theory this provides rapid protection where signature-based protection cannot deliver due to morphing or other factors.

Bits and Pieces

.: The Story of a Hack - Part 3. Kung Fu Shopping – SynJunkie concludes his walkthrough on a hack-attack.  It was a nice and clearly written/illustrated example of the challenges sysadmins and CSO’s face keeping things locked down.

I’ve been following the .:Computer Defense:. blog for a long time.  However, lately the posts have been dropping off a bit.

Fortunately they have pointed to a new security-news and commentary aggregation site that I’ve quickly added to my RSS feed list.

• securitybloggersnetwork.com

I’m constantly amazed at the wealth of fantastic material and work out there by lots of dedicated IT security workers and researchers.  It is almost impossible to canvass them all.  Many I stumble across in the act of researching a specific problem or via cross-links in other posts.

For the two days I’ve been subscribed to the above site, I’ve already collected at least ten new sites and posts that have really added to my understanding and knowledgebase.

Good work guys and gals!

Cheers!

--Claus V.

Windows Registry Tricks and some Processing Treats

Yes, October is behind us and the pumpkins are being ground up for pie.

However, I really scored a few awesome finds on the Net this week while I was continuing my hunt for a solution to my PE 2.0/Vista project headaches.

Alas, despite a plea for assistance in loading a preferred driver in VistaPE over in the Boot Land forums, no one has yet dared take up the challenge.  Either it’s too hard for even the pros to deal with, or it is noobie question they don’t want to waste their time on.

Exciting Progress!  At Last…

Luckily the D-Man has been brainstorming at work as well and on Friday proposed a trick that I had toyed with, but didn’t allow to fully bake in my brain and follow through to its conclusion.  I had all the tools, just didn’t put the pieces together in just the right way. Initial testing of a method based on his recommendation was very favorable.  I have a bit more work to do before calling it a success and posting the brilliant and remarkably flexible custom hardware/driver building solution for all VistaPE builders, but looks like I’m buying D-Man’s lunch pretty soon. Looks like our dual-core brain-processing array has paid off on this particular issue.

But I am getting ahead of myself.  You have to wait a bit longer for those posts.

In a troubleshooting low-point, I was feeling like I had no choice but to scrap the whole VistaPE boot build environment model and return to a simple WAIK Windows PE 2.0 boot disk with the specialized and injected PGP WDE drivers alone.  I had already proofed it would work technically on all our systems, but the interface of WinPE 2.0 is (initially) pure Command Line Interface (CLI).  If you know your CLI commands and custom-load the disk with extra GUI tools/utilities in the building process, you can still find and launch them; it’s just not very sexy.  And yes, I like sexy tech.

So since I already have crafted a pretty advanced auto-run menu and utilities package for the Windows “auto-play” side of the disk, I wondered if there was a way I could just have the Win PE 2.0 boot disk side call and auto-run the menu-system.  It wouldn’t be quite as sexy (more like lipstick and hot-pink heels on pig) as librarian-sexy VistaPE is, but still would be better than a pure CLI box.

I knew that Win PE 2.0 is all based on a WIM file. And I knew that WIM files and their contents could be manipulated.

Could I build a standard WAIK Win PE 2.0 boot disk and modify the registry to add a custom auto-start key?  That would meet my need to load-up and execute the custom auto-menu utility picker.

Sure enough, you can modify the registry of a WIM file.

WIM Registry Editing

• Edit the registry on a mounted WIM – Off Campus blog.  Michael Greene post a great basic walkthrough on just how to do it.  Granted, you really need to be familiar with ImageX and registry work, but if you know the basics of both, you should get the gist of the process pretty quickly.

For some added background, I also offer this find:

• How to edit the registry offline using BartPE boot CD ? – Ramesh’s site contains a few more helpful foundational elements on the process as well as additional pictures and though it doesn’t apply specifically to mounted WIM file Registry editing, it does show the process of attaching to an offline Registry Hive, which still applies.

Fortunately, before I spent too much time in this retro-lounge, D-Man burst in with his lead and I left this exploration uncompleted.

• Windows Registry – Wikipedia provides some great information for quick lookup of facts and locations of Hive files.

Finally, you shouldn’t begin to muck around without a good understanding of the Windows Registry structure and functions.  To do that you could buy and read the Microsoft Windows Internals (4th Edition) as I am now doing on the side, or you could just download a free chapter from that same book offered by Microsoft.  Amazingly it happens to focus on the Registry! Windows Internals Chapter 4 (direct PDF file link).

Just be careful you don’t nuke your system in the process.

Blue Gold from Alex Ionescu

To be released in February 09 will be Microsoft Windows Internals (5th Edition) which will cover Vista and Sever 2008 this time.  Mark Russinovich and David Solomon will be the lead authors again, but contributing to this edition will be newcomer Alex Ionescu.

I happened to stumble upon Alex’s blog this weekend and found a number of amazingly great posts on Windows Vista processes and internal goodies.  He hasn’t posted for a while, but I imagine he has been busy with editing the new book.  It ends up being a good thing as it is taking me a while to read through and get my brain around his wonderfully detailed posts.

Here’s a sample of recent ones:

• MemInfo: Peer Inside Memory Manager Behavior on Windows Vista and Server 2008

• ScTagQuery: Mapping Service Hosting Threads With Their Owner Service

• Inside Session 0 Isolation and the UI Detection Service - Part 1

• Inside Session 0 Isolation and the UI Detection Service - Part 2

• Some Vista Tips & Tricks

• Building the Lego Millennium Falcon: A Lesson in Security?

Hope this helps and leads to wonderfully wasted time in pursuit of Windows Internals understanding.

Cheers!

--Claus V.

Three Quick Bits

These finds just didn’t seem to fit in with any of the other posts I have planned for this week so here they are as standalone items.

• Creating bootable Windows 2000/XP/2003 Disc (CDBurnerXP 3) (Windows 2000/XP/2003) - TACKtech Corp. 

Not so really useful (IMHO) as a boot disk any longer, now that there are better options such as Bart's Preinstalled Environment (BartPE) bootable live windows CD/DVD or Windows PE 2.0 or even the amazing VistaPE projects.

What I did find useful from that particular link was that TACKtech Corp. provides a ton of useful tips, links, news, articles and other resources off their home page.  Take some time to poke around.  I’m sure you will find it worthy of adding to your bookmark pile.  It is well laid-out and fun to browse around.  Kudos TACKtech and thanks for sharing!

• Help! I need a free app to convert DAA and UIF files! - Download Squad

I don’t often run into DAA/UIF disk-image format files.  I prefer the ISO format and after that BIN/CUE files.  If however you do need to convert a DAA/UIF file, you can buy a program, or use DAA2ISO and UIF2ISO freeware tools from developer Luigi Auriemma. Read the DLSquad link and find the additional link to Luigi’s proof that he actually had his original code “appropriated” by a commercial software company for their own product.

• Network toolset: Axence NetTools 3.2.0.3749 - Confessions of a freeware junkie

Confessions Junkie maximillian_x takes a look at a freeware network suite that might just have a few things worth looking into.  I’ve got a number of network tool suites and I have a hard time deciding which one I want to use.  Now I’ve got another one; Axence Software - Free NetTools.  Max does a great job on his review and covers all the major points as well as a few shortcomings.

That is all…

--Claus V.

All Over Gmail: Like Stink on a Skunk

It’s not the Shine…

If you are a Google Gmail users and unless your ISP has been down, you probably haven’t been able to miss the newest eye-candy rolled out this week to you.

Spice up your inbox with colors and themes – Official Gmail Blog

Google starts rolling out Gmail themes - Download Squad

Gmail: Gmail Updates Its Look, Adds Themes – Lifehacker

Gmail gets pretty, oh so pretty, with new themes – TechBlog

When the dust had settled and I had run through all the offerings with Alvis hanging over my shoulder, we both settled on the “Shiny” theme.

Lavie remains on the fence at the moment.

It’s about keeping safe from stink…

I’ve noted here in the past that I am a bit overprotective when it comes to Web accounts.  I always follow the following procedure when active on a secure website…say for checking my Gmail or doing on-line banking.

1. Close out my current browsing session.
2. Open a fresh browsing session window.
3. Use a pre-saved and inspected bookmark URL to go immediately and directly to the web-account in question I intend to log into.
4. Log in and conduct my business, remaining only on the host site or any cross-linked pages only.
5. When done with my secure session, I log out.
6. I delete both my cache files as well as any saved form data.
7. I shut down my browsing session window.

From there I open a fresh session and begin my general web-surfing again.

I know it is a drag to do that, but this is a key layer in trying to avoid any page-exploits or XSS shenanigans.  And as tied as I am to my Gmail account (a weakness in itself) I must disciple myself in not remaining logged in to my Gmail/Google sessions when I go browsing across the web.

Check your Gmail Filters…Regularly!

Case in point, I’ve now had to add an 8th step to the list above:

• Check my Gmail “filters” to ensure they are mine and mine alone.

One of the blogs I follow is MakeUseOf.  It always has great freeware and how-to tips.

Recently they were hacked and lost their domain.

I encourage you to read the great details of their post-attack assessment.

BREAKING: New Gmail Security Flaw. More Domains Get Stolen! - MakeUseOf.com

What became clear is that Gmail was one key factor in the subterfuge.

How the attack actually was implemented is still a matter of some discussion; is it a new non-disclosed Gmail flaw? It is a variant of an existing one? Maybe none of the above?

One very interesting (and disturbing) angle can be found in this awesome Gmail Security Flaw Proof of Concept post from Brandon at Geek Condition blog.

Regardless of your interest in any of these things I believe Brandon makes one very clear and important point for ALL Gmail users to follow:

What you should do if you have a Gmail Account?

Check your filters and make sure that nothing seems out of the ordinary. If you’re using Firefox, you can download an extension called NoScript which helps to prevent you from becoming a victim of one of these attacks. Overall, though, be cautious.

To check your Gmail filter rules, log into your Gmail account and select “Settings” 

Then select “Filters”

And now examine your Filters closely to make sure they are what you have set and expect. 

If not then delete any ones that shouldn’t belong, change your Gmail password immediately, and start the damage assessment and mitigation process depending on what you find.

The end-result of this attack, however it occurs, is that the user is completely unaware that important and critical emails are being deleted and/or routed to the hacker/exploiter without the owner even being aware.  They continue to log into and use their Gmail account, blissfully unaware of all the traffic and danger speeding in and back out of their account. (This of course assumes the Gmail owner hasn’t completely lost the keys to their Gmail account and the violator broke into their account and actually changed the password on them.  In that case, things get even worse!)

So check those email/Gmail filters, and check them often!

Related posts and perspectives:

I’m sure there will be more on this story and “exploit” as security folks dig deeper.  So stay tuned for details.  In the meantime, the following might not be as effective as tomato-juice, but might be a good place to continue from.

Using filters – Gmail Help Center

Stealing Domains via GMail - Sûnnet Beskerming

Malicious Setting Up of Filters in Gmail? – Google Blogoscoped

Hacking Security Researchers -  - Sûnnet Beskerming

Be safe.

--Claus V.

Microsoft Link Dump: Load #4

CC Photo Credit: by Choctopus on Flickr

That’s not just any dirt I’m leaving on your doorstep.  Nope.  It’s fresh Redmond brand dirt!

The Biggest Dirt Clod First

Let’s break this one apart into the good bits.

Updates: Process Explorer v11.3, Handle v3.42 | A new Mark’s blog post | 2 New Mark’s webcasts: Case of the Unexplained and Inside Windows Server 2008 R2 Virtualization and VHD Improvements - Sysinternals Site Discussion

• Process Explorer v11.3 - (freeware) – Nice update that “includes numerous enhancements and bug fixes, including a physical memory history graph, options to configure memory tray icons, asyncronous thread symbol resolution and security ID lookup, dynamic recognition of new volume drive letters, multiple character matching in the process view, and a smaller memory footprint.” Stop and download it right away!

• Case of the Unexplained – MS Tech-Ed EMEA 2008 - (video) – Mark Russinovich provides an updated presentation showing how some basic Sysinternals and Windows tools can help diagnose and resolve a myriad of confunding Windows system issues.  It’s a good review of foundational points that all good desktop support and system administrators should be familiar with.  I watched it with delight and relish.  Run time is just about an hour and fifteen minutes.  It goes by very fast.

• Inside Windows Server 2008 R2 Virtualization and VHD Improvements - Microsoft Tech·Ed EMEA 2008 - (video) – A bit more technically specific for Virtualization geeks and admins, Mark Russinovich goes over a number of highlights including a demo of the new Windows native BHD and boot-from-VHD support.  This gets into features available in the coming Windows 7 release architecture.

While there, you might want to peek around at Mark’s other webcasts on TechNet.  Vista will still be kicking around for years to come, so some folks might find his presentation on Windows Vista User Account Control Internals particularly useful knowledge.

MS Blog Watch

The Microsoft blog machine was a bit lighter on material in the specific areas I follow.  Nonetheless, there were a few good finds.

Engineering Windows 7 : Disk Space – Fascinating technical post that attempts to address two questions before moving on to describing how Windows 7 manages disk space:

• What does the WinSxS directory contains and why is it so big, and can I just delete it?
• Where does all the disk space go for Windows components?

The post is a very long one and gets both technical and philosophical from a design standpoint, however I found it really illuminating both for current Vista system file caching and storage as well as the issues facing the Windows 7 build team as hardware (and storage devices in particular) force changes in OS design.

Engineering Windows 7 : The Windows 7 Taskbar – Another long post.  This isn’t quite as technical.  It touches on how users have been observed interacting with the Windows taskbar in the past and how the Windows 7 design team have been hard at work tweaking it.  It’s not just about eye-candy but trying to bring added efficiency and workflow to users.  I think these posts give me a better understanding the differences on how Windows was designed to work for me, and how I actually use it.

IEBlog : IE8: What’s After Beta 2 – Umm. Release Candidate 1.  Keep the testing coming.  I’m not planning on converting to the MS IE dark-side when IE8 is finally released, but I will relish it’s eventual deployment at work as a more secure “approved’ browser than IE 6 that remains the version of standard across most all of our systems.  Heck, I would be happy if we could bump to IE 7 before IE 8 final rolls out.

Third-Party MS Bits

Windows Live Sync to replace Windows Live FolderShare - Windows Experience Blog – Brandon drops a bomb on all you Windows Live Folder Share fans and users.  Sorry Charlie.  It’s getting yanked and replaced with Windows Live Sync.  The Windows Live FolderShare Team Blog lists all the information you need to know.

In December, we will release a new product called Windows Live Sync. You can think of it as FolderShare 2.0. It's going to look familiar and offer the same great features, plus:

• More folders and files - sync up to 20 folders with 20,000 files each.
• Integration with Windows Live ID - no more extra sign-in stuff to remember.
• Integration with the Recyle Bin - no more separate Trash folder to fiddle with.
• New client versions for both Windows and Mac. 
• Unicode support - sync files in other languages.

A huge part of Sync's success story depends on FolderShare users like you. When Sync releases, FolderShare goes into retirement. That means your FolderShare software will stop working and will ask you to upgrade to Sync. Once you do, Sync will automatically rebuild your personal folders. We expect a lot of new users when Sync is released, so if you can't sign in right away, please give it a little time.

Here's the part you need to pay attention to: Sync will not be able to rebuild your shared libraries. If you have a lot of shared libraries, you should hop over to the FolderShare website while it's still available and copy all that information. You'll need it to rebuild your shared libraries in Sync.

You should also note that the Professional option is being retired with the FolderShare name. Sync has a single offer, which provides free synchronization for up to 20 libraries and 20,000 files. We'll be working to raise those numbers as our service grows.

No upgrades from XP to Windows 7?  - Ed Bott’s Windows Expertise.  Leave it to Ed to rain on XP users who like the in-place upgrade path to a new OS.  At least in the current version, it does not appear that users can upgrade their XP systems to W7 as an overlay.  It’s going to be a clean-install only, baby.  So plan on doing some major user-data collection and migration before attempting.  To be honest, it’s probably all for the best anyway.

What is the quickest/easiest way to open the Network Connections page in Vista/2008 – Off Campus blog. Great tip as when I was setting up Wi-Fi on the Vista notebook, it seemed like I had to navigate a number of links to get to where I wanted to go.  Solution? Go to the Vista Start orb and put in ncpa.cpl in either the search field or the Run field.  Bam!  There you go!

--Claus V.

Firefox 3.1b2 Watch

Over the last week there were hopeful signs that the beta 2 version of Firefox 3.1 (Shiretoko) would be released.

There were in fact a few teasers that it would be released on November 21st, but alas, that did not come to pass.  From what I can tell, the official release might be around the 28th, give or take a few days.

I suppose that one could dive into the “nightly” Minefield builds, but I’m trying to be good of late and stick with the slightly more stable beta versions.

On the Watch Tower

Some b2 watch-bits while we wait:

Releases/Firefox 3.1b2 – MozillaWiki – Basic pre-release checkpoints and timetable.

WeeklyUpdates/2008-11-17 – MozillaWiki – Big picture on Mozilla release activity. Its all about bug-killing and quality assurance.

Firefox3.1/StatusMeetings/2008-11-19 – MozillaWiki – For the most part it seems that most (all?) of the release blocking bugs have been neutralized.

However, it looks like one anticipated feature will get yanked out of this beta version, again; Ctrl-tab preview switching.  For specific reasons why this is being held back see bug 465843 link.

If you don’t recall, this is the Vista-ish alt-tab feature that pops up a preview page highlight dock-style when ctrl+tab-ing through tabs on a browser window.

If you read that bug link, seems there is some interesting behind-the-scenes discussion on the merits and application of the feature when just one or two tabs exist.

Anyway, looks like there is still some cleanup work and decisions to be finalized before we get a working 3.1b2 in our hands.

So until things become “official” I guess I will keep checking in at the Index of ftp://ftp.mozilla.org/pub/firefox/releases/ site and look for a new folder called 3.1b2.  Sometimes I can get lucky and snag it a day or so early that way.

Coming soon to Firefox: Tab Tearing

One of the newest features that 3.1 will offer is an expanded feature called “tab-tearing.”

Mozilla Links offers a great video and rundown of this capability. Firefox 3.1 gets tab tearing.

While previous versions of Firefox have always allowed some URL drag-n-drop handling, say a link from the desktop, a file, email application, or from the bookmarks, tab-tearing is a bit different

Basically it allows you to click and hold on a tab and drag it off the browser window and when released it will open in a new browser window and be removed from the originating browser window.  Or you can drag the tab off the existing Firefox window and drop it on another Firefox browser window and it will be added to the destination and removed from the source.

If it sounds complicated, it really is basic.  Hop to the link and view the very short window video and you will see what I mean.

Claus V.

Absent today, on to “Morro”; MS’s coming free AV tool

Earlier this week, Microsoft quietly let leak they would be releasing a new and free anti-virus tool for XP and Vista users. 

Improving Global Access to Core PC Protection: Q&A: Amy Barzdukas, senior director of product management, discusses Microsoft’s strategy to provide broader access to critical anti-malware protection. – Microsoft PressPass release.

Available at no additional cost,this new solution will focus on delivering easy-to-use protection from threats that can place personal information at risk and harm system performance.

This new anti-malware offering, scheduled to be released in the second half of 2009, will provide protection from a variety of threats – including viruses, spyware, rootkits and Trojans – and is specifically designed to address the demands of smaller PC form factors and the rapid increases in the incidence of global malware. This solution will be suitable for customers in emerging markets where infection rates tend to be higher,¹ and where demand for entry-level PCs makes it even more important that protection be available that does not sacrifice system performance.

First Thoughts

I expect it will be offered in some fashion (I’m not yet saying “bundled”) with Windows 7 as well.

Kind of like how if you have Windows XP, you can download and install the free Microsoft Windows Defender anti-malware product. But if you have Vista, it comes pre-installed.

While Windows Defender does an acceptable job providing basic and free anti-malware protection to users, it doesn’t really provide any anti-virus protections.

That’s not to say that Microsoft doesn’t already address consumer’s anti-virus needs in a (very) limited scale. Remember the MSRT (Malicious Software Removal Tool) that gets updated each month? It’s installed on every XP and Vista system although most consumers don’t know it.

Information at the moment is sketchy, but either we will see a complimentary product to Windows Defender, or some new iteration that incorporates existing Windows Defender protection along with anti-virus/trojan type protections.  I say that as the Microsoft quote above specifically mentions “spyware”.

Windows Defender is an optional install for XP users and, as mentioned, comes included in Vista.  Because of the third-party anti-malware/anti-virus protection I have, I made the decision some time ago to disable Windows Defender. Nor do I run it on my XP systems.  I suspect and hope that Microsoft makes Morro either an optional consumer install or makes disabling/uninstalling it a simple and clean process.

They probably will to avoid ire of anti-trust/competition attention.

While Microsoft is generally hammered on the web for its constant insecurity and vulnerability patching, and OneCare hasn’t always received high-marks in efficacy tests, to those in the know, Microsoft’s security analysts work hard to understand and counter trojan and virus code. Regular reading of the following company blogs often finds great technical information on emerging and persistent threats.

• Microsoft® Malware Protection Center

• The Microsoft Security Response Center Blog

• Microsoft Security Vulnerability Research & Defense Blog

• Forefront Team Blog

Morro Tolls for who?

So who exactly is the targeted audience for Morro?

Definitely “emerging” markets where Microsoft/Windows hopes to gain a larger share.  Average consumers across the board looking for basic/free malicious file protections, probably technical users looking for something very simple to toss on their relatives pc’s that they won’t have to explain or continually return to tweak and babysit.  I expect “thin” platforms like Netbooks might be another target if Morro is (as claimed) designed light and lean and does not impact system performance over protection.

The biggest winner? 

Microsoft and their enterprise security product customers.

Why do I say that?

It almost seems “Dickens-esque”

Check out what Microsoft’s "Forefront” security product team blog says:

So, people may ask how does "Morro" compare to Forefront Client Security?  Will enterprise customers use it?  The answer is no, "Morro" is intended for consumers, whereas Forefront products are enterprise solutions, providing the capabilities and features required in sophisticated IT environments, e.g. centralized deployment, management and reporting, security state assessments, scheduled signature distribution, update management, etc.

It is worth noting that "Morro" will have a positive impact on Forefront, because it will allow Microsoft to capture even more threat intelligence from customers as more people use the free anti-malware solution.  We'll be able to use that information in our security research and the development of signatures and protection capabilities in Forefront.

Yummers!  Gads and Loads of juicy consumer-provided threat-intelligence data funneled up to Microsoft off the backs of the humble and poor masses so they can analyze and then develop improved signature and protection capabilities in their enterprise and upper-class threat-protection product Forefront.

I hope that doesn’t come off sarcastic.  It’s actually a brilliant move and the consumer (and everyone) wins in the end.  Microsoft’s offering of Morro just isn’t as altruistic as the spin might seem.

More opinions on Morro. 

Expect the discussions to grow, and become interesting as we begin to see beta releases.

• Microsoft offering free security program in 2009 – Chron.com TechBlog

• Microsoft to deliver free antivirus software next year -  Ed Bott’s Windows Expertise

• ‘Evil’ Microsoft strikes again by ‘giving away’ their security suite - The Stone Blog - Windows Connected

• Will Microsoft’s antivirus move draw antitrust fire? - Beyond Binary - CNET News

• Microsoft Realizes No One Wants To Pay Microsoft To Fix Its Own Security Flaws - TechDirt

I’ll be keeping my eye for beta versions and will be quick to test and evaluate when available.

The things I do….

--Claus V.

Linkfest – Nov. 16, 2008

I can’t believe it!  Sunday isn’t even over and I have processed about eight loads of laundry, taken the trash out, cleaned the kitchen at least two times, baked peanut-butter cookie bars, cleaned up the “downloads” directory of our laptop (it was quite full), installed/removed a number of assorted utilities and software, hung out with Alvis as she did her homework, and sorted the collection of recycling trash to go out next week.

Whew!

Working in my favor was a quiet weekend on the InterTubes, allowing me to easily keep pace with the remaining links in my “to blog” bookmark folder.

Weekend Thanks

Special thanks this weekend to Gary Berg for taking his time to leave me some great feedback on the Olympus E-5xx line of DSLR cameras.

Also getting a big hat tip this weekend is SunbeltBLOG who I had a brief but awesome back-channel conversation with this weekend.  I’ll eventually disclose a bit more of that goodness in the coming weeks.

Linkage

This week’s links are almost all software related.  There are a few tips, but it’s pretty much all neat stuff to consider and play with.  All free!

Help! Some idiot partitioned my giant hard drive! - Download Squad – The DSquad suggests some software tools to help fix accidently (re)partitioned drives. Take a quick look and make sure you have noted these recommended tools.

Free ISO Creator - (freeware) – I have quite a collection of ISO file tools. This will become yet one more to add to that mix.  It makes creating an ISO file (particularly for data-disks) a very simple process.  Spotted via Download Squad.

ISODisk - (freeware) – While I personally use and recommend the freeware tool SlySoft Virtual CloneDrive for my virtual drive (ISO file mounting) needs, this one looks pretty sweet also.  ISODisk supports up to a remarkable 20 virtual drives for ISO file mounting support.  Wow!  Not sure why anyone would need that many, but if you do, there you go.  I generally just mount one or two ISO files at a time, max.

5 Windows tools to remove damaged antivirus programs - Download Squad – Very nice collection of commercial AV product uninstall tools.  These are always great to keep bookmarked.  I can’t recall how many times a borked Symantec AV install simply refused to come out of a system and we had to resort to a brute-force SAV uninstaller tool to gut it from a system.

Ammyy Admin - (freeware) – Funny name but handy “remote control” software for Windows 2000/XP/2003/Vista/2008, 32-bit and 64-bit systems. Basically you and your remote “customer” both download the file and run it.  The customer provides you the ID # which you enter into your window and away you are connected.  See this MakeUseOf.com review for more details and screenshots.

Hive Five: Five Best Remote Desktop Tools – LifeHacker – Not to be outdone by MakeUseOf, LifeHacker offers five additional remote-desktop tools.  Take the time to sort through the comments as LifeHacker readers are known to be a clever bunch and the comments really add some meat to the post.

ShowMyPC- (freeware) – My personal favorite and “go-to” tool for remote-desktop support extended to family and friends. It’s got an easy-to-remember URL.  Just have your “target” download the single file and click-to-run.  You do the same. Have them click the “show my PC” button and provide you the password ID number. You click on “View a Remote PC” button and enter in the number they give you.  In a matter of seconds, you are viewing (and controlling) their system.  Works through firewalls quite nicely with almost no issues.

Windows Vista SP2 and Windows Server 2008 SP2 - the interesting part – 4sysops – What is going to be the most interesting part of Vista SP2? Nothing!

New features of Vista SP2

• Windows Search 4.0
• Bluetooth 2.1 Feature Pack
• Support for ICCD/CCID smart cards
• Ability to record data onto Blu-Ray media natively
• Adds Windows Connect Now (WCN) to simplify Wi-Fi Configuration
• exFAT file system to support UTC timestamps, which allows correct file synchronization across time zones
• New VIA 64-bit CPU support
• Print server and spooler performance improvements for printers
• Application compatibility updates

New features of Windows Server 2008 SP2

• Hyper-V RTM included
• Backward compatibility with Terminal Services licensing keys
• Improved manageability features with DFS/FRS console and Storage Resource Manager
• Print server and spooler performance improvements for printers
• Improved error reporting in DFSR to help identify incorrectly configured deployments which lead to failed replication
• Improved power profile

Delicious new Windows Live Wave 3 icons – istartedsomething – Long’s got some new icons dug up for the Windows Live Wave products.  I rather like them.

ShadowExplorer - (freeware) – Now this is handy for all you Vista Home Premium users out there! Basically, Vista’s “Volume Shadow Copy Service” creates point-in-time duplicates of your files. So if you accidently delete or change one, you should be able to recover a prior “shadow” version. Only the problem is that even though all versions of Vista run this service by default, only users of les you accidentally deleted or altered. This service is turned on by default on all versions of Vista Ultimate, Business, and Enterprise editions can take advantage of the benefits.  ShadowExplorer allows Vista Home users to now have access to retrieval of those “shadow” files. Neat!  For more information check the developer’s website as well as a review by Confessions of a freeware junkie.

Tiny Victories Inside Microsoft - SmallestDotNet makes headway & SmallestDotNet: On the Size of the .NET Framework – Scott Hanselman’s Computer Zen.  - This is some good stuff to read and then bookmark. Many more applications today are being developed on the .NET framework from Microsoft. The problem is that for many users, trying to decide which is the best package to download can be a real headache. As Scott points out, the .NET download can be a real whopper.  So one of Scott’s first tasks at Microsoft was trying to make this process much clearer to understand. He had mixed results, but it’s a good reminder that a stop by the SmallestDotNet.com website will almost certainly ensure you get the smallest-sized, but correct, .NET package you need.  It’s a great and interesting series of posts to read.

Two tools to remove locked Windows files on restart - Download Squad – Yep. DSquad has two more freeware utilities to assist with removing stubborn files from your system.  For an expansive roundup check out my previous GSD post of freeware locked-file deleter utilities.  I bet you won’t click-away unsatisfied.

Use On Screen Keyboard - Technofriends - Who knew that XP and Vista OS’s included a handy on-screen keyboard utility. Yep. Just go to

Start —> Run –> and type OSK then press <enter>. There you go!  Great if the keyboard goes out…what? How are you to type OSK if they keyboard isn’t working? Ummm Good question. Try navigating to the OSK.exe file in the Windows\System32\ folder with just your mouse and launch it.

For a slightly more configurable and fully portable version use On-Screen Keyboard Portable from PortableApps.com. I now include it on all my USB and utility/Win PE 2.0 boot CD’s…just in case the keyboard drivers fail to load. (Grrrrr.)

WinAudit Creates Seriously Extensive System Profiles – LifeHacker – Nice recommendation for WinAudit which is yet another system auditing tool. Looks like it has been recently updated. In the past I used Belarc Advisor which does a great job but isn’t able to be used at work without a license. Nowadays I prefer to use SIW-System Information for Windows (freeware) or the amazing SIV - System Information Viewer (freeware) tools. If you want a truly “tiny” application in this class, consider looking at the EFD Inspector (freeware) tool. Although it doesn’t provide quite the same depth of information, it does weigh in at just 252kB. Scroll down a bit on the page to find it as it isn’t the main focus of it’s developer’s page.  By the way, all of these are nicely portable for use on USB sticks.

How To: Customize Your Own Killer "Enigma" Desktop – Lifehacker – Now I personally have my desktops just the way I like them, and as cool as the Vista Sidebar is, it seems a bit cluttered to me so I disable it from running on my Vista system.  Nevertheless, reader Kaelri has provided a great tutorial on how to create a very polished and stunning desktop theme.  Check it out.

Signing off for now…!

--Claus V.

Browser Bullets

Last night Lavie went in for a sleep-study. I think this one was number four in less than two years.

Why is it that when your partner has a sleep-study, the other seems to not get any sleep?

The first time Lavie went in, she didn’t want to be left alone, so I remember trying to sleep in her room in a faux-pigskin recliner. Everytime I moved it sounded like a prat-joke movie gone bad. I got about three hours of zzz’s that night.  The only comfort was my iPod filled with Security Now podcasts.

By the time Lavie had her second and third studies she was a bit braver and was allowed to just drop her off and pick her up.  The center’s results were very inconclusive.  Lavie’s diagnosis was that the center wasn’t getting very good results if they had to keep coming in to wake her up every hour to adjust a sensor, or ask her to roll a certain way.

Friday night I dropped her off again and stayed a while as she got connected up to the harness.  The technician was young but enthusiastic.  Turns out he was also sleep deprived as his main work hours were at night, but he was going to school on a GI Bill grant during the day.  Tough kid.  He had served, with honestly mixed feelings, on a few different ships during his tour, including a carrier flight-deck.  Lavie and I had watched the PBS series CARRIER on PBS so we were able to hold a great discussion with him. Turns out his duties involved crash-recovery as well as some aircraft taxi control.  Although he didn’t seem particularly impressed with military life, he did exhibit a noticeable attention to detail as he plugged Lavie up so the sensors wouldn’t come loose by applying extra conductivity paste and taped the leads down where possible.

Lavie was tucked in by 9PM and I was home just before 10PM.  Alvis quickly went to bed but I stayed up restless until past midnight listening to the wind howl and bay and the trashcans tumble around.

Then came the 5AM phone call that Lavie was ready to be picked up.  When we got back home before 7AM, it was back to bed.  Unfortunately, I slept way too long (until almost 10AM) and woke up with a sleep-hangover headache.  I’m prone to those when I get greedy with oversleeping in the mornings.  Should have just stayed up.  The rest of the morning was a write-off with the girls going shopping for a bridesmaid dress for Alvis and sundry items for Lavie.  Me? I was pretty much a weekend bum until the fingers started moving on these blog posts mid-afternoon.

On to some browser related links of interest:

Browser News

Opera Mini 4.2 beta – I’ve been using Opera Mini on my Blackberry unit for a while now and generally like it a lot.  This new beta-release installs alongside the current version you may have.  It boasts skin colors (yawn), some performance improvements, video compatiblity, and Opera Sync support. For more on that last one check out Opera Link.  This is actually pretty cool as it offers the opportunity to sync information from both your desktop Opera browser with your mobile Opera browser and even a web-accessible version of your Opera data if you happen to be using another brand of browser.

Upcoming Releases – Firefox Extension Guru – While the Mozilla release schedule in of itself is pretty dry reading, if you are a Firefox fan, seeing that the next beta 2 version release of Firefox Shiretoko 3.1 is coming out around November 21’st is certainly something worth expecting. Especially if it incorporates the new Private Mode features.

Meet Firefox private mode - Mozilla Links – Speaking of that Private Mode feature, Mozilla Links has a great overview of how this feature will work.  Basically if you want to start a browsing session that disables retention of history, cache, cookies, etc, you select a Private Mode session. Your current browsing session is saved and the window/tabs closed. A new Private Mode window opens and away you go. When you exit, your previous “normal” Firefox browsing mode returns.

Although Mozilla’s, along with IE 8’s, and Safari’s private browsing modes are “private” but not actually anonymous sessions, I suspect they will still leave a bit of evidence behind for the forensic experts and am looking forward to how these Windows sleuths will uncover the evidence left behind.

Make Firefox look better on Vista - Mozilla Links -  If you were looking for a quick solution to add a nice Vista Aero effect to the default Firefox theme, forgettaboutit.  However, if you are willing to do a bit of work and theme-tweaking, Percy Cabello’s walk-through is pretty simple and really does deliver a much more pleasing effect.

Firefox: Why TraceMonkey is Going to Blow Your Web Browsing Mind (Lifehacker) and JavaScript:TraceMonkey (MozillaWiki) – Both posts give more information on just how awesome the TraceMonkey JavaScript performance improvements will be.  These are now built into the Firefox Nightly (Minefield) and Shiretoko (beta) releases of Firefox 3.1 but to my knowledge not enabled by default.  You can enable them with a quick about:config tweak. 

In my usage, many JavaScript enabled sites to respond much faster. However the JavaScript still can do weird things. For example, even though I NoScript enabled all the elements at Lands End (I’m buying some long-needed dress shirts), with TraceMonkey enabled, some drop-downs just didn’t work. When I disabled it again all behaved normally. So play with it all you want, but be mindful that some sites still don’t always work quite as expected.

Safari: Safari 3.2 Released, Bolsters Security (Lifehacker), Apple Safari download, (or via FileHippo.com).  Either way, if you are a Windows user and run Safari, go ahead and get this update.  It contains a number of security-related tweaks.  I personally am running a beta version of Safari 4 – Apple Insider. If you are interested in this version, follow the steps at the end of this previous post and you should be set.  It continues to work great on my Vista system.

Browser Related Utilities of Note

Transmute - (freeware) – Now I don’t know how it has taken me so long to find this clever little utility. Transmute allows you to convert bookmark files between different web-browsers.  That doesn’t sound like a big deal but consider this, this particular utility will let you do so for Google Chrome, Mozilla Firefox (versions 1, 2, and 3), Microsoft Internet Explorer, Opera, Apple Safari, and Chromium.

Wow! Think how much time this could save if you are a browser junkie like me!  Or maybe if you are a sysadmin or investigator and you want to review some links from a user’s Internet “exploiter” browser but want to do so in a more secure and controllable browser like Firefox with a ton of specialized security add-on extensions.  Convert away and go!  Added options include exporting directly to the target browser file locations, another folder, appending with a timestamp, exporting to a root folder, and overwriting the target file directly. You can (and should) also request a backup file be made.  It is glorious in its simplicity.

Transmute does require the .NET 2.0 framework, but does come in both install and “portable” flavors. Always a big plus in my book!

OperaCacheView - (freeware) – NirSoft's cache viewer for Opera web browser now allows for recall of last specific cache folder opened/viewed as well as re-saving the cache files in the same directory structure of the website.  Something that might be handy for forensic examiners.

ChromeCacheView - (freeware) – NirSoft's cache viewer for Google Chrome Web browser now also allows re-saving the cache files in the same directory structure of the website.

IE PassView - (freeware) – NirSoft's Internet Explorer password viewer adds an exciting new feature. Namely the ability to read the IE 7 passwords off an external drive. As Nir points out in his related NirBlog entry, this could be useful for users (or examiners) who want to collect the passwords from a dead (or offline) drive.  The only restriction is that you need to know “…the last log-on password that you used for the user profile that store the passwords.”

Good stuff, all around!

--Claus V.

Windows 7 News Roundup #3

Overall the dust has settled from the previous weeks’ W7 madness.

Everyone has retreated back into their caves to play with their official or torrent sourced W7 install files and are poking around for the deeper bits and pieces.  So far things have been pretty quiet.

Only a handful of W7 news bits came out this week that piqued my interest:

Windows 7 to allow PC backups to network share – istartedsomething – Long Zheng discovers an option that allows backups not only to another local drive or CD/DVD media, but now you can specify a network share as well.

Windows 7 security: An overall improvement? - Defense in Depth – Robert Vamosi breaks down how the Vista Security Center will be removed and replaced with the W7 Action Center that seeks to unify 10 existing Windows features: Security Center; Problem, Reports, and Solutions; Windows Defender; Windows Update; Diagnostics; Network Access Protection; Backup and Restore; Recovery; and User Account Control.

5 very basic things Windows 7 still isn’t any good at - Download Squad – The crew is feeling pretty bold to make judgments on a pre-beta release, but they do nail some key issue such as compressed file handling and time adjustment.

10 genuinely kick-ass features to get excited about in Windows 7 - Download Squad – On the other hand the crew does find many more things they like in W7 including the Device Stage, improved network file sharing, PC Safeguard, and a new “Time Machine”-like image-backup system.  I’m wondering if it will be based on Microsoft’s ImageX utility which is frankly super-cool.

Get Windows 7 Calculator In Vista – Daily Gyan takes us down a hack to get the W7 calculator working in Vista.  It’s not too difficult, but will take a moderate amount of system-fiddling so you better want it really badly to take the effort to get it configured.

"Blue Badge" tool available, unlocks all known protected features - Within Windows – A few weeks ago Rafael Rivera did some great detective work and found that many of the cool W7 features displayed in the Microsoft presentations (but missing from the pre-beta not-quite public release version) were actually in it anyway, but trickily disabled.  His workaround released those locked up bits.  Now, Rafael has refined his tool with the "Blue Badge" tool.  It’s really clever and polished.  Recommended for everyone playing with the W7 pre-beta.

Engineering Windows 7 : Action Center – The W7 Microsoft team gets all crazy-technical about why they felt they needed to redesign the Vista Security Center into the W7 Action Center.  Lots of end-user behavior studies and stuff like that.  Skip past all that boardroom discussion and head down to the technical presentation on Action Center mid-way into the post.

Our effort to quiet the system and make sure you are in control took the following approach:

• Working across Windows 7 to reduce unnecessary notifications
• Put you in control of the notifications you see
• Creating Action Center with the following goals
  • Reduce the number of notification balloons sent to you and make the ones that are sent more meaningful
  • Provide a contextual way to address the issues with a single click
  • Reduce the user-interface clutter in the system to streamline solving system issues

While there are many other efforts going around notifications and the notification area I’m going to focus on Action Center. In a nutshell, Action Center is a central location for dealing with messages about your system and the starting point for diagnosing and solving issues with your system.

If pulled off right, this could be a Good Thing for the W7 user experience.

--Claus V.

Security Simmerings…chunky style goodness

Lean Snake-meat

I’m trial-testing a new (to me) anti-virus/anti-malware product on our Vista system.  It’s Sunbelt Software’s VIPRE Antivirus + Antispyware program.

It’s a bit of a different product for me as I usually stick with “free for personal use” versions such as AVG Free.  This one is good for just 15 days.  On the plus-side, Sunbelt offers a $49.95 deal to register its use on all the computers in your home for a year.  That does seem like a good value.

I uninstalled AVG Free 8 then after a reboot loaded this one up.  A full scan with VIPRE took 128 minutes and as the image above shows scanned a bunch-load of items.  In all it found five cookies as well as two possible trojans and one potentially unwanted program.  I was a bit shocked at first, but found that one was Abel (of Cain and Abel), one was a utility in NetTools, and the last (PUP) was a tool that allows you to run an application under a different date. So all were in fact, known and approved by me to be on my system.

I must say my first impressions are very positive.  The interface is very logical and easy to navigate. Each time I wanted to do something or find something, I was quickly able to find it, even without having read the Help files.

My only “gripe” at this point is that I was not able to select any of the items found in the middle of a scan to view the details on them.  This led to some mixed concern on my point until the scan completed and I was able to see the details. I’d like to ask the Sunbelt team to allow viewing of detected threat details in the process of the scan, or allow additional columns to be added to the default view that would at least show the location (path) and filename of the threats so some information can be reviewed mid-scan.

I’m not intending this to be a “review” but more of a first impressions.  However, if after the fifteen days are up I’m still happy, I’m pretty sure I’ll be signing up for a subscription and composing a longer review.  In the past I used their Sunbelt Firewall product for a very long time, abandoning it only when it took so long for them to deliver a Vista compatible version…(now available). I was very pleased with the product and company from that experience.

On top of that, CEO Alex Eckelberry’s SunbeltBLOG is a long-time RSS feed of mine and I really enjoy the posts found there. Alex is very responsive and frequently drops into forums and blogs and leaves his comments.  I’m always impressed with his attitude and willingness to engage in constructive discussions on both his company’s product as well as the anti-malware industry in general.

AVG Foul and Alternative Poultry Choices for the Pot

Goodness knows, I’ve been a long-time apologist for AVG Free here on this blog.  It was one of the very first “free” anti-virus products I switched to after leaving a paid-subscription service.  It’s had its ups and downs but overall I still remain pretty pleased with AVG and continue to recommend it for most home-users looking for a free security product.

My complaints remain, however; a very busy interface, difficulty finding and using the “advanced” settings and configurations tools, periodic false-positives, the fact I’ve never been able to get the “upload to AVG” feature for sending sample files to AVG to work, and the fact that it continues to hammer away on a number of my utilities as “Potentially Unwanted Programs” despite the fact I tell it not to.

AVG again has made the tech-circles with reports of nailing false-positives for some critical (or important) system files. Although I personally haven’t experienced any of these recent behavioral problems, they could be a bit disconcerting for AVG noobies not yet accustomed to the frequent AVG false-positives the signatures are know for.

TechBlog: Ooops: AVG thinks key Windows file is a Trojan

TechBlog: Yet another AVG false alarm: Time for an alternative?

AVG virus scanner removes critical Windows file - Security and the Net

This led to me re-evaluating my selection with AVG Free 8 again and giving VIPRE a try.

In my previous AVG Free v8 versus the Competition (Speed to Scan only) post, I came to the conclusion that AVG Free v8 had the fastest performance overall of any free anti-virus product that I had tested.

The runner up was Avira AntiVir Personal.  I said that I would likely choose this as my second choice were I to leave AVG Free 8.  The only drawbacks I find with AntiVir is the fact that the free product did have a few more limitations in this product compared to other free solutions. On the plus-side, Avira consistently leads the pack of SRI’s Most Effective Antivirus Tools Against New Malware Binaries detection list.  See also AV-Comparatives.

Curiously, I did not see Sunbelt Software’s VIPRE listed in either location. So I really have no way to see how they would stack up in these tests by comparison.

If I did go with AntiVir I would probably also use it in tandem with either (or both) Malwarebytes' Anti-Malware (free but $ for full-feature version) and ThreatFire (freeware).  I had always relied on ThreatFire’s HIPS type protection before, but it seemed to conflict with COMODO’s firewall and kept locking up my XP system’s hard-drive so I just uninstalled it from everything for now.

Then there is COMODO’s Internet Security suite which remains a free security product that bundles both it’s awesomely hardened firewall along with some interesting anti-virus/anti-malware products.  Certainly worth looking at as well as an integrated anti-malware/anti-virus solution if you are tempted to walk away from AVG Free 8.

Finally, I found this security software review site that uses YouTube videos to highlight its findings: Remove Malware.

Pure Angus Meatiness

Microsoft® Malware Protection Center : Malware and Signed Code – Yep, it’s a brief discussion on code signing and how it is beneficial to preventing malware.

Microsoft® Malware Protection Center : Win32/FakeSecSen - A Nasty Piece of Work – MMPC staff take some of the fake security programs to task. I frequently see evidence of these at work where users were surfing, got a pop-up and the program/presentation looked quite legitimate and tricked the user into installing the app on the system.  Then our Symantec program alerts on them, (but can’t remove them) and off we go to pull them off the system.  It’s probably even worse for many home users. It’s a great roundup and discussion.

Wi-Fi Networking News: WPA Not Cracked, But Still Vulnerable and Security experts reveal details of WPA hack - News - heise Security UK – The weakness of the WPA chain is finally fully out.  It is a flaw, but probably nothing for the average home user to be deeply concerned about…at least not quite yet.  If you are really concerned and your Wi-Fi router supports it, consider switching to WPA2.

Windows Incident Response: More Deleted Keys Goodness! – Harlan shows just how valuable the ability to find (and recover) deleted registry keys can be. Neat stuff.

Windows Incident Response: New Code Posted – Harlan also kindly offers up a plug-in to his RegRipper tool that will help recover deleted registry key information for investigators and SysAdmins.

SynJunkie: The Story of a Hack - Part 2. Breaking In – SynJunkie is continuing his class on how a penetration attack occurs.  So far it has been quite educational and nicely documented.

Shoulder Surfing a Malicious PDF Author « Didier Stevens – This was really cool.  Didier was able to obtain a malicious PDF file that actually retained the incremental changes the malware writer used to try to get the PDF bomb ticking.  He provides a great analysis and I wonder what applications this technique could play for forensic examiners as well who could find some good clues and data as well.  If nothing else it is good information to be familiar with.

--Claus

Saturday Diversions

Well, it’s Saturday.  It’s cool, bright, and lazy.

I usually have a pile of bookmarks I’ve noted and collected each week, but this week has been slower than most.  I have a few collections of subjects to get up, but so far I have been feeling pretty lazy.

Watched the Notre Dame – Navy game.  It was really exciting.  Went outside for a brief bit to pick up yard litter and stuff overturned from the strong winds over the last 24 hours.  I’d like to test my wireless connection out in the back-yard, but it is just too windy to be enjoyable out there.

I do have plans to make a pot of chili for the family.  Got a new recipe to try out. Seemed appropriate for the cold night forecast for tonight.  I haven’t done much baking for a while, but I might also make some peanut-butter/chocolate bars again as well.  Alvis and I tried about a month ago, but the big mistake was going with margarine rather than real butter.  The bottom layer came out mealy.  Ick.  Nothing beats butter.

Dell USB HID Keyboard and WinPE headaches 

I’m still banging my head against the wall with my VistaPE building sessions at work.

For a recap, see Rainy-Day Placeholder Linkage: It’s a PE 2.0/VistaPE thing…

To summarize, I have to create a WinPE 2.0 based live boot CD that has had PGP encryption drivers “injected” to allow access to whole disk encrypted systems.  My preferred platform for WinPE 2.0 is VistaPE.  I can successfully build a PGP/PE combo with a pure WAIK build but that just nets me a command-line box.  Not very “sexy”.

I can build a VistaPE/WAIK build that is sexy and has PGP, only the Root USB HID keyboard driver used by our Dell Optiplex systems won’t load.  I’ve installed an on-screen keyboard tool as a workaround, but it is clunky-sexy.

The D-Man attended a TechNet session last week here in Houston and brought me back some awesome goodies.  Biggest was a “real” Vista Ultimate setup DVD with a 1-year promo license.  I’m less interested in installing Vista with it, but it has become golden as it now allows me to build full “Vista” based VistaPE disks instead of relying on the Vista WAIK wim file.  Really sexy.

So now it gets really weird.  I successfully build a Vista base VistaPE WinPE 2.0 disk.  I also successfully injected the PGP drivers on it.  I copied the resulting WIM file to my bootable USB stick build and tested it on the Dell Optiplex.  Worked 100% perfectly.  Full VistaPE environment and keyboard worked perfectly.  So did the PGP drivers. Awesome.

But when I burned the same ISO file to CD, the PGP driver load causes a BSOD in the boot disk.  It works off USB but not off CD.  Strange.

So I continue to work through the driver loading issues.  I’m determined to get it to work.

Lego Building

Although tonight’s schedule at the Valca den is to eat chili and watch a classic movie or two with the girls, I might also try to divert my weakened brain cells by doing some more Lego building.

Mom got me a few Star Wars Lego sets for my birthday last month. I built a mini-kit in bed one night, but the two bigger sets remain in the box.

I noted this week that Lego loses EU trademark on bricks.  We grew up with Lego blocks in our home and had several large tubs filled with them.  I think Mom still does have them somewhere in her home.  Every now and then a wanna-be brick would make it in.  These were like weeds.  They looked pretty but we tossed them as soon as they were discovered.  Lego has always been tops in our book due to their quality.  Everything else just doesn’t satisfy.

For days when you don’t want to scatter the bricks, there is also the Digital Designer by Lego.  It’s a free download that lets you design and build virtual Lego models.  If you are so enamored by your choice, you can always purchase the custom build kit from Lego.  That’s pretty cool.

Flickr Voyeurism

I still haven’t had the fiscal courage to help our nation’s ailing economy by making a DSLR camera purchase.

I keep going around and around on the choices.  My photography friend at work (as well as my brother) both recommend the Canon EOS Digital Rebel XTI, or the SIGMA DP2, but now I am leaning towards something from the Olympus E-System Digital SLR mid-range line.

To keep fueling my jonesing, I have been spending time browsing through the loads of great photography work to be found on Flickr.  However, browsing and finding the best works is daunting.

To that end I have been using two specialized “Flickr aggregators” to help speed my image surfing.

Scout: Find your photographs in Flickr’s Explore – Created by BigHugeLabs, it allows for image collection loads from random artists who have made Flickr Explore.  It’s really nice and I’ve found a number of artists in particular I have bookmarked for future reference.

Flickr Leech – Created by Andrew Houser is simply amazing.  Load a collection for a particular day or search for images based on a keyword.  The interface is really pleasing and it is a joy to search for specific images.  Just how long Flickr Leech is allowed to continue is in some doubt.  See Thomas Hawk’s post “Flickr Censors Popular Flickr API Developer, Developer Threatens to Kill Flickr Application FlickrLeech This Week” to get the background.  I hope it survives.

--Claus

Update/Tip:  Figured out there were also some Flickr Groups that specialized in the particular DSLR cameras I am considering.  What a fantastic way to really see just what kind of imaging each camera is capable of delivering in the hands of an amateur or professional photographer!

• Flickr: Canon EOS Digital Rebel Groups
• Flickr: Olympus E-510 Group
• Flickr: Olympus E-520 Group
• Flickr: Sigma DP1 Group

All of them look pretty amazing!

Rainy-Day Placeholder Linkage: It’s a PE 2.0/VistaPE thing…

Rain is coming down pretty heavy here on the Texas Gulf Coast.

I had the day off in remembrance of Veteran’s Day.  I met my Dad last night in Houston and took him out for dinner at a local bar-b-que joint. My treat as he is a Vietnam vet and it seemed like as good an excuse as any for trying to convince him not to grab the check.

Tonight, in honor of the rain, I’m getting ready to put on a pot of homemade potato soup. At some point in the past Lavie was the family soup maker and we had some recipes we used. Now I’ve made this particular blend so often that I just make it from scratch using recipe-reckoning.  And I found some a loaf of fresh roasted-garlic artesian bread to serve on the side.  Yummers.

So anyway, I’ve been working on a technical side project at work and making some progress. Basically it has two elements…the first I seem to have overcome, the second has me stopped at the moment.

We are now getting ready to deploy whole-disk file-encryption to all our computer systems.  This is a great idea and a long time coming. It should greatly help secure our data in case any of our desktop/laptop systems walk off.

This does add a layer of complexity to our IT jobs, however, as each system will be encrypted at the boot level, using a “LiveCD” to boot and troubleshoot the system/files would be impossible.  Two primary workarounds do exist; first to use the vendor’s “LiveCD” to boot the system and enter the access-code to get on to the system, or use the vendor’s “LiveCD” to to decrypt the entire drive before working on it.  The first only provides a limited set of tools, the second could take hours (4+) to process.

I did discover a third option, and that is a method to inject the encryption drivers into a Win PE 1.0 or 2.0 boot disk.  By running a command to execute the encryption filter service along with the password, the entire disk’s files can be manipulated, user-data extracted immediately, or other “normal” off-line technical service to the system.  Perfect.

I use a customized VistaPE (Win PE 2.0) so after a bit of effort, I was able to successfully inject these specialized encryption system filter drivers into my PE disk. Worked like a charm. I was so happy.  (Will post about this later once I have everything worked out.)

However, turns out that I’m still having issues with these crazy Dell Optiplex 755 systems.  They are pure USB connectors now (no legacy PS2) and while the USB keyboard/mouse works just fine with a “pure” Win PE 2.0 WAIK built disk, the keyboard refuses to work under my VistaPE build.

To further complicate things, the Dell USB keyboard is an “enhanced” multi-media keyboard with additional USB ports on the back of it.  Now I’m not certain but I really think that is the real issue.  I suspect the VistaPE hardware detection is picking up the keyboard as a USB hub and not as a keyboard.  If that’s true, and I can find that driver, it might take care of the keyboard issue.

I do have a PS2 –> USB adapter.  I might also try using that to use a different “standard” keyboard and see if that is sensed by VistaPE better.

I’ve discovered that during the building process, not all of the drivers from the WAIK .wim file are installed in the VistaPE wim file, it is much smaller in size.  Also, from what I can tell, either the USB keyboard driver isn’t getting loaded in the VistaPE build OR there is a USB root hub controller driver that isn’t getting properly loaded.  To compound things, Win PE 2.0 is build on Vista so I’m having to look for Vista drivers for this thing…fortunately they seem to be in the Win PE 2.0 wim so I just need to identify the specific ones I need and either try to “inject” them into the VistaPE wim or load them during the VistaPE wim building process.  So, I know the drivers I need are present in the Win PE 2.0 boot.wim file, and (they?) are missing in the VistaPE wim file.  Sigh.

Miles (from TinyApps Blog) posted a tip over on another post that might have some bearing as well: PC Accessories Issues when USB Legacy Support is Disabled so I’m going to see if the Dell 755 BIOS has a setting for this.  If so, that might make things simpler. But I’m now determined to figure out how this works so I can master a new skill in the VistaPE building process.

I’ve signed up for the Boot-Land forums and am waiting to be approved by an administrator so I can post a few questions there as well.

In the meantime, I’m dumping all the links I’ve been bookmarking and referring to here for quick reference.

Most won’t probably mean anything to anyone but me, but if they help…bonus!

VistaPE — Downloads – VistaPE now at a v12 RC1 release.  I’m using v11 beta 3 and I’m not sure if the new version will help me or not.  Will be trying that as well.

HOW TO: inject drivers into Microsoft’s free OS, Windows PE 2.0 – APC Mag

How To Inject Drivers into Win PE 2.0 – Commodore.ca post

DriverView: List all device drivers currently loaded on your Windows – NirSoft utility

Windows Preinstallation Environment & BartPE Tools – PGP technical guide (PDF) and zip files. Note the PDF document seems to have quite a few typos and other technical errors in it. Took me a while to work through them all.  Will post those as well once I get my bigger fish caught and mounted.

Oscdimg Command-Line Options – Microsoft TechNet

Wpeutil Command-Line Options – Microsoft TechNet

PEImg Command-Line Options – Microsoft TechNet

Toss DOS, Install Vista with Free WinPE – ITsVISTA

cd c:\program files\Windows AIK\Tools\PETools\

oscdimg –n –m -bc:\winpe_x86\etfsboot.com c:\winpe_x86\ISO c:\winpe_x86\winpe_x86.iso

WinPe with Dell Optiplex 755 - MSFN Forums

v12RC1: RAID driver not loaded (even though included in SATA script) - Boot Land – Although I don’t have this specific issue, the discussion seemed to touch on related issues.

Adding Drivers for Unsupported Hardware – MudCrab’s VistaPE WinBuilder script looks like it could save me (and others) time in trying to “inject” drivers into the wim by installing them via the VistaPE building process.  Still not sure which drivers I want to be adding to get the stupid USB keyboard/hub working.

Driver Installer For VistaPE - Boot Land. Another thread on drivers and VistaPE.

[App Scripts Guide] Creating a new app script - Boot Land. I’m feeling like I need to take my knowledgebase for VistaPE up to a new level by understanding the foundations of how it works and script-building.  This guide by Nuno Brito looks to be excellent.

VistaPE - Boot Land. Primary forum for VistaPE issues and discussions.

PC Accessories - Issues when USB Legacy Support is Disabled – Intel tip from Miles with USB support and BIOS settings.

Wish me focus, patience and a measure of luck.

Oh yeah, I still have my “normal” work duties to stay focused on while I work this one out.  Very hard to do once I get focused on trying to resolve a technical issue that is just outside my fingertips!

Now…on to that soup!

--Claus V.

Portable Anti-Virus/Malware Security Tools: A Primer

The Mounties are Here!

At least in the circles that I keep there are several common approaches to dealing with a possible virus/malware infection on a system

1. Use a system-installable anti-virus/anti-malware scanner (hereto referred to as an AVAM).  Common programs such as Norton’s, McAfee, Panda, AVG, Avast, Trend, etc. Once installed, run and (hopefully) remove. However, sometimes they can have trouble removing malicious files from a “live” system.
2. Manually remove the virus using a host of utilities such as ProcessExplorer, Autoruns, a registry editor, and probably a host of other tools.  Usually effective, but for advanced users only and often no guarantee that you got all the “bits” off your system.
3. Use a specialized scanner or removal tool specifically crafted just for that particular infection.  This can be fast and flexible, but you have to be sure that the tool you are using specifically address the variant you are dealing with…and often pre-supposes you even know if and what you are infected with.
4. Try Online Scan Tools and run the AVAM scanner from a web-based source. Or…
5. Just recover your key data, wipe the system and start fresh and clean.

At least one more technique exists as well that may not be quite as popular; a USB-based AVAM scanning solution.

The benefit with this technique is that you can try to run the scan in Windows Safe Mode (see comment section for clarification) which might increase your effectiveness in removal. Also, if the infection has impacted your ability to access the network/Internet, you don’t have to worry about dealing with getting the needed files downloaded.  You can set many USB devices to “read-only” so you don’t need to worry about cross-contamination to your media.  Finally, you can quickly maintain and deploy multiple AVAM solutions at a problem PC and have a potentially larger success rate.

There are quite a few “portable” AVAM tools out there, and I am not attempting to list them all here.  These particular offerings are from large and well-trusted vendors and also are “free” (assuming you meet their particular licensing and use requirements).  If you know of any others feel free to leave a comment and why you think it is worthy to be considered as well.

If nothing else, I recommend familiarizing yourself with these and maybe keep them stowed away on a USB stick.  Some you will want to periodically update; either by downloading the primary file again or the DAT file signatures and processing them.

Release the hounds!

Trend Micro’s SysClean

Miles over at TinyApps frequently comes up with some great tools on his blog.  A recent offering was Trend Micro’s SysClean.

SysClean is a great and flexible stand-alone AVAM scanner which can be deployed directly to a suspect system off USB or direct-downloads.

The only real “gotcha” is that is isn’t at all intuitive on how to get all the files together to make the thing work.

So here you go.

1. On your system or on a USB drive, make a folder and name it SysClean.
2. Download the following Sysclean Package from Trend Micro and place it in there.
3. Download the latest Virus DAT file named lptxxx.zip from this page.  Note the numbers in the name will change as new DAT files (or Official Pattern Release-OPR as Trend calls them) come out.
4. Extract the contents of the ZIP file into your SysClean folder.
5. Download the latest anti-spyware patterns from this page.  You are looking a bit mid-way on that page for the “Detection and Cleanup (Trend Micro Anti-Spyware) – Ssapiptn.Da5” section with the file named ssapiptnxxx.zip where xxx will change with the pattern file number version. 
6. Extract the contents of the ZIP file into your SysClean folder.
7. Open the SysClean folder and double-click the "Sysclean.com” file.  It will auto-extract itself and present you with the GUI interface.
8. Select your options (click “advanced” button for some more) and click “Scan” to go!

It’s an elegant and easy to use solution.

Copy your SysClean folder onto your USB stick and you are good to go traveling!  Just don’t forget to keep those OPR and sig files updated frequently.

Downloads are fast and updated very frequently by Trend.

For more information check out these posts:

• Chris Quirke’s Blog: SysClean on Bart PE
• SysClean Read Me file
• TinyApps.Org Blog : Automatically click OK (or any button) with ClickOff – for when you run into a very infected system…saves some aggravations with “OK” clicking on removal.  Good TinyApps tip.

Panda Command-Line Scanner GUI

Panda is one of those security companies that is often liked but not well known outside of the geekier security types.  That’s too bad.

Their product line includes a command-line AVAM tool that is beyond the reach of mere-mortals.  However, Pedro Bustamante wrote and maintains a GUI interface for the CLI module that is pretty slick and useful.

Command line scanner GUI frontend - Panda Research Blog

Deployment walkthrough

1. Download the PAVCL GUI installer from that page and run the executable.  To make things simple, tell it to make the folder on your desktop.
2. It will unpack necessary files into it from the installer package.
3. Download the signature file (pav.sig) from the GUI’s blog page and unzip the file into the Panda folder created in step one (pavclg). Rename the folder to something more meaningful if you want.
4. Open the folder and find the “Pavcl Gui.exe” file and double-click.
5. The GUI interface appears and away you go!
6. Advanced options are available from the configuration window.

The only drawbacks I know of are that the signature file may not be updated quite as frequently by the developer as some of the other solutions and that the download speed of the signature file can take a while to bring down…even on a  speedy connection.

That said, if you do your work ahead of time and copy your Panda folder over to USB, you are good to go on demand.  Just check for signature updates periodically before you actually need them.

Like SysClean, it is a great tool who’s simple interface belies it hidden power.

Kaspersky Virus Removal Tool

This is a slightly odd-ducky in the pond.

Kaspersky frequents the top of the AVAM food-chain and is one of the most effective security products of its class.  This free stand-alone scanner isn’t well known, but with a little bit of familiarity, it will become a big-gun in your portable arsenal of weapons.

Deployment walkthrough

1. Download the tool from Major Geeks or do a direct-download from Kaspersky Labs here.
2. Save the file to USB.
3. When needed copy the executable you downloaded to the target system’s desktop and run.
4. It will auto-unpack using a simple wizard and execute.
5. Hit the “Scan” button and away you go.
6. For more options you can click the underlined “Settings” link that is under the location list.

Potential Gotcha’s

First, be aware that this method “installs” the program on your system and enables a real-time “Self-Defense” process to prevent malicious removal of the program.  That’s fine but makes simply closing out of the application and “uninstalling” it difficult and unintuitive.

Luckily Miles has figured it out for us already. To uninstall first go back to “settings” link mentioned and click it.  Uncheck the “self-defense” box. Select OK and close the program window.  Then you can confirm the uninstallation of the program prompt you will see or…

Now copy this folder to your USB stick and use without having to go through all that stuff again.  Especially if you want to use it in Safe Mode on a system…as Windows Safe Mode does not always play nice with installation and removal of programs due to the Windows Installer service not running. (Link for Taking Command of Safe Mode via registry hack or with SafeMSI.exe tool.)

Secondly, Kaspersky aggressively updates this program/file/signature package.  That’s not a problem, but you won’t have the latest signatures unless you download the file again just before you need to deploy it…so keep that in mind as well.

Other than that it is a great tool from an awesome AVAM vendor.

McAfee command-line virus scanner with GUI wrapper

I really like this BartPE tool, but it can be a real pain to get set up if you don’t use or build BartPE disks.

Like Panda, McAfee also offers a command-line AVAM scanner. But it is very powerful and most users will not like using the CLI arguments.  Bart does have a great GUI wrapper for it, similar to the Panda GUI wrapper that really eases things up.

Deployment walkthrough

1. Hop over to Bart’s PE and download his PE builder package.
2. Unpack it.
3. Browse into the unpacked folder to find the \plugin\mcafee folder. Copy this folder and its contents to your USB stick or other handy location.
4. Now go to Index of ftp://ftp.nai.com/pub/antivirus/superdat/intel/ page and download the SDATxxxx.exe file. Note; the xxxx number will change.
5. Copy that SDAT file into your mcafee folder.
6. Now you must unpack it using the "/e" parameter. Open a command-line window session and browse over and into the mcafee folder.
7. Run the command sdatxxxx.exe /e (where xxxx is the version number, for example sdat4290.exe). When unpacking you don't see anything happen for about 20-30 seconds, just wait for it to be all done.
8. Delete the sdatxxxx.exe file to save space.
9. Copy and paste this whole directory to your USB drive.
10. When needed run the scangui.exe file in the mcafee folder to begin.

The GUI has a ton of configuration options and is a breeze to use.

Headaches

The biggest complaints I have is that you must have a valid McAfee license to use this software. It isn’t “free” even though it is freely available.  Also, the download of the SDAT file can take a long time to complete, even with awesome bandwidth.  Finally you need to be very patient when allowing the command-line unpacking to run.  It isn’t always fast.

You need to specify a valid location to write the log file before starting.  The default location often gives errors when generating.

Sometimes I’ve run into issues with executing it correctly from NTFS formatted drives.  It doesn’t seem to balk running from FAT32 formatted partitions so I think there might be a security permissions thing going on here.

All that said, this is a great tool from another trusted AV company.  Keep it handy and frequently updated on your USB drive if you qualify for usage.

a-squared Emergency USB Stick

I’ve come to figure out that there are two camps with EMSI; you either love ‘em or you don’t.  I personally like their AVAM products.

Recently (?) they expanded their product line to include a USB stick “bundle” that includes both a portable version of their freeware a-squared Free and a-squared Commandline Scanner. (Actually I suspect the first is the GUI that powers off the second. But you can run either one depending on your needs.)

Deployment walkthrough

1. Download the a-squared Emergency USB Stick files from the link mid-way down the page.
2. Unpack the files to a location on your USB stick or system.
3. Open the folder and run the a2free.exe file and away you go!
4. If you copy the unpacked folder to your USB stick it will be ready to go on-demand…just be sure to run an updated signature file check before using.

Pretty simple and not a lot to complain about.

Clam-Win Portable

Clam-Win is an open-source AVAM program that is growing daily.  While in many ways it is still a bit limited in functionality to full-bore AVAM scanning programs, it does provide some pretty good signature files in a fairly intuitive interface.  And it’s free.

This one’s simple.

Deployment walkthrough

1. Download the ClamWin Portable package from PortableApps.com
2. Run the installer and point it at the location you wish to save it at. Note that it doesn’t really Install the program but unpacks everything you need to the target location.
3. Browse to that location and open the folder.
4. Run the ClamWinPortable.exe file.
5. You will be prompted to download the signature file database (or check for updates).
6. Select your preferences and scan away!

No real issues with this one.  Pretty simple and lots of folks love and trust this little mollusk.

Keep it handy and updated on your USB drive and check for program updates often as it is frequently being fine-tuned overall.

Malwarebytes Rogue Remover Free

Malwarebytes Rogue Remover Free is free for personal use.  It is a particularly brutal tool to use against rogue AMAV products that trick the user into thinking they are getting a needed security product but actually contain adware, spyware, trojans and other icky things.

I highly recommend this program and keep it handy on a USB stick when visiting family and friend’s systems.

Deployment walkthrough

1. Download the Malwarebytes Rogue Remover Free application to your local system.
2. Run the installer.
3. Browse into your system’s “Program Files” folder and look for the Rogue Remover Free folder itself.
4. Copy this one to your system in another location, or even better, copy it to your USB stick.
5. Go back and uninstall the program from your system (if desired).
6. Go to your copied folder and drop into it.
7. Find the RogueRemover.exe file and run to execute.
8. It will make a request for an update-check (program and signatures) go ahead and let it do it’s thing.
9. When done, scan-away!

It’s tough, it’s trusted, and it’s fast.

What more do you want?

IKARUS T3 CLI Scanner

T3 Command Line Scanner 1001026 - (freeware) -  Use this utility to perform a virus scan from command line – Softpedia.  Made by German IKARUS Security Software.  I haven’t spent much time with this particular Command-line scanner, but it could be good. Or not.  Just tossing it out there. 

I linked above to the Softpedia location as it has the command-line arguments in English.  If you want it directly from the source to ensure you get the most recent version, do this:

Deployment walkthrough

1. Download the t3scan zip package from this IKARUS update location.
2. Run the file and name a location and folder you want to unpack it in. I like using the folder-name “T3 CLI” myself.
3. Download the t3sigs.vdb signature files from that same update location above in step 1.
4. Copy the file into the folder from step 2 where you unpacked the CLI engine files.
5. Now, open up that folder and rename the original file “t3scan.lng” to something like “t3scan.lng.old”
6. Now find the file “t3sacn.en.lng” and rename it to “t3scan.lng” so that the help command will output in English and not in German (unless you happen to speak German, then skip steps 5 and 6!)

You are ready to go!

Open a command-line window and browse to the folder location.

To do a full scan of the primary drive use this command >t3scan.exe c:\*.*

If you want more finesse, then run the command >t3scan.exe –?

Copy your folder to your USB stick and check back for updates frequently. Download them (t3sigs.vdb) back into that folder.

Multi Virus Cleaner 2008

This is one of those free AVAM tools I keep around…just in case.

It hasn’t been updated since April 2008, but then again, you never know if it might be helpful.

Multi Virus Cleaner (MVC) : detects and removes major viruses

Deployment walkthrough

1. Download the Multi Virus Cleaner (MVC) application to your local system.
2. Run the installer.
3. Browse into your system’s “Program Files” folder and look for the \AxBx\Multi Virus Cleaner 2008 folder itself.
4. Copy this one to your system in another location, or even better, copy it to your USB stick.
5. Go back and uninstall the program from your system (if desired).
6. Go to your copied folder and drop into it.
7. Find the MVC.exe file and run to execute.
8. There isn’t really any point of checking for updates.
9. Pick your scan type preference and scan away!

VIPRE PC Rescue - (freeware) - Sunbelt Software is now offering a “standalone” anti-malware scanning/removal tool.  The self-extracting executable is updated daily with the latest signatures. Scans include rootkit detection.  “Four command line options are available, enabling the program to perform a boot scan during the next start-up, perform a deep scan, log the events, and disabling the rootkit.”  I really like the fact that not only can you download and execute it from the net, but you can keep it packed/unpacked on a USB stick and run from there.  I’ve been using the full VIPRE product from Sunbelt Software for a while now and am very impressed with it.  A full GSD review on both should be coming soon.  Sunbelt reports that they will be providing a guide on how to use VIPRE PC Rescue with a bootCD for non-bootable system use. Sounds like a great add-on for VistaPE or other WinPE based boot disks. Spotted via the Sunbelt Blog. (update – this item added to post on 2/14/09.)

Micro-Scanners

These are specialty AVAM scanners that only target specific threats.  However they are single-file executables that are perfectly portable!

They aren’t as inclusive as some of the others, but they are tiny and fast and do the job.  Updated periodically (but not necessarily frequently) based on major threats as seen by their makers.

I always keep them handy.

Avira Antivirus Solution - Download AntiVir Removal Tool – Just download the removal tool and save to your USB stick.  Execute to run.  That’s it!

Stinger - McAfee Threat Center – Fantastic stand-alone portable AVAM tool.  Download the file and run.

avast! Virus Cleaner - free virus removal tool – Download  link is at the bottom of the page. Download it and run.

Microsoft Windows Malicious Software Removal Tool – Yes.  I’m listing the MSRT tool that is common on XP and Vista systems.  Often overlooked and discredited, it can do a job if needed against specific high-profile threats.  Find the MRT.exe file on your Windows system in the \Windows\System32 folder and copy it to your USB stick in case the local file isn’t up to date and a download isn’t possible from a compromised system. Just run the file to begin.

• Malicious Software Removal Tool – Info page and link to on-line scanning version as well.
• Download details: Windows Malicious Software Removal Tool – KB890830 download link. Always the most recent available.
• PC Hell: How to Manually Run the Microsoft Malicious Software Removal Tool – How to run it locally.

Whew!

Hope that’s enough to pad-out your USB stick and keep you busy scanning for a while!

For other related tools (portable and non-portable) look at these Grand Stream Dreams posts: Anti-Malware Tools, Anti-Virus Tools, Online Scan Tools, and Anti-Rootkit Tools.

Please let me know of any other similar AVAM programs that work well off USB that you trust and recommend.

Cheers!

--Claus V.

Windows 7 News Roundup – Moving Forward

Just when I though I captured all there was to know about Windows 7 in my Windows 7 News Roundup – The Very Best and Windows 7 Watch – Micro Edition posts, looks like someone forgot to shut the tap off fully.

A little nagging drip of Windows 7 news continues to fill the sink.

Maybe it’s just a leaky washer…

• Windows 7: Beta 1 tracking for mid-December – Mary-Jo Foley’s All about Microsoft – Looks like some form of a more-open “official” Windows 7 beta release version will be offered by Microsoft before the Christmas holidays.  I hope so.  I know I could grab a version off a torrent right now but I’m going to try to wait until this one gets released before putting it into a VPC session on the Valca system.  See also: Windows 7 Beta 1 Available December 2008 - Mid-December to be more exact – Softpedia and Windows 7 Beta 1 available for download on December 2008 - KezNews.com for a tiny bit more info.

• Windows 7 security: An overall improvement? - Defense in Depth – Robert Vamosi brings up some very quiet but dramatic changes with Windows 7 security: First the Windows Security Center gets replaced by the Windows Action Center, secondly System Restore will include a list of programs removed/added so users can better select a particular Restore Point to use, and finally, there’s a major introduction to the Microsoft firewall in W7 called “Windows Filtering Platform (WFP).  For some reason this one doesn’t quite sound like a "Good Thing”. From that link:

  Windows 7, which Microsoft unveiled at its PDC 2008 event this week, also introduces something called the Windows Filtering Platform (WFP). The idea is that third parties can take advantage of aspects of the Microsoft Windows Firewall in their own products. Microsoft says "third-party products also can selectively turn parts of the Windows Firewall on or off, enabling you to choose which software firewall you want to use and have it coexist with Windows Firewall."

• Sandbox users with Windows 7 PC Safeguard – istartedsomething – Now this IS a very cool feature.  Similar (but not identical) to Windows SteadyState for XP and Vista users, this will allow standard-level users to not make any chances to the Windows system. All changes to the system and files are removed at log-off.  According to Download Squad, there is a way for an Administrator user to save the changes and make them permanent if desired: Windows 7’s PC Safeguard sandboxes user accounts - Download Squad

• Windows 7 to revolutionize PC troubleshooting – istartedsomething – I for one always like built-in diagnostic tools, if they are effective, powerful and make sense to use.  What Long points out here is that this system is built upon the PowerShell 2.0 scripting system.  Neat!

• Ask the Performance Team : Windows 7 is coming! – Miscellaneous collection of links.

• Windows 7’s Superbar in action - is it made for multitouch? - Download Squad

• That "unlocked" Windows 7 taskbar is also unfinished - Ed Bott’s Microsoft Report – I think this was made pretty clear to everyone who started messing around with this “hack”.  But just to be clear, it doesn’t result fully in the same taskbar feature set shown off by the Microsoft PDC gang…although it is closer than the unlocked version.

• Windows 7 to let users create a Desktop Slideshow from files, feeds - Within Windows

• Why I’m Skipping Windows Vista: IT Speaks Out - CIO.com – Some more thoughts on why corporate IT decision makers don’t want to migrate from XP to Vista. Make sense to me. Especially coming on the heels of W7 announcements.

• Opinion: 10 Best Features in Windows 7 for IT Pros - CIO.com – Rundown of key features of W7 that might finally temp corporate IT decision makers to migrate from XP to W7.  Maybe.

• Windows 7 for the Enterprise: The Optimized Desktop – Microsoft – Generic “Windows 7” landing page, but it’s a start.

--Claus

In Security News – Weekend Edition

Wi-Fi Headache – get out the Goody’s powder

Just off the heels of getting our wireless network up and going (still got to add the MAC address filtering…) comes word of a partial-crack.

• Once Thought Safe, WPA Wi-Fi Encryption Is Cracked - PC World – Basic summary of the issue at hand. We are talking about WPA here, not WPA2 and involves breaking the Temporal Key Integrity Protocol (TKIP).
• WPA/TKIP ChopChop Attack - RaDaJo (RAul, DAvid and JOrge) Security Blog – Pre-official presentation technical details on just how the attack is designed.  Offers some security thoughts and mitigation methods.
• Battered, but not broken: understanding the WPA crack – Ars Technica – Good and readable primer that the previous link built from. Good reading and information for any geek-minded or wireless network supporting sysadmin to know about.
• Wi-Fi: How to Protect Your Wi-Fi Network from the WPA Hack – Lifehacker.  Current solution (if your Wi-Fi router supports it) is to switch over to using WPA2 and the Advanced Encryption System (AES) only and drop the TKIP mode.  When I set our router up, that’s what I used, even before this partial-crack had been announced.
• WPA Wi-fi Cracked (but it's not as bad as you think... yet) – ISC-SANS Handler’s Diary – A few more thoughts on migration and they point out the fact that Xbox360 does not support WPA2 currently.  Wonder what other similar devices don’t support WPA2…
• WPA Cracked - additional details – ISC-SANS Handler’s Diary – A bit more info and pointed me to the RaDaJo post linked.
• Download Squad PSA: WPA encryption successfully cracked- Download Squad – points out (like some other articles) that the attack method has made its way into the freely-available Aircrack-ng wireless cracking tool.

Security Miscellanea

Here are some other security-related items I stumbled upon this week.

• RaDaJo (RAul, DAvid and JOrge) Security Blog – What they have is pretty good with tips, book reviews, and leads to tools.  Detailed enough to be interesting and helpful but not so much to put you to sleep.  Added to my security RSS feed list. For example:
• Security Book Review: "LAN Switch Security: What Hackers Know about your Switches”
• Investigating File Deletion from Windows File Servers – Part III – See also Part I and Part II.
• Challenge: Cracking the Password and Challenge Solution: Cracking the Password
• "A Picture From Your IP Address Has Been Uploaded To This Site..." - SpywareGuide Greynets Blog – Christopher “PaperGhost” Boyd looks at a (harmless?) website that could be a good example of how not to respond to phishing-type email notices.
• SynJunkie: The Story of a Hack – Introduction – SynJunkie begins a series on how a hack-attack occurs.
• SynJunkie: The Story of a Hack - Part 1. Reconaisance – Part I is the build-up of a fictional hack-attack.  First things first, identify the target, and learn all you can about it.

--Claus

Eye on Obama…Hello POTUS-elect!

Gotta confess…regardless of personal political affiliation or leaning (or apathy), POTUS-elect Obama does have a very youthfully attractive Presidential style.

I voted on Tuesday, Lavie did not (very sick that day and didn’t early vote as planned), and Alvis will be voting in the next presidential election for the first time. Wow.  We already had a bit deeper political discussions between ourselves which is an interesting thing.

Here’s hoping that the next coming years will bring positive change and renewal inside our borders and reconciliation with our allies outside of them.

A few related links:

The next President of the United States – Boston Globe’s “Big Picture” feature with 35 stunning journalistic photos that bring to mind the aura of the Kennedy years…despite not having been born yet in that period.

Viewing a LOT of Images Effectively (plus 700 Obama Newspaper Covers in Silverlight Deep Zoom ) – Scott Hanselman’s ComputerZen.  Scott shows us what Silverlight Deep Zoom can do with web-images of the Obama onslaught.  If you have Silverlight and want to skip the technicals just hop over here: Silverlight DeepZoom Obama News.  If you don’t have or want Silverlight, check out this link instead: 730 Newspaper images from 66 countries at the Newseum by Scott Stanfield (although it isn’t nearly as “sexy”).

5 Signs President-Elect Obama Is a Geek – Wired Blog.  I wonder if he is an XBox360 guy or a Wii Dad….and does he prefer Vista or XP or a Mac?

BTW…I gotta be willing to stand behind any President who seems to have the same pair of eyeglasses as I wear.  I’m not 100% sure but I’m guessing those are Ray-Bans and the MIB style looks particularly close to the ones I wear.

--Claus

Post-Mortem – Valca Goes Wireless…

Just a few minor updates from my post Valca Goes Wireless…Headaches included free.

Thoughts on the SSID name

When I set up our new wireless router one of the things I needed to do was to provide a name for the SSID field on the settings.

Being a good sysadmin, and following what we do at work, I assigned it a custom name that was helpfully descriptive.  Made sense.

Because I had also turned off the SSID (Service Set Identifier) broadcasting option on the router, I didn’t feel too strongly that it was an issue.  As it stands, this action is just one component in the larger wireless security configuration lockdown.

FYI from this geeksaresexy post

The SSID (Service Set Identifier) is a sequence of up to 32 letters or numbers that represent the ID of your wireless network. the SSID is broadcasted from your AP to all wireless devices within range to let them know that he's available and ready to receive connections. If you shut off SSID broadcasting, the clients will have to know about the ID of the network if they want to be able to connect to it.

Anyway, I already knew that even if broadcasting was turned off, it could still be sniffed with the right tools.  Just something you have to accept with wireless.

So a few nights ago I was playing with NirSoft’s new tool WirelessNetConsole. It worked great.

However it’s certainly one thing to know something and another to see it for yourself.

------------------------------------------------------------
SSID                          :  [name here]
Signal Quality                :  82%
Security Enabled              :  Yes
Connectable                   :  Yes
Authentication                :  RSNA-PSK
Cipher                        :  CCMP
PHY Types                     :
MAC Address                   :  xx-xx-xx-xx-xx-xx
RSSI                          :  -55
Channel Frequency (GHz)       :  2.437
Channel Number                :  6
Company Name                  :
------------------------------------------------------------

After looking at what I originally had in the [name here] field for the SSID I decided that it still might have been a tad-too descriptive for security purposes.  I also was able to see quite a few others around me as well.  Enlightening information.  Like I said, it’s a great little tool.

So I went back into my router settings and changed the SSID to be very generic instead.  Then after saving the update to the router config, I had to go back and create new wireless connection items on the laptops since the SSID was different.  No problems.

I know that someone with a signal detection antenna could probably then track down my wireless information to our house, but for the average war-driver (or neighbor) it now appears just like any other wireless point in a crowded neighborhood field. Before I did this change a bit a Google work might have been able to make a more specific match.

Anybody have any thoughts about SSID naming conventions for home and corporate applications?

I certainly spent some additional time thinking about it and think the smart approach is security through obscurity applies here.

SharePort BSOD Resolved

The other (larger) outstanding issue I had was that when I installed the D-Link DIR-655 SharePort software all my systems would immediately go into a BSOD and crash hard.

System Restore points would get them going again, but it was still kinda stressful.  Also, that SharePort feature was a important reason I went with the router in the first place.  I wanted to be able to shuffle files (primarily syncing my portable utility collection around as well as my Firefox OMPL RSS feed file and my bookmarks files) between systems.

At the time of my previous post, I had ruled out AVG 8 being the issue as I first suspected.  I then had turned my attention to NetLimiter Monitor and was able to replicate the bad behavior in a Virtual PC session.

So today I finally took the leap and live-fire tested it.

I had previously uninstalled NetLimiter Monitor from my systems but double checked just to be sure.  Then I set a fresh manual System Restore Point.

Finally I reinstalled the SharePort v1 software.

It went on with no issues at all.  Hurray!

I was quickly connected and transferring files back and forth.

Neat!

Still no response from the email I had sent to NetLimiter support team.

Worked just fine on the XP Home (SP3) systems as well as the Vista Home Premium (SP1) system.  No BSOD, no crashes, just pure file storage mounting bliss.

(Note: It appears that only one system can “mount/connect” that shared device point at a time.)

So if any one else tries to install D-Link’s SharePort software on their Windows system and gets a hard-crash during the installation process, take a look after you have recovered and see if you have NetLimiter Monitor installed on your system. If so and you want to use SharePort, looks like you will need to uninstall it first.

Cheers!

--Claus V.

Windows 7 Watch – Micro Edition

These articles today on W7 were just too important and good to pass up a fast post tonight.

Videos, Videos, Videos!

Engineering Windows 7 : Back from the PDC…next up, WinHEC – in of itself a fairly standard “whew we made it' post.  However it provided awesome linkage to most all the major presentations in streaming video.

So if you didn’t get to make it to the conference and want a bit more information than the web-post digests you have been reading, these are the places to go:

• KYN02 Day Two #1 - Ray Ozzie, Steven Sinofsky, Scott Guthrie and David Treadwell (Windows 7 starts +17:00 minutes)
• PC01 Windows 7: Web Services in Native Code
• PC02 Windows 7: Extending Battery Life with Energy Efficient Applications
• PC03 Windows 7: Developing Multi-touch Applications
• PC04 Windows 7: Writing Your Application to Shine on Modern Graphics Hardware
• PC13 Windows 7: Building Great Audio Communications Applications
• PC14 Windows 7 Scenic Ribbon: The next generation user experience for presenting commands in Win32 applications.
• PC15 Windows 7: Benefiting from Documents and Printing Convergence
• PC16 Windows 7: Empower users to find, visualize and organize their data with Libraries and the Explorer
• PC18 Windows 7: Introducing Direct2D and DirectWrite
• PC19 Windows 7: Designing Efficient Background Processes
• PC22 Windows 7: Design Principles for Windows 7
• PC23 Windows 7: Integrate with the Windows 7 Desktop
• PC24 Windows 7: Welcome to the Windows 7 Desktop
• PC25 Windows 7: The Sensor and Location Platform: Building Context-Aware Applications
• PC42 Windows 7: Deploying Your Application with Windows Installer (MSI) and ClickOnce
• PC43 Deep Dive: What's New with user32 and comctl32 in Win32
• PC44 Windows 7: Programming Sync Providers That Work Great with Windows
• PC50 Windows 7: Using Instrumentation and Diagnostics to Develop High Quality Software
• PC51 Windows 7: Best Practices for Developing for Windows Standard User
• PC52 Windows 7: Writing World-Ready Applications
• ES20 Developing Applications for More Than 64 Logical Processors in Windows Server 2008 R2

If I only had a W7 loaded USB Drive…

Of course, had you and I actually been invited to attend the PDC, we would have walked away with an awesome USB hard-drive loaded with a pre-beta version of Windows 7 to play around with and test and then blog a whole lot of warm-fuzzies about W7 with.

Had I received one, this post from Long Zheng would have been very helpful indeed:

Tip: make your PDC 2008 USB hard drive a bootable Windows 7 install disk – istartedsomething

Long provides a great and clever how-to. Worth looking at even if you don’t have one of those disks.

Putting Lipstick back on a pre-beta W7….

But keeping with our fantasy…not only did we attend the PDC, and got our W7 loaded drive, and made it a bootable install platform, we loaded it up on a test-bed as quickly as we could get home.

Unfortunately, we soon discovered that it didn’t “quite” look like the W7 version that was presented officially.  Many of the neat parts and eye-candy seemed to be missing from our version.

Luckily, l33t reverse-engineering guru Rafael Rivera Jr. got curious and poked that version of W7 with a stick for a while and ended up making a breakthrough:

Flashy Windows 7 bits protected by elaborate scheme, workaround - Within Windows

Read his how-to, download a file, patch the W7 system and you almost get the same eye-candy in your W7 release version that the Microsoft presenters had.  Great work and Rafael’s blog has earned placement into my RSS feed list.

One last finding

Turns out that W7 now has native ISO file burning support.  ‘Bout time.

That took long enough: Windows 7 can burn ISO files - Download Squad

Yes I above many others know that there are ton of free and tiny and fast ISO burners for Windows. You can still use them, but I think the decision to include this feature “out of the box'” in W7 is a good move.  Certainly will make things easier on a lot of noobies who are told to download and burn an ISO file for some recovery reason, but end up copying the ISO file to a data disk burn and can’t figure out why it didn’t work. (Burn the image file to a disk, not the ISO file to a disk. Sheesh. How hard is that to understand?)

Like I said, good move.

--Claus

NirSoft births five new utilities

Break out the cigars ladies and gents!

The prolific Nir Sofer has released five new utilities to the world.

Just spotted these over at the NirBlog.

I found the first two will be particularly useful in my sysadmin work.

UserProfilesView - (freeware) - “UserProfilesView displays the list of all user profiles that you currently have in your system. For each user profile, the following information is displayed: Domain\User Name, Profile Path, Last Load Time, Registry File Size, User SID, and more. You can save the profiles list into text/xml/html/csv file.”  When I tried it on my work system I even discovered some legacy registry bits for profile information that were later removed in the image-making process for the original system.  Pretty cool and very easy to use.  This is a real winner.

WirelessNetConsole - (freeware) - “WirelessNetConsole is a small console application that dumps all current detected wireless networks information into the standard output. For each wireless network, the following information is displayed: SSID, Signal Quality in %, PHY types, RSSI, MAC Address, Channel Frequency, and more.” Very easy to use and provides quick information dumps.  Will be a great tool to do spot audits for wireless compliance in our offices.

IPInfoOffline - (freeware) - “IPInfoOffline Allows you to view information about IP addresses, without connecting any external server. It uses a compressed IP addresses database that is stored inside the exe file. For each IP address, the following information is displayed: IP block range, Organization (RIPE, ARIN, APNIC, LACNIC or AFRINIC), Assigned Date, Country Name, and Country Code. After retrieving the information about the desired IP addresses, You can copy the information to the clipboard, or save it into text/html/xml/csv file.”  Want to do some basic IP research immediately and don’t have a network connection handy.  Good place to start.

DNSDataView - (freeware) - “This utility is a GUI alternative to the NSLookup tool that comes with Windows operating system. It allows you to easily retrieve the DNS records (MX, NS, A, SOA) of the specified domains. You can use the default DNS server of your Internet connection, or use any other DNS server that you specify. After retrieving the DNS records for the desired domains, you can save them into text/xml/html/csv file.”

SkypeLogView - (freeware) - “SkypeLogView reads the log files created by Skype application, and displays the details of incoming/outgoing calls, chat messages, and file transfers made by the specified Skype account. You can select one or more items from the logs list, and then copy them to the clipboard, or export them into text/html/csv/xml file.”

Thanks very much Nir!

Go get’em!

--Claus V.

Fall-Back Linkfest

So most all of our clocks have been updated with the time-change.  I think the ones in our cars still need to be updated.  I never can remember if the cellular phones we have auto-update the time or not.  I’ll worry about them in the morning.

Last night we had a belated birthday party for little-bro.  Ate a mess of NY strip steaks, made some special Valca fresh green-beans, taters…all the usual.

Then we cut up and watched a humiliating loss of UT Texas to Texas Tech. It was a real heartbreaker.

In the end the real highpoint was when I bumped our dining-room table and six cans of A&W root beer rolled off the table onto the floor.  It’s a “bistro” style table so the table-top is about three-feet high.  I wasn’t looking as they rolled off, but heard them hitting. And they all exploded.

Root-beer was shooting out of tiny breaks in the can all over the place!

Root beer on the walls, all the chairs and table, the floor was coated in root beer.  The sideboard. Yep.

Took almost an hour for the first-round of cleanup last night.

This morning I dug out a bucket, filled it with hot water and soap and did a full Cinderella-style old-school cleaning of the room and all known surfaces.

I like root-beer and so does Alvis, but Lavie hates the smell.

Needless to say she wasn’t impressed.

Here’s your link roundup for the week.  These should be safe for all ages, unlike those A&W cans.

Vista Bits

Guide to Freeing up Disk Space under Windows Vista - Scott Hanselman’s Computer Zen – Most Excellent guide to lots of uncommon steps to reclaim your hard-disk space under Vista. Even if you don’t do all these steps, all good Vista buckaroos should be familiar with them.

Windows Vista Service Pack 2 Beta - Windows Vista Team Blog – Brief roundup of what Vista SP2 may deliver.

How to Update Windows Vista SP1 to SP2 - Windows Vista Help Forum. Hack on how to get a pre-release, non-beta version of SP2.  I wouldn’t dare consider this, but I do find these exercises informative and fascinating. You’ve been warned.

Browser News

Chrome beta update lands with security and performance tweaks – Ars Technica. Chrome is not quite the Web darling it was for the two weeks in the spotlight it enjoyed.  Nevertheless, they are working hard at tweaking it better.

Beta and Plugin Improvements in Google Chrome - Chromium Blog – More information from the Chrome development team.

The dark (theme) side of Firefox and The dark side of Firefox, unabridged - Mozilla Links. Two excellent posts that compare a number of polished “dark” themes for Firefox.  I liked both the Abstract Zune and the Gradient iCool in particular.

Minefield is Firefox - Mozilla Links. I’ve covered this distinction before as well. Only my mistake was not adding the cool illustrative graphic.  No point in being confused now I suppose.

Polishing Firefox, Week n (Special Edition) - Alex Faaborg’s blog – Wonderfully well done post that illustrates the amount of time and effort the Mozilla team is putting into the details. Sure it is just tiny GUI elements, but the detail work and attention is crazy (in a good way).

Privacy UI - Alex Faaborg’s blog – Alex reveals that the PrivacyMode indicator for the next version of Firefox is going to be a neat masquerade mask.  I think it looks kinda cool.  And if you take the time to dive into the comments, you might find a good discussion on this trend in private-browsing in general.

At Mozilla, blowing the lid off security practices - Defense in Depth - CNET News – Robert Vamosi sits down with Window Snyder, Mozilla's chief security something-or-other to discuss security in browsers and what Mozilla is paying attention to specifically.  It’s a good background on threat-modeling and the tools used to find vulnerabilities.  Interesting discussion.

Newsfox v 1.0.4.2 released – Nice (pre-release) minor update to this fine and fast RSS reader plugin for Firefox. Get this version here.

MinimizeToTray :: Firefox Add-ons – With taskbar space at a premium on my systems, especially when I want to leave Firefox open to run automatic RSS feed update checks with Newsfox, I had a problem.  This bitty add-on solved it. It minimizes Firefox to the system-tray. But RSS notifications in Newsfox still pop-up when new feeds are found. Perfect solution.

Desktop Security Updates

Comodo Internet Security – (freeware) - New release of Comodo’s free security software combines both their noted firewall product along with their anti-virus program.  In both XP and Vista supported flavors. Download Squad has a great screenshot tour and first impressions review.  I have to confess that I have since removed Comodo’s firewall from my XP and Vista systems along with ThreatFire a while back.  The reason was that my XP desktop system had been locking up hard with the hard-drive light steady-on.  At first I thought my drive was failing again, but the more troubleshooting I did it appeared that both programs were somehow conflicting with each other in a very-bad way.  So I removed them both, rolled back to the XP and Vista firewalls and have just been running AVG 8 Free otherwise.  Could just be something weird with my configuration, but better steady that not.  No problems since.

Hitman Pro 3 – SurfRight - (not quite freeware) – A previously surprisingly controversial program that bundles and throws a heavy posse of anti-malware programs at a potentially infected system.  It has quite a lot of things going for it and takes the more-is-better approach at malware removal. MakeUseOf has a great review of Hitman Pro. Well worth reading to get the big-view. For a deeper look at the controversy surrounding this tool, please take the time to read  Surfing Safe's breakdown on this program.  I’ve not used it and it seems like a good approach…so long as the developer can secure permission from the companies it depends on to integrate. Hitman Pro 3 is free for scanning for threats and allows for a 7-day activation window.  After that you have to pony up your $.  Hitman Pro 2 was free but ran into a lot of problems with both vendors and users who thought it didn’t allow enough user-control.  Worth taking a look at and being familiar with for all you malware-busting ninja’s out there.

Anti-Malware Toolkit 1.03.125 - (freeware) – Previously noted here, this program is only a bit similar to Hitman Pro.  What it does, with much less issue, is to enable a key selection of anti-malware busting tools to be directly downloaded to a system for installation and use. Kind of saves a bunch of time in the pre-work.  However, you still need to be skilled enough to use many of these tools and there is no guarantee any of these tools will remove the problem files.  That may take some deeper l33t skilz for success.  It’s a good starting point however, and if you don’t have your pre-loaded USB response stick ready, it can save a bunch of time surfing the web to all the individual sites.  Definitely a keeper.

Secunia PSI RC4 - (freeware) – This program is the localized client version of Secunia’s vulnerability scanner. It is a rocking application to make sure your desktops (home) are kept safe and secure.  It makes keeping an eye on critical patches for software are identified and able to be easily applied to your systems.  See the full changelog here.  Strongly Valca recommended.

Apps Galore

xp-AntiSpy - (freeware) – Great tweaking tool got another minor update.

8 Best Defragmenters To Keep Your PC Running Like New - MakeUseOf.com. Roundup of several latest generation third-party defragmenters.  All are good in their own way, so find one you like and meet your needs and stick with it.

CrystalDiskInfo - (freeware) – Wonderful hard-drive monitoring and health utility. Recently updated.

Process Monitor v2.02 - (freeware) – Sysinternals tool got a minor bug-fix for symbol configuration issues.

Bare Tail - (freeware) – Wicked-cool tool that allows real-time monitoring of log-files. Too cool to pass up!  All sysadmins must get this one.  This version is free for home and professional use, but there is a Pro version ($) that adds on the features. Check out Confessions of a freeware junkie’s review for a great breakdown of what you may have been missing.

AutoMen (Mini Mencoder Gui) 5.0 - (freeware) – Multifaceted code converter.  See this freewaregenius.com review for a bit more information on why you might want to add this one to your collection.

DVD neXt COPY - (freeware) – Offers to turn your DRM managed iTunes files to unlocked MP3 format files.  Sure, you can do like my brother did and rip his whole collection of iTunes purchases to CD on your own to get around it (backup) but you probably aren’t single and have the ripping rig he does (nor the time) to do all that.  This program might simply that process a bit. As usual, freewaregenius.com walks us through the high/low points of this program. A fuller-featured Pro version is available as well for a few $.  Not a magic bullet but could be a time saver for quick rips.

USBDeview - (freeware) – NirSoft utility to manage and get info about USB devices connected (currently or historically) to a system has been updated to include ability to open items in RegEdit.

MozillaCacheView and OperaCacheView - (freeware) – NirSoft utility to read the cache file of Mozilla and Opera web-browsers have been updated to enable saving of cache files in the website’s directory structure. Very helpful when reconstructing browsing sessions and comparing them to websites visited.

Whew!

Time for bed little mouse, little mouse. Darkness is falling all over the house!

--Claus

Windows 7 News Roundup – The Very Best

Intro to W7 class is now in session!  Pay attention!

I’ve recently started to work at collecting news and information about Windows 7.  Just when I was getting comfortable with Vista and was deliberating the upgrade of our two XP systems to Vista, now a few things are clear.

• Vista looks to be treated as a “road-bump” in their Windows OS releases.

• That W7 is hoped to be the savior of the future of Microsoft.

• That W7 is remarkably similar to Vista under the hood, but it is different in many respects.

I think that now Vista SP1 has resolved many of the underlying issues with it, most XP users (home/corporate) are in no hurry at all to switch to Vista; except with purchase or build of a new system.  I certainly fall into that category.

That said, just as I am getting used to and finding many things to like about Vista, it looks like Windows 7 will again require some major UI adjustments.

So with the big Microsoft effort taking the wraps of an early version of W7, the Net has been flooded with posts, reviews, and analysis of all things Seven.

I’ve been dutifully reading them all and have collected the very best (IMHO) of these posts for posterity.  Once you get done working though this Valca syllabus, you should have a pretty decent working knowledge of what W7 will deliver as well as what it means to you.

Hang on.  It’s a bunch.

Bookmarking ready? Netbooks open?

OK class, let’s begin!

First Big Picture Looks

These posts show us the major design elements and features of W7.  Particularly the desktop, revised task-bar, and window and file management elements.  Overall the Windows feel is still there, but there will really be new ways of relating to your data.

• A first look at Windows 7’s pre-beta PDC release – Ed Bott at ZDNet shares his first take. With a wealth of early-build W7 screenshots.

• Window 7 - The New UI – Josh’s Windows Weblog - Windows Connected

• Notes on the Windows 7 Demo from Today’s PDC Keynote - Windows Experience Blog - The Windows Blog

• Microsoft takes the wraps off Windows 7 – Dwight Silverman’s TechBlog’s take on W7.

• First look at Windows 7’s User Interface – Ars Technica

• Loads of Windows 7 eye candy – Paul Thurrott’s Windows 7 information landing zone

• Windows 7 Preview, Part 4: Apps, Internet and Devices - Paul Thurrott’s SuperSite for Windows

• Windows 7 Preview, Part 3: Explorer and Networking - Paul Thurrott’s SuperSite for Windows

• Windows 7 6801 Review - Andre Da Costa has the most extensive single-page review and breakdown of W7 I’ve yet seen.  It’s a doozie.  Go get a 2nd cup of coffee and come back.  This should get you prepared for any W7 pop-quizzes at the geek’s cafeteria table.

• Windows 7 hands on - Impressive at every turn - Download Squad provides an abbreviated look at W7.  They—like many—have peeked behind the curtain and come back changed.

Deeper into the Eye Candy

Like most Windows faithful, the technicals are interesting and important, but come-on, we want eye-candy to inspire us.  Looks like W7 won’t disappoint.

• Windows 7 UX tidbits: color hot-track – istartedsomething – Applications minimized to the action/task bar will glow with a intuitive color based on the application itself.

• Windows 7 themes: glass, basic and classic – istartedsomething. At least in the developmental versions of W7, it looks like you can roll back the theme to Classic, and Vista'ish styling.  To a point as we will soon see.

• Windows 7 DPI scaling: my 7 is bigger than your 7 – istartedsomething. Supersize my DPI please!

• Improvements to fonts in Windows 7 – istartedsomething. Font display and management will get a major overhaul in W7.  Should be much more helpful and intuitive; especially for those like me who have a bazillion fonts installed.

• Windows 7 and light sensors: let there be light – istartedsomething. W7 will be able to interface with future laptops that have light sensors to adjust the screen display for optimal viewing enjoyment.

• Tidbits about the new "superbar" taskbar – istartedsomething.  The new action/taskbar is going to be radically different in W7 from XP and Vista.  Prepare for something much different, and maybe, just maybe, much more useful.

• More on the Windows 7 UI: new taskbar will be mandatory – Ars Technica.  Oh. Did I mention that you have to have the new W7 action/taskbar?  No rolling it back to the Vista/XP task-bar behavior Windows users world-wide have gotten used to.  Cope. You will like it. Microsoft says so.

• Why you should contribute to Win7 Taskforce  - istartedsomething. Long Zheng continues his campaign to make the UI interface in Windows (W7 now) more logical and beautiful for Windows users.  It makes a lot of sense. Hop over to the Windows 7 Taskforce page to view and comment on the most popular submissions for the past 30 days for GUI elements needing tweaking and repairs.

Greater than the Sum of its Parts

Haven’t fallen asleep yet? Good. Teacher’s watching…

• PDC 2008: The 7 Coolest New Features in Windows 7 – Web_Monkey blog gives us our list of key power-words vocabulary: Taskbar, Jump Lists, Areo Snaps, Unified Search, UAC, HomeGroups, and Device Stage.

• Windows 7: Looking ahead at PDC – Martijn Brant breaks down (pre PDC event) many of the elements that make up W7.  Including news that W7 will support virtual hard-drive files (VHD) natively.  That’s cool.

• PDC 2008: Mike Nash answers your questions about Windows 7 – BetaNews interviews Mike Nash, corporate vice president of Windows Product Management. Nothing deep but a good primer.

• Windows 7 (M3) pre-beta features detailed in privacy statement – istartedsomething. Ready for your second vocabulary list? BitLocker, Device Information Retrieval, Driver Protection, Dynamic Update, Gadgets, Games Folder.

• PowerShell will be installed by default on Windows Server 08 R2 (WS08R2) and Windows 7 (W7) – PowerShell Team Blog.  Oh yeah. By the way…Windows 7 will ship PowerShell natively installed so all you Command-Line Interface geeks rejoice!

• Understanding Windows Live Essentials in Windows 7 – Ars Technica.  So Microsoft learned it’s lesson about embedding many key programs in its OS.  Now you can get them via Live Essentials.

• The Complete Windows Experience – Windows 7 + Windows Live - Windows Experience Blog.  More screen shots and element breakdown of the Windows Live elements: Windows Live Messenger, Windows Live Mail, Windows Live Photo Gallery, Windows Live Movie Maker, Windows Live Family Safety Filter, and Windows Live Writer.

• PDC 2008: Windows 7 will add a “volume knob” to UAC – BetaNews – While UAC will not be removed, it will be refined to present a friendlier end-user interaction. The hope is that most users will no longer see it, and those that do can tune how obtrusive it is.  Great information about the behind-the scenes development of UAC version 2.

• PDC 2008: More details on the new Windows 7 Taskbar – BetaNews – Close up look at the revised taskbar and Jump Lists.

• Under the Windows 7 Interface – TweakVista blog rounds up with a final summary of all the features, improvements, and benefits that W7 brings to the table.

For IT Professionals

• Windows 7: What’s coming for business users -All about Microsoft | ZDNet.com – First indications that Microsoft is trying to woo their enterprise and corporate IT customers.  Something that has not been going so well with Vista: Includes Branch Office caching, new imaging (ImageX?) method, BitLocker to Go (for USB devices), AppLocker, Direct Access (allows employees to stay connected to their W7 system data from anywhere Internet connections, VHD support.

• Windows 7 management features will make IT admins grin – Ars Technica takes the teases above and fleshes them out with added detail and explanations.  Real world stuff that many IT shops may find appealing.

• Windows 7 Preview, Part 5: Business and IT Pro Features - Paul Thurrott adds a bit more information that the Ars Technical post above leaves out.  But not much.

• Windows 7 M3 Interactive Install Screenshot Gallery - Paul Thurrott has a fantastic gallery of screenshots for a pre W7 setup.  Looks very polished and easy for both IT and home-users to follow.  Reminiscent of Vista, but not quite as confusing to some.

Diving Deep

These posts are only for those GATE students or those wanting to earn extra credit.

• Channel9: Mark Russinovich goes Inside Windows 7 - Mark talks about kernel changes in Windows 7 and Windows Server 2008 R2, including the removal of the scheduler’s dispatcher lock, support for up to 256 CPUs, boot from VHD, MinWin, core parking for power savings and more.

• Design principles for Windows 7 – istartedsomething.  It’s clear to me that Microsoft wants to put to rest application design issues that still show up from developers on Vista software releases. Long Zheng walks us through highlights of expectations from Microsoft when designing GUI elements and user interactions for W7.

• Windows Media Center in the PDC Build of Windows 7 - Charlie Owen delivers a master-work of Media Center goodies for W7.  If you are a media-fan, you have got to study his post.

• Windows 7 DWM cuts memory consumption by 50% – istartedsomething. The Desktop Window Manager has been optimized and tweaked to deliver even more performance than Vista. That’s a Good Thing!

• Windows 7 software logo requirements published – istartedsomething. Want to stick a W7 certified logo on you package? Better understand the requirements. Let’s hope Microsoft also learned it's lesson with the Vista Ready, Vista Compable logo hi-jinks as well.

• The Windows 7 Blog for Developers – Microsoft Blog.  New blog that should provide more technical information for folks writing code and figuring out how to earn that coveted W7 logo. Might be worth adding to your RSS feeds as I’m sure some back-room goodies will come from this site.

• Engineering Windows 7 : Windows Desktop Search - Information regarding how Windows Desktop Search will be implemented in W7.

• Engineering Windows 7 : Follow-up: Windows Desktop Search – What we meant to say about Desktop Search but maybe need to further clarify….

• Engineering Windows 7 : User Account Control – Everything you wanted to know about the Microsoft’s justification and design for UAC…but without saying much technically about UAC…just yet.

• Bits from Bill: WinPatrol Exposes New Windows 7 Services – Leave it to Bill and his WinPatrol Scottie dog to sniff out some new W7 services.  Interesting post.

Windows 7 and Netbook Support

For Christmas we are almost committed now to getting Alvis a Netbook.  No decision yet but we are strongly leaning to a Sapphire Blue Acer Aspire One Mini Laptop running XP.  So future compatibility and performance of Windows 7 on it is a prime concern.

Looks like it should do sufficiently well.

• Windows 7 & Netbooks – Ars Technica interviews Steven Sinofsky with some netbook questions. I like the answers so far!

• Eee PC 1000H Runs Windows 7 Well – Real-world test of early W7 release on a netbook.  It works and works well!

• PDC 2008: Microsoft Debuts Sleeker Windows 7 on a Netbook – A few folks noticed that Microsoft didn’t do their big W7 debut on a super-maxed-out gaming rig to impress.  Nope. They boldly used a Netbook and pulled it off.

W7 will you be ready?  Will you care?

You probably should.

Class dismissed until next time.  Study up!

--Claus V.

Miscellaneous Windows Troubleshooting Info

When I was dealing with the SharePort issue, I was looking for additional tools and things to help me with the troubleshooting process

I already was using Process Explorer, Process Monitor, and AutoRuns to try to pin down the issue.

I had been pouring through the system logs on the XP and Vista systems as well.

In the end I found these particular post especially helpful:

Monitoring Event Logs in Windows Vista – Windows Networking

How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program generates in Windows Vista – Microsoft Help and Support

Windows Vista Event Viewer – Computer Performance UK

One really golden find in my Web-diving was discovery of the Ask the Performance Team bog.

• Ask the Performance Team : Understanding Crash Dump Files
• Ask the Performance Team : Capturing Application Crash Dumps

Both are really in-depth and fascinating explorations of the Windows crash-dump process and post-mortem review.  Darn good stuff.

Software Solutions?

Here are some freeware software solutions to help with program installation monitoring and logging:

InstallWatch - (freeware) – Epsilon Squared

InstallSpy - (freeware) – scroll to the bottom of the page to find.

Advanced Uninstaller PRO - (trialware/$)

Tiny Watcher - (freeware) – See review over at freewaregenius.com

In the end, none of these helped me, but I thought I would pass them on anyway.

--Claus

Valca Goes Wireless…Headaches included free

For quite some time now the only method the Valca clan has had to access the Internet from the laptops is to string 50’ Cat-V cables down the hallways from the router.

It wasn’t so much that I was against a wireless solution (although not fully as secure as a hard-wired connection in the purest sense), but I just didn’t want to face the time and likely aggravation in getting it set up.

So, using craftily placed eye-hooks above the doorways, the girls have strung the cables along, on demand, to avoid trip hazards, but otherwise soldiered on.

Recently, I started looking at the D-Link DIR-330 Wireless G VPN Router, 4-Port 10/100 Switch as a possible solution.  I really liked both the pricepoint and built-in VPN server in the unit itself.  I thought it would be a great solution for secure surfing when I was on the road in hotels.

I asked Dwight for his masterful advice and his general recommendation was to find and go with a 802.11n router as this would provide much better performance moving onward.

So I continued to wait and research.

Last month Claus here had a birthday and little bro gave me a nice Amazon.com gift certificate.  I decided to use it to pull the trigger on going wireless.

I wanted to stick with D-Link as my current wired router has been rock-solid and never had a hiccup.  I was familiar with the configuration manager.  So when I looked on Amazon for the DIR-330 it wasn’t found, but they did have the D-Link DIR-655 Extreme N Wireless Router at a similar price.  Reviews were very good across the Net.  Additional research on the D-Link site satisfied my concerns.  Order placed and was received.

I put off doing the setup for about two weeks to be sure I was well-versed in what I was going to do for the setup and that I allowed sufficient time for any trouble.

Good thing.

Wireless Install Woes

The hardware-installation for the router went slamming-good.  I started out with the desktop unit as it is hard-wired.  Loaded the drivers, swapped the unit, configured the initial settings and locked down the default passwords.  Changed configuration so it (and all our systems) would use OpenDNS. Good.  In about fifteen minutes it was flying fast and both my desktop and the Ethernet enabled network HP Printer were chattering away on the Net and net just fine.

Now to the wireless config.

Our laptops both only support 802.11g not “n” spec yet, but the router is backward compatible.  I generated a WEP-2 WPA2 password and set the SSID.  Shouldn’t be any issues right?

Well I started with the Vista system and despite all my configuration efforts, it wouldn’t pick up the wireless connection.  I had disabled the SSID broadcasting, but figured if I put the information in during setup it would see it anyway.  In the end I had to temporary enable the SSID broadcasting.  It appeared in the Vista wireless setup, I connected and entered the password and was good.  Then I went back and disabled the SSID broadcasting again and the connection stayed solid  Full speed connections. Wonderful.  Took about an hour to work it all out after going round and round for a while.

Next I moved on to Lavie’s XP Compaq Presairo V2575US notebook.  This took three hours.  I’ll save you the details but it seemed that the on-board network card was bad.  I had resigned myself to going out and picking up another USB wireless device for it, but decided to play around with one more thing.

I had noticed during my hours of troubleshooting that no matter what I did, the XP wireless configuration screens just didn’t quite match with what I was seeing on the on-line search results.  At first I figured it was a XP SP3 change, but that just didn’t seem right.

Using ProcessExplorer and AutoRuns, I took another look at the system.  It seemed that the wireless would enable during startup and for a few seconds on reaching the desktop, but then disconnect.  I finally noticed an OEM Compaq application HP Wireless Assistant.

The web had a number of posts in forums with HP wireless assistant issues.  So I figured what the heck and uninstalled it.

Rebooted and wham!  Full wireless connectivity! Woot!

Turns out that software was overlaying the XP Wireless configurations. Once gone everything worked fine.  So file that one away kids.

Right now the wireless is going strong.  No problems or issues with the unit itself.  I did have to do a firmware upgrade on the router to bump it up to v.1.21 but that also went flawlessly.

Connections are instant, fast, and flawless.  If/when we go with another 802.11n device, we will be ready.

As an added bonus, the router came with a 30-day full trial of Cisco’s Network Magic software.

I’ve really, really been impressed with this product.  So much so that I think I will buy the full version when the trial is up. Something I rarely, if ever, do.  It has a ton of management tools but even more importantly it interfaces with the router and provides a real-time network map of our network and all the devices connected, as well as logs.  This provides a wonderful security check to see if any unauthorized devices have joined the network.  There are other ways to accomplish that as well, but this is very home-consumer oriented.  Good stuff guys!

I’ve still got to go back and enable MAC address filtering.  Just haven’t had the time to do so at the moment, but it is locked down enough I’m not too worried at the moment.

Expect for SharePort BSOD the systems….

One of the bonus points of the DIR-655 router (and a few others) is that it now comes with D-Link’s SharePort software.

D-Link DIR-655 SharePort Downloads

Basically what this does is to enable devices to access a USB device (printer, drive, etc.) plugged into the rear USB port on the router itself.

It’s kinda like a poor-man’s server.

• D-Link DIR-655 Router and SharePoint/SharePort | Tech Gremlin
• D-Link Blogs - Home & Home Office

Only when I went to install it on my XP systems AND the Vista laptop, all were reduced to blue-screens of death.  Apparently I am not the only one with this issue.

After my heart got beating again, I was able to get all the systems restored and operational again.

Whew!

At first I suspect a conflict with AVG Free 8 which is a common piece of software on all my systems as it installs some HIPs style protections and I thought it might be happening when SharePort got installed and tries to load some system driver or service.

Based on some Virtual PC build testing I felt comfortable enough that this could indeed be  the issue so on my Vista system I uninstalled AVG and rebooted, then tried again to install SharePort.  It horribly BSOD the Vista system again.  Luckily I had done a System Restore point just before the attempt so I got it going again.  Not AVG.  What next?

The other similar application on all my systems was NetLimiter Monitor.  I didn't even consider this could be the issue.  It's been great and stable.

So I started a fresh Virtual PC session with a pristine XP SP2 load.  I installed NetLimiter Monitor and rebooted. So far so good.  Next I attempted to install SharePort software and, sure enough, the XP system black-screen rebooted near the end of the setup just like on my real systems.

After the number of system restores I've had to do, I'm a bit hesitant to try again before I reattempt an install of SharePort again on my "live" systems even after uninstalling NetLimiter Monitor from one of them.

I'm convinced the issue is with the SharePort software itself and specifically a driver or service conflict at installation initialization, since both NetLimiter Monitor and SharePort touch on the system networking elements, it looks like a logical conflict point.

I’ve put in an email to the NetLimiter support team and asked them for any feedback.  Will let you know what i find out.

So for now I haven’t yet gotten it successfully installed yet.

But that isn’t a problem with the router itself so I can’t complain too much.

Good Wireless Setup Articles

Here are the best Windows Wireless setup articles I read in preparation for this conversion:

• Securing your Home Wireless Network : A simple security guide - [Geeks are Sexy]
• 5 Steps to Home Wireless Security – Connected Home
• Securing a wireless network--The basics - Network Systems DesignLine
• 4 steps to set up your home wireless network - Microsoft
• Set up a secure wireless network using Windows Connect Now - Microsoft
• The six dumbest ways to secure a wireless LAN  - ZDNet.com
• The ABCs of securing your wireless network – Ars Technica
• Security Practicum: Essential Home Wireless Security Practices – Ars Technica
• Set Up A Wireless Home Network – PC Today
• 10 Tips for Wireless Home Network Security – About.com
• Build Your Skills: Configure a wireless LAN connection in Windows XP – TechRepublic

More. A bit dated but useful:

• ToDo: secure your wireless network - Lifehacker
• Setting Up an 802.11b Home Wireless Network – O’Reilly Network
• Geek to Live: Set up a home wireless network - Lifehacker

Wireless Tips, Tools, and Techniques

Finally here is a collection of utilities, advice, and how-to’s that you wireless freaks might find interesting.

WirelessKeyView v1.17 – (freeware) – NirSoft utility “recovers all wireless network keys (WEP/WPA) stored in your computer by the 'Wireless Zero Configuration' service of Windows XP and by the 'WLAN AutoConfig' service of Windows Vista. It allows you to easily save all keys to text/html/xml file, or copy a single key to the clipboard.”

WirelessNetView v1.03 - (freeware) – NirSoft utility is “a small utility that runs in the background, and monitor the activity of wireless networks around you. For each detected network, it displays the following information: SSID, Last Signal Quality, Average Signal Quality, Detection Counter, Authentication Algorithm, Cipher Algorithm, MAC Address, RSSI, Channel Frequency, Channel Number, and more.”

BluetoothView v1.10 - (freeware) – Nirsoft utility is “a small utility that runs in the background, and monitor the activity of Bluetooth devices around you. For each detected Bluetooth device, it displays the following information: Device Name, Bluetooth Address, Major Device Type, Minor Device Type, First Detection Time, Last Detection Time, and more.”

Confessions of a freeware junkie: Tip: Recover your Wireless WEP/WPA keys with WZCook – Alternative method to snag your WEP/WPA key if it goes missing.

LucidLink WiFi Client - (freeware) – Utility that helps automate wireless configuration and setup on a device (XP/Vista) system.  I personally was able to manually configure mine as noted above, but this might have been a fallback tool had I not been able to persevere.  Supports a WEP, WPA, WPA2 security configurations.  Spotted in a review over at Confessions of a freeware junkie.

Network Mining, and Wireless Fun, and Wireless Network Penetration, and Securing a Wireless Connection – all courtesy of SynJunkie.  Lots of great info posts that provide additional background on WiFi monitoring, sniffing, and other dubious l33t skillz. Well worth the while to be familiar with.  SynJunkie also has additional great posts that might be interesting to forensic examiners and system administrators.

Wi-Fi: Troubleshoot a Slow Home Network  - Lifehacker.  My wireless is ripping fast, but in case I were to have a problem, these tips would be valuable.

How to catch hackers on your wireless network - TechRadar UK – Mix of $ and free solutions. Not so much for home-users, however.

--Claus

Off the Microsoft beaten path

Just became aware this week of a few things.

Windows Blog Redesign

Official Windows Blogs Redesigned & Has New URL – Josh’s Windows Weblog - Windows Connected.

I’ve loved the Windows Vista Blog site.  It has provided a lot of great information and insights.

However, since it is becoming clear that Microsoft is working hard as possible to now distance itself from Vista and move attention to Windows 7, the blog was targeted for an “Extreme MS Blog Makeover”.

It now breaks down into three distinct blogs

· Windows Vista Team Blog

· Windows 7 Team Blog

· Windows Experience Blog

That’s all great and the redesign is a bit “brighter” but which site(s) do you add to your watch-list?

Keep it simple by just sticking with this one Front Page which pulls articles from all of the others. IF you want a singular feed source for all the blogs, as Josh points out, just use this Main RSS Feed.

Free MS Ways to Access your Data, Remotely

James.Random() : Live Mesh is now in BETA

I hadn’t even heard of Live Mesh Beta before until James mentioned it.  Turns out it is pretty cool, especially for home users.

Sign up for and download Live Mesh and get treated to the following features:

Live Desktop – 5 GB of free storage where you can view and access synchronized folders and contents on the web.

MeshBar – Kinda like a sharable meeting space where you can share shared-items with other Mesh users, collaborate on items, chat.  Sounds a bit like a poor-man’s SharePoint service.

Live Remote Mesh Desktop – Like “GoToMyPC” but only free.  Of course, your remote-enable workstation must be on as well as loaded and registered with your Mesh devices for this to work.

I mentioned this over at the TechBlog and Tim responded that it’s been around for a while in a buggy-beta status.  Not sure how this new version compares.  Looks very promising and I am sure we may see some form incorporated for Windows 7

Tim also suggested looking into Windows Live FolderShare beta.  According to Tim it is more stable and the limitations aren’t very high.  Also allows for sharing of folders between registered systems for a user, but it seems to be local-system based and not “cloud-storage” based, meaning that the devices must be on and the service running on them to access the file-sharing.

Windows System Recovery Bits

Specifically for my little bro.  Turns out that he downloaded the latest Adobe Creative Suite 4 and now it absolutely refuses to install on his almost brand-new Vista system (like many others) even though it has more than enough cores, RAM, and drive-space. He feels there may be some bad Registry bits causing the muck-up in his case. I recommended he try a System Repair for Vista first, before he nukes all his hard work with a OEM system restore.

Want a quick way to build a Vista system rescue disk?

Vista SP1: Create a recovery disc – Long Zheng – Background information only. Feature removed from the final Vista SP1 release…kind of.

Recover “Create a recovery disc” on Vista SP1 RTM – Long Zheng – So Long shows you how to build one anyway with a bit of hacking around.  It’s a fun exercise and should help teach you a bit of things about how this tool was intended to function before it got yanked.

Windows Vista Recovery Disc Download – NeoSmart – Or save all the time, education, and self-learning that you get by going through that process and just download a pre-made ISO file from NeoSmart.  I have and it checks out fine as far as I can tell.  If you ever think you will need this, I recommend snagging it now, just in case the ISO gets pulled sometime in the future.  It’s not very big so assuming you have a broadband connection to the Net, shouldn’t take any time at all to download.

--Claus

Security Watch #1

Been a busy couple of weeks over at my favorite security blogs.  Lots of goings on.

Here are a number of the highlights for interested folks.

Know your adversaries.  This way you can better craft your defense and recovery responses.

Microsoft Threat Teams

Microsoft® Malware Protection Center : Get Protected, Now! - Begins the discussion on why MS08-067 was such a critical patch that it had to be release out of schedule, so closely after Patch Tuesday.  “On some versions of Windows, an unauthenticated attacker can remotely execute code on a vulnerable computer. Basically if file sharing is enabled and the security update is not installed yet, the computer is vulnerable. File sharing is enabled in several scenarios though it is disabled by default in XP SP2 and newer operating systems.”

The Microsoft Security Response Center (MSRC) : Microsoft Security Advisory 958963 – Updated information that some malicious software has been seen attempting to exploit the MS08-067 vulnerability  Appears to be trojan-based rather than self-replicating.

Security Vulnerability Research & Defense : More detail about MS08-067, the out-of-band netapi32.dll security update – A more technical post about the attack method for the issue, and specifically how UAC in Vista can protect the system;

Instead, the UAC and integrity level hardening work introduced with Vista is forcing the authentication requirement. The anonymous user connects with integrity level "Untrusted" while the named pipe requires at least a "Low" integrity level. Since "Untrusted" is lower than "Low" integrity level, the access check fails. Note that disabling the UAC prompt does not disable the integrity level access check. In other words, regardless of whether the UAC prompt is enabled or disabled, the integrity level check will be performed. The integrity level check will fail on Vista and Windows Server 2008 if the user connects anonymously.

Mostly

There is a non-default scenario where a non-domain-joined Windows Vista and Windows Server 2008 can be exploited anonymously. If the feature “Password Protected Sharing” is disabled, anonymous connections come in at “Medium” integrity level. Because "Medium" integrity level is a higher integrity level than "Low", the integrity level check will succeed. This would allow Windows Vista and Windows Server 2008 to be exploited anonymously. This feature could be disabled through Vista’s Network Sharing Center in the “Sharing and Discovery” section.

Microsoft® Malware Protection Center : Uprooting Win32/Rustock – Really wonderfully written analysis of the distribution method of the Rustock trojan; more frequently being found responsible for malicious “fake” Windows security program scans. The dropper actually kicks off a installer which hooks in as a system driver.  This kicks off the rootkit installer which further hooks into the system.  Clever stuff, but even cleverer work by the analysis team.  I love that stuff!

SWF for Malware Deployment – Brief on how SWF files can be used for malicious downloader methods.  Be careful of all those attachments and unsolicited “fun-things” you find in your in-box!

Web Attacks Using Microsoft Help and Support Center Viewer - Vulnerabilities & Exploits - STN Peer-to-Peer Discussion Forums - Symantec DeepSight Threat Analysis found a curious method for malicious payload delivery.  What makes this method a bit different is that in some circumstances, malicious code could be executed immediately.  And it begins with a visit to a malicious web-page…

1.    An attacker creates a malicious Web page that uses an arbitrary file-overwrite issue to place their malicious binary on the victim's machine. The attacker then tricks their victim into visiting this page.

2.    When the victim visits the page, the attacker exploits the same vulnerability to overwrite one of the Help and Support Center's HTML files, such as "C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\sysinfomain.htm." The attacker overwrites this file with script code that performs malicious actions on their behalf.

3.    Once the previous steps have been carried out successfully the attacker redirects the victim's browser using the "window.location" method such as "window.location = hcp://system/sysinfo/sysinfomain.htm."

4.    The Microsoft Help and Support Center viewer, which handles "hcp://" links, runs the attacker's script, which in turn executes their malicious binary.

What makes this attack remarkable is that because the Help and Support Center can run script commands in the context of the local user, attackers can utilize inherent ActiveX controls not marked as "Safe for Scripting" to execute a malicious binary that they have already placed on the vulnerable user's computer.

It's worth noting at this point that in order for this attack to be successful the user must be logged in with Administrator privileges.

Windows Incident Response Blog

Windows Incident Response: What do you need as a responder? – Harlan’s question is perfectly poised coming behind the threats just mentioned.  And it is a good one.  When a threat (or violation) is detected, what DO you need to respond? It might start with an understanding of the company policy and procedures.  Each incident also carries a different flavor, and likely will need a different set of tools.  As Harlan points out, sometimes it is even more important to know the answers your customers will need, before they themselves even know the questions they want to ask.  Most of this comes with experience.  My philosophy is to capture as much data as you can ahead of time, as quickly as possible.  That’s a lot more stuff to sort through in terms of data-sets, but in the long-run it will give you even more flexibility in the long-run.

Windows Incident Response: New Tools – Harlan brings our attention to a few more new tools in the forensics and incident response field.

Windows Incident Response: Bridging the Gap – Harlan mentions a few of the links I’ve posted to above with malware incidents.  He also finds value in finding the How of an incident. Additionally, Harlan illustrates how some choice forensic tools can be applied to those events.

Windows Incident Response: Random Updates – More odd’s-n-ends from the every active world of forensics and event response. Some good tools and tips in there.

Miscellaneous Bits and Bytes

TaoSecurity: CWSandbox Offers Pcaps – I’ve used CWSandbox before to analyze suspected malicious files. What I didn’t know is that it now can provide Pcap file data for you to download and examine with your favorite network packet tools.  That is really cool to know!

TaoSecurity: Windows Syslog Agents Plus Splunk – Richard also investigates how to collect system logs remotely for review and analysis. I’m thinking that in an organization our size, that would be a lot of logs to handle, however if there were some workstations that had a history of problems or infections, this might be a good way to collect data on them specifically.  Certainly interesting.

The Case of the Corrupted Stream Object « Didier Stevens – Didier is quickly becoming the guru of PDF files and how they can be hacked, manipulated, and misused for malicious purposes.

Analyzing a Malicious PDF File « Didier Stevens – Didier is starting a new series (with video) on how to analyze a malicious PDF file.  This is very, very good information because many users and organizations use and trust PDF files as they seem “innocuous” and safe. See a .exe that slipped in via e-mail, no way they would run that now.  But if it is an unsolicited PDF file, hmm. That’s a “safe” file format.  No harm there.  Let’s see what it says…BAM!  Exploited!

pdf-parser.py – Didier’s tool to break down a PDF file to its elements. Must have. (Although in all fairness, Didier’s expertise makes it look so simple.)

Filterbit - OPSWAT Metascan Demo – A GSD commenter left a tip to this additional on-line malware file-scanning service.  Looks pretty good.  I’m adding it to my bookmark list already filled with others from my Online System Security Scanners post.

Thanks to all the researchers and experts who share their learning and work to keep us in the know!

--Claus