Well, here it is. Meh new bloggeh! Feel free to make yourselves at home, but don't touch the walls - the paint's still a little wet. :D
Well, there's some anecdotes that happened over the summer that I've forgotten to blog about. Rest assured, they're coming... So too are some geeky stuff, but I'm sure you're all used to that by now. :)
--MarkKB
This post was originally posted at my Windows Live Spaces blog. Yes, I'm well aware of the irony involved. [View original post]
I'm sorry, Windows Live Spaces. No, it's not you, it's me.
Okaaay, bad metaphor. Still, the fact remains that I'm moving this blog to http://markkeyb.blogspot.com/. For the four or five people who read this blog (yes, that's an overestimation), that means you'll get to see new posties an' stuff. For everyone else... well... I'll give you candy? OK, well I can't give you candy due to obvious technological hurdles, but the instant they invent a way of transferring candy over the Internet, I'll be right on it. ;)
What about all the old posties? Well, they're coming too, so you don't have to switch between blogs to see them. It also makes it easier for those types who read all the posts to the beginning and then moan about having to go back yet another blog. :D
See ya on the other side!
--MarkKB
This post was originally posted at my Windows Live Spaces blog. [View original post]
Disclaimer: While this post is about something that happens to everybody, it might get a tad too geeky[1]. Continue at your peril.
Note: This account is based on what I remember, and so might be a smidge inaccurate. I only took a few screenshots, and in hindsight I realise I probably should have taken more. Ah well, what's done is done.
I'd also like to note that I don't usually do stuff like this. It just so happens that my bro's computer got a trojan that I needed to manually remove, and I like to tell you guys about my experiences. However, I don't go out looking for nasties just to document them. Such things are best left to the likes of Paperghost and the Sunbelt guy(s).
While I was going to post about this sometime-or-another, what prompted me to do so today was a post I came across in the security-minded Sunbelt Blog with a chillingly familiar screenshot. (You'll see how familiar in a second.) The Sunbelt post is more investigative on the who rather than the what, but it's still an interesting read.
One day in late December, my younger brother Andrew mentioned something like "Windows XP [on his computer] needs to activate". I thought it was odd, as nothing went wrong during activation (I had recently reinstalled it), and I decided I would do something about it the next day.
The next day came, and Andrew called the problem to my attention again. Looking at the screen, I saw the following:
Riiiiiight. Clicky-button probably equals lotsa nasties. This was a trojan horse.
Cleverly, the usual key combinations (<Ctrl>+<Alt>+<Del>, <Ctrl>+<Shift>+<Esc>, <Alt>+<F4>, <Super>+Anything[2]) had been disabled, the only recourse being to reboot your computer or to give in to the program's demands. Note that the keys work fine until the program pops up, suggesting some kind of key-hooking.
So I rebooted into Windows 2000 and scanned the computer for evil stuff with Spybot.
16 nasties found and removed = problem gone, right?
Wrong. This time it also popped up with what seemed like an IE shell (selectable text, permanent scroll bar to the right, right-clickyness). Oh, and the spelling! What exactly is "exprited" anyway, death by Sprite? I guess when you drink several bottles in a row, it could get rather dangerows...
OK, enough with the bad puns. During the process of trying-to-beat-the-trojan-at-startup, I discovered that if you open the start menu and leave it open while the program loads, it stays up, thus enabling me to run Windows Explorer, and thus Task Manager, with which I can kill the offending processes (locker.exe and iexplore.exe). Me 1, Trojan 0.
During this, I had noticed two interesting things: The "IE shell" wasn't one at all, but rather Internet Explorer itself, stripped down to its bare bones. If one had his Search sidebar up, it would also appear in the trojan-thingy, and so I had a little fun using it as an actual web browser. Also, once you terminated "locker.exe", the keys listed above would continue to be inoperable. A separate TSR perhaps?
It's registry time! As the trojan had seemingly also removed msconfig, I traversed to HKLM\Microsoft\Software\Windows\CurrentVersion\Shell\Run. Sure enough, we had a key that launched something called "License". So, on a hunch, I looked up App Paths. Bingo! "License" linked to locker.exe. Removing both entries ensured that locker.exe would never darken our startup again. Two for two!
Another interesting thing is that it seems to have eaten the Computer Browser, Security Center and Windows Firewall services. As a result, it can't explore the local network, the computer's wide open and the security center won't tell you about the lack of a firewall.
Of cause, many trojans install themselves into the Windows directory, and so I travelled there and surprise, surprise: locker.exe. Sorting by date revealed two other files created the same day as locker.exe: WinLockDll.dll, and wl.exe. So I moved them to a zip file where they could no longer do no harm (at least, in theory), intending to send them as samples to a security research thingy. With all due respect to Batman, BIFF! BAM! POW!
So, if I'm right, locker.exe uses either wl.exe or WinLockDll.dll to "lock" the computer. It then proceeds to display a screen prompting you to renew your license (the black one), and then launches IE (presumably with arguments that force it to shed most of it's stuff) which shows a (webpage-based) fake anti-whatever downloader. Or something.
The webpage in itself is quite interesting. It starts off with a loading graphic (far left). Once the dialog is "loaded", it "attempts" to download some "update files" on a public channel (mid left) with a ridiculously long estimation. It then "fails" (mid-right). The private channel is advertised as being a ridiculously short estimation (35 sec v. two days?) but, of cause, you have to pay for it. A nice touch is that the dialog is moveable (far right).
The whole charade seems to be aimed at those people who frequently download from "free" file hosting services and/or GameSpy's file download site, both of which usually advertise free vs premium accounts, where premium dudes don't have to wait in line and/or get faster servers. Most people will look at it and think "getting in my way, must get rid of it", which, of cause, means "activating" your "account", and won't even look at the rest of the stuff.
So, now we have a de-gunkafied computer, although it looks like I might have to do a repair reinstallation of Windows XP (again). Ah well. Happy new year, and may your days be without malware!
Footnotes:
[1] Mandatory disclaimer, as most of the readers of this blog will be my peers in high school.
[2] <Super> is more commonly known as the Windows key.
This post was originally posted at my Windows Live Spaces blog. [View original post]
MarkKB's Blog - Thu 29 Nov 2007
I hate myself. [1]
Last Thursday we had our NCEA[2] English external exams. I did an almost complete repeat performance of the practice exams, where I did Unfamiliar Texts and Formal Writing[3], and then ran out of time. But that's not why I hate myself.
After the exams, I hung around a bit outside, catching up with some of my friends in the English 100 class, who were also taking exams that day[4], as well as some of the guys I had taken our exam with. We talked, joked, and so on.
By and by, I decided to walk home, like I usually do when I go home from school mid-day. (Study leave is awesome.) As I was making the turn just past Gallony Avenue, I saw someone lying on the ground, moaning, with tear-filled eyes. (I think she's from my English class.[5]) Evidently, she had twisted some part of her foot, or something was making it unbearable for her to walk. So, like the dolt that I am, I asked her if she was OK. She didn't answer, possibly because she was in too much pain to do so, but more probably because she was too busy considering whacking me with a large mallet. So, announcing that I would go back to the school (to look for any of her friends that were still hanging around), I proceeded to do just that.
Now, sometimes when you're focused on something, it takes a while for your brain to process your surroundings. And so, it wasn't until I had reached the school gates that the cogs started whirring: Didn't I just pass two guys?
Looking back, I saw the afore mentioned dudes turning the corner. I backtracked, and sure enough, the two were doing what I should have done: they had flagged down a car and were now helping her on. At least, I think so, and that's what it looked like.
So, tell me: did I do the right thing?
Footnotes:
[1] By "I hate myself", I, of cause, mean "I hate the course of action that I'd taken", not "I'm going all emo".
[2] If you're not from New Zealand, you probably won't know what this is. It's the national certificate for New Zealand, and it's based on arbitrary levels of achievement designed to show your knowledge of a subject. You can either achieve (A), achieve with merit (M), achieve with excellence (E), or not achieve (N). Markers often write up a grid, showing you how much of each you got, which forms the word NAME across the page.
[3] Unfamiliar Texts is answering a bunch of questions on poems, extracts from literacy, "visual texts" (static images) and the such. Formal Writing is writing a x-word essay, where x=~200-300 words, choosing from an unknown list of subjects. The other two sections are film and book essays, the former being What's Eating Gilbert Grape, directed by Lasse Hallstrom, and the latter, Alex, by Tessa Duder.
[4] I am not in the English 100 class, instead I am in one of the many 101 classes, which are basically mid-range. Apparently, the reason I wasn't put into such a class was my lack of organisation, a decision with which I can't find fault with. You should see my room...
[5] Not naming names, of cause. I mean, it was rather embarrassing.
This post was originally posted at my Windows Live Spaces blog. [View original post]
MarkKB's Blog - Sun 12 Sep 2007
I've updated my website. 'Tis at http://markk-b.sitesled.com http://www.markkb.com/. Yays.
OK, here's the other anecdote I promised earlier:
Mrs. Donnell, our English teacher, was talking to us about our upcoming external exam (1.6 - Unfamiliar Texts), and during this talk she revealed that she had started high school in 1975. It was at this moment that one of my fellow learner-peoples felt the uncontrollable urge to utter the following:
“Wait, that means you're older than me!”
'Cause everyone knows 12 is a popular age to start teaching...
NB
I have not posted the above mentioned student's name for a reason. Please, no guessing, no telling, and no mean words.
Updated 14/07/2013 to fix broken links.
This post was originally posted at my Windows Live Spaces blog. [View original post]
MarkKB's Blog - Sun 26 Aug 2007
I know, it's been a long time since my last post, but from now on I'll try to post with more regularity.
Having said that, I have two rather interesting anecdotes that I'd like to share with you guys... but I'll save the second for later. First, something from Tuesday about two weeks ago.
Well, I was late.
OK, I know, no surprise there. But this time I was super-extra lateTM, and so was told by Mr. Van Niekirk (the Te Henga dean, who was at that time performing a crackdown on lateness) told me to go to the sign-in window.
Now, the sign-in window is on the side of the office block opposite to the one facing the street. Most people take the (literal) high road/pavement, which went directly past said window; I, however, usually walk down the driveway and then up the stairs. I really don't know why.
Here's a map to illustrate. The 'most people' route is in red, while my way is in green. Not to scale, if you're wondering.
Well, anyway, I set off down the driveway, and after a few moments, Mr. Van N. shouted for me to go to the sign-in window. I shrugged my shoulders and continued. When I was about halfway to the stairs, he shouted again. But it wasn't 'till the third time that it clicked.
He thought I was going to class.
After shouting back something that resembled "I'm going this way!", I continued down the driveway, up the stairs, and to the window.
NB
This post is not meant to be hurtful to anyone. Please don't take it the wrong way, and, if you guys comment, please don't say mean things about anyone.
Oh, and sorry if I spelt Mr. Van N.'s name wrong.
Thanks for tuning in! I look forward to seeing some of you back at Massey on the 7th.
This post was originally posted at my Windows Live Spaces blog. [View original post]
MarkKB's Blog Tue Aug 24 2006
I missed the class photo. Yay.
At least I feel a lot better knowing someone, somewhere, missed theirs too. Yeah...
I blame my bed. Drat you, bed! And my clock which is four hours behind. Cliché, blaming the clock, I know, but eh.
Anywho, I'm planning to wipe Fedora off my main computer (read: the computer in my room who's monitor is currently decapitated because of my brother wanting to play networked AOEIIx 2v1 [i.e. he and his friend vs. me] and we can't find an extra monitor for the second computer) and install SuSE on it. (Fedora and SuSE are distros of Linux.) Maybe SuSE will network with the other two computers and my laptop better than Fedora... but I'm not holding my breath. (Yes, I always make a point to install SAMBA...) I'll tell ya guys how it works out! Not that anyone will read it...
C'ya!
--MarkKB
