Massive Botnet "Indestructible," Say Researchers

CWmike writes "A new and improved botnet that has infected more than four million PCs is 'practically indestructible,' security researchers say. TDL-4, the name for both the bot Trojan that infects machines and the ensuing collection of compromised computers, is 'the most sophisticated threat today,' said Kaspersky Labs researcher Sergey Golovanov in a detailed analysis on Monday. Others agree. 'I wouldn't say it's perfectly indestructible, but it is pretty much indestructible,' Joe Stewart, director of malware research at Dell SecureWorks and an internationally-known botnet expert, told Computerworld on Wednesday. 'It does a very good job of maintaining itself.' Because TDL-4 installs its rootkit on the MBR, it is invisible to both the operating system and more, importantly, security software designed to sniff out malicious code. But that's not TDL-4's secret weapon. What makes the botnet indestructible is the combination of its advanced encryption and the use of a public peer-to-peer (P2P) network for the instructions issued to the malware by command-and-control (C&C) servers. 'The way peer-to-peer is used for TDL-4 will make it extremely hard to take down this botnet,' said Roel Schouwenberg, senior malware researcher at Kaspersky. 'The TDL guys are doing their utmost not to become the next gang to lose their botnet.'"

Comments

Take 'em offline

[jnpcl]

Yeah, it'll piss off every Grandma and Grandpa with an infected computer, but really.. the best way to deal with these massive botnets is to have the ISPs disable those accounts and contact the owners.

Re:Take 'em offline

[Shikaku]

From TFS:

What makes the botnet indestructible is the combination of its advanced encryption and the use of a public peer-to-peer (P2P) network for the instructions issued to the malware by command-and-control (C&C) servers.

So what's the difference between this botnet data, an SSL connection to a bank, or an encrypted email/file?

The answer is you can't tell, and neither can the ISP.

"What about the volume?" Encrypted Bittorrent.

Re:Take 'em offline

[Joe U]

The only long term solution is to infect the infected with something that low level formats their HDD.

That will stop the problem.

It's amazingly illegal though, so it's not happening anytime soon.

Re:Take 'em offline

[vux984]

So what's the difference between this botnet data, an SSL connection to a bank, or an encrypted email/file?

Well there must be some way to sniff them out or the researchers wouldn't know it existed or have any idea that millions of machines were infected....

Re:Take 'em offline

[geekmux]

Yeah, it'll piss off every Grandma and Grandpa with an infected computer, but really.. the best way to deal with these massive botnets is to have the ISPs disable those accounts and contact the owners.

Asking ISPs to stand in the firing line of legal liability? Uh...yeah. You'll stand a better chance in hell with a snowcone machine.

And that answer isn't very easy when you're talking AT&T or Verizon cutting off entire hosted corporations.

Re:Take 'em offline

[garcia]

geek, ATTBI (back in the 2001/2002 days) took infected computers off their network by disabling their cfg files. There's no legal liability there.

Re:Take 'em offline

[realityimpaired]

Netcat, and watching for traffic from a system that you know for a fact isn't sending that kind of traffic.

Without your ISP installing some kind of spyware on your computer to determine if you have torrent or other p2p software installed, they have no way of knowing whether that encrypted p2p traffic coming from your system is a virus, or you trying to download a movie. And as for them determining how many systems are infected? That same netcat... once they know the traffic is there, it is fairly easy to find the source of the traffic, and then to analyse said source. Once they find a way into the network, it's fairly trivial to estimate how many clients are connected to it. Taking over the network is another animal entirely, but figuring out how many are connected to it is relatively easy.

Re:Take 'em offline

[spydum]

DNS traffic from the client may still be used to identify infected hosts -- but it is certainly less simple than it used to be.

Re:Take 'em offline

[the_bard17]

Just throw a clause in the Terms and Conditions that states the subscriber is required to maintain an outgoing connection free of malware. Otherwise, the ISP gets to redirect all traffic to a "Hey, you're infected!" page for the duration.

The first time the subscriber calls in to say it's rectified, remove the redirection and monitor it. The second time, be nice and request some proof. The third time, require a faxed copy of a receipt/invoice/statement from a third party verifying that all the connected in the residence are clean and all wireless networks are encrypted securely. Rinse, lather, repeat.

It seems the T&C is being used as a catch all for all the other shady business telecom's are pushing down our tubes... may as well as use it for a bit of good, too.

Re:Take 'em offline

[asdbffg]

Yeah, it'll piss off every Grandma and Grandpa with an infected computer, but really.. the best way to deal with these massive botnets is to have the ISPs disable those accounts and contact the owners.

Yeah, it'll piss off every person who has ever lost their wallet or been a victim of identity theft, but really... the best way to deal with this massive identity theft problem is to freeze these peoples' bank accounts and explain to them that the unauthorized transactions on their credit cards have been directly funding thieves and terrorists.

Yeah, it'll piss off every person who wants to go outside, but really... the best way to deal with this massive crime problem is to have four cameras on every street corner so we can keep track of what everyone is up to at all times.

Yeah, it'll piss off every Muslim with a friend of a friend who's linked to a terror group, but really... the best way to deal with this massive terrorism problem is to detain these people for years in secret prisons and question them using enhanced interrogation techniques.

Yeah, it'll piss off every person who's ever smoked a joint, but really... the best way to deal with this massive drug violence problem is to arrest the buyers and throw them in prison for the rest of their lives.

Re:Take 'em offline

[vux984]

I'm with you on the use of netcat etc.

I assume they build honey pot systems, setup with shit security, programmed to randomly surf the web and click on everything that it finds... and then take it offline into a lab and see what there is to see.

it's fairly trivial to estimate how many clients are connected to it.

That gives you the LAN but that doesn't tell you how many infected systems there are worldwide.

To shut it down by the way, once the virus is reverse engineered enough, one can deploy honeypot systems designed to impersonate legit infected machines, and wait for C&C commands to get passed to it via peers.

Due to it being p2p that won't get you the C&C servers... but it does give you lists of peers that represent infected systems, many of which probably are on the ISP running the honeypot that the ISP could take offline... a few coop agreements, and ISPs could swap lists of infected systems from eachothers networks easily enough as well.

Re:Take 'em offline

[geekmux]

Just throw a clause in the Terms and Conditions that states the subscriber is required to maintain an outgoing connection free of malware. Otherwise, the ISP gets to redirect all traffic to a "Hey, you're infected!" page for the duration.

And as this particular one operates, good luck discerning a valid encrypted connection from a invalid/infected one.

The first time the subscriber calls in to say it's rectified, remove the redirection and monitor it. The second time, be nice and request some proof. The third time, require a faxed copy of a receipt/invoice/statement from a third party verifying that all the connected in the residence are clean and all wireless networks are encrypted securely. Rinse, lather, repeat.

Wow, faxed copy? What's next, a notarized statement and sworn testimony? After that, it'll be a race to see which falls faster; your customer base or your stock price.

Re:Take 'em offline

[countertrolling]

Asking ISPs to stand in the firing line of legal liability?

Not a problem.. The government can grant them immunity, like it did for the unwarranted wiretaps..

Re:Take 'em offline

[mug funky]

not sure if this is a slippery slope here.

we're talking ISPs, not governments.

if they spin things right, or if the problem is big enough, they could include a nominal surcharge for sending round one of their guys to scrape the malware off their clients machines. then they save a ton of bandwidth, stop the botnets, and actually end up with happy customers (with computers that work somewhat better).

i think there's money to be made for the first ISP that tries this.

Re:Take 'em offline

[shentino]

Well, spewing spam should be a strong clue.

Dynamic IPs shouldn't be allowed to send outbound email directly anyhow.

Re:Take 'em offline

[LordLimecat]

What an awful comparison. The people with infected computers are responsible for their computers, and it is their computers that are doing damage via spam etc. Disabling their accounts and requesting followup is in no way similar to:
*throwing someone in prison
*interrogating them
*implementing a police state
*freezing bank accounts

Its perfectly reasonable, if a PC is causing damage to a network, to remove that PC from the network. Schools do it, business offices do it, and Im sure government offices do it. That ISP has no obligation to cooperate with a botnet.

Re:Take 'em offline

[interkin3tic]

The only long term solution is to infect the infected with something that low level formats their HDD.

That's not true, there are plenty of long term solutions. We got -plenty- of nukes.

Re:Take 'em offline

[gumbi west]

Yeah, I'll bet your honeypot system would be squeaky clean, plus just this program. Digging this out from all the other crap on the machine would take months.

Re:Take 'em offline

[gatkinso]

It is possible to fingerprint encrypted traffic, even if you can't decrypt it.

But you asked about differences: destination, port, rate, traffic volume. To name a few.

Re:Take 'em offline

[AvitarX]

Heaven forbid I use an smtp server that's not my isp

Re:Take 'em offline

[farseeker]

The third time, require a faxed copy of a receipt/invoice/statement from a third party

Yeah, because I still live in 1998 and work at a law firm, and thus have access to a fax machine

Re:Take 'em offline

[Anonymous Coward]

not really, idiots will reinstall and still be insecure, you have to start trashing data and connected accounts

delete all messages and contacts and change password on any webmail account.
send out pornography and racist email on any VPN or outlook web access accounts accessed, but not in a high volume that would be obviously spam, replace one or two randomly selected outgoing emails with a collection of racist and misogynist jokes then delete from sent messages
if any online shopping is detected track credentials then start randomly wandering the same sites buying shit, again in low enough quantities to not be obviously automated
reflash and brick USB connected smart devices which are recognized as being vulnerable to such mischief.

sector by sector encrypt the entire hard drive then trash the keys at some point, only run before and after read/write operations to not be suspicious
any data that looks like tax info or medical info automatically uploaded to upstanding and trustworthy places, like 4chan

any info on connected VPNs that looks like corporate data (collections of word documents, 3D models, source code, accounting records, etc, sent to 4chan and wikileaks
any data that looks like contact lists or address books gets uploaded to trustworthy places

use the chatroulette genital algorithm to scan images and videos being brought on to the machine from sources that are likely to be capture devices, webcams, media cards, etc. anything that hits gets sent to every email and facebook contact


as long as the consequences for getting infected do not ruin peoples lives they will continue to not care

Re:Take 'em offline

[DarwinSurvivor]

Sorry, I am NOT going to attempt to eradicate a virus at someone's house if they have no internet. Makes error code lookups, update managing, etc nearly impossible. Sure you could download everything at your own house, then bring that with you, especially since after a re-install you need to run windows-update about 15 times!

I do believe that infected computers need to be dropped off the net, but it is VERY difficult to fix the problem without the internet to begin with.

Re:Take 'em offline

[cbiltcliffe]

Yeah, because I still live in 1998 and work at a law firm, and thus have access to a fax machine

You got an all-in-one printer and a phone line? Then you've got a fax machine.

Re:Take 'em offline

[Anonymous Coward]

The third time, require a faxed copy of a receipt/invoice/statement from a third party verifying that all the connected in the residence are clean and all wireless networks are encrypted securely.

There probably aren't enough IT workers or businesses in 1 state to process the inspection requests for 1 major city.

Re:Take 'em offline

[mcavic]

Don't you mean watching for traffic from a machine that you know is infected? I can almost see ISPs or researchers running infected machines just to see who those machines talk to.

Re:Take 'em offline

[vux984]

Nope it'd be full of crap to be sure.

But how else do researchers "find" botnets, except by looking at infected pcs... ?

Re:Take 'em offline

[AvitarX]

I bet getting rid of that type of customer saves money in support, not all customers are profitable, and the calls about my google hours to a different site probably cost money.

Re:Take 'em offline

[MichaelKristopeit420]

destination is variable.

rate is variable.

traffic volume is variable.

you are presumptuous and ignorant. to name a few.

Re:Take 'em offline

[Grishnakh]

Well if they're sending SMTP mail, then it should be easy to identify them without excessively curbing customers who have legitimate SMTP servers: place a simple limit on outgoing email.

Normal people with their own SMTP servers probably aren't going to send more than a few dozen emails per day.

An infected PC will send millions. No human can generate millions of emails on a keyboard, and there's little reason to think that activity might be legitimate and not spam.

Find people sending tons of email, contact them and find out what's up, and if they don't have a really good answer, shut down their connection until they clean up their PC.

Re:Take 'em offline

[Grishnakh]

The only long term solution is to infect the infected with something that low level formats their HDD.

That will stop the problem.

It's amazingly illegal though, so it's not happening anytime soon.

It's also illegal to infect a PC with a worm and use it to run a spam botnet, but that hasn't stopped anyone. Maybe some vigilante will finally get tired of it and do something about it.

Re:Take 'em offline

[Grishnakh]

not really, idiots will reinstall and still be insecure,

There's no way around this, as long as everyone's running Windows. There is no permanent "fix" for this solution, only therapies. Wiping out infected HDs is an effective therapy. It'll eliminate the infection, and then the users will have to take their computer to the computer store to have Windows reinstalled (and maybe get a newer version that isn't as insecure as 98/Me/XP that many people are still running).

Yes, it's only a matter of time before they get reinfected, but at least it cuts down the botnet size for a while. Similarly, it's only a matter of time before you die, but you don't see many people saying it's pointless to continue living because of that.

Re:Take 'em offline

[Grishnakh]

What the heck is a "phone line"? Is that one of those things they used to have back in the 70s and 80s where your phone was connected to the wall? How quaint.

Re:Take 'em offline

[unity]

Well that won't work, the ISPs might disable the botnets run by govt contractors.

Re:Take 'em offline

[postbigbang]

Sniffing traffic pairs to CnC destinations. Mirror a switch port, then sniff the traffic to nonsense destinations. Watch DNS logs for odd hit builds. Sift some more.

Look for local destination peers that don't make sense. Then you've got the local net infections.

Re:Take 'em offline

[DigiShaman]

Scorched Earth policy. I like it! Better hope they have backups for when the data reaper comes.

Re:Take 'em offline

[DigiShaman]

Considering that DARPA played a part in funding packet switched technologies in the 1960s, I'm fairly certain redundancy was the goal in the event of a nuclear exchange. So if the Internet today was spawned from that primal goal of military redundancy, I don't think a few nukes will take it out entirely. Hit a few cities, and you'll break its back. Sure. But it will route around the damage.

Re:Take 'em offline

[gumbi west]

The thing about P2P is that it need not communicate with CnC destinations, only a few need to do that / or the CnC only needs to communicate with a few of them.

Re:Take 'em offline

[zippthorne]

Well what is it doing? Calculating bitcoins? The C&C is encrypted, but the shady things it does cannot be. Just look for a lot of SMTP traffic in leet-case, or other signs of it trying to interact with the "outside" world.

Re:Take 'em offline

[the_bard17]

Detecting the difference between the encrypted P2P traffic and "normal" P2P traffic's gonna be difficult at best, I'd agree. So approach it from a different angle. Figure out what the infected PCs are being used for, and look for similar behavior. I'm not saying it's easy, but it's something.

Who doesn't have access to a fax machine? My local grocery store has one. My workplace has one. As another poster pointed out, a landline and a scanner (or AiO printer) will function as one. Anyone sufficiently literate to remove the malware from an infected system should be able to reason out how to access a fax machine.

Send the T&C requirement off to marketing. I imagine they'll spin off some blurb about the ISP making the internet a "safer place". Let marketing word it right, and the unwashed masses would probably eat it up. Not everybody, but likely enough.

Thankfully, I'm not running an ISP. The previous has been nothing but an idle thought experiment. It's someone else's problem to deal with.

Re:Take 'em offline

[the_bard17]

Hence the first two "allowable" incidents. Let the subscriber (or a hired tech) call in, explain the situation, and allow 'net access after the system's being cleaned or the infected system is disconnected from the local network. That's not assuming that the hired tech has access to mobile broadband. Yeah, it's not perfect, but it's better than simply twiddling thumbs while the infected systems are controlled.

Re:Take 'em offline

[dakameleon]

I think GP was referring to the EMP effect of nukes zeroing out the drives.

Re:Take 'em offline

[Dadoo]

The only long term solution is to infect the infected...

I dunno... I'm inclined to believe it would be best to just fine people, every time their computer is found participating in a botnet. Start with $10, then double it every time, until you get to a maximum of $250, or even $500.

A computer is not an appliance, like a refrigerator or a toaster. It's more like a car, where you need a minimum level of knowledge to keep yourself and others safe. The sooner people learn that, the better.

Re:Take 'em offline

[DigiShaman]

No, an EMP will not zero out the drive platters, but they will induce enough current to fry the gates in microchips. That includes, RAM, ROM, Controller...etc. So data can be recovered as long as you replace the fried controller board.

SSDs on the other hand...toast. Toss it. It's deadweight.

Re:Take 'em offline

[slashmydots]

They would also have to fake the size/duration of the data sent and the interval though. It would likely match some sort of recognizeable pattern. Years ago I heard about encrypted data being recognizeable to a specific software suite because of intervals and data sizes combined. Also, I'm no networking expert but that type of encryption doesn't mask the target IP, just the sending one, right?
Oh and the MBR being invisible to the OS is BS. Avast, Combofix, Malwarebytes, the fixMBR utility built into windows, and at least a dozen other tools I know of can detect malicious MBR changes. In fact, it's such a simplistic location that it's almost impossible to hide a virus there and the virus is helpless against bootable utilities like BartPE and Knoppix.

Re:Take 'em offline

[jimicus]

So what's the difference between this botnet data, an SSL connection to a bank, or an encrypted email/file?

The answer is you can't tell, and neither can the ISP.

Not strictly true, actually. IIRC it's already been shown that while SSL hides the content of the connection, it does a lousy job at hiding the protocol/likely payload; you can generally deduce this with remarkable accuracy by looking at the patterns the traffic follows.

For instance: Voice will have a more-or-less constant stream of small packets going in both directions, an interactive HTTP session will have bursts of data with packets of varying size in both directions, the total amount downloaded in each burst being up to a few hundred K at a time, a file being downloaded over HTTP will have a number of large packets in one direction and a constant stream of much smaller packets going in the other direction. It's a bit more sophisticated than this but AIUI that's the general gist.

It isn't 100% accurate, but for most practical purposes it's close enough.

Re:Take 'em offline

[Anonymous Coward]

... and that means ... what?

Re:Take 'em offline

[EvilIdler]

My ISP blocks outgoing, non-authenticated SMTP to outside services, and only accepts authenticated connections to their own service on the usual higher-numbered ports. I can still use my own SMTP service, since I use authenticated and encrypted connections on a different port. Spam trojans tend to try using the locally discovered SMTP service on port 25 (similar to how some Linux distros guess settings), which is easily stopped. There might be more cleverly designed botnets out there, of course, but isn't the whole point of some botnets to use as many different mail servers as possible to spew out spam?

Re:Take 'em offline

[Opportunist]

So the next version of the trojan will emulate being a SSL encrypted webpage, or even wrap the C&C commands in HTTPS to make sure. By the time you have actually implemented such a filter, it's already rendered useless.

Re:Take 'em offline

[Opportunist]

Considering how far we're today from the original intention of the internet and redundancy has been reduced to a mere shadow of what it used to be (face it, it's been nearly eliminated), I wouldn't count on the internet as we know it today being able to deal with a massive blow to one of its SPOFs.

Re:Take 'em offline

[Vegeta99]

Airwave Networks, the ISP for my apartment complex when I was in college, did the same in 2005-2010.

Re:Take 'em offline

[Opportunist]

The OS is helpless against a user that clicks "ALLOW" on anything the OS identifies as dubious. Do you think it would be different if everyone used Linux?

Scenario: Someone downloads a cool Linux tool that allows him to completely hide his internet traffic and use P2P with a spoofed IP address so nobody can trace it to him. Doesn't work? Of course it doesn't, but that's what this tool (aka trojan) promises. Joe Clueless now switched to Linux, since it's so much more secure, and wants that tool, since he doesn't want anyone to know that he's hunting down P2P networks for Llama porn. Now, he tries to install it and gets shot down by the system because, well, a trojan wants more than just simple user privs. But thankfully the trojan tells him "sorry, you need more privileges to run this, type "sudo installthattrojan" and provide your root password.

Will Joe do it? You bet he will! Can Linux prevent that infection? Hardly, without taking away Joe's control over his own box. And if you propose that, we're on a very slippery slope here, taking away control from the owner of a system is opening a whole different can of worms.

Re:Take 'em offline

[cgenman]

Judging by some of my clients, a low-level HDD format is just a short-term solution to virus problems. It will be back.

Of course, my system has caught bugs in the past too, from god-only-knows-where. Quite frankly, I've had enough random slowdowns on this machine that I wouldn't mind a way of securely scanning the MBR for rootkits. Also, why can any application alter the MBR without explicit, highly-manual interaction? You should have to open up a cover on your computer and hold down a small red button to enable MBR writes.

Re:Take 'em offline

[catmistake]

The only long term solution is to infect the infected with something that low level formats their HDD.

That will stop the problem.

Yeah, because infections totally can persist if you just do a quick format. Low level format is the way to go, especially if you charge by the hour.

Re:Take 'em offline

[heypete]

Heaven forbid I use an smtp server that's not my isp

Go for it. Just don't do it directly from a dynamically-assigned address. While doing so may be handy at times, it makes spamming incredibly easier. Blocking such addresses significantly reduces the scope of the problem.

There are plenty of non-ISP email providers that provide SMTP service (usually over port 587). I use several myself.

Re:Take 'em offline

[orange47]

perhaps, but if the network was secured properly it couldn't be damaged in such way.
infected computers are damaging only non-secured ones.
I still believe one day all exploits will be patched and people will be smart enough not to infect their PCs, even though software is getting more and more complex.

Re:Take 'em offline

[interkin3tic]

I think GP was referring to the EMP effect of nukes zeroing out the drives.

You give me too much credit: I was just suggesting we destroy the people who get infected and their computers. With nuclear weapons.

Re:Take 'em offline

[Anonymous Coward]

I don't think you know what a low-level format is.

Re:Take 'em offline

[eugene ts wong]

That red button that you suggest should also shut down the computer and restart it into a different mode, so that the user can see that the operating system is no longer working. That should scare the user a little, so that Joe Sixpack will know that this is not for enhancing his web browsing experience.

Altering an MBR should be as hard as installing an operating system onto a blank hard drive.

Re:Take 'em offline

[eugene ts wong]

Your idea doesn't seem to be very popular, but I like it. I especially like bringing in a third party, because there is less conflict of interest.

Re:Take 'em offline

[Jaruzel]

Can you provide some links to these services? Thanks.

Re:Take 'em offline

[hairyfeet]

There is a BIG difference between you running an SMTP server, even if you send out a daily newsletter to a couple of hundred folks, and a spambot cranking out several hundred thousand emails an hour. Not to mention most ISPs have it in their TOS that if you want to run a server you need to be on a business line anyway, so in either case the ISP has reason to dump you.

As for TFA as a guy who actually fixes the thing for a living it used to be you could actually clean a machine, but not anymore. The rootkits, trojans, all the nasties have gotten so infectious it is pretty much nuke from orbit. Considering how big a bunch of cheap bastards the OEMs are and how everyone ends up with "restore partitions" instead of actual discs I'm just waiting on a bug that infects the restore partitions first thing. Personally that would give me a big happy as it might force the OEMs to actually hand over a disc once in awhile.

As for it being "indestructible" where have they been? The nasties have been getting sneaky as hell for the past couple of years. Ultimately unless as another poster said they are using them as Bitcoin miners they are gonna HAVE to use the infected person's bandwidth and THAT is where you'll catch them.

The only thing that worries me about bugs like this using encryption is a friend that works state crime lab says more and more CP pushers are using infected machines as file dumps. With all this encryption it wouldn't surprise me if whomever cooked this up ends up renting out space to the CP scum. Having your door kicked in by the FBI because some fed traced a CP download back to your machine? Not a nice way to spend a weekend I think.

Re:Take 'em offline

[VortexCortex]

Sorry, I am NOT going to attempt to eradicate a virus at someone's house if they have no internet.

I've removed viruses at people's houses before.

Step 1: Boot the system from a known good state: Linux Live CD or USB ( I used the latter for persistence of virus signatures, and installed programs).
Step 2: Scan the files.
Step 3: Backup any essential non-infected data.
Step 4: Use MY computer with MY mobile Internet to download a BIOS image, then flash the infected machine's BIOS.
Step 5: Re-Install the OS. Use my computer's wireless Internet connection to obtain any drivers / applications needed for the newly installed system.
Step 6: Hand them the backup media and say, "Your data is on this disk, but I can not ensure it is safe to use this. If you insert this disk, you may re-infect your computer and I'll have to charge you to disinfect again -- none the less, here are your backed up files."

"You've been caught being a Spy, and disciplined, are you still a spy?"
No, I promise... I'm not going to defect again...
(You Trust Them?)

If you "remove" viruses by removing files, etc., you need to turn in your geek badge. Oh, sure, some malware has known removal procedure -- How do you know that malware wasn't installed by a deeper rootkit? BIOS flash, reformat & re-install.

Re:Take 'em offline

[snemarch]

Making the MBR invisible to the OS isn't BS, once the rootkit has loaded it will intercept disk access and return filtered data.

Won't be able to do that with a (clean) boot-from-cd/usb OS or tool of course, but that's a different story.

Re:Take 'em offline

[snemarch]

...and sudo probably isn't even going to be necessary, there's surely a fair amount of local privilege escalation bugs that haven't been detected yet. Yep, they'll get patched eventually, but a "Joe Clueless" won't be updating his system and thus won't get the fixes :)

Re:Take 'em offline

[mcvos]

I'd rather we didn't do that. I don't know for sure whether anyone in my neighbourhood has an infected PC, but I'd rather not take that chance.

Re:Take 'em offline

[rbarreira]

So you're suggesting that people get a "computer license" like a driving license?

Re:Take 'em offline

[realityimpaired]

No, I was responding to his question about how they detect this kind of virus in the first place. At that point in time they don't know it's infected, so they watch the traffic from a system that they presume to be clean and not doing any sort of p2p, and when they notice that sort of traffic happening, they know to examine that system to see what got it.

Re:Take 'em offline

[Anonymous Coward]

Heh. Anyone can now generate torrent-like traffic unknowingly. TDL zombies looking like bittorrent clients, bittorrent clients looking like TDL zombies.

Only thing left to do is make TDL zombies actually participate in random popular torrents. =P

Re:Take 'em offline

[Anonymous Coward]

Just issue p2p command signals to make every bot download MPA torrents, then it will soon get taken offline.

Re:Take 'em offline

[scrib]

infected computers are damaging only non-secured ones.

This is patently false. One of the reasons people create botnets is to spam non-infected computers. Spam may or may not be "harm" depending on your definition, but a DDoS attack certainly is.

Re:Take 'em offline

[scrib]

It'll also piss off anyone who lets a friend come over and use their wireless while visiting. ISPs may be able to block an infected account, but that would affect every computer connected through the account. How do you prove that your systems are clean?

How about doing it the other way around? Contact the owner of the account to let them know they have a potential problem. If they don't get in cleared up in some reasonable time, THEN block the account.

Re:Take 'em offline

[Kijori]

I don't know whether it's the same in the US, but over here (the UK) most businesses have a fax machine. Certainly everywhere I've worked has, and when I had trouble with my mobile phone and had to send a document to their HQ I just went to their nearest retail store and they faxed it for me. They're so cheap that if having a fax machine saves one employee one hour to get or send a document then it's already practically paid for itself.

Re:Take 'em offline

[Anonymous Coward]

It should be "lather, rinse, repeat". Unless you have a very odd way of washing your hair, that is...

Re:Take 'em offline

[postbigbang]

Yes, and no.

Consider that nodes need a direct route, and that it's unlikely to need store-and-forward where messages are waiting in a queue. Cut a few key nodes and synchronicity is lost. Seeding instructions requires a number of reliable nodes; lose some of those, and you're hosed.

Re:Take 'em offline

[JasterBobaMereel]

The difference being is that having a driving licence does not mean I am responsible for people attacking my vehicle ...

Do I need a licence for my SatNav, My PVR, My Phone, etc ...

Not entirely practical

Or perhaps we should start fining MS since the vast majority of Botnets consist almost entirely of MS systems ....?

Re:Take 'em offline

[Abstrackt]

It's also what a lot of rural people have when power outages are common, cell phone reception is shitty and they'd like to be able to phone people in an emergency.

Re:Take 'em offline

[jc79]

What the heck is a "phone line"?

It's one of those pipes that the intarwebs comes through. Not heard of DSL?

Re:Take 'em offline

[berzerke]

...Find people sending tons of email, contact them and find out what's up, and if they don't have a really good answer, shut down their connection until they clean up their PC.

Working for an ISP, I can tell you it's suspend first, ask questions later. Wait too long, and you're on every blacklist in existence. It takes as little as one message in some cases to get your server blacklisted. And some blacklists don't care how fast you shut it down, you're still on until they decide to lift it, and it takes a LONG time to get off. Hotmail/MSN are really bad about this.

Re:Take 'em offline

[berzerke]

I'm seeing spambots use stolen authentication and even encrypted connections. Authentication won't fully protect you.

Re:Take 'em offline

[Anonymous Coward]

It's easy to block connections on port 25. You're the idiot.

Re:Take 'em offline

[Anonymous Coward]

I'd rather we didn't do that. I don't know for sure whether anyone in my neighbourhood has an infected PC, but I'd rather not take that chance.

Well, that's an attitude that's contributing to the problem, isn't it? ;)

Fortune favors the bold.

Re:Take 'em offline

[Deadplant]

No, no, that is overkill. The electrical grid is the real source of the problem. Shut that down and the problem is fixed.

Re:Take 'em offline

[SanityInAnarchy]

Well, more than that, access to the local account is usually sufficient. This is why additional sandboxes (like Chrome's, or App Armor) are still useful.

Re:Take 'em offline

[Grishnakh]

Scenario: Someone downloads a cool Linux tool that allows him to completely hide his internet traffic and use P2P with a spoofed IP address so nobody can trace it to him. Doesn't work? Of course it doesn't, but that's what this tool (aka trojan) promises.

Trojans are indeed pretty much impossible to prevent given clueless users who have root access to their own machines.

However, most of the Windows infections in the past decade I remember weren't trojans at all, they were worms that came from websites, and didn't require this degree of user interaction, or which auto-executed from infected media. Infections from vulnerabilities are of course possible on Linux too, but I don't think they're as easy since Linux systems tend to be much more heterogeneous (i.e., is a user running a Debian system, Ubuntu, Red Hat, Suse, Sabayon, etc.? Is he running kernel 2.6.35, 2.6.38, 2.6.32, etc, and which patch version (2.6.38.6, etc.)?). There's a lot more variability in Linux land than in Windows land, where everyone is pretty much running one of three XP versions, possibly Vista (not likely), or 7. And infections from autorun are unique to Windows AFAIK; I can't imagine a Linux distro being stupid enough to implement autorun, yet it's still the default on the latest Windows. (Oh wait, I can imagine it: with the way Canonical is going these days, if anyone implements Autorun, it'll be them.... But with all their regular users abandoning them in droves lately I wouldn't be surprised if they fold soon.)

Will Joe do it? You bet he will! Can Linux prevent that infection? Hardly, without taking away Joe's control over his own box. And if you propose that, we're on a very slippery slope here, taking away control from the owner of a system is opening a whole different can of worms.

Re:Take 'em offline

[KnownIssues]

So what's the difference between this botnet data, an SSL connection to a bank, or an encrypted email/file? The answer is you can't tell, and neither can the ISP.

Simple solution... don't allow encrypted traffic. If you're not doing anything wrong, you don't have anything to hide.

And no, I'm not being serious.

Re:Take 'em offline

[Deadplant]

It is the same everywhere. Businesses pretty much all have fax machines.
Why? because they are useful. fast and effective.

Re:Take 'em offline

[Deadplant]

I still believe one day all exploits will be patched and people will be smart enough not to infect their PCs

awwww, that's adorable!

Re:Take 'em offline

[GameboyRMH]

they have no way of knowing whether that encrypted p2p traffic coming from your system is a virus, or you trying to download a linux ISO.

Ahem, FTFY >_>

Re:Take 'em offline

[Grishnakh]

I tried and abandoned DSL ages ago for cable internet. Around here (Phoenix), Qwest has a universally horrible reputation (and I was dumb enough to try them out back around '02; never again). Cox cable, OTOH, has been working out quite well for me for many years, even though it's not quite as cheap as the Qworst crap.

I dread the thought of eventually moving out of here and finding that Comcast is the only provider in my new location....

Re:Take 'em offline

[vux984]

For all intents and purposes that's "inspecting local pcs".

Re:Take 'em offline

[mcavic]

Oh, right. Sorry. By "that kind of traffic", you meant p2p, not virus.

Re:Take 'em offline

[Anonymous Coward]

Curious Yellow was suggested by Brandon Wiley back in 2002.

It includes features like a distributed p2p network, encrypted communication, obfuscated and morphed code, updates through background traffic to avoid timing correlations. And finally, a Curious Blue antidote by the "good guys".

Re:Take 'em offline

[justsayin]

Good comments, I am with you on most of them. I do occasionally get an actual OS CD from the OEM. Just to freshen up my stock. I totally understand why they went the embedded partition for a system restore. It makes it awfully handy to put the laptop/PC back like it was when it left the factory. Users usually lose the OS CDs or DVDs anyway. I also cringe every time I do a system restore with that embedded or hidden partition because just like you said, it's the first place I would put a virus if I knew how to write one. :)

I just opt to pay Dell or whichever OEM a little more money and they include the installation media. I remember way back when they started calling it media. I figured they were just setting us up for another charge so they could maximize their profits.

I wonder if this botnet survives a good DBAN? I use that tool if I even think the hardware was rooted. 3 Cheers for Darik! Huzzah, Huzzah, Huzzah.

Re:Take 'em offline

[sabt-pestnu]

If you're serious about your customers not being parts of a botnet, you're probably not terribly concerned when someone who has been repeatedly pwned and not taken steps to protect themselves becomes a "former" customer.

Re:Take 'em offline

[Coren22]

You do realize that "low level format" will brick the hard drive right? I think you mean to do a non quick format, they are slightly different things.

Re:Take 'em offline

[Coren22]

Heck, Sprint threatened to disconnect my work's DS3 when we had an infected machine. Geekmux shouldn't kid himself, the ISPs with balls are more than happy to do this.

Re:Take 'em offline

[equivocal]

I wondered what an EMP will do to LEDs, particularly the ones in a flashlight.

Re:Take 'em offline

[RocketRabbit]

You could just filter by MAC instead, which would probably be easier. Tell them to call in and ask for reactivation.

Re:Take 'em offline

[Anonymous Coward]

fixmbr anyone?

Re:Take 'em offline

[ultranova]

Consider that nodes need a direct route, and that it's unlikely to need store-and-forward where messages are waiting in a queue. Cut a few key nodes and synchronicity is lost. Seeding instructions requires a number of reliable nodes; lose some of those, and you're hosed.

Nope. You just connect a machine into the Net and wait for it to get infected. Then you can insert instructions through that local node.

Re:Take 'em offline

[melikamp]

Will Joe do it? You bet he will! Can Linux prevent that infection? Hardly, without taking away Joe's control over his own box.

Actually, many current GNU/Linux do make this scenario very unlikely. If you use Debian or Ubuntu, you are led to install from signed repos. Even adding a custom repo is too complex for regular users. What am I saying... Regular users find synaptic incomprehensible. Raving idiots like Joe you described (people who heard about "spoofed IP address" but will download and run a strange binary) are extremely rare. And you are right, there is no cure for them.

There is, however, a cure for almost everyone else, and it should not be dismissed. People need to recognize that proprietary closed-source software is insecure by design, and there is never a good reason to use it. I bet that many more people get rooted through either Flash, Internet Explorer, Outlook, or Office than by downloading and running a program. The latter requires one to be an ignorant moron. The former will happen sooner or later if you trust a proprietary software vendor. Hell, vendors themselves root you whenever they think they can get away with it. How else would you characterize copy-protection? You are essentially rooted for their pleasure, after having paid.

We as consumers need to get our shit together and start paying directly for free software development. We also need to get it through our thick skulls that no form of entertainment is worth giving up control of your general-purpose computer. The outcome will be much cheaper (2-20 times), much more secure, and all-around higher quality commodity software.

Re:Take 'em offline

[Joe U]

I don't think you know what a low-level format is.

MFM or RLL?

Yes, I know what it is, and yes, the result is erasing and re-writing the underlying track and sector map of the drive.

Of course, we don't low-level format anymore, there's no need, I was being dramatic. Zero out, would be the closest thing to a low-level format in today's environment.

Consider yourself told.

Re:Take 'em offline

[Joe U]

Burning people! He says what we're all thinking!

Re:Take 'em offline

[Joe U]

Yeah, because infections totally can persist if you just do a quick format. Low level format is the way to go, especially if you charge by the hour.

I figured turning the system into something that's unusable and near impossible to recover from would be a good starting point.

Re:Take 'em offline

[catmistake]

Actually, it was sarcasm. Show me any malware that can survive a quick format, please. I get a lil annoyed at so called Windows experts that say and do things without thinking, using rhetoric so the end user thinks they must be 1337. Its simply dishonest when a tech acts like they did a lot of work and says things like "yeah, I scanned for this and I scanned for that, defragged and optimized for you, this system is clean, you're all set," and its clear they have no idea what they just did, and simply do not know (and no one in the universe could) whether a system is clean or not. That's one of the major issues with Windows... you just never know. Its why reinstall, as much as a pain as it is, is so appealing when it really matters.

Re:Take 'em offline

[catmistake]

I was being sarcastic. Show me this malware that can survive a quick format. I want to work for the author of that piece of impossibility.

Re:Take 'em offline

[Anonymous Coward]

Your solution is impractical. Suppose the infection hits the office lan, and you need your systems up and running to answer help desk requests, or to run your manufacturing applications.

What do you recommend then?

What I believe we must do, is have a CD/DVD boot drive, where the operating system is entirely read-only. When we need to boot the system, we boot from it, and it immediately scans the system, and ensures that critical files are replaced. I say replaced, because the existing one from the previous day may already be corrupted.

I think that the other alternative is to change operating systems to a version that does not use the same module names. But this will not protect existing systems that are rarely used.

Re:Take 'em offline

[jon3k]

The answer is you can't tell, and neither can the ISP.

You really don't know that yet. We very well could use deep packet inspection to identify the traffic to a very high degree of accuracy based on the traffic patterns.

Re:Take 'em offline

[jon3k]

Oh, also honeypots. Intentionally infect a machine with the virus and watch the network traffic to see what it talks to and how often.

Re:Take 'em offline

[hairyfeet]

The really sad part? There is a BUTT SIMPLE way they could fix it. Simply have all their OEM Windows discs on a server somewhere so you pay them $10 and get a download link to the .ISO. Just imagine how much easier it would be for you as the user, for me as a small shop, for everybody. Don't have the disc? pay $10 and have an .ISO that you can download forever. You burn, you install. Easy peasy.

What really scares me on this bug is the encryption thing. According to my bud in the crime lab CP pushers have been using infected machines more and more as file dumps and this fits right in with their MO. The way he explained it is like this: I'm a CP pusher, I have several Gbs of CP porn but I sure as fuck don't want it on MY computer. So I hire Mr malware who infects thousands of machines. We spread my CP crap to these machines with plenty of redundancy so that if any are offline my customers can still get to the filth, then I sell keys to the botnet for those that want to view my garbage. According to him we are talking $30,000 a month on up with some making a cool quarter million a month easy.

So it is THIS which makes me think restore partitions are a BAD idea. Most are filled with trialware garbage that most users wouldn't even notice if the malware were to remove it since they never used that shit anyway, and when you are talking $30k a month you have a damned good reason to hang onto those boxes as long as they can. Hell they could even wipe the restore partition and replace it with encrypted CP and have an extra 5Gb+ worth of filth on every box! it is just a bad design that ignores the reality of modern malware IMHO.

Oh and if you haven't tried Tuneup utilities you really should. They have a trial version and if you look around the net they often offer last years version for free hoping you'll like it and upgrade. The last 3 versions work great on Win 7 so no worries and it takes the BS out of keeping a PC clean and fresh. It really is worth the $30 and I highly recommend it and combined with Comodo Dragon browser and Avast free I have yet to see a PC with that combo cross my desk again for anything but hardware upgrades. they just keep on purring, no hassles, no bugs, and they are simple enough that anybody can run them. hell with tuneup you don't even have to do anything as it schedules its own one click maintenance every three days silently. really sweet and you should give it a whirl.

Re:Take 'em offline

[Joe U]

If I remember, quick format doesn't overwrite the MBR or partition tables. There are plenty of ways for a virus to survive that.

Re:Take 'em offline

[Joe U]

Show me any malware that can survive a quick format, please

It's called a boot sector virus.

Re:Take 'em offline

[DarwinSurvivor]

By that logic, how do you know a virus you never detected wasn't installed by a deeper rootkit? You're basically saying, once it touches the internet that you need to flash/format/install anyways. That's like saying you need to replace the axel of your car after a flat tire because there MIGHT be an issue in the axel that caused it.

Believe it or not, reformatting is not always necessary.

BTW, it's really nice that you bring your own mobile internet with you when you fix someones house, but many people don't have that luxury.

Re:Take 'em offline

[Anonymous Coward]

Actually, in a past life I was an "abuse team" member for a small ISPand we did use the above policy. If a customer called and said there was a tech in their home, we would turn their interet back on for a few hours. If they didn'tcall back in a reasonable amount of time, then we would shut them back off.

Re:Take 'em offline

[heypete]

Gmail and LavaBit, to name but two.

Re:Take 'em offline

[Sardaukar86]

you are presumptuous and ignorant. to name a few.

...and you are a useless cunt with nothing to contribute.

Your point?

Re:Take 'em offline

[Anonymous Coward]

Okay, so you can tell the difference between a voice conversation, a typical web surf session, and a large unidirectional file transfer.

Newsflash: every other type of transmission tends to look like one of those three. Admining a server would probably look like HTTP, with me sending small commands and receiving page-long responses. Gaming probably looks like voice, with its constant sync chatter between hosts. My hourly backup scripts might even look like Bittorrent, because a bunch of my servers start pushing gigabytes of data to a big file server.

More importantly: nothing is preventing any one of these from masquerading their data flow as another. Steganography is extremely easy to implement. Just stuff your valid data inside a stream of innocuous-looking garbage. Anyone devising a botnet can incorporate such techniques to hide their evil bits in plain sight.

Re:Take 'em offline

[jroysdon]

Not if the instructions are signed. Assuming public key encryption, you'd have to have the private key to sign the C&C messages.

The best you can do is block the C&C channel.

Re:Take 'em offline

[jroysdon]

This assumes only a few payloads. Mix a constant rate of traffic in for a constant bitrate and you'll never know. I can easily perform QoS on both end-points to give voice or streaming content a higher priority than the "background" filler data. Mix in multiple users going to multiple remote VPN hubs and you can't effectively track anything if the client tools and/or the VPN hub proxies are scrubbing it all.

Re:Take 'em offline

[jroysdon]

> I'm inclined to believe it would be best to just fine software vendors, every time their software is found participating in a botnet.

Fixed that for you. So long as the end-user doesn't do something stupid (disable the OS and other software updates), the vendor should be liable. If the end-user does muck it up and their was a vendor fix available, fine the end-user.

Lawsuit

[kylemonger]

Some operating system vendor is going to have to be sued for damages and lose before this ever stops.

Re:Lawsuit

[AvitarX]

I hope not.

If os's need to be locked down like ios to avoid liability we're fucked in the long run (the fact that it's described as a trojan implies to me it's a stupid user issue).

Linux will always have forks that give users control, even if the main branch removes this, in your hypothetical world, does that make it the least secure vs the other toal lockdown systems, and therefore all the developers liable?

Re:Lawsuit

[lymond01]

I'm guessing there are still 4 million XP machines with default Administrator accounts and no password. Microsoft has done a much better job with default user security starting with Vista and improving in Windows 7. Even if you're silly enough to run as admin, as long as you don't turn off UAC, you're a million times better off than running Windows XP as admin.

Re:Lawsuit

[kylemonger]

Out in the non-software world, if you operate a machine that damages someone else's property, you're liable. If you were operating the machine properly and it malfunctioned, causing the damage then the manufacturer or whoever serviced the machine last is probably liable. Right now, when PCs wreak havoc there's no proximate party to go after. Until that changes, there's no strong incentive to fix the problem at the root.

The OS doesn't need to be locked down like iOS, but if you're gong to hold the user liable, you need to give them some way of installing software that doesn't give that software the full power of the PC. That is, some way to properly operate the device that limits the damage it can cause. As an example, something that purports to be a game doesn't need to be able to send packets to every IP address on the Internet. Once the OS vendor gives the user a way to properly operate a PC, then the liability can be shifted to the user. Until then, the liability should rest on the OS vendor.

Re:Lawsuit

[scubamage]

the fact that it's described as a trojan implies to me it's a stupid user issue.

I had a trojan issue once. Now I have a kid. Trojans are stupid.

Re:Lawsuit

[Anonymous Coward]

In the physical world it wasn't so long ago that cars didn't have keys, airbags, antilock brakes, etc. It wasnt the manufacturers liability for accidents with those older cars as the generally accepted state of car tech didn't include those components. Even now if you drive a 1952 Ford the company that originally sold it isn't responsible. The analogy - MS will be responsible only for the most up to date OS they ship to be on par with most other commercially available OS's. No, they don't have to build an Edsel (look up one of the safe car designs in the past and see where they ended up - on the junk heap).

The difference now - someone else ganged up a few million machines and has them accessing the public byways with malicious intent. The obvious solution- safety inspection and certification for all nodes with corresponding loss of anonymity just as we've done for automobiles. Trivial for MS and Apple to implement.

The key question - will their be room for hobbyist OS's as the required brrier of safety testing, certification, liability and identity tracking?

Re:Lawsuit

[Homr Zodyssey]

Time for a car analogy.

If someone hot-wires my car, and then rams it into a police station, then I'm not liable. The car manufacturer is not liable. The police are not liable. As a matter of fact, its not even my fault if I left the doors unlocked and the engine running. The person responsible is the bastard that stole it and did the damage.

These viruses and botnets are not spontaneous. They are not random acts of nature. They happen because of bad guys doing bad things. We should all take reasonable precautions, but we shouldn't be held liable for their actions.

Re:Lawsuit

[kylemonger]

If you're in the car when he rams the station you might be held partly liable.

As for a PC, the worm or trojan is running on it, but you connected the PC to the Internet. You supplied the PC with electric power, and you let it run unmonitored while it was doing the damage. So you're partially to blame. Or if you were monitoring it while it was DOS'ing some site, why didn't you stop it?

The OS vendor is to blame because allowing a program to install itself and run without user intervention or monitoring can be considered a preventable malfunction.

Re:Lawsuit

[toonces33]

Yeah, but lots of people do disable UAC. They see it as an annoyance, and they don't see the value.

Re:Lawsuit

[Anonymous Coward]

Malware can run just fine as a user. In fact, all the goodies are on the user level, such as stored documents, etc.

Even running sandboxie might not help, especially if one browser gets infected while another instance of the browser is used for banking.

Re:Lawsuit

[mevets]

I don't know how the post-XP world of malware attraction works. At least in the XP-and-before world, the major goal wasn't your data. The windows kernel put a user modifiable, and kernel-used data structure in place. In this situation, anything that could manipulate the user space could manipulate the kernel space, thus spread itself in addition to stealing all of your data.

This is what is so disingenuous about then 'we are the target because so many people run us' crap. W/(95,98,2000,NT,XP) were the target because it was so easy that anybody could do it.

The real question is whether Vista/7/8 has abandoned this brain damaged VMS inspired model, or is just waiting for the malware bomb to hit.

Re:Lawsuit

[Intrepid imaginaut]

I think having the engine running in your vehicle while you aren't in it might open you to liability, even if its not used in a ram raid.

Re:Lawsuit

[grcumb]

If someone hot-wires my car, and then rams it into a police station, then I'm not liable. The car manufacturer is not liable. The police are not liable. As a matter of fact, its not even my fault if I left the doors unlocked and the engine running. The person responsible is the bastard that stole it and did the damage.

That might be true for the first half-dozen times the bastard did it. But once the number reaches into the millions, you might want to reconsider the design of the car.

Problem right now is that you are all driving pintos.

Re:Lawsuit

[dragonturtle69]

Yeah, but lots of people do disable UAC. They see it as an annoyance, and they don't see the value.

Correct, they see the UAC prompt (or for some needing su/sudo) as an inconvenience, not as a security warning. Maybe if the prompt came with a sound of a locked door handle being twisted, breaking window glass, or car alarm they would get the point.

In the end, they see the "shiny that they want", and will do want they need to get it. Oh, this website needs to install an Active X control and administrator access? Sure, if I get my video/game/screensaver!

Re:Lawsuit

[snemarch]

A user-mode-only process can't do effective rootkitting, though, so it will be easy to detect and remove.

Re:Lawsuit

[snemarch]

The windows kernel put a user modifiable, and kernel-used data structure in place

Citation needed.

brain damaged VMS inspired model

Are you saying VMS is brain damaged, or that the way NT borrows VMS concepts is brain damaged? What exactly do you find brain damaged about the model?

Re:Lawsuit

[scrib]

This is what is so disingenuous about then 'we are the target because so many people run us' crap. W/(95,98,2000,NT,XP) were the target because it was so easy that anybody could do it.

What percent of Windows boxes of have no antivirus? Sure, AV isn't perfect, but it is something that a malware writer has to contend with in the Windows world. Mac may only be about 10% of the market, but a Mac with AV is a rare thing, I think.

My point is that while Mac may seem to be a smaller target, it is relatively uniform and only guarded by the OS itself. Windows is guarded by the OS AND many different AV packages. Can malware authors really look at the 90% Windows market (still lots of XP, some Vista, more and more Win7) as a single monolithic target? Finding a hole in Windows means you can get a small percentage of Windows machines, finding a hole in OSX would likely open the door to almost every Mac out there. Is that really a smaller, less desirable target?

Re:Lawsuit

[BlueLightning]

You would probably be denied your insurance claim at the very least. It might not be liability, but it might at least be be "contributory negligence".

(IANAL, etc.)

Re:Lawsuit

[Terrasque]

In the end, they see the "shiny that they want", and will do want they need to get it. Oh, this website needs to install an Active X control and administrator access? Sure, if I get my video/game/screensaver!

Reference : Dancing pigs / Dancing bunnies problem.

Indestructible?

[__Paul__]

Just wait for the next massive solar storm...

Re:Indestructible?

[Anonymous Coward]

Exterminate all vulnerable platforms?

Re:Indestructible?

[Anonymous Coward]

Exactly.

In the past hackers went after Microsoft because it was "cool" to try and kick the big "boy" in the shins, the it became "cool" to go after government sites on the internet, now ...

With such claims as "botnet X is indestuctible", I wonder how long it will be until hackers start trying to take out botnet's to prove they-are-THE-h4x0r.

Potential circle-of-life moment?

Invisible?

[blair1q]

Putting the thing in the MBR just means you can't intercept it during boot.

It doesn't for a second mean it's invisible.

Re:Invisible?

[vux984]

It can become pretty well invisible to the infected host system though.

A bootable CD or flash drive should take care of things, but that's a bit of a hassle, since a bootable disc needs to be up to date to detect the latest threats... or perhaps the way to go on this is to checksum the existing known good mbr and then validate it from time to time offline against the checksum.

Speaking of which... what are people recommending for actually dealing with this sort of stuff...?

Re:Invisible?

[Anonymous Coward]

Read the article. It explains that is not what makes it invisible and that isn't the type of invisible they are talking about. It is just hard to detect the systems in the botnet.

Re:Invisible?

[korgitser]

Speaking of which... what are people recommending for actually dealing with this sort of stuff...?

Isn't it obvious? The next version of Kaspersky of course!

Re:Invisible?

[schwit1]

http://download.bitdefender.com/rescue_cd/
http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk10/

Both of these update from the internet after booting up.

Re:Invisible?

[Z34107]

The safest way is nuke it from orbit - boot from your Windows install disk, do a "diskpart clean" to nuke the MBR, and reinstall.

The easiest way is to just trust that your favorite brand of virus scanner will eventually take care of it.

Expert mode is make an image of the machine using ImageX, mount it on another PC, clean the virus from the image, and reapply it to the infected computer (after nuking the MBR.)

For lesser threats, MalwareBytes will take care of most anything, although I usually run ComboFix and HijackThis first.

Protip: If you're running a modern version of Windows, you don't need a special boot CD. Vista/7 disks boot to a full WinPE environment which will give you a command prompt (press Shift+F10 or wade through the menu), let you repartition your disk (diskpart), write a new boot sector (bootsect), and mount network shares (net use x: \\computer\share). Any install disk can also install and activate any other version of Windows (you can borrow a friend's Home Premium disk to reinstall Ultimate or whatever).

If you're still rocking XP, the install disk is next to worthless, so go grab a Live CD if you have to do anything interesting.

Re:Invisible?

[scubamage]

fdisk /fixmbr should fix it, no?

Re:Invisible?

[Spikeles]

TDSSKiller

Re:Invisible?

[the eric conspiracy]

Depends on whose fdisk you are using.

Re:Invisible?

[Zaphod-AVA]

That will make the MBR clean on the next boot, but it will reinfect the MBR once Windows loads as well.

Re:Invisible?

[Anonymous Coward]

> The safest way is nuke it from orbit

Whoa, Windows administration is so easy [insert sarcasm sign]... if we really need cannot use a Linux rescue CD, rather than doing all the fuss above, isn't it easier to send someone to the past to defeat the bots?

Re:Invisible?

[Anonymous Coward]

If you had a netboot server (pxe?) you could boot a boot sector that you download from the boot server each time. Just keep the boot server off the network, and you should be sweet. Then a virus can shit all over the boot sector on the hard disk; you just never boot from it!

Actually, is there some pxe image existing already that can do this? Perhaps use dd to create the boot sector initially...?

Re:Invisible?

[cgenman]

Unfortunately, most people who are running a modern version of Windows are doing so because it came on the computer they bought it on. I say unfortunately, because I have yet to see a computer ship with anything but those damned useless "restore" DVD's. It can't fix your system, or perform routine maintenance tasks, or anything useful. And if you've make any alterations to your hardware setup, you can forget it.

Shipping without an install disk for a paid for pre-installed OS that bundles lots of routine OS functionality on its install disk should be illegal. Or, rather, it should be legal to pass around copies of the install disk to everyone who has the OS.

Re:Invisible?

[Anonymous Coward]

This tool has been removing TDL4 for months now.

Re:Invisible?

[snemarch]

Not if the rootkit intercepts MBR access.

Re:Invisible?

[AmiMoJo]

You can run the repair tools from the HDD in Windows Vista and 7 (F8 while booting). You can also use the backup tool in 7 to make a bootable CD with said tools. Still not as nice as having a real install disc but more than capable of killing this virus off.

Once booted into the repair environment if you select the automatic fix option it will check the MBR, see it has changed and put it back to the standard one. It can also take care of driver incompatibilities if say you changed your motherboard and now the system won't boot.

Re:Invisible?

[Anonymous Coward]

Using the MBR used to be the trick for viruses well over 10 years ago. Then BIOSes were released that prevented writing to the MBR, and boot viruses stopped being common. I guess as a result, MBRs with enabled MBR write protection are the exception rather than the rule now.

Boot viruses are supremely detectable though. In order not to be overwritten, any software that wants to stay in memory during boot needs to alter the amount of base memory (does such a thing even still exist?) reported by the BIOS. Back in the day that was typically done by decrementing the contents of address 0040:0013. This used to be pretty straightforward to detect. Does this botnet do the stealth thing that boot viruses used to employ, intercepting the drive interrupt to make itself essentially invisible? That can be circumvented by resetting the drive interrupt to its known-good vector (which can be found by stepping through the code until it reaches a BIOS address).

Re:Invisible?

[xded]

the way to go on this is to checksum the existing known good mbr and then validate it from time to time offline against the checksum.

Isn't there supposed to be a BIOS setting to protect from writes to MBR? I know that MBR stuff is so '90s and nobody remembers about that anymore, but still...

Re:Invisible?

[Rennt]

Or, rather, it should be legal to pass around copies of the install disk to everyone who has the OS.

It is. Well, sort of. It's a licensing thing. You can download an ISO off the piratebay for all Microsoft cares. They only get pissy if you don't use a legitimate key to install it with.

Re:Invisible?

[Anonymous Coward]

Not if you've been blocked by your ISP because they decided you were infected.

Re:Invisible?

[Anonymous Coward]

Boot into Windows Recovery Console:

fixmbr
fixboot
reboot

-- You're done. The MBR and boot sector are good as new.

Re:Invisible?

[Anonymous Coward]

months? I'm sorry, but I was figthing with TDSS kits over three years ago. Ever since, I carry a Linux boot disk with me everywhere.

Re:Invisible?

[The Breeze]

Thank you. I read the whole article wondering, "how can these over-sensationalistic idiot writers spend half the article talking about TDL4 and interviewing Kaspersky employees, and yet not bother to mention the very excellent, and very free, TDSSKILLER tool from Kaspersky that kills TDL4 dead?" If I was one of the Kaspersky guys interviewed, I'd be pissed.

Re:Invisible?

[johnw]

Speaking of which... what are people recommending for actually dealing with this sort of stuff...?

http://www.debian.org/

Re:Invisible?

[Anonymous Coward]

This may have changed, but last I was aware, you were well within your rights to request a physical copy of all the software that comes pre-installed on a computer including the operating system, directly from the manufacturer. And they are obliged to provide it to you for negligible cost, if not for free.

One could also take the route of torrenting an ISO for the OS and burning it to disc. As far as I am aware it is not the possession of illigitimate installation media that is illegal, just installing and activating it with an illigitimate product key. Granted, the type of person that buys pre-fab computers probably won't be aware of this route, let alone have a clue as to how to go about taking it once made aware, but that doesn't remove the existance of this as a route to getting a physical copy of something you already paid for.

But of course, I fully agree with you. If you pay for something that has a physical component, it should be illegal to provide that product as digital only (unless the digital only version carries a discount with it, and the choice remains with the buyer.)

Re:Invisible?

[TangoMargarine]

Not that I knew so at the time, but the first thing you do after buying a computer should probably be to fire up a copy of Clonezilla and image your disk. (Then, after you've cleaned all the crapware off of it, image it again.) Since I'm a CSSE student, I was lucky enough to be eligible for a free copy of 7 Pro which was totally crapware-free, but I ended up imaging it anyway when I fell victim to some malware just a month after reinstalling. So if I get infected with something again, I'll have to reinstall most of my programs, yes, but not the whole system.

Re:Invisible?

[Provocateur]

Er, what is a 'Windows Install Disk'?

Nowadays, I guess the closest thing would be the restore disk or partition from the factory.

Re:Invisible?

[Phrogman]

Shipping without an install disk for a paid for pre-installed OS that bundles lots of routine OS functionality on its install disk should be illegal. Or, rather, it should be legal to pass around copies of the install disk to everyone who has the OS.

I would assume that this is by design, and part of an agreement between Microsoft and the manufacturer so that the manufacturer can include a copy of windows on their computer - otherwise with the current cost of windows it would comprise most of the cost of the computer itself. This way, when windows inevitably dies on the user, they have to go out and buy a real copy. I have yet to have a windows system that has not suffered a failure that required re-installation eventually. MS software is after all, the only software that goes up in price over time...

Re:Invisible?

[flonker]

If you boot into the repair tools on the HDD, you have to load the code in the MBR first. Once you load the code in the MBR, you're hosed, as it just rootkits all calls to read and write the MBR.

Re:Invisible?

[CSMoran]

The disk can be written to not only through BIOS.

Modified MBR Detection?

[Anonymous Coward]

Man, can't they detect a modified MBR nowadays? I even had mainboards which detected a modified MBR upon boot. So where's the problem?

Re:Modified MBR Detection?

[Voyager529]

As long as there isn't a recovery partition (or even if there is, most of the time), boot from an OS install disk, go to repair mode, then type 'fixboot' and 'fixmbr'. you're now have a stock MBR.

Re:Modified MBR Detection?

[Anonymous Coward]

The problem with this is that most people disable the MBR protection in order to install (or re-install) the OS and forget to turn it back on, or leave it off so they won't have to deal with it next time.

This is user error - sort of like changing the tires on your car but leaving the lug nuts off so it's easier to remove the tires next time.

Re:Modified MBR Detection?

[QuantumRiff]

If you load before the OS, then you can load as the host, and run the 'real' OS as a guest operating system. You can then intercept all calls to the hardware. (kind of like how VMware can sit under windows, and tell it that it has an LSI SCSI drive, when it doesn't.) Instead of reporting the real MBR, you can tell the guest operating system that the MBR is exactly what it expects.

Re:Modified MBR Detection?

[mlts]

This is one reason why a TPM chip is a useful tool. It is present, but disabled in most servers.

Enable BitLocker, make sure to save the recovery key somewhere safe (preferably printing it out as well), have it use the MBR, and call it done.

If malware nails the MBR after BitLocker gets turned on, the machine will not boot. One can use Windows PE, mount the system volume with the recovery key, and squash the malicious software that way.

Re:Modified MBR Detection?

[lennier]

If you load before the OS, then you can load as the host, and run the 'real' OS as a guest operating system. You can then intercept all calls to the hardware. (kind of like how VMware can sit under windows, and tell it that it has an LSI SCSI drive, when it doesn't.) Instead of reporting the real MBR, you can tell the guest operating system that the MBR is exactly what it expects.

What if you boot off the CD-ROM created by your favourite virus scanner which bypasses Windows and the hard disk and the MBR entirely?

Kids these days do know that nothing on the hard disk has ever been trustworthy once you have the slightest suspicious of any kind of malware, and that you always boot right off trusted read-only media as soon as you even think of running an remedial anti-malware tool, right? and that this is not some new 2011 thing but was always the case, because MBR infectors were the first kind of virus that came out? You all remember that, right?

right?

Re:Modified MBR Detection?

[flonker]

Not necessarily. The way a typical virus like this works is that it copies the original MBR somewhere (usually at the tail end of the HDD) and calls the original MBR after it installs itself.

Re:Modified MBR Detection?

[mlts]

The key is if the TPM gets "sealed" before or after the infection. After, you are screwed. Before, the modified MBR will be detected, because the PC in its pre-boot process will scan the MBR, make a MD5 hash of it, and pass it to the TPM. Even the most clever malware can't get past that, barring an infected BIOS flash or a compromised TPM.

Re:Modified MBR Detection?

[flonker]

My mistake, I missed the part about TPM. However, in this case, BitLocker doesn't add to security, as TPM by itself would protect you from an MBR threat.

Re:Modified MBR Detection?

[Anonymous Coward]

What encrypting the filesystems do (such as with BitLocker) is provide a definite means of stopping the OS from booting.

Since the TPM is a passive device and does not actively take part in the boot process, without having filesystems encrypted, even a compromised OS can keep going along the boot process. No "/" available means that the worst thing the compromised OS can likely do is either fake a login screen, or just erase all hard disks attached to the machine as a going away present.

Indestructible?

[CokeBear]

Sounds like a challenge...

It runs on windows?

[gmuslera]

Just wait till it faces blue kriptonite

What I want to know is ...

[DrJimbo]

Does it run Linux?

Re:What I want to know is ...

[DaMattster]

The article states that Windows PCs are vulnerable to this botnet. I think it is a safe guess that BSD and Linux machines are, as per the usual, safe.

Re:What I want to know is ...

[Anonymous Coward]

"per the usual", eh? Cocky much?

Take a moment to cogitate on where the "root" in rootkit comes from.

Re:What I want to know is ...

[jamesh]

The article states that Windows PCs are vulnerable to this botnet. I think it is a safe guess that BSD and Linux machines are, as per the usual, safe.

With a couple of exceptions on a dual boot system...

1. If your Linux bootloader is on the MBR then having your MBR overwritten might break something
2. The code that runs in the MBR that starts the bot running before Windows starts might be incompatible with Linux and/or whatever bootloader you are using.

You're right in that Linux won't be infected but it could still get broken.

Re:What I want to know is ...

[toonces33]

It was over 10 years ago when I got my first infection - on a Linux box, of all things. Back then, the distros didn't have automatic updates with security patches, and consumer-grade firewalls weren't available yet...

In this case it might be true that only Windows PCs are vulnerable, but you can't assume that Linux/Mac is completely safe..

Re:What I want to know is ...

[Anonymous Coward]

If it's made its way to 4 million users, i'd say it's out-achieved linux on the desktop.

Re:What I want to know is ...

[dudpixel]

There are linux boot disks available that will fix that up.

I'm betting that a good many of us have had to fix the MBR/bootloader on linux before.

Re:What I want to know is ...

[magamiako1]

The Windows Recovery Disk can do this also without having to wipe the partitions.

Chinese Justice

[msobkow]

Collect botnet creators. Apply one bullet to head. In public.

Repeat.

Nothing else will stop the leeches.

Re:Chinese Justice

[DrJimbo]

Or we could, you know, just use more secure operating systems.

Re:Chinese Justice

[Anonymous Coward]

Ok, then how does this sound...

Collect botnet infected users. Apply one bullet to head. In public.

Repeat.

Nothing else will stop the leeches.

Re:Chinese Justice

[Anonymous Coward]

Users will always circumvent the OS limits. One reason Windows is so vulnerable is that you've got so many technologically illiterate users. If you forced everyone to Linux, that's where the virii will go. Path of least resistance...

Re:Chinese Justice

[Rob the Bold]

Collect botnet creators. Apply one bullet to head. In public.

If you could "collect" the botnet creators, then you could solve the problem in any number of less messy ways, though. Even in a jurisdiction that placed serious limitations on violent public executions, if you arrested the creators you've made pretty major progress toward dismantling it.

Remember: there's nothing magical about ad hoc public capital punishment. (Did I just say there's no silver bullet?) Organized crime exists in countries of all judicial philosophies.

So, by all means, capture the miscreants. Or worm your way into their organization. Or whatever. If the botnet is technically impregnable, do what the criminals would do to gain access: social engineering, carrot and stick, threats, bait, plea bargains -- that sort of thing.

Re:Chinese Justice

[Anonymous Coward]

Collect botnet participants. Apply one bullet to head. In public.

That will teach them not to be so stupid!

Re:Chinese Justice

[ObsessiveMathsFreak]

That didn't work for General Tarkin and it won't work for this.

Re:Chinese Justice

[aztracker1]

You can't fix stupid.. unless you want your new computer to com with an embedded DRM laden, hard to remove OS like iOS?

Re:Chinese Justice

[theGhostPony]

My thoughts exactly. Mod parent up.

Re:Chinese Justice

[lennier]

Or we could, you know, just use more secure operating systems.

A technological solution to a technological problem? Surely you jest!

Re:Chinese Justice

[dudpixel]

Or we could, you know, just use more secure operating systems.

I dunno - even the most secure OS is still vulnerable to social engineering attacks.

The onus is on Microsoft to make windows more secure, rather than the ignorant users. Expecting everyone to research the security of every OS before buying a computer is not realistic.

Re:Chinese Justice

[dudpixel]

Or we could, you know, just use more secure operating systems.

A technological solution to a technological problem? Surely you jest!

Even if it were possible, its still cat and mouse between OS creators and malware writers.

Re:Chinese Justice

[dakameleon]

For the stupid ones? Yes.

Re:Chinese Justice

[snemarch]

Or we could, you know, just use more secure operating systems.

Won't work as long as there's still regular people using computers. Yes, for XP and below the default user account has administrative privileges, but Vista and upwards it's a LUA - the infections you get there are usually from stupids clicking "yeah sure, rape me anally" on the UAC prompts, not by malware doing sneaky privilege escalation.

Re:Chinese Justice

[TangoMargarine]

One bullet for all the botnet creators?

GPL Violators! Get em!

[Hatta]

# When developing the kad.dll module for maintaining communication with the Kad network, code with a GPL license was used â" this means that the authors are in violation of a licensing agreement.

Somehow I think that's the least of their concerns.

Here's an idea

[MrEricSir]

What if someone wrote malware that would run a VM from the boot sector, and then ran your existing OS from the VM? That way it wouldn't matter what OS you used, it could still access your system in the background.

Re:Here's an idea

[DaMattster]

What if someone wrote malware that would run a VM from the boot sector, and then ran your existing OS from the VM? That way it wouldn't matter what OS you used, it could still access your system in the background.

It is still only feasible if the intruders can gain root access to the machine to install the botnet client and vm. I use OpenBSD and I can look at my logs and laugh at the number of failed intrusion attempts. A more secure OS certainly will prevent this.

Re:Here's an idea

[rtaylor]

Ahh, but can you detect the successful intrusions?

Most windows users can also look at their logs (assuming they keep such things) and view a large number of failed attempts. Of course, there are also a handful of successful ones.

Yes, I know OpenBSD is very secure, particular for root access; user accounts not so much if the user will run anything they download. More than half of OpenBSDs security is that security conscious people select that operating system.

Re:Here's an idea

[Anonymous Coward]

It is still only feasible if the intruders can gain root access to the machine to install the botnet client and vm. I use OpenBSD and I can look at my logs and laugh at the number of failed intrusion attempts. A more secure OS certainly will prevent this.

That's fantastic. Now install Gnome or KDE on that box and tell us how secure it is[n't].

Make something useful and it's a lot harder to secure.

Re:Here's an idea

[jmorris42]

> What if someone wrote malware that would run a VM from the boot sector, and
> then ran your existing OS from the VM?

You would notice when your 3D performance began to suck ass. And when either all of your devices became virtual ones or all other performance (net, disk, etc) also began to suck ass. Unless you assume a genius who can create a VM environment that works perfectly transparently, has almost zero overhead and otherwise breaks major new ground in the science; and that they waste their time on a virus instead of kicking VMWare, RedHat, QEMU, etcs ass and seizing a multi-billion dollar red hot market segment.

Re:Here's an idea

[MrEricSir]

It's not new at all; hypervisors have been around for decades.

Re:Here's an idea

[dudpixel]

hypervisors are nowhere near good enough to do all the things the GP mentioned. so yes, the 3d performance would suck!!

Re:Here's an idea

[catmistake]

or all other performance (net, disk, etc) also began to suck ass

But what if the installation was already over 6 months old? How would you differentiate this alleged performance degredation from rot?

Re:Here's an idea

[wmbetts]

Check this out

http://en.wikipedia.org/wiki/Blue_Pill_(malware)
http://www.invisiblethingslab.com/itl/About.html

A girl even helped create it :)

Re:Here's an idea

[snemarch]

More than half of OpenBSDs security is that security conscious people select that operating system.

Spot on the sugar.

Re:Here's an idea

[snemarch]

A rootkit wouldn't need to do the same level of virtualization that a full-blown hypervisor does - access to devices could be let through directly, filtering of disk access to hide the rootkit is done by intercepting OS drivers anyway. Running the rootkit as a hypervisor would still allow the rootkit to hide the memory it's operating in from the OS, as well as not allowing the OS full ring0 access.

I'm pretty sure this wouldn't give a noticeable speed hit for regular users, and would still be pretty darn effective.

Re:Here's an idea

[snemarch]

A girl even helped create it :)

A transsexual guy, to be precise.

Re:Here's an idea

[AmiMoJo]

You would notice when your 3D performance began to suck ass.

Wrong. A virus only needs to virtualise the CPU and memory, it can leave hardware directly accessible.

A VM runs code natively on the CPU and remaps or intercepts access to memory. How far you take that is up to you. Some viruses install a driver that gets loaded early in the Windows boot sequence and uses the MMU to intercept access to memory locations that would allow it to be detected and removed by anti-virus software.

This botnet virus does the same thing but sets up the MMU in the boot block rather than via a driver so it is even more difficult to detect. Any anti-virus software that tries to read the boot block is directed to a clean copy, and the same is done for all the Windows data structures that might show the virus up. Even file system access is intercepted, and I think the FS itself must be corrupted somehow because even attaching the drive to a non-infected Windows machine won't allow you to see the files in some cases. Linux can see and remove them fine, with the added bonus that the NTFS driver ignores permissions so you don't even need to take ownership etc.

Re:Here's an idea

[Anonymous Coward]

Fine for technically literate people, but most people are morons and wouldn't notice this on their overpowered laptop they use to browse Facebook and play Mafia Farm or whatever is the hip thing these days.

I'd be surprised if they even noticed a slowdown to be honest. They'd just complain that "google is loading slowly" or some nonsense.

Re:Here's an idea

[Anonymous Coward]

PROTIP: A transparent VM is easier to make!
You start out with allowing the OS inside the VM direct access to everything. Then, only for very small cases, you use efficient triggers to intercept and change those parts. For example you could intercept the SATA channel with something that only compares each byte sequence going to the controller with the address for the MBR. And only if that is true, you replace the address transparently, redirecting the read/write to e.g. the last sector on the disk, where you previously copied the original MBR to. Since that happens very rarely, and the CMP of the addresses takes no time compared to the read/write time of the disks, it would probably be 100% invisible, unless you specifically look at the time of accessing the MBR, vs. the sectors that follow it.

Re:Here's an idea

[Anonymous Coward]

That already existed a year ago (or 2 or 3 ), I just can't recall it's name but I'm confident it can be googled...

Re:Here's an idea

[Anonymous Coward]

It doesn't need to leave you with much of a host system beneath it.
It shouldn't take too many CPU cycles and byte of RAM to perform typical botnet tasks (spamming) and it can give the virtual system direct access to everything except HDD and network, for both of which you won't notice a speed drop from virtualization.

Re:Here's an idea

[Anonymous Coward]

LOL. He does have a point...

Re:Here's an idea

[Anonymous Coward]

> What if someone wrote malware that would run a VM from the boot sector, and
> then ran your existing OS from the VM?

You would notice when your 3D performance began to suck ass. And when either all of your devices became virtual ones or all other performance (net, disk, etc) also began to suck ass.

Yeah, and performance degradation would be a total departure from current malware.

Re:Here's an idea

[wmbetts]

haha really?

Re:Here's an idea

[snemarch]

Yep, do a little googling :)

Is this

[Anonymous Coward]

the same botnet that's been recently terrorizing SMF forums all over the place?

general purpose computing is dead

[Anonymous Coward]

And this is why. People are completely unable to understanding anything about the operation of their computers.

No, Linux would not solve this. If magically tomorrow every single Windows box was Linux instead, socially-engineered malware would appear the next day.

Apple tries to protect the system from its own user. That's probably the way of the future in general, as as it is to say.

Re:general purpose computing is dead

[drooling-dog]

If magically tomorrow every single Windows box was Linux instead, socially-engineered malware would appear the next day.

One thing that protects Linux, and that has little to do with the OS itself, is the FOSS ecosystem. Pretty much everything you could want is available for free from trusted repositories, and so there is little or no incentive to download and install warez or other pirated software that may have been tampered with. You would still be right, though, if being the dominant "OS for the masses" implies that a similar proprietary closed-source ecosystem would quickly arise around it.

Re:general purpose computing is dead

[lennier]

Nobody is completely able to understand everything about the operation of their computers.

Fixed for reality. If computer security depends on the user knowing every single detail of every program running on their computer at every instant, we're screwed.

But if it were possible for there to be some kind of, I dunno, "system which operates" the computer, and if that system could have some kind of tiny "nut-core" of trusted code which only allowed operations which were mathematically provable not to violate security expectations in strange and confusing ways, like with buffer overflows, the user could simply delegate their trust to the via some kind of "list of controlled accesses" and rely on it not to do things randomly like, eg, execute untrusted root-level code from USB sticks when all the user thought they were doing was reading a file, or have a JPEG image suddenly smash the stack and run i386 machine code. And if the system ever, ever violated these security expectations, and let an application program's attempt to smash the stack or pass random data to an API actually get root access, everyone on the design team would be fired and the company which sold it would be fined a billion dollars instantly, because it would be as unthinkable as a CPU adding 1+1 and getting 58734. .. nah, that kind of idea would never fly, it's crazy thinking. The only route to security is for everyone to take a 15-year multi-doctorate in low-level CPU design and compile all their machines from raw silicon. Anything else is laziness.

Re:general purpose computing is dead

[Stupendoussteve]

Software on the repositories can be tampered with, either before or after being put on the repositories. When Unreal IRCd was infiltrated and had malware placed in the source, that malware ended up in a few distribution's repositories. This attack vector is not all that complicated, because the distributions are not combing the source with a fine toothed comb, they are just building and packaging the binaries. After doing some work submitting packages to Ubuntu in the past, I really feel this vector could be pretty lucrative, and would not be all that difficult.

Some repositories still do not do package signing, which makes a hack against the repository very useful, and again if done right, with some self control, it may not be noticed for a while.

I agree it is safer than downloading things from everywhere, but it's important to realize that the software in the repositories is essentially there because someone did that for you, it doesn't necessarily mean it's 100% safe.

Re:general purpose computing is dead

[gottabeme]

No, it's not 100% safe, but it's neither is going to the bathroom.

All the major distros sign their repos--even Ubuntu PPAs are signed. You're probably right in that the best attack vector would be to modify source code without being noticed, but even that is harder now because of RCSes--project authors will most likely notice commits that they didn't make. It gets to the point that, in order to insert trojans without being caught, attackers would need to attack authors' personal systems, rather than hosting servers--and personal systems are more likely to have changing IPs, be behind firewalls, and be taken offline at random.

The bottom line is that the bar to insert trojans into FOSS software distributed through Linux distros' repositories is so much higher than the bar to infect Windows machines that the odds of it happening on a large scale are relatively infinitesimal. And so, if Windows PCs were magically changed to Linux overnight, it would almost be like the measles and mumps: practically eliminated.

Re:general purpose computing is dead

[snemarch]

Pretty much everything you could want is available for free from trusted repositories, and so there is little or no incentive to download and install warez or other pirated software that may have been tampered with.

Even in a pipedream world where everybody ran Linux, you wouldn't be getting major label games for free. There'd still be piracy for pr0n, movies, games, high-end applications that regular people don't need but do want, et cetera. And your regular Joe Moron won't stop downloading (trojanized) codecs in order to see his warezed pr0n, and even if no local privilege escalation exploit is used, Joe Moron still won't think twice before allowing the trojanized codec root access.

And even in a 100% securely locked down OS, Jane Stupidcunt will still enter her email+password combo on hxxp://funny-party-pictures.rapemecozimstupid.com to see "OMG YOU WERE SO DRUNK!" pictures, her address book will be harvested, and the email spamming will happen elsewhere.

Re:general purpose computing is dead

[magamiako1]

Create completely malware infected repository that keeps most common packages +1 to the version in say, Ubuntu.(so the system always thinks there's upgrades)
Local privilege escalation on client machine.
Insert new public key that accepts malware hosts.
Add malware repository to user's sources.list.
Go to town.

This would not be difficult to do.

Re:general purpose computing is dead

[magamiako1]

Infect GCC with malware so that every future built package is infected.

Re:general purpose computing is dead

[gottabeme]

Local privilege escalation? If you have physical access to the machine, you don't need a local privilege escalation. Sheesh, you don't even need a malicious repo, just install your malware directly.

You'd need a remote privilege escalation in order to install malicious repos on other systems. But if you have such access, why bother? Just install the malware directly.

The only reasonable route to such an attack would be to compromise existing repos, and I already explained why that would be very difficult and likely impractical.

The point is that creating a botnet of this size on Linux systems would be nearly impossible. The architecture of Linux systems and of Linux distros is fundamentally more secure.

Re:general purpose computing is dead

[gottabeme]

Sounds nice. How will you infect the binary that's used to build all the software in a distro's main public repo? Keep in mind that many of them, like Launchpad's build service, build in freshly-extracted chroots, which are built from packages from the main public repo.

Again, you're back to compromising the distro's main repos. That's probably not impossible, but it would probably boil down to an unpatched remotely-exploitable vulnerability in the server software. Those are patched whenever they are found, and on such important systems, I'm sure they have IDSes that wouldn't allow anyone to spend so much time pentesting. The attack window would be very small and you'd need a fair bit of luck to find it in time.

Theories are easy to think of but proving one to be practical is difficult. Linux systems are fundamentally more secure by design, and their record proves it, as well.

It seems MS could make this go away

[tkrotchko]

Microsoft knows their OS better than anyone. For anyone getting MS updates, it seems it would be a simple matter for Microsoft to identify these machines, disable the rootkit, and alert the user.

It would be a little bit of work for MS, but isn't this kind of service that you'd expect to get from a vendor that stands behind its products?

Re:It seems MS could make this go away

[scubamage]

It doesn't involve DRM, so I doubt they'll worry about it for at least another 9 months.

Re:It seems MS could make this go away

[Anonymous Coward]

Actually, it's a huge cost to microsoft as they have ot take phone calls for folks who are trying to reinstall Windows and failing the anti-piracy bullshit. The retards at the unix vendors are failing by not flooding the media with press releases about this "windows only botnet"

Re:It seems MS could make this go away

[Architect_sasyr]

The last thing I'd want to see is any company, at all, automatically fucking with my MBR just because it doesn't think it matches what they consider a standard MBR. If they can't do that then they can't remove the rest of the infection and the botnet guys can just upload a new one to circumvent the patch.

Re:It seems MS could make this go away

[jamesh]

Microsoft knows their OS better than anyone. For anyone getting MS updates, it seems it would be a simple matter for Microsoft to identify these machines, disable the rootkit, and alert the user.

It would be a little bit of work for MS, but isn't this kind of service that you'd expect to get from a vendor that stands behind its products?

The problem is that by definition, the malware authors always get to go first. As soon as Microsoft (or other antivirus vendor) figure out how to prevent the current malware from working, the malware guys will have reverse-engineered the update, developed a workaround, and deployed it before the windows/antivirus update has reached widespread deployment. They also have other advantages over Microsoft as they don't care as much if they crash a few computers along the way. Microsoft need to do heaps of regression testing before releasing an update, the malware authors just have to make sure it works on (say) 99.9% of computers - incidental damage isn't an issue.

Re:It seems MS could make this go away

[dudpixel]

I think what you meant to say is they could roll it into a "premium" version of MSSE and then charge you for it.

Re:It seems MS could make this go away

[the_bard17]

Microsoft hasn't messed with a non-standard MBR, but they will fail certain Windows Updates when a non-standard MBR is present. They don't come right out and say so, too... just give some generic error code.

I've had it happen when trying to install some Vista related Bitlocker update, and SP1 on Windows 7. Both would error out, since GRUB's installed on my primary drive. Yank it, and let the system boot off the WIndows drive (separate drives for Linux & WIndows), and the patch completes fine.

Ideally, MS would toss up a verbose error stating that the MBR's not standard, and that it was refusing to touch it further.

Re:It seems MS could make this go away

[magamiako1]

This likely had to do with the bitlocker update.

Nothing new

[Billly Gates]

In 2004 my cousin had malware that hid in the partition table and even a fresh format and windows reinstall could get rid of it. Only a good dos fdisk that deleted the table with a format and reinstallation. Today evil malware can hide in both the shadow volumes of restore points to reinstall themselves and avoid detection and also system recovery partitions so a fresh os reinstallation will reinstall the malware. Fun times

Re:Nothing new

[Anonymous Coward]

Let's not forget alternate data streams, I remember filling up an entire server hard drive with a huge text file that resided in the alternate data stream and nobody ever found it.

Re:Nothing new

[Anonymous Coward]

In developing LoseThos's format command, I learned that if you put bad, nonzero drive geometry values in the MBR, Windows can't reformat it. You have to zero-out the MBR before windows can restore it. That wasn't so good public relations for Losethos. It's better, now, I think, but Linux squacked just the other day about CHS stuff. (LoseThos puts zero CHS values.)

Re:Nothing new

[Anonymous Coward]

Some proof of concept malware hides in the firmware on certain CD drives and chipsets. I'm not aware of any doing that in the wild, yet.

Re:Nothing new

[SpazmodeusG]

You've never heard of CIH then?

http://en.wikipedia.org/wiki/CIH_(computer_virus)

I know a ton of people who got hit by that in the 90's. It would usually hide in the system BIOS but it also was capable of hiding in the firmware of CD drives. Yamaha CD-ROM drives were vulnerable and in fact were shipped from the factory with the virus lurking in the drives firmware.

Comma abuse

[Anonymous Coward]

> Because TDL-4 installs its rootkit on the MBR, it is invisible to both the operating system and more, importantly, security software designed to sniff out malicious code.

What's this "more, importantly, security software" nonsense? Was this narrated by William Shatner, or are these abused, runaway commas who needed a home?

I realize that's an unmarked quote from TFA, but I guess the editor over there is asleep right now.

Wow

[scubamage]

Technically speaking, that's pretty awesome. I know they're bad guys, but some props to them. They're geek bad guys, and they've done some fine work here.

Re:Wow

[Anonymous Coward]

Pretty awesome? Really? MBRs were the easiest place for viruses to write themselves back in MS-DOS days - not much has changed on the Windows front, except that there are so many new and exciting ways to infect the system that this is almost a sort of "retro chic" thing.

Re:Wow

[kikito]

It isn't "cool" or "geek".

The ultimate purpose of all engineering/scientific/geeky endeavors is making the world a better place. We, as science people *should* have strong ethics.

Using technical knowledge this way (this is, purely for personal gain, at the expense of others) makes all of us (computer people) look bad.. It hinders human advancement more difficult (we have to spend resources and time combating this net instead of inventing new, useful stuff).

And you are wowing them. WTF is wrong with you.

Re:Wow

[Anonymous Coward]

Ah, so by your measuring stick every scientist who worksoutside of academia doesn't deserve any credit, since they're doing their work for profit and not the good of mankind.
That said, for good or bad what they've created is pretty cool from a technical standpoint. Its sad you can't appreciate that.

Re:Wow

[scubamage]

Nothing is wrong with me. If you think that science people always have strong ethics, then why is it pharmaceutical companies essentially hold people's health at ransom? What do you think happens if someone has cancer - essentially they are told *by science people* to pay, or die. Great ethics there in the medical, radiology, and organic chemistry communities. You do realize that that didn't always happen. Just look at the smallpox vaccine. As for making us look bad, you're right. It does. So do neckbeards who haven't showered for months. It is an interesting use of existing technology to solve a problem presented to them. It is excellent engineering, and a great strategy. You need to stop looking at your adversaries as "bad guys" and looking at them as intelligent people who have different goals than you do. Learn from the tech they use and see what way it can be used to benefit the world. Military science does this, why can't we?

Re:Wow

[kikito]

"why is it pharmaceutical companies essentially hold people's health at ransom?"

First, not all of them do that. Second, for the ones that do that, they do it because they can, and have no ethics. What I'm saying is that they *shouldn't* do that.

"They are told *by science people* to pay, or die"

I don't really understand your point here. You think it's ok to do that? Or are you agreeing in that they are doing bad things? If so, do you wow them too?

"Military science does this, why can't we?"

You seem to imply that military science is a paramount of ethical conduct. Are you able to validate that argument with some evidence, or are you just talking out loud?

Re:Wow

[Anonymous Coward]

I felt a little sick reading that too.. ain't nothing 'cool' about that tech.. no 'props' from me.. just rather a comparison with the nazis who also has good tech.. and nobody with any ethics gives THEM props. but hey wuddya xpect from sum1 floggin 'filesonic'?

Only a matter of time ...

[tomhudson]

A new and improved botnet that has infected more than four million PCs is 'practically indestructible

... only until an 8 million PC botnet decides to "borg" the competition.

Just use a UEFI mobo'

[Anonymous Coward]

Just make sure you buy a UEFI mobo, or then buy mac-tel hardware. [mac mini, etc etc etc] (comes with UEFI).
[Linux / Windoze / OsX - can all run on this hardware, but gives you an easy one stop shop for a daily use machine].

Given MebRoot/TDL/TDSS/etc etc are all thanks to the "original" work of eEye bootkit, we should really be thanking them for this one ..

But really hats off to the mighty M$, for thwarting any move out of bios for so long .. coreboot anyone ?

anyhow, Use/buy a UEFI enabled board, if you have a bios based mobo, look to see if theres the built in "virus protection", which used to be just a check to see if something was modifying the MBR. many dont have it any more.

Ps: fixmbr \Device\HardDisk0

Command and Control

[Fractal Dice]

Isn't command and control the antithesis of indestructability? Any software that can be patched can be destroyed.

Re:Command and Control

[Anonymous Coward]

Isn't command and control the antithesis of indestructability? Any software that can be patched can be destroyed.

except when said patches require the digital signature to match

Re:Command and Control

[pclminion]

You can sign the patches and make it impossible to inject update packets straight into the botnet. A more plausible line of attack would be to find a traditional security vulnerability and exploit it.

Re:Command and Control

[Anonymous Coward]

In a P2P botnet, *every* node is potentially a C&C node as long as it gets the right key. Cracking the maintenance backdoor would require cracking the maintenance key. Assuming no major weaknesses in the auth, the keys are uncrackable. However, there hasn't been a pure-software DRM scheme written that hasn't been cracked wide open eventually, so this botnet is just a debugger run away from a counterattack.

Re:Command and Control

[Fractal Dice]

http://xkcd.com/538/

Re:Command and Control

[Anonymous Coward]

Sure, you can send a patch to the botnet. Do you happen to be holding the 256 bit key that is required to sign the updates? No?

Too bad you don't have a large collective of operational, networked computers. Because you could totally use something like that to try and brute force the key. Someone should invent something like that... maybe call it a zombienet.

Now, to go entirely off the deep end - has anyone considered that the entire point of the PSN hacking was to get far enough into the system to send out an update that causes all PS2/3's to become part of a botnet? Because that would make for a very, very bad ass botnet. Aren't cell processors crazy good at raw number crunching?

Re:Command and Control

[Microlith]

Rubber hoses only work if you have the person with the key in custody.

NSA has a botnet?

[Anonymous Coward]

That must of been a great meeting:

Q. How do we stop all these botnets?
A. We take them over with our own super botnet!!!

Johnson your a genius.

ohhhhh noooo

[Anonymous Coward]

....its the deamon!

Not behind my "100,000 megavolt forcefield" here

[Anonymous Coward]

Because all of its known sources are "blocked out" here, either by:

---

1.) NORTON DNS (& it's DNSBL vs. all forms of "malware-in-general")

---

2.) My custom HOSTS file which is currently as of this writing in its tempfile prior to commission back to the HOSTS file itself, @ 1,459,566++ blocked known bad sites strong, & more for speed (adbanners blocked)...

(AND, it updates every 15 minutes now from 17 different reliable sources for HOSTS file data, DNSBL's I convert, & also trackers of various botnets out there online, yes, including THIS one too(earlier variants & current build).

---

3.) System Security Hardening:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

(Which includes the "std. antivirus/antispyware/firewall toolsets in use, but also a HELL OF A LOT MORE like conscientious patching/updating the OS & apps, group & local security policies work, using javascript (the "harbinger of DOOM" @ times) judiciously/sparingly, etc./et al)

---

* Nice part about the "heart of it" in the HOSTS file + Norton DNS is that even IF I were to 'suck in' this beastie? As soon as they get its C&C servers, I get them... every 1/4 hour, & it won't be able to "talk back to HQ"...

(AND, Despite all the "hype" of "not being able to see its transmissions" due to encryption? An ISP/BSP can see it, & that's where the info. will come from, eventually - & every encryption, even QUANTUM lately, can be broken OR eavesdropped on... just a matter of TIME! Hey, if wind & water can blow down mountains, right?)

So, "that all said & aside", well... IF they're smart about it? They'll update their DNSBL's too (effectively blocking communications "back to HQ" for this thing!)

APK

P.S.=> Besides, there isn't a botnet (or even ROOTKIT) I can't deal with effectively for removal anyhow - & I don't use the same tools others do...

Well, @ first I do, & when those fail? Out come the "big guns" in Process Explorer & Recovery Console - & there's nothing I can't "dust" between them...

... apk

But how ?

[DrYak]

For anyone getting MS updates, it seems it would be a simple matter for Microsoft to identify these machines

But how ? The virus hides its first stage in the MBR and is launched *before* the OS. By the time windows has started the computer is *already* compromised, the virus is already running and can do all the trick it wants to hide it self from the running system, or to alter the software being run.

Re:But how ?

[gweihir]

Basically, there is no way to hide effectively. Windows or any other OS can detect this on start-up, unless it is a full-fledged blue-pill. But you cannot squeeze something like that into the MBR, far too little space. Also, detecting that you are running virtualized is possible in most instances and a warning could be given to the user.

No big deal

[countertrolling]

The president and congress can just use the commerce clause in the constitution to force everybody to buy an officially approved operating system and anti virus program..

There, see? Problem solved

Re:No big deal

[benjamindees]

If this were a dictatorship, it'd be a heck of a lot easier.

Not impossible

[Anonymous Coward]

I work at a computer repair shop.

We frequently encounter computers that are kitted up with boot and rootkits, TDL-4 included. Kaspersky's TDSS killer does a pretty good job of removing this stuff, and it's pretty easy to tell if the MBR as been modified. Just fire up a copy of GMER and you'll be able to tell pretty quickly. I see a lot of people posting stuff about having to wipe drives and start over from scratch. That is simply not necessary. The only reason TDL-4 is such a pain in the ass is because it is decentralized, only communicates with a handful of its infected counterparts at a time and modifies the MBR. Even then, it's not impossible to detect or even remove. Just gotta use the right tools...

Re:Not impossible

[Anonymous Coward]

It should be easy to get the md5 of the MBR for the OS to check and stop loading if there is a problem. This info could be encrypted to make changing it extremely difficult for the botnet.

Re:Not impossible

[Anonymous Coward]

Congratulations. You just invented trusted computing.

Re:Not impossible

[fluffy99]

I work at a computer repair shop.

We frequently encounter computers that are kitted up with boot and rootkits, TDL-4 included. Kaspersky's TDSS killer does a pretty good job of removing this stuff, and it's pretty easy to tell if the MBR as been modified. Just fire up a copy of GMER and you'll be able to tell pretty quickly. I see a lot of people posting stuff about having to wipe drives and start over from scratch. That is simply not necessary. The only reason TDL-4 is such a pain in the ass is because it is decentralized, only communicates with a handful of its infected counterparts at a time and modifies the MBR. Even then, it's not impossible to detect or even remove. Just gotta use the right tools...

Sure you got rid of the TDL-4, but what about all the other crap it downloaded? Seriously, if the computer got owned, you can't trust it anymore. You'd never be able to find all the little things like permissions changes and registry tweaks even if you got rid of the trojan's executables. Copy your data files off, scan them really well before introducing them elsewhere, and then reformat the disk. Nuking it from orbit is the only way to be sure.

Re:Not impossible

[toygeek]

I do the same kind of work that AC does, and he's right. Its not impossible. Also, I'd like to introduce you to the Real World(TM) where wiping a machine at the drop of the hat isn't always an option.

Re:Not impossible

[Anonymous Coward]

I would still nuke it from orbit, and the reason is very very simple: after a machine has been infected in the wild, you must treat it as untrusted. You must treat all accounts you've ever accessed with it as compromised. You don't know what it might have downloaded in the background. You don't know if they've already keylogged you or stolen other data. You don't know what new capabilities might have come out in the last 24 hours. There are entirely too many unknowns. I know security companies will tell you otherwise, but they have a product to sell. If people stopped believing their product was 100% effective and instead resorted to formatting (which IS 100% effective when done properly) then they'd be out of business. Of COURSE they say you can keep using your system afterwards.

For me, "cleaning" a virus out is merely a way to get access to files in preparation for a format. I will NOT simply "fix" a virus infection for anyone these days, knowing that they could remain quietly compromised and later fall victim to identity theft or worse. It's just not worth chancing it.

ALWAYS nuke an infected system after recovering uninfected data files from it. Without exception.

Re:Not impossible

[toygeek]

Once you get rid of the rootkit, cleaning the rest is fairly trivial.

Re:Not impossible

[Anonymous Coward]

They aren't talking about one PC. They're talking about the botnet. So your "Not Impossible" comment title shows a bit of a misunderstanding.

Re:Not impossible

[Jeppe Salvesen]

There really should be no problem

1. Performing a backup
2. Wiping the machine
3. Installing a clean OS
4. Updating the OS
5. Installing proper security software
6. Re-importing data and applications from backup, and have the security software handle any nasty stuff in what you're importing.

That there is a problem wiping a machine is a serious security issue. There are a myriad ways which different kinds of malware use to hide themselves and bounce back up after surviving a round of security scanning. The malware itself is continuously self-updating.

If I were to engineer a package system, all files within a package (program) would be checksummed, and the list of checksummed would be PKI-signed in order to prevent the malware from hiding its misdeeds by altering the checksums. Of course, this has been done several times in Linux-land. Microsoft has Windows 8 coming up. Let's hope they finally fix their design.

Re:Not impossible

[Anonymous Coward]

I see these MBR things too. The thing is the other crap gets updated so frequently it is hard for antivirus makers to keep up. here is my solution for cleaning:
Tell the user to shut the pc down for the weekend, on mondaymorning scan it with an up to date virus scanner on a boot cd. the then two days 'old' crap gets recognized and removed without a complete reinstall.

Re:Not impossible

[Anonymous Coward]

I'd love to live in your deluded little world.

Re:Not impossible

[Anonymous Coward]

It's pretty clear that you don't work at an Enterprise IT shop. For home users the risk is acceptable that something has been left in a different state than it should be or at the very least if they're bringing it in to have it worked on they probably won't know better. They'll probably also not have backups of the data on their machine.

In the Real World(TM) of IT aka Enterprise level IT, not only can you not trust it, but all of the important business information will not be stored on any office machine or laptop and it will be backed up. It's faster, more reliable and safer to restore an office machine from a known trusted configuration and give it back to the end user.

Re:Not impossible

[Timmmm]

They meant the *botnet* is indestructible. You just killed one of four million nodes.

Re:Not impossible

[SoupGuru]

It's getting to the point where I can't trust any Windows machine entirely. That Adobe Flash update? Am I really certain I haven't just opened up another vulnerability that's being exploited? Any number of "legit" software packages have their way with registry settings, file permissions, network access, etc in ways that would make most of us a little uncomfortable. So "probably good enough" is good enough these days.

Re:Not impossible

[Krneki]

If you do all that, why are you wasting your time in a comp shop? That's the point. People are not prepared to pay properly for a good job.

Re:Not impossible

[fluffy99]

If I were to engineer a package system, all files within a package (program) would be checksummed, and the list of checksummed would be PKI-signed in order to prevent the malware from hiding its misdeeds by altering the checksums. Of course, this has been done several times in Linux-land. Microsoft has Windows 8 coming up. Let's hope they finally fix their design.

You still need to verify file permissions in particular setuid, something Linux package managers don't do.

Re:Not impossible

[Anonymous Coward]

True. It's frightening the number of people saying "Hurp durp we just use a removal tool". Is it any surprise to find that the US and UK rank highest for %age of machines infected with malware?

Put it THIS way (I wrote how 2 destroy it already)

[Anonymous Coward]

http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272

When news of this thing came out, or one MUCH like it rather (using "blended-threat" rootkit technology, in utilizing not only bootsector spawn & control, but also a filtering driver/hooking driver to protect itself @ the bootsector level?) - What's up there CAN & WILL get rid of it...

APK

P.S. => Even the guys researching it are saying what I am pretty much:

PERTINENT QUOTE/EXCERPT FROM SOURCE ARTICLE

---

"I wouldn't say it's perfectly indestructible, but it is pretty much indestructible," said Joe Stewart, director of malware research at Dell SecureWorks and an internationally-known botnet expert, in an interview today. "It does a very good job of maintaining itself."

---

And, there you go... look in my link above? That'll do it, no system restore/reset/reinstall required... Yes, I am THAT sure it works, I've faced rootkits like this before (I am sure others here have as well & used similar tactics too).

It's just a matter of KNOWING how it works, & once you understand a thing? You can control, or destroy, it!

Simple - you just have to know how it operates, & what to do vs. it with tools out there for it (not std. tools, so I opt to go against rootkits using Process Explorer, FIRST, in usermode/RPL3/Ring 3 operation, & if that fails? Out comes Windows Recovery Console - blow the driver loading, & then reset the bootsector... it'll work!)

... apk

I knew this was going to happen

[Omnifarious]

Curious Yellow was bound to happen sooner or later. I was wondering what was taking botnet authors so long, and why they were relying on a centralized system like DNS for coordinating their bots.

Re:I knew this was going to happen

[DMUTPeregrine]

That's the first thing I thought of when I saw this article.
Botnets are becoming more and more sophisticated, and as with all attacks they only get better, never worse.

P2P is also its weakness

[Dachannien]

The fact that the software maintains itself peer-to-peer is also its greatest weakness, because it allows any infected node to identify other infected nodes. So, you set up a number of honeypots and use those to identify infected machines. You then strongarm those machines' ISPs to disconnect their customers until they get their shit together.

Yes, the whole "strongarming the ISPs" thing is a flaw in the strategy since it hasn't really been successful to date, but I'm sure Microsoft can come up with a legal solution to that little hitch.

Re:P2P is also its weakness

[Anonymous Coward]

Not every infected machine needs to have *all* the other peers, just a few!
Nice odds? You have 10peers from config out of 4000000 , how many honeypots you need to setup to guarantee you got all the peers?

Re:P2P is also its weakness

[adri]

Unless you're smart and you limit your P2P to the kinds of "cell" organisations used in shady groups.

That way the only nodes you can get are the few you immediately know about.

Add some logic to ensure that all your nodes are cross-jurisdiction and throw in some random time delays and random connections to nodes that aren't infected (ie, law enforcement honeypots) and .. well, you've just increased the paperwork level 100 fold.

I'm glad I'm not a blackhat.

Re:P2P is also its weakness

[snero3]

You then strongarm those machines' ISPs to disconnect their customers until they get their shit together.

What is the difference between and ISP cutting of a customers account because of a "suspected" infection and an ISP doing the same thing because the suspect piracy etal. You can't switch between privacy and a police state just to suit the needs/wants of the moment.

Re:P2P is also its weakness

[Anonymous Coward]

The fact that the software maintains itself peer-to-peer is also its greatest weakness, because it allows any infected node to identify other infected nodes. So, you set up a number of honeypots and use those to identify infected machines. You then strongarm those machines' ISPs to disconnect their customers until they get their shit together.

Yes, the whole "strongarming the ISPs" thing is a flaw in the strategy since it hasn't really been successful to date, but I'm sure Microsoft can come up with a legal solution to that little hitch.

When they say "indestructible" they are misusing the word. What they meant was "Hardened against hijacking". It's nearly impossible to steal control of the botnet or issue commands to shut it down on its own. Instead of taking control of the Hydra and telling it to kill itself, you have to start chopping off heads.

Re:P2P is also its weakness

[Anonymous Coward]

Which is great for taking down 10k at a time. When you have to deal with 4m, this becomes less effective.

Re:P2P is also its weakness

[sabt-pestnu]

Perhaps a better strategy is to corrupt an infected node and cause it to distribute a counter-agent, extending the corruption.

You only get one chance at that, though, as you still need to a) patch the initial vector of infection (if other than social engineering), and b) prevent your corrupted node from accepting any further alterations, allowing you to sunset the infection once all peers it communicates with have been identified. Fail to harden it against change and the network simply turns your node again.

Re:P2P is also its weakness

[Dachannien]

The problem is that the botnet operator can encrypt or cryptographically sign the updates they push, making it impossible to trick an infected node into accepting arbitrary updates.

Re:GPL Violators! Get em!

[gumbi west]

Think of how they get Al Capone. Noting would make federal prosecutors more interested in the GPL than if they thought it was the best way to nail a bad guy.

BTW, I like the idea of malware coming with a GPL license agreement and link to the source code.

This is easy to take down

[drmofe]

All that law enforcement needs to do is to purchase payload delivery on the botnet and include commands to delete Windows from each offending PC. Alternatively, they just need to place copyrighted material on each host and send in the MPAA and RIAA with infringement notices. That should get the job done.

Detection and removal

[Zaphod-AVA]

When they say indestructible, they mean it's more difficult to steal control of the botnet, like they have done with several other hostile networked threats, not that it can't be detected and removed.

To detect it, run the latest version of GMER.
http://www.gmer.net/

To remove it, you need to run a series of three scanners in this order:
TDSSkiller
http://support.kaspersky.com/viruses/solutions?qid=208280684

Combofix
http://www.bleepingcomputer.com/download/anti-virus/combofix

and Malwarebytes' Antimalware
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol;1

Note that TDL4 is often a blended threat, and has other secondary infections that can cause issues. One of the most common does search redirection that can make it hard to get to the tools to remove it. Most versions of that you can work around by clicking on the Google cache of the site with the tool instead of the link itself.

As for who to blame, most of the infections installed on people's machines were abusing exploits in Adobe Flash. Keeping up to date helps, but I started installing Flashblock on my client's systems because I was convinced there were unknown Flash exploits.

-Z

Re:Detection and removal

[ArundelCastle]

Could you please link to OSX versions of these tools?
Can't be too careful, I say.

Re:Detection and removal

[Anonymous Coward]

https://addons.mozilla.org/en-US/firefox/addon/flashblock/

stoops

Re:Detection and removal

[Anonymous Coward]

How do you interpret the GMER results?

Re:Detection and removal

[Nagrom]

So fix malware probably ultimately caused by downloading and trusting a random executable by downloading and trusting a random executable? Would be a lot easier to feel safe about something open source.

Re:Detection and removal

[lordSaurontheGreat]

My local IT group uses the "If Sophos Enterprise console can't fix it, then we'll just re-image the machine from PXE" approach. Now, if our PXE image gets infected, we're completely screwed.

With more and more services moving towards the Cloud, re-imaging is less hassle than it used to be. Our corporate image logs in using a Novell client, and then it auto-configures Outlook; out of the box you get your corporate email with no sweat.

If you use a tool like N-nite to mass-install your favourite software, you're that much closer to your preferred computing environment with little to no extra work.

A good corporate network is very locked down as well. TDS-4 wouldn't work too well here because the only open ports (that I know of, and I've been working on these) are 80, 443, FTP, and Skype's ports. CONNECT requests from all of those are prohibited. Even if we experienced a large TDS-4 infection, the P2P aspect would become neutralised right off the bat because of local network policies. Most CC servers connect using IRC; those ports are sadly blocked (wtf grief please! Get me my Freenode back!)

Plus I run a Mac. As long as I don't do something stupid (MacDefender) I'm generally* pretty safe.

However, in the long run, I think that most would agree that most computer security can be accomplished through basic education.

(*) Knock on wood.

Re:Detection and removal

[strangel]

Don't forget Java. Out-of-date versions of Java are also largely responsible for infections. I'd actually love to have a way to see method of infection, whether it's Flash or Java. I've been able to tell sometimes simply because infected .jar files are detected in a scan of the system, but that's not really a reliable way of telling.
Flash updates seem to be much more reliable in terms of asking to install the update than Java. In 99.9% of infections, I see an out-of-date version of Java installed on the system.

Re:Detection and removal

[Marcika]

I think the equivalent scanner for OS X would be OS X Rootkit Hunter. You will need different removal tools of course, because BSD rootkits operate differently from Windows rootkits...

would have to modify the grub binary and/or kernel

[decora]

or something like that, because linux machines are constantly running grub to rewrite the bootsector

you could rewrite part of the kernel binary so that it would lie to grub i guess.

or you could rewrite the grub binary to lie to the user.

those two things are kind of non-trivial because linux is increidbly diverse.

now that i think of it, perhaps Windows becoming 'diverse' is a way to prevent some of this junk from happening.

Try TDSS killer!

[Falconhell]

I had a bit of trouble removing it with TDSS kiler a few weeks ago, but got there in about half an hour.

If it wont run you will need the file association reset tool.

http://support.kaspersky.com/downloads/utils/tdsskiller.zip

Re:Try TDSS killer!

[Anonymous Coward]

Still, what they mean is that the strain of the virus is indestructable, not that the individual viruses are. Because of the P2P+encryption+signed patches the only way to overtake or destroy the botnet (not the individual bots) is with some kind of coordinated counterattack.

Re:Try TDSS killer!

[Anonymous Coward]

I have found a couple variants of TLD3/4 that actually watch for the filename TDSSKILLER.exe and actively prevent it from running, so rename it if you have any troubles running it.

Same with Combofix, so I rename it before running it too.

BTC

ListSvc, Disable, & Fixmbr from RC can kill it

[Anonymous Coward]

http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272

In that order too... will take a reboot (kill the driver, first... reboot, the blow out & refresh the bootsector - NO reinstall involved!)

* Be sure NOT to use Windows 2k/XP/Server 2003 Recovery Console on VISTA, Windows 7, or Server 2008 though (diff. bootsector format)!

However, theoretically @ least?

Listsvc & Disable WILL still work, as they only query the registry & write it, respectively, to find the offending protective driver, first & stop it from loading (reboot & then do fixmbr) - the registry structure remains the same essentially for them all, & in THIS case on drivers? It is.

Also - Since the NTFS5 filesystem is in place on them all so... in theory? You can use Win2000/XP/Server 2003 for the listsvc/disable portion to "knock-the-chocolate" outta the protective driver!

APK

P.S.=> That'll work, that is, until they "alter it futher" (ala Darth Vader)... protecting the registry where the MBR protective driver loads from, that is...

... apk

Re:Not behind my "100,000 megavolt forcefield" her

[Z34107]

Your posts read like mental disorder, but I think it'd be fascinating to hear if you actually speak aloud in stilted, gratuitous

"formatting"

. I imagine you sound something like a cross between William Shatner and the pork chop sandwiches kid.

Anyone else morbidly curious?

Z34107

PS => I'll pay for your bus ticket to come speak on the proper use of the hosts file.

...z34107

This kills it, & that is CERTAIN

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36618304

I wrote it up yesterday in fact, & posted it here also in regards to this rootkit that uses blended threat type tech!

That technique vs. it? Yes - it will work (until this thing is rewritten to also protect the registry as well in its driver... THEN, we have problems!)

* HOWEVER, since we're on the subject of 'critiquing others' in myself, who's only trying to help others here? Go away now troll... shoo!

(ROTFLMAO...)

APK

P.S.=> NOW, regardless of whether you like my writing style or not? Do you own this forums?? No - Thus, I take your off-topic trolling b.s. with a "grain of salt", troll... LOL, trolls: You're ALL THE SAME! Easily dealt with, since you're "off-topic"...

... apk

Well,

[myoparo]

I, for one, welcome our new indestructible botnet overlords.

How does this bot spread?

[jonwil]

Infected emails?
Hacked website or ad provider serving out drive-by-downloads?
Compromised IM accounts?
All of the above?

Personally I think someone needs to write an "Internet Security for Dummies" book that uses real world analogies to explain internet security concepts to clueless people. For example, it could compare leaving your front door unlocked to not having a firewall. Or it could show real-world things that most people would never do (give their credit card or bank details to a total stranger because the total stranger promised money) and then explain that doing the same things on the Internet is just as dangerous.
Or it could show that buying pills from an online site advertized is a spam message is just as risky as buying them from a guy in a back alley. Or whatever.

Give it a scary sounding title and blurb to scare people into thinking the internet is really dangerous (which it is if you dont know what you are doing) and get them to pick up the book.

Re:How does this bot spread?

[Stupendoussteve]

They exist, but people don't care. The US government has some pretty good information on OnGuard Online, written in a simple way that most users should be able to understand, but it's not like they advertise.

Re:Not behind my "100,000 megavolt forcefield" her

[cbiltcliffe]

* Nice part about the "heart of it" in the HOSTS file + Norton DNS is that even IF I were to 'suck in' this beastie? As soon as they get its C&C servers, I get them... every 1/4 hour, & it won't be able to "talk back to HQ"...

Until you realize that malware can change the DNS settings of the interface directly, so while you think you're using Norton DNS, you're actually using InfectedSpywarePOS DNS.

Locker down...

[Kernel Krumpit]

That's OK. MS can just "lock'er down" like some of the competition, make 'er proprietary, claim IP, hire the codebreakers, turn-the-tables on the courts over accessibility and O/S binding and no-one can touch the MBR. Not allowed. But wait..... the MS whiners...

I rotate DNS servers periodically here & check

[Anonymous Coward]

I don't GET MALWARE, & neither do others using HOSTS + the other protective measures I noted in that guide of mine, in fact? Here's a testimonial from a user HERE ON THIS SITE, you can write he to see if he wrote this, as to the efficacy of using a HOSTS file:

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

So, it's NOT JUST I, telling you HOSTS files are an effective addition to the concept of "layered security"...

---

On DNS settings:

Here, I ROTATE THEM PERIODICALLY, so I look @ them every 3-4 days here in fact because of that!

(Norton's ALWAYS up there @ the top, & in Windows you can put in multiple DNS servers to query, mind you - I know the IP's of the ones I use to rotate (NortonDNS, OpenDNS, ScrubIT DNS, Google DNS & my ISP/BSP ones too)

* In fact, on the job? That's one of the things I test for & check when dealing in fighting malwares (there's only so many places they can attack anyhow).

APK

P.S=> So YOU? You have been "shot-down-in-FLAMES" vs. myself... as trolls always are!

... apk

Additionally, U have to get malware, 1st

[Anonymous Coward]

And, per my last post to you? Like TestedDonut, whose testimonial I put up in my last post?? I don't get malware, ever, in the 1st place...

NOW/Additionally: IF you see my init. post & the guide in it - you have to get one first... I don't per that guide is why!

I.E.-> I mean, heck - Cutting off what I called "the harbinger of DOOM" there (javascript) & being judicious in its usage alone cuts off a good 90% of the probability of getting one online in the first place!

(Plus, other things like doing text only email, not HTML scriptable types, helps as well)...

* I do MUCH more too, for the concept of "layered security" (best thing we have going currently in fact, & I've done guides like that since 1997 for securing Windows - here's what NEOWIN thought of that one:

http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text

Great rating, when they got ahold of it in 2001 (older less comprehensive than today's is since 2007)

* In fact? I suggest you read it the newer one in my guide link I put into my 1st post - here it is again for your reference (you sound like you know a "trick-or-two" though, but you MAY pickup something too, never overlook THAT much):

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

From your DNS thing though? Though you have a point?? Well... sounds like you NEED to read that!

APK

P.S.=> HOWEVER, in fairness? That's been the most challenging point I've heard here vs. my ideas on "layered security" - VERY good!

You did make a good point though, I will give you that (& sorry for calling you troll - I thought you were the other post here (DEFINITELY a "troll"))

... apk

Re:Additionally, U have to get malware, 1st

[cbiltcliffe]

No. You stated that "if" you were to suck in one of these, then the update to Norton would prevent it from being able to talk back to it's C&C.

Well, once you've got one, you can't trust the DNS servers that are shown in the NIC config GUI, because you're infected.

Admittedly, as you've said, the chances of you getting something is significantly diminished due to your diligence. But you're sounding a bit cocky right now, as if you think it's impossible for you to get infected, rather than just unlikely.

What you're forgetting is that Norton DNS updates, HOSTS file updates, and everything else you can do to prevent connecting to known malicious domains are all reactive. Meaning someone has to update that list between when the domain begins distributing malware and when you try to hit it. If you try to hit it before the list is updated, all bets are off.

Re:GPL Violators! Get em!

[Ltap]

This is one option, but another is that people like the BSA will use it as an example of how "evil" free software is. When in doubt, public opinion tends to go the way of lobbyists.

THIS KILLS IT, guaranteed... apk

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36618304

In this rootkit's CURRENT DESIGN, that is... see my p.s. below in that regard!

* Hello again... -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36618376

APK

P.S.=> The technique noted there will do the job, guaranteed, until this thing is altered to ALSO PROTECT THE REGISTRY entries for its Ring 0/RPL 0/kernel mode protector of the bogus bootsector that is!

(Where the driver loads from that protects the MBR... listsvc & disable take care of that in this CURRENT DESIGN OF IT, no system reinstall needed... guaranteed!)

Still - IF they get 'wind' of what I am doing here? They will, mark my words... & then? THEN, we have problems! Make sure you have CLEAN backups people, mainly of your data you cannot just "reinstall"!

... apk

Re:THIS KILLS IT, guaranteed... apk

[Anonymous Coward]

APK quack quacking again.

Do everything to prevent a reinstall and wonder forever if you caught every piece of malware. Or start clean and have peace of mind.

Then again, peace of mind is nothing that concerns APK. His braindumps give good insight into the fucked-up state his aged mind is in.

Go home, grandpa. You're not relevant and your quack theories aren't either.

Re:would have to modify the grub binary and/or ker

[DrJimbo]

You could also run Grub from a LiveCD or a LiveUSB. If you are worried about the botware modifying the programs you use to create these then you could donate a few dollars to a distro you want to support and have them send you a LiveCD.

There is strength in this simple modularity as well as in diversity.

now that i think of it, perhaps Windows becoming 'diverse' is a way to prevent some of this junk from happening.

What better way to make Windows both diverse and modular than to make it open source?

it REALLY is indestructible

[uvajed_ekil]

I would say it is the first of its kind, but you will only ever need one like it, so it is TEH botnet coded and maintained by Chuck Norris. Totally indestructible, Skynet is jealous. OMG phear dis one nothing will evar be betr lol

IOMMU

[xororand]

It's possible with an IOMMU. Most desktop systems don't have one, except for some Intel chipsets that are marketed to businesses.
For instance the Lenovo Thinkpad T400 has one.
http://en.wikipedia.org/wiki/IOMMU

Re:IOMMU

[Anonymous Coward]

The AMD 890FX chipset has an IOMMU.

Its CURRENT DESIGN is very "destructable"

[Anonymous Coward]

For now, via this technique -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36618376

* For NOW that is... now, if later the designer of it "gets smart" & starts protecting the registry area from which ALL driver load up from on Windows NT-based OS, per the DDK design for them & registry structure for device driver instancing?

"HOUSTON WE HAVE A PROBLEM!"

APK

P.S.=> Still, doing this, in THIS order, kills it:

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

(I just hope the guys designing it don't read slashdot & see what I wrote, because were I they? I'd be writing a registry monitor & overwrite routine into that rootkit now.. because while that driver's resident? It can PROTECT that area of the registry just as it does the bogus MBR, & the disable command ONLY TAKES on reboot - if they protect the driver load area that protects the MBR? Big problem then... probably reinstallation!)

... apk

Easy solution

[Anonymous Coward]

ISPs should just refuse connections from any system running MS Windows.

Windows security is a game

[gottabeme]

You write like Steve Gibson on meth. Hey, you are an AC...

Sounds like you have a lot of fun maintaining your defenses. I remember keeping up with that sort of thing back in the day. Then in 2003 I switched to Debian and haven't had to worry about malware since.

I'm amazed by the time and effort people spend to defend against malware when the best solution is so obvious. 'You can lead a horse to water..."

Maybe the problem is that some people enjoy "the game" so much that they wouldn't know what to do if they stopped playing.

Easy solution

[Anonymous Coward]

The botnet doesn't run itself. Send Seal Team 6 in with capture or kill orders. You don't have to get them all, a couple would be fine. I would expect the enthusiasm to keep running the botnet would significantly decrease after a couple of their buddies get a burial at sea.

Note to CDC:

[ibsteve2u]

Don't hire any of the above bloodthirsty "Three infections, max - and then smoke 'em!" types. Won't do to be euthanizing people the third time they catch a cold...or a venereal disease.

No Way

[h4x0t]

That Command and Conquer is moving to a Pay 2 Play system. I don't care if electronic arts is ToDaLly - 4 it or not. The people wont go "4" it. Also there is no way 4 million already signed up, someone cooked that number on a spoon.

I've got to be reading this wrong, it doesn't make a lick of sense.

rkhunter && chkrootkit

[Anonymous Coward]

I have run into this problem lately with a unnamed client. I am wondering, load malwarebytes onto each machine and check or boot into BackTrack5 and run the programs I mentioned in the subject?
Obviously if I run a *nix OS to detect then no malware has a chance to hide itself. But for each one I must update the plugins in order to detect anything newer than the release of BT5. Thanks

They must be used for something...

[SanityInAnarchy]

Unless it's a massive bitcoin mining operation or some actual spyware of the sort which steals credit card data, there's not a lot I can think of that they would want those machines for which would be able to work with entirely encrypted communication. In particular, if they're spam zombies, the flood of email should be a clue.

Then again, there is the problem of knowing that a given attack was a DDoS, and knowing whether a given machine which participated in that attack was a botnet zombie or a legitimate user with bad timing.

Still, if there's a way to single these machines out, I agree with the original poster -- join a botnet, get disconnected.

Re:They must be used for something...

[oreaq]

Unless it's a massive bitcoin mining operation

OT, but bitcoin transactions are propagated to each bitcoin peer and hence cause network traffic, bitcoin mining is just calculating hashes with special properties and doesn't produce any network traffic.

Re:They must be used for something...

[SanityInAnarchy]

Not quite. For these hashes to be useful, you also need to be aware of the current state of the network -- you can't mine offline. Also, in order to cash in, you need to broadcast the resulting hash as far as you can through the network before someone else beats you to it with their own hash. So it does generate traffic -- not a lot, but some.

However, there's nothing stopping this botnet from distributing bitcoin network updates via its own encrypted communication, minimizing the number of nodes it needs to be connected to the actual bitcoin network. Also, even if every node were connected, it's still not easy to distinguish a legitimate bitcoin node from one of these bots. By contrast, if they're using it to spam, it should be quite easy.

Re:They must be used for something...

[Anonymous Coward]

Its a good day on ./ when someone stands up and offers to train all the grandmothers, non-geek, and anyone else who doesn't know computers well enough to relaize Microsoft is a bane on you system and lack of security is your fault. I mean really how did grandma know that her 8yr old grandson was surfing porn and got her machine infect.

Anarchy thy name doth fit but you should add "stupid" or some acronymn therein to it.

Re:They must be used for something...

[SanityInAnarchy]

Its a good day on ./ when someone stands up and offers to train all the grandmothers, non-geek, and anyone else who doesn't know computers well enough to relaize Microsoft is a bane on you system and lack of security is your fault.

I'd certainly be willing to offer classes, but this problem is not going to be solved -- ever -- until those people start seeing some consequences to their lack of security. In this case, grandma calls her ISP because she can't get online. Her ISP says "Oh, you can't get online because your machine's infected." She takes it to her local geek relative or computer shop to get it cleaned, so there is now one less bot in the world.

Maybe she keeps it clean. But maybe, a few weeks later, it happens again. Sooner or later, she's going to decide that enough is enough and decide to make a point of learning something about security.

I don't really see a better solution. Or are you suggesting that botnets are OK?

I mean really how did grandma know that her 8yr old grandson was surfing porn and got her machine infect.

She didn't, the first time. But she might notice if every time he comes to visit, she gets booted offline.

The easiest thing she could possibly do is forbid her grandson from using her computer -- which also avoids all of the above training. So now we have one less bot in the world, and the grandson has felt some consequences to surfing porn unsafely, which means there's one less asshat who infects computers by surfing porn.

Or, if she learns something about security, she at least gets a decent browser and keeps it patched so that whether she knows where he's going or not, her grandson isn't going to infect her by surfing porn.

Yeah, it does kind of suck for grandma, but what's your alternative, other than botnets forever?

Re:They must be used for something...

[oreaq]

IIRC all (i. e. confirmed *and* unconfirmed) transactions are distributed to each node, not just to miners. The fact that you are mining doesn't create any more traffic than you would get from running a non-mining node. You only produce additional traffic if you solve a block and announce it to the network. That's what? At most one additional message per miner per week or per month or even more rarely?

Re:They must be used for something...

[ConceptJunkie]

Yeah, it does kind of suck for grandma, but what's your alternative, other than botnets forever?

iPads.

Re:They must be used for something...

[ultranova]

Still, if there's a way to single these machines out, I agree with the original poster -- join a botnet, get disconnected.

Thus further reinforcing the notion that ISPs have the right - nay, the duty - to inspect the traffic flowing through them, and blocking content and users deemed... disruptive.

I yearn for the day when we get rid of ISPs entirely and have a worldwide mesh network where it's impossible to disconnect anyone. We've been moving that way ever since Gutenberg invented his press, and will hopefully continue doing so, never mind some control freaks being outraged at the thought of people being able to talk to each other without their approval.

Re:They must be used for something...

[ultranova]

I'd certainly be willing to offer classes, but this problem is not going to be solved -- ever -- until those people start seeing some consequences to their lack of security. In this case, grandma calls her ISP because she can't get online. Her ISP says "Oh, you can't get online because your machine's infected." She takes it to her local geek relative or computer shop to get it cleaned, so there is now one less bot in the world.

Yes. Now weight the pretty much non-existent benefits of that against the harm caused to grandma.

Maybe she keeps it clean. But maybe, a few weeks later, it happens again. Sooner or later, she's going to decide that enough is enough and decide to make a point of learning something about security.

Yeah. Namely, that it's impossible - even actual experts get hacked. Thus grandma either gives up computers completely, or continues to go through the cycle. And the same goes to everyone else too - yes, including you. One of these days a bot will contact your machine before it can apply an update, and then you're p0wned.

Even if you use Linux, your web browser is bound to have bugs, and those allow bots to your machine - or perhaps one manages to break into a package repository. And the kernel itself has had holes before, and likely still does.

Yeah, it does kind of suck for grandma, but what's your alternative, other than botnets forever?

All ecological niches get fulfilled, that's one of the basic laws of nature. The Internet is an ecosystem, botnets have a niche, they will continue to exist as long as computers can run code not approved by some authority and talk to each other. And so what? They're a nuisance, nothing more.

The existence of malware is the price for having open computation platforms, and the existence of botnets is the price for an open Internet.

Re:They must be used for something...

[SanityInAnarchy]

You know, I think I like the "botnets forever" option better.

Oh, and it doesn't solve the problem. "Hey, here's a cool app to install! But Apple banned it, so you'll just have to..."

Re:They must be used for something...

[SanityInAnarchy]

Yes. Now weight the pretty much non-existent benefits

Eliminating botnets is a "non-existent benefit"?

Yeah. Namely, that it's impossible - even actual experts get hacked [gulker.com].

If I understand that story, Mitnick launched a direct, targeted attack against this individual. Grandma was hit with a drive-by. She didn't have to be an expert, she just had to keep herself patched and read dialog boxes -- basic stuff which anyone should know before using a computer.

For that matter, if she was the target of a deliberate attack, I'd think she would want to know about it and do something about it.

One of these days a bot will contact your machine before it can apply an update, and then you're p0wned.

Contact my machine how? Through what listening service? And before I make an outgoing connection, I patch. It'd have to be a zero-day exploit, probably of my browser, and then it'd have to get lucky enough that I happen to hit that particular website.

Reducing the attack surface area to about that has serious consequences for botnet authors. If this was true for everyone, it would mean you would have to be incredibly lucky and incredibly skilled in order to start to build a botnet -- and as soon as anyone notices you, ISPs start killing the bots. I don't see how that could possibly remain profitable.

And yes, if this does happen to me one day, I'd like to know about it. It'd be bloody inconvenient to be offline, but that's also something I'd want anyway, since whichever machine is infected also has all sorts of personal data I don't want sent out.

Even if you use Linux, your web browser is bound to have bugs, and those allow bots to your machine...

I use Chrome, which means most of those bugs are going to be sandboxed.

or perhaps one manages to break into a package repository.

It's not enough to "break into" the repository servers. Every package is signed, and often areas of the package tree will belong to different users. So you not only need to break into the repository servers, you also need to get access to very specific people's signing keys.

And the kernel itself has had holes before, and likely still does.

It absolutely still does, and they're discovered and patched all the time. The thing is, it's been a long time since anyone's found viable remote exploits, and as much as APK would love to believe otherwise, the kind of local exploits Linux has now aren't nearly as serious, and also aren't that relevant to this discussion.

A local exploit could be what gets them out of, say, the Chrome sandbox. But this means they now need two zero-day exploits.

All ecological niches get fulfilled, that's one of the basic laws of nature. The Internet is an ecosystem...

That's a pretty metaphor, but does it actually fit?

Actually, yes, somewhat. Ecological niches get filled. They can also be created or destroyed. So...

botnets have a niche, they will continue to exist as long as computers can run code not approved by some authority...

What does "approved by some authority" have to do with anything, especially when you were pointing out that repositories could be pwned? What's stopping someone from pwning the iTunes store?

But no, I don't see this happening -- again, they need to be economically viable. If botnet creation requires an incredibly high level of skill, timing, and luck in order to, say, slip something into a Linux repository (or iTunes, or Windows Update), and the botnet then lasts a few days, maybe a few weeks before those machines are taken offline and cleaned, I don't see that being economically viable, I see it being worse than playing the lottery. If it instead requires a ton of labor to add each bot by hand, by deliberately targeting that machine the way Kev

Re:They must be used for something...

[ultranova]

Eliminating botnets is a "non-existent benefit"?

Yes. Botnets exist right now, yet the Internet works just fine. What is the benefit their non-existence would create? Would this presumed benefit be sufficient to justify causing grief to ordinary people?

Your proposal would, for all intents and purposes, shut everyone who isn't a computer expert outside of information society. It is questionable if that consequence can be justified at all, but if it can, it requires a huge, imminent-collapse-of-society -level justification. Botnets are far from apocalyptic threats. They are nuisances. So what's the benefit that justifies making grandma a second-class citizen?

Actually, yes, somewhat. Ecological niches get filled. They can also be created or destroyed. So...

The niche here is "general-purpose computers capable of communicating with one another". And, from my observations, it seems there's another law of nature: the harder you want something gone, the hardier it is :(.

What does "approved by some authority" have to do with anything, especially when you were pointing out that repositories could be pwned? What's stopping someone from pwning the iTunes store?

It is impossible to enumerate badness, because there are an infinite number of programs that could be bad. So, you either inspect every piece of code before running it - which is impossible in practice, especially for grandma - or only run programs inspected by some authority. Do neither, and you'll get an occasional malware infestation.

They're a nuisance until they hit you up for extortion money -- pay us or we'll DDoS you. Or maybe they start collecting data from their hosts -- credit card numbers, etc.

Keyloggers don't require botnets to work. And extortion means money trail, which can be followed.

We don't require everyone to go around armed just because there's real-life pickpockets and mafiosos. We certainly wouldn't dream of installing metal detectors to their front doors and refusing to let them through if they're not packing heat. Why should such demands become acceptable in the Internet?

My suggestion would severely cut down on botnets, and I don't see how it makes these platforms less open -- nor do I see a closed Internet and computation platform making botnets much more difficult than open systems with ever so slightly more educated individuals -- and the only way to make that happen is to provide an incentive.

Your "incentive" would cause lots of harm to Joe Average, and give little if any benefit whatsoever. That is unacceptable.

Re:They must be used for something...

[SanityInAnarchy]

Your proposal would, for all intents and purposes, shut everyone who isn't a computer expert outside of information society.

I really don't see how. It doesn't take much to make yourself a hard enough target that it's no longer financially tenable to use you as a bot.

I've made this point again, but you continue to say things like this:

So what's the benefit that justifies making grandma a second-class citizen?

Either this is a strawman, or I've missed the part where you explain how botnets would continue to survive if people had at least the equivalent of driver's education for the Internet.

So, you either inspect every piece of code before running it - which is impossible in practice, especially for grandma - or only run programs inspected by some authority...

Not impossible; why does grandma need to run code other than what her grandkids installed for her? Why should she ever need to download a program from the Internet?

But, accepting this premise for the sake of argument...

Do neither, and you'll get an occasional malware infestation.

Which sounds like you are suggesting, again, that if I trust an authority, I'll be safe -- which not two posts ago was a point you were arguing against, that even if I only install software from my Linux distro's repository, I'm not safe. Which is it?

Keyloggers don't require botnets to work.

They do require a means of distribution and a means of phoning home. Botnets make both of these easier to do and harder to stop...

But that's beside the point. The exact same steps which will protect you from becoming a bot will also protect you from keyloggers. And having your machine flagged in a big way as "infected" is still useful if you want to get rid of both.

And extortion means money trail, which can be followed.

Maybe. Sometimes. And even if so, how likely is that to get the guy his money back? How is this better than actually eliminating this as a threat?

We don't require everyone to go around armed just because there's real-life pickpockets and mafiosos. We certainly wouldn't dream of installing metal detectors to their front doors and refusing to let them through if they're not packing heat. Why should such demands become acceptable in the Internet?

I haven't made that demand. I've instead suggested that people should lock their front door, at the very least. I'm a bit confused as to how "Keep yourself patched, run a decent and up-to-date browser and OS, and don't download random crap" turned into "OMG grandma has to know EVERYTHING!!!"

2006 calling, sorry, it's been done already

[Anonymous Coward]

See

http://www.eecs.umich.edu/virtual/papers/king06.pdf

I would like to have PC's to implement non-interactive boot sequecy from microSD or SDHC type media only. That is because you can manually write-protect those after system preparation.

By non-interactive I mean that boot always from microSD if you don't press some complicated (like A-F-H-L) enough key combinations on the keyboard while POST sequence.

Only if you press that key combination you get to choose other boot media, which you need complete reinstall of the system.

Ofcourse the microSD then would have a boot system like EFI or whatever which enables (chain)booting from HD, PXE, USB, .. but only after the system consistency and security tests have been done.

That microSD would then implement mentioned consistency and security checks, using digital signatures etc. It would also be helpful implementing full HD encryption, diskless systems and because microSD is cheap, easily available, reasonably sized it would be easy to make a 1:1 backup of it once you have OS installed. If it ever got corrupted or broke you just replace and rewrite it after checking crypto checksum created when it was initiated and then reboot with it.

Once the microSD was prepared, you would install the OS(es) and each of those boot sectors would be signed by the keys stored on that microSD. If your OS boot sector(s) were tampered or the like. The boot would not proceed but ask fixing the system with the OS-install media which would then if needed even contact to manufacturer site and verify that the OS-boot secuency is OK or not.

The more I think of it that kind of system would make a lot of sense.

It would be very hard to bypass by unauthorized and malicious code. If anything goes wrong it would be also quite easy and cheap to fix. Also it would be very easy to understand by users and advanced users to tweak it new features.

Cheers,

Two words

[bytesex]

Virtual Machine

Re:GPL Violators! Get em!

[Anonymous Coward]

Maybe they are planning to make it open sourced ? :)

Re:GPL Violators! Get em!

[hippo]

I don't think they are distributing their code so are not in violation of the GPL, you may have their code on your computer but you cannot make use of it. It's more like you have provided them with CPU and ISP resources so let's hope you have the source code to all the GPL stuff you have distributed to them.

Re:Not behind my "100,000 megavolt forcefield" her

[Yvanhoe]

Actually the amount of copying between the various interlinked crossed messages indicate some sort of automated content generation.

The weakest link

[kikito]

... Is always the people, not the technology.

Instead of spending time trying to disarm the worm, do a regular investigation (i.e. simulate that you are someone willing to pay to use the botnet) and get the name of one of the builders. Trying to attack the botnet itself is a waste of time and resources.

But this is hardly unexpected

[Arrogant-Bastard]

Those of us who have worked in the anti-spam world for decades have been predicting this for many years, so it's hardly surprising that we've turned out to be right. Again. It's the inevitable consequence of the non-security of Windows. There is of course no reason to believe that this is the ONLY such botnet. (And if it is? It won't be for long.) With something on the order of 200 million compromised systems on the Internet, botnet builders have plenty to work with. What IS surprising is that so very few have been able to wrap their heads around the obvious and direct consequences of this state of affairs. For example, all click-based metrics are complete nonsense: anyone in control of a botnet of substantial size can alter them at will. For another, it is ludicrous to pretend that any email address can be kept "private", once used. And for a third, courts really do need to recognize that "X's computer did something" is in no way indicative that "X did something" -- a fact that should significantly alter much of the litigation underway. And this is only the beginning. It's going to get much worse.

Re:But this is hardly unexpected

[toonces33]

If it were the case that the majority of consumers were running Linux, then the people writing this junk would be targeting Linux instead of Windows. All systems have vulnerabilities of one form or another.

These days most of the infections arise from people opening virus-laden attachments and through social engineering (getting people to click on something popped up from an infected website).

I fear you are right - that it will get worse. And in some ways I wonder if this will be the death of the internet - that the spam and malware will have so soiled the nest that it would be largely unusuable for many people.

soi

[Anonymous Coward]

I designed sphere of influence to look for this type of threat (based on cisco asa/ips for now, but changing)....p2p weakness is who it contacts and where geographically its talking too. If you happen to own a local business, and all of a sudden traffic is going all over the world to universities, homes etc...then you can correlate. my software visualizes this...its free to government agencies, education

check it out on http://www.youtube.com/watch?v=ekOXjrF9enI

im working on correlating url vs connectiont to see if any visualization could be gleaned ..

An application of "ReVeRsE-PsYcHoLoGy"... apk

[Anonymous Coward]

".niaga gnikcauq kcauq KPA .dnim fo ecaep evah dna naelc trats rO .erawlam fo eceip yreve thguac uoy fi reverof rednow dna llatsnier a tneverp ot gnihtyreve oD ni si dnim dega sih etats pu-dekcuf eht otni thgisni doog evig spmudniarb siH .KPA snrecnoc taht gnihton si dnim fo ecaep ,niaga nehT .rehtie t'nera seiroeht kcauq ruoy dna tnaveler ton er'uoY .apdnarg ,emoh oG" - by Anonymous Coward another off-topic "ne'er-do-well" /. troll on Thursday June 30, @07:31AM (#36620876)

"???"

Uh, COULD SOMEONE PLEASE GET ME A TRANSLATION OF THAT OFF-TOPIC "TROLL-SPEAK"?

(ROTFLMAO!)

* By the way, since the last line made it thru in actual english in my Python code, BOY, as you can see just 4-5 lines above? What I wrote's NO MERE THEORY!

Yes - it will work vs. the current design of this thing!

(That is, until they change the bogus MBR protecting driver to not only protect the fake rootkit MBR, but also the drivers initialization area if the registry also!)

APK

P.S.=> Now - The rootkit maker does THAT? "HOUSTON WE HAVE A PROBLEM" then a reinstall would be needed, imo but only then!

EXACT Steps to take in this order to "KNOCK-THE-CHOCOLATE out of this rootkit:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

... apk

Sourcecode 4 "ReVeRsE-PsYcHoLoGy"... apk

[Anonymous Coward]

Courtesy of my TrollTalkComReversePsychologyKiller.py "ReVeRsE-PsYcHoLoGy" system here, lol:

---

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
          try:
                          trollstring = ""
                          for apksays in s:
                                  trollstring = apksays + trollstring
          except:
                  print("error/abend in reverse function")
          return trollstring

s = "String to reverse."
print reverse(s)

try:
                                                  #print(5)
                                                  s = "Go home, grandpa. You're not relevant and your quack theories aren't either."
                                                  s = reverse(s)
                                                  print(s)
except Exception as e:
                                                  print(e)

---

* ROTFLMAO!

APK

P.S.=> That's just what I use to deal with these trolls around here on /. ... lol Time for the A.M coffee now...!

... apk

How do I know if my system is infected?

[Anonymous Coward]

I have no real idea to detect malware that bypasses virus scans and other routine measures. I know of the programs and tricks that have been mentioned here, but it's hard to learn what counts as a thorough or even sufficient check.

EXACT ORDER OF STEPS to kill this rootkit

[Anonymous Coward]

Steps to take to "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* This absolutely WILL work!

(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )

APK

P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)

... apk

"ReVeRsE-PsYcHoLoGy" & more

[Anonymous Coward]

"...CA na era uoy ,yeH .htem no nosbiG evetS ekil etirw uoY" - by gottabeme (590848) In his TROLLSPEAK portion of his reply on Wednesday June 29, @11:58PM (#36618920)

* Uhm, lol... Could we get a translation of that off-topic "troll-speak" of yours, please?

(LOL!)

(See my next reply instead, where you actually spoke normally instead of "troll-speak", ok?)

Thanks for your time!...

APK

P.S.=> Courtesy of this sourcecode for TrollTalkComReversePsychologyKiller.py

---

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
          try:
                          trollstring = ""
                          for apksays in s:
                                  trollstring = apksays + trollstring
          except:
                  print("error/abend in reverse function")
          return trollstring

s = ""
print reverse(s)

try:
                                                  s = "You write like Steve Gibson on meth. Hey, you are an AC..."
                                                  s = reverse(s)
                                                  print(s)
except Exception as e:
                                                  print(e)

---

Here endeth the lesson... on the trollish part of your reply!

... apk

Take the easy way

[Anonymous Coward]

Just point the C+C server address to one not controlled by the bot. How hard can this be?

It's a manufacturer problem in the end.

[Sqreater]

It seems to me the problem is really just that TDL-4 etc. can depend on the MBR being in the same place on all computers. Manufacturers should take a page from communications and "spread spectrum" the MBR over different sectors, and make those sectors unique to each drive. Make sure the sequence of sectors is not readable from the net. Perhaps change the sequence from power up to power up. End of problem.

Re:It's a manufacturer problem in the end.

[gweihir]

That is not possible. The BIOS depends on the MBR being found in order to boot the OS. The MBR contains the 2nd stage boot code.

Re:It's a manufacturer problem in the end.

[mlts]

We have the technology to deal with this -- the controversial TPM chip, which is around on a lot of hardware.

On Linux, an implementation to prevent MBR-based rootkits could be having at the minimum / encrypted, optimally every filesystem. Use a passphrase for recovery, so if the TPM fails, it isn't hard to just boot without it. This way, if malware does infect the MBR, it will get booted as far as the initial ramdisk and get stuck when the boot process asks for the key to the root volume and the TPM reports that there was tampering.

"Trusted" computing is controversial, but using a TPM in this context will significantly add to security.

MS Stuff, vs. Linux KERNEL ONLY (sec. vulns)

[Anonymous Coward]

"Sounds like you have a lot of fun maintaining your defenses." - by gottabeme (590848) on Wednesday June 29, @11:58PM (#36618920)

I do, & I only had to do it ONCE, & I don't EVER get "sick online" either because of it...

Here's a testimonial from another user who uses a portion of what I do for "layered security" (best thing we currently have vs. threats online) only, in HOSTS files usage, because you can't get BURNED if you don't go into the 'malware kitchen':

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

AND, here is the rest of my defense system (& yes, it REALLY WORKS):

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

---

I'm amazed by the time and effort people spend to defend against malware when the best solution is so obvious. 'You can lead a horse to water..." - by gottabeme (590848) on Wednesday June 29, @11:58PM (#36618920)

That water?

That is "layered security" here:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

(1-2 hours of your time, for stable & secure uptime for YEARS into the distance.... it works, for Windows (the OS with more high quality drivers & software than Linux has by FAR (especially games)).

---

"Maybe the problem is that some people enjoy "the game" so much that they wouldn't know what to do if they stopped playing. - by gottabeme (590848) on Wednesday June 29, @11:58PM (#36618920)

Oh, I "don't play" - see above, my last reply too (lol, "ReVeRsE-PsYcHoLoGy" & below too (epsecially security info. on unpatched Linux vulerabilities in its KERNEL ONLY mind you, vs. nearly ALL of what MS gives you to do business & development with no less))!

---

"I remember keeping up with that sort of thing back in the day. Then in 2003 I switched to Debian and haven't had to worry about malware since." - by gottabeme (590848) on Wednesday June 29, @11:58PM (#36618920)

The ONLY thing protecting Linux users is "Security-By-Obscurity", or, isn't ANDROID (yes, it's a Linux variant that's actually getting a big share of market & usage by users on mobile phones).

Isn't THAT showing anyone anything by example? Does me!

NOW:

Some things you ought to know, on unpatched security vulnerabilities in Microsoft's near ENTIRE offering of what you need to do business & development, vs. THE LINUX 2.6x MAINSTREAM KERNEL ONLY:

This data's ALL from a respected source for known security vulnerabilities unpatched:

---

Vulnerability Report: Microsoft SQL Server 2008: (06/26/2011)

http://secunia.com/advisories/product/21744/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (06/26/2011)

http://secunia.com/advisories/product/17543/

Unpatched 0% (0 of 6 Secunia advisories)

Vulnerability Report: Microsoft Exchange Server 2010: (06/26/2011)

http://secunia.com/advisories/product/28234/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft SharePoint Server 2010:

GMER - Rootkit Hunter/Killer

[Anonymous Coward]

I'd recommend this to anybody, at least as a try out. It's free and it does a heck of a good job of detecting any sort of rootkits on the system. Though remember, this isn't the sort of tool a uneducated computer user can utilize. There is no one click do-it-yourself button.

http://www.gmer.net/

I do EXACTLY that in fact

[Anonymous Coward]

On that which you speak, here are the "layered security" methods I use for it (covers BOTH IP addresses & hosts-domain names of botnet C&C servers):

---

1.) 1,460,225++ KNOWN bad servers/sites/hosts-domains blocked in my custom HOSTS file (vs. hosts/domain names of C&C Servers), updated every 15 minutes from 17 reputable & reliable sources for DNSBL data, HOSTS file data, & my own research!

2.) Firewall rules tables in BOTH hardware router NAT stateful packet inspecting type (LinkSys (vs. IP addressed C&C Servers)) vs. this botnet & others like it

3.) Norton DNS (which uses a DNSBL filter vs. known bogus sites/servers/hosts-domains too) for "layered security" on the principle of "YOU CAN'T GET BURNED IF YOU CAN'T GO INTO THE 'MALWARE KITCHEN'", so-to-speak: Simplest principle there is, & you're onto it yourself!

---

So... how effective is that "layered security" on the principle of which you now speak of?

Ok, a testimonial thereof from another /. user doing the same in addition to my own:

---

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

---

Trick is though, here?

You HAVE TO HAVE the url/domain name of this thing, & IP Addresses of its C&C servers FIRST (for firewall blocking rules tables entries)...

* I don't know if ANYONE has that information yet on this latest model...

Hence, why I posted HOW TO REMOVE IT below, in its current design, guaranteed, 100%

(That is, until the rootkit/botnet makers change the driver to protect not only the MBR, but also the registry area where drivers initialize that is...)

In its latest version, I don't have the IP addresses or hosts-domain names yet!

HOWEVER - I do have it for its previous builds for the botnet itself & its C&C servers though, which they are also PROBABLY most likely STILL USING!

APK

P.S.=> In the meantime?

This IS how you kill the rootkit propogator yourself, & STEP-BY-STEP (it works, read it - makes TOTAL sense as to why by taking out the fake MBR protecting driver itself):

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* This absolutely WILL work!

(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )

... apk

How long? Yesterday... apk

[Anonymous Coward]

Steps to take 2 "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* This absolutely WILL work!

(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )

Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)

APK

P.S.=> Actually, I posted HOW TO DO IT BEFORE YESTERDAY, 2 days ago, here on /.:

http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272

... apk

Re:The hidden truth behind thruth, why they say th

[Anonymous Coward]

I agree with much of your analysis, except for the last part.

I think it has more to do with finding a fictional excuse to lock down the sharing of information, so that when it happens, people will say, "Oh, well. We understand this. We've seen it coming. So let's NOT riot and self-destruct in a non-orderly fashion."

This way, when world crises become intolerable, population control measures can be set in motion with a minimum of fuss and bother from the remaining herd.

But, yeah, I'm sure some of the people involved think it's all about wealth. And in the estimation of their controllers, they're dupes also.

There is an easy way to destroy this botnet

[__aailob1448]

Just make everybody switch to apple computers and the botnet is immediately worthless, along with 99.9999% of the malware out there.

You're welcome.

-Steve

Re:There is an easy way to destroy this botnet

[CSMoran]

Yeah, cut off all noses and voila, no more runny nose.

What, malware scanners do noch check the MBR???

[gweihir]

When did that happen? The original scanners checked only the MBR and now they do not look at all? That would be pretty stupid.

Also, what about alternative MBRs? Does this thing keep a GRUB installation intact? And how does it hide in memory?

EXACT steps to kill this botnet/rootkit

[Anonymous Coward]

Steps to take to "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* This absolutely WILL work, no questions asked/period... vs. the CURRENT design of this botnet/rootkit that is...!

(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )

APK

P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)

... apk

Windows is for experts only.

[Hasai]

To everyone else, I give a Linux box.
];)

EXACT order of steps 2 take to kill this rootkit

[Anonymous Coward]

Steps to take 2 "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* This absolutely WILL work!

(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )

APK

P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)

... apk

This works, 110% guaranteed, vs. this rootkit

[Anonymous Coward]

Steps to take 2 "KNOCK-THE-CHOCOLATE" out of this rootkit's design currently:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* This absolutely WILL work!

(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )

APK

P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)

... apk

Re:This works, 110% guaranteed, vs. this rootkit

[Yvanhoe]

That's great, can you answer to me with more loghorrea please ?

Genuinely curious

[TangoMargarine]

Why sign all your messages but not make an account? Wouldn't an account make it much easier to keep track of what you've posted, and notify you when people respond?

Re:Genuinely curious

[Anonymous Coward]

If he had an account, all of his posts would start at -1 (due to downmods) and he'd be limited to a certain number of posts per day (and due to downmods, that "certain number" would be two).

That is, unless he pulled a MichaelKristopeit (but then, he probably hasn't figured out how to register 400+ accounts).

Quote, but so true

[DarthVain]

From my windows experience with viruses, the safest way IS to nuke it from orbit, its the only way to be sure.

Clean install. It really is too bad you can get free updated install disks from MS... as a clean install isn't the pain in the ass, it is updating all your service packs and updates, and drivers, etc... which you have to connect to the internet for, exposing yourself before you're fully patched. Never made any sense to me considering MS business model.

No trust.

[DrYak]

Windows or any other OS can detect this on start-up

No.
At start-up the system is already compromised.

If the windows loader checks the MBR with BIOS calls, it might by getting translated.
If the windows system tries to check some content, nothing guarantees you that the drivers (hard-disk, filesystem, etc.) used to do so aren't compromised too.
If the system tries to compare driver checksums, it's not guaranteed that the comparer itself isn't corrupted (that the "good checksum list" or the public key used to check signatures wasn't overwritten).... ...from here on it's a cat and mouse game between microsoft trying to come up with newer idea to check for presence, and the virus writer creating newer versions that can also circumvent this new check.

And modern botnets have an additional advantage : they can update their code while running. That means that, as soon as the virus authors find that microsoft uses a new check, they can send the new virus version to all the already infected machines. Copies running "in the wild" can be upgraded to the latest circumvention scheme, at the same pace as microsoft is writing them.

Once again : a compromised system can't be trusted anymore. Anything you can come up as an idea, could have been overwritten by the version of the virus running on your machine.

unless it is a full-fledged blue-pill

Virtualisation is one solution. Corrupting drivers (and checksum lists and public keys is another).

But you cannot squeeze something like that into the MBR, far too little space.

You can't also fit GRUB in the MBR, nor the Windows kernel. You never could.
Booting is a staged process. MBR is defenitely too small but for everything including for legit usage.
MBR loads a later stage in a known fixed place (with DOS & Windows its a regular file in a fixed position) (with GRUB, patches to make BIOS support big drives, and viruses - its unused sectors between the MBR and the first partition).
This space is still too small for the whole stuff, but it can contain better file/data access features (that's GRUB's stage 1.5, or Linux's LILO).
So it can load the stage after that from any file, from a hidden file system, whatever the author chooses and that can contain everything you need (the whole GRUB, the whole virus, the OS kernel, etc.) including full R/W filesystem access.

From that point on, you can have enough complexity in place, either to fire up a hypervisor, or to overwrite some critical files in order to go undetected, or check to be sure that the network-payload is still on the "Run after start-up" list, etc.

Re:No trust.

[gweihir]

You far overestimate what can be done from the MBR. The system is not "compromised" at all at that stage, the second step of the booting process is. What it can actually do is limited. In Linux, e.g., it would need to uncompress and then patch the kernel in memory. This is slow and very, very difficult. Also different to do for every kernel version. It is possible that patching Windows in memory, while it is not yet running is easier, due to its monoculturial nature.

This stops the rootkit/botnet propogator

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36621252

Steps to take 2 "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* This absolutely WILL work to kill the rootkit botnet propogator @ the source/root of it... the driver itself & the bootsector.

Then, once it starts bringing in the "std. fare" of OTHER malware it summons & infest you with - which it DOES do?

You can THEN use std. tools for malware/virus/spyware etc. removal, to "NUKE IT", w/ out a reinstall!

ProcessExplorer's another excellent tool, for killing unknown malwares/viruses when "std. tools" (antivirus/antispyware etc.) don't cut it... by freezing the source lib, service or exe itself & killing it on disk once frozen thus.

* This is a good idea to backup your data too, the personally created stuff you cannot just "reinstall" like OS &/or softwares as well...

APK

P.S.=> Only problem with my technique above, is tht IF the botnet makers alter the bogus MBR protecting driver to protect NOT ONLY the MBR as the current design does (which is WHY that series of steps can stop it, for now), but, also the registry initialization of itself from inside the registry here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\STORAGE

(IIRC, there may be others also)

Then "HOUSTON, WE HAVE A PROBLEM"

Which the above registry location, iirc, IS the area the hooked/filtered driver resides for DiskIO (& which the rootkit's MBR protecting driver protects vs. overwrite via MBR protection)... this rootkit's maker, IF he decides to protect that as well? Backup your data, & NUKE IT FROM ORBIT!

However, in the meantime vs. this rootkit's current design? This works to kill it... & you can clean out any other infestations most likely with std. tools AFTER, if they exist @ all, period!

... apk

Correct driver init. area... apk

[Anonymous Coward]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root

APK

P.S.=> This rootkit's MBR protection comes from a driver that hooks/filters on the Storage IO driver somewhere in that device driver init. tree... & this + other areas are what control driver instancing (we had best HOPE he doesn't "get smart' & correct for the ability of RC's disable command to shut down this thing, @ the root (it's driver mainly))

... apk

Unlike most "AC's"? I don't have a limit on

[Anonymous Coward]

The # of times I can post (& I can track my posts via tabs easily, & other methods (google site: searches even)...

I.E./E.G.-> I have a "technique" that's not a hack/crack of /., nor is it against the rules, for doing so: That's all!

Plus, I have been literally TOLD this before by trolls here whom I have "offended" & gotten the better of TONS of times on tech issues: & there's NOTHING worse than a geek who gets "shot down", lol... worse than WOMEN imo!

E.G.-> I have a pack of them from trolltalk.com whose "Geek Angst" is 'UP' vs. myself e.g.:

http://slashdot.org/comments.pl?sid=2230966&cid=36418796

Who use multiple accounts OR ac replies, etc. around here to "troll me" with etc./et al...

* In fact? Well - Here's a sampling of what they've told me, as they troll & harass (and yes, even libeled myself) me:

"Some (many) of us are tired of you're trolling and would like to be able to mod you down." - by Anonymous Coward on Monday May 23, @01:08PM (#36219132)

FROM -> http://it.slashdot.org/comments.pl?sid=2177744&cid=36219466

I've just "taken down" a pack of them (countertrolling, tomhudson, gmhowell, & others) who are or have consented to a "truce" with myself... only 1 more to take out now.

He has started hiding in his journals for the most part, OR doing AC replies (I think that's stopped though), because of that "fail list" above of only 1 of their members vs. myself on technical issues on this site...

APK

P.S.=> Thus, I gain little, if anything, by becoming a "registered 'LUSER'" - and, it would by the SAME TOKEN, make myself as easily "trackable" as they are... get it?

... apk

"absolutely" right... except it's not

[Anonymous Coward]

This absolutely WILL work! ... That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area

Nice contradiction there. I suggest you look up "absolutely" in the dictionary, it doesn't mean what you seem to think it means. It doesn't mean "probably, unless the rootkit makers got smarter".

Rootkit driver design not changed yet... apk

[Anonymous Coward]

See subject above, & thus? That's ALL THERE IS TO IT!

(Thus, my RC ListSvc, Disable, FixMBR technique works against its current design which has NOT changed yet...)

* Your forums "Illogic Logic" fails again, troll!

So, until it changes, & the exact way I noted? My technique, works...

APK

P.S.=> Needless to mention? I pointed it out & had the intelligence to do so... Did you??

... apk

Hence why I don't (see what I mean?)

[Anonymous Coward]

Downmods by the trolltalk.com trolls by nefarious means (they downmod, logout, keep their cookie unaltered in state, & troll/harass as AC replies as you see now - transparent & easily seen thru), lol...

"If he had an account, all of his posts would start at -1 (due to downmods)" - by Anonymous Coward on Thursday June 30, @03:16PM (#36626278)

Sure, bogus downmods for no good reasons is more like it! Funny how I can show a 100++ of my favorite up mods in my 'p.s.' below though,eh? Especially vs. THAT outright b.s. ... and??

Proof? Ok:

These trolltalk.com trolls cheat the moderation system!

Here's how they downmod others, and this is where countertrolling - the one doing it now by ac replies explains what he's doing while he trolls others (to his fellow trolltalk.com friends):

http://slashdot.org/comments.pl?sid=2245866&cid=36491652

And, here's where countertrolling's "troll mechanics" for downmodding others is explained in detail by someone (me) that got sick of it happening:

http://slashdot.org/comments.pl?sid=2271908&cid=36579618

As far as bogus up moderations, the trolltalk.com bunch (tomhudson, countertrolling, & others) collectively "team up" to upmod one another, in teams, as favors to one another.

(Talk about low, and bogus!)

---

In fact, here's what countertrolling says about it, why he does it, and to all of us here:

"What the skiddies here don't understand is that I don't give a shit about dumbass 'karma' on the internet.. I'm here for the jollies with nothing to lose or fight for.. watching them destroy their world.. They can go absolutely nuts as far as I'm concerned.. It's nothing but pure entertainment (and data points) for me and mine... Tragicomedy is probably the best word I can think of to describe it" - by countertrolling (1585477) on Thursday June 30, @10:26AM (#36622502) Journal

QUOTED VERBATIM FROM -> http://slashdot.org/comments.pl?sid=2281808&cid=36622502

---

Sounds like a sick individual to me.

The "trolltalk.com" troll/harass/stalk & libel squad is:

---

tomhudson (have enough to silence tomhudson)
gmhowell (have truce in place)
webmistressrachel (she leaves me along afaik)
jeremiah cornelius (he & I got along fine, he leaves me be)
countertrolling (the only 1 left to "take down" that remains)

---

* Perhaps a few other stragglers like Qzukk, but afaik, he doesn't bug me...

(And, there you are, the truth of it...)

APK

P.S.=>

"and he'd be limited to a certain number of posts per day (and due to downmods, that "certain number" would be two)." - by Anonymous Coward on Thursday June 30, @03:16PM (#36626278)

BUT, I'm not... am I? Heck - I can POST MORE THAN REGISTERED "LUSERS" CAN IF I SO CHOOSE in fact, lol... period!

---

"That is, unless he pulled a MichaelKristopeit (but then, he probably hasn't figured out how to register 400+ accounts)." - by Anonymous Coward on Thursday June 30, @03:16PM (#36626278)

Why bother? Again, I can POST AS MUCH AS I LIKE (even more than registered "LUSERS" can, who are also EASILY TRACKED SHEEP)... and?

As far as my being "downmodded"?? It's funny I can show a hundred here of my favorites, easily:

---

Roughly 100++ of them & I post as AC (hard to get even +1, as /. hides our posts & we "AC"'s start @ ZERO/0 points, unlike registered "lusers", lol!):

+5 'modded up' posts by "yours truly" (5):

Genuinely curious - GENUINE EXAMPLE

[Anonymous Coward]

Read this, this is what I go thru with trolls -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36626278

And another like it, here in this exchange also:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36626356

(See what I meant now here in my original reply to you after seeing that URL above http://it.slashdot.org/comments.pl?sid=2282088&cid=36624418 )

* I think you see my point on the "trolltalk.com" trollsquad around here... & that I wasn't b.s.'ing you!

APK

P.S.=> My rebuttal to his b.s. is here, IF you are interested:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36626888

It easily disproves the crap he spouted, with backing proofs as well, & easily, as per my usual vs. the "trolltalk.com" trolls that have infested slashdot!

... apk

An application of... "ReVeRsE-PsyChOLoGy"

[Anonymous Coward]

"? esaelp aerrohgol erom htiw em ot rewsna uoy nac ,taerg s'tahT" - by - another done nothing with his life "ne'er-do-well" off-topic troll

"???"

* Uhm, lol... Could we get a translation of that off-topic "troll-speak" of yours, please?

(LOL!)

APK

P.S.=> Yes, it must have just have been another off-topic done nothing of significance with his life troll spewing his off-topic b.s. again & not contributing to the ongoing conversations. Oh well - No biggie!

("ReVeRsE-PsYcHoLoGy" courtesy of this code by "yours truly" in 1 second flat):

---

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
          try:
                          trollstring = ""
                          for apksays in s:
                                  trollstring = apksays + trollstring
          except:
                  print("error/abend in reverse function")
          return trollstring

s = ""
print reverse(s)

try:
                                                  s = "You write like Steve Gibson on meth. Hey, you are an AC..."
                                                  s = reverse(s)
                                                  print(s)
except Exception as e:
                                                  print(e)

---

... apk

How to reverse in Python

[gottabeme]

Here's a lesson for you:

#!/usr/env/python
print "How to reverse in Python"[::-1]

Re:How to reverse in Python

[gottabeme]

Oops:

#!/usr/env/python

should be

#!/usr/bin/env python

Silly me. But that won't matter for you, anyway.

Re:How to reverse in Python

[Anonymous Coward]

Don't bother. Do a little research on APK and you'll see that his specialty is horribly ugly and inefficient GUIs tacked together to do really basic stuff. Exactly like that little script he's posting copypasta in all his posts. That, and accusing people of libel and claiming that he's going to sic his lawyer on you (what a joke, right?).

Re:How to reverse in Python

[Anonymous Coward]

What have you ever done that was rated well by others troll?

Epic troll!

[gottabeme]

Haha, I was actually going to refute some of your claims about Linux, but a few minutes of googling uncovered that you are an EPIC INTERNET TROLL!

So, APK, or cybordeath, or AlecStar, or Alex, or Alexander--I suspect APK are your initials, but I've had enough of googling you: game over.

No wonder you're an AC on here. I wonder how many times you've been banned from Slashdot. Your karma must be as low as possible.

You've been told this before on other forums, but I'll say it again: In all seriousness, you need to see a psychologist. We all have problems, but you show signs of extreme OCD, paranoia, egotism, delusion...I could go on. Your life would likely be much happier if you could get help to deal with these issues and overcome them. I suspect that you have so much free time to carry on these online campaigns because you have trouble holding down a job. Maybe you're on disability. I honestly feel sorry for you. I even wonder if you were in a wreck or something years ago and suffered brain damage, causing a severe personality change.

Anyway, I hope you will seek help and begin to change your life.

This does the job MORE than adequately

[Anonymous Coward]

":uoy rof nossel a s'ereH" - by gottabeme (590848) on Thursday June 30, @05:01PM (#36627650)

See subject-line, & this code below:

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
          try:
                          trollstring = ""
                          for apksays in s:
                                  trollstring = apksays + trollstring
          except:
                  print("error/abend in reverse function")
          return trollstring

s = ""
print reverse(s)

try:
                                                  s = "Here's a lesson for you:"
                                                  s = reverse(s)
                                                  print(s)
except Exception as e:
                                                  print(e)
---

* &, there you go... courtesty of yours truly!

APK

P.S.=> I think you made a mistake though...

... apk

This works 4 "ReVeRsE-PsyChOLoGy" vs. trolls

[Anonymous Coward]

This works for purposes of subject-line -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36628334 this code works for the purpose I use it for: "ReVeRsE-PsyChOLoGy" vs. trolls here on /. ...

APK

P.S.=> Thanks for nothing, but you at least stayed on topic & I whipped that out in about 5 minutes time, & added in errtraps etc./et al...

... apk

U can't refute my claims on Linux is why, lol!

[Anonymous Coward]

And, UR version of "ReVeRsE-PsYcHoLoGy" had error in it, lol - mine doesn't, it works!

",xuniL tuoba smialc ruoy fo emos etufer ot gniog yllautca saw I ,ahaH" - by gottabeme ANOTHER "ne'er-do-well" troll from arstechnica (590848) on Thursday June 30, @05:41PM (#36628132)

See? LMAO!

".todhsalS morf dennab neeb ev'uoy semit ynam woh rednow I .ereh no CA na er'uoy rednow oN - by gottabeme ANOTHER "ne'er-do-well" troll from arstechnica (590848) on Thursday June 30, @05:41PM (#36628132)

Ask Jeremy Reimer how he had to remove his impersonations of myself from his website... lol, see here on that note:

http://www.windowsitpro.com/article/internals-and-architecture/the-memory-optimization-hoax#feedbackAnchor

Where he was put on a tracking ticket by his then ISP Shaw of Canada as well, & had a Det. Felton of the Vancouver BC RMCP called on he as well for harassing me, libeling me, cyberstalking & impersonating myself + a Mr. Martin Meszaros as well!

His friend Jay Little had his websites removed in their ENTIRETY as well for cyberstalking myself, email harassing me, and making DEATH THREATS to me by his hosting provider CrystalTech.com (who told me that both Reimer & Little would do it again, Little has stopped, Reimer has not & only ceased for a year or so).

Talk about "Geek Angst", because they impersonated me on Reimer's puny OSY/Pegasus website, lol, which NOBODY visits, and also cyberstalked me to Windows IT Pro magazine's forums!

LMAO - Only to be SHOT DOWN on 15 technical points, including the fact that memory optimization technology can UNHALT frozen/stalled Exchange Servers...

Yes - that's right, & even Dr. Russinovich had to concede that to me in fact due to documentation from Microsoft no less proving it!

(& I've helped he fix his work before, in pagedefrag.exe in his Hardcodes telling he how/when/where/why via the native NtAPI how to do so in fact (he used to be a "colleague/coworker" of mine for SunBelt Software in the mid to late 1990's in fact - he thanked me for it by email no less!)

---

".tsigolohcysp a ees ot deen uoy ,ssensuoires lla nI :niaga ti yas ll'I tub ,smurof rehto no erofeb siht dlot neeb ev'uoY" - by gottabeme ANOTHER "ne'er-do-well" troll from arstechnica (590848) on Thursday June 30, @05:41PM (#36628132)

Ahem - Do YOU have your:

---

1.) PHD in the Psychiatric sciences?

2.) A license to practice psychiatry professionally??

3.) Years-To-Decades of professional experience in psychiatry???

4.) A formal examination of myself done in a professional environs to make your "snap prognosis/diagnosis" there, Mr. "SiDeWaLk-ShRiNk of /."????

---

NO, to ALL of the above?????

* Thought not... go away troll, & when you quit making mistakes in Python code, THEN you can talk... as you can see above in quotes of your "TrollSpeak"? Mine works...

APK

P.S.=> Trolls - You're ALL THE SAME, & easily dispatched with documented facts & truths, everytime...

... apk

Re:U can't refute my claims on Linux is why, lol!

[gottabeme]

I'm curious: Please explain how quoting me backwards makes me look bad. And please explain how it is a form of reverse psychology.

"Got there first"

[DrYak]

You far overestimate what can be done from the MBR. The system is not "compromised" at all at that stage, the second step of the booting process is.

I'm not saying that you can completely hack a machine with the 200 free bytes for custom code in a boot sector.
What I'm saying is that if your code is running first, you can decide what will happen next.
Even if the "big stuff" only happens 7 stages later down the line, you get to chose what happens in the 5 stages in between, if you already control stage number 1.

Even if none of these stage can do great things for you, the same is also true for the legit code. A viral MBR can't do much except redirect the boot process to viral stages. A legit MBR can't do much either. Same for later stages. Except that your code was running first and you get to overwrite the legit code first, before it runs.

What it can actually do is limited. In Linux, e.g., it would need to uncompress and then patch the kernel in memory. This is slow and very, very difficult.

Sorry, no. *You* apparently have no idea.
Uncompressing the kernel is something which happens in a snap second at every boot.
The first 512bytes of a kernel (Linux, Memtest, and a few other) contains already enough code to do it without any problem. You can write the kernel directly on a bootable media (say on a floppy) and it will boot (used to be the case for the Linux kernel, before it became too complex to fit on a floppy. That's still one possible way to load memtest).

Something as small and as simple as GRUB can have already enough functionnality to freely read and (in-place) write any file on a partition. That's already enough functionality to make sure that the content of a few key ".SYS" files in Windows are overwritten with content coming from a few other files in viral origin.
These files can reside on the boot partition (and be subsequently hidden by the hacked file system drivers) or on a separate hidden partition (which could be hidden too, using a hacked disk driver) like overwriting the "System tool" partition that most modern boxes come with out of the factory.
All it takes is that, instead of running the vanilla NTLDR or Winload.exe, the previous viral stage (the one booting from the free sectors) load an alternate Boot loader, one that first overwrites critical .SYS files before booting further.

Again, GRUB is also able to load load and uncompress a kernel, then load and optionally uncompress modules (although this function isn't much used by Linux. ReactOS does use it extensively though), and finally load a ramdisk (which is quasi-instantly decompressed during boot).
A viral stage2 bootloader code could load the kernel, load and inject a special "root-kit" module, load the ram disk and let the whole stuff run.

The Linux kernel has several facilities to all modifying code in-place. Modules are a standard way. Root-kits as modules are a standard attack on Linux. Normally they are hard to do, because once Linux is running, you need privileges to load modules, and the module functionnality might have been disabled at this stage for security reason. Before booting, injecting a root-kit module is just trivially using the facility used to pre-load modules.
Counter measures could be disabling support for boatloader provided modules, or adding a checksum control in the first step of the kernel startup.
Evasion could be putting the root-kit module inside the ram-disk, or using an alternate kernel (with no checksum, or with root-kit build in statically).

The windows booting process even *COUNTS* on lots of files and modules being loaded. System .DLL files, SCSI miniport, other boot critical .SYS driver ...
Hacking windows's boot process is as simple as either making sure at a previous stage that the critical .SYS

Re:"Got there first"

[gweihir]

You still need to bring the system up in a way that the user does not notice something bad happened. With a well-designed system that has security in mind, this is very, very difficult at this stage. True, Windows does not qualify and this may be easy.

Don't use Windows 2k/XP/Server 2003 FixMBR

[Anonymous Coward]

ON WINDOWS VISTA, WINDOWS 7, or WINDOWS SERVER 2k8 - that's simply because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!

For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!

(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)

* Because all they do is query the registry in write it, respectively!

(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).

APK

P.S.=> To quote Sean Connery from "The Untouchables"? Well, "Here endeth the lesson..."

Why use listsvc & disable vs. this rootkit?

[Anonymous Coward]

Proof thereof below on WHY those 3 commands (listsvc, disable, fixmbr) WILL work, because this rootkit uses a protective driver:

---

http://blogs.technet.com/b/mmpc/archive/2011/06/22/don-t-write-it-read-it-instead.aspx

PERTINENT QUOTE/EXCERPT:

"now it introduces a driver component to prevent the malicious MBR and other malicious data stored as disk sectors from being changed. The driver component protects the data in an unusual way Ã" by hooking the DriverStartIo routine in a hard disk port driver (for example, atapi.sys)"

---

(Doing a listsvc /? or disable /? shows their paramter switches for their commandlines)

* ... & there you are!

APK

P.S.=> Assuming this IS the "indestructable rootkit" that came out 2 days ago in the news that is... &, I am PRETTY SURE it is (big news is why) ... apk

Why listsvc & disable too vs. this rootkit

[Anonymous Coward]

Proof thereof below on WHY those 3 commands (listsvc, disable, fixmbr) WILL work, because this rootkit uses a protective driver:

---

http://blogs.technet.com/b/mmpc/archive/2011/06/22/don-t-write-it-read-it-instead.aspx

PERTINENT QUOTE/EXCERPT:

"now it introduces a driver component to prevent the malicious MBR and other malicious data stored as disk sectors from being changed. The driver component protects the data in an unusual way Ã" by hooking the DriverStartIo routine in a hard disk port driver (for example, atapi.sys)"

---

(Doing a listsvc /? or disable /? shows their paramter switches for their commandlines)

* ... & there you are!

APK

P.S.=> Assuming this IS the "indestructable rootkit" that came out 2 days ago in the news that is... &, I am PRETTY SURE it is (big news is why)

Global stats ...

[Anonymous Coward]

Infection of the TDL-4 botnet is estimated at 1.55% (about 1 in 64) in the US.... higher in other countries... (e.g. romania 3.49%)
http://www.internetsecuritydb.com/2011/06/tdl-4-botnet-statistics.html

Don't use Windows 2k/XP/Server 2003 FixMBR

[Anonymous Coward]

ON WINDOWS VISTA, WINDOWS 7, or WINDOWS SERVER 2k8 - that's just simply because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!

For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!

(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)

* Because all they do is query the registry in write it, respectively!

(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).

APK

P.S.=> To quote Sean Connery from "The Untouchables"? Well, "Here endeth the lesson..."

A play on words, that's all... apk

[Anonymous Coward]

It's obvious you WERE trolling me though, for Pete's sake!

(Now, see subject-line: IF you weren't trolling me? My bad then!)

HOWEVER - it's obvious you came in here trolling!

Proofs/Evidences thereof to that very effect:

---

I.E./E.G. #1: Your bringing up Arstechnica (& myself EASILY "shooting it down in flames" with documented proof from where it happened + why). See here on that note -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36628132

---

I.E./E.G. #2: Opening your init. post the way you did. See here on THAT note -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36618920

---

I.E./E.G. #3: Your trying to tell me how to write PyThon code, when mine works fine & yours had an error in it too? Please... see here on THAT note -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36628334

---

(That's how it did, mainly the LAST example #3 above all others in fact!)

* I call that "ReVeRsE-PsyChoLogy" merely because it's a "play on words", diff. meaning entirely, but when trolls "troll me"? That's what they get in return - their OWN GIBBERISH thrown back @ them... & there you go!

APK

P.S.=> Heck that Python error you made, when my code works JUST FINE?

Well - I really didn't HAVE to use my "patented 'ReVeRsE-PsYcHoLoGy'" anti-troll technique... the way you 'blew it" with the mistake in your PyThon code did that for me, lol (sorry, just fact).

... apk

Re:A play on words, that's all... apk

[gottabeme]

Actually, I never mentioned Ars Technica--you did.

Actually, my typo was not in the Python code, but in the shebang. It's a Unix thing. The Python code works "JUST FINE".

Please explain which Python exceptions your code could raise.

Please explain how quoting me backwards makes me look bad. I think it makes you look silly and childish.

Please explain how typing in ALtErNaTiNG CaPs makes you appear mature.

I have a challenge for you: Write a reply: 1) without using bold text, 2) without using alternating caps, 3) without using @'s or ampersands, 4) without using horizontal lines, 5) without a postscript (those make no sense online because you can backspace--they are for paper correspondence where one can't change what he's written), 6) without claiming or insinuating that you are a superior being. In other words, write without vitriol, without hyperbole, without insults--the way a normal, reasonable person would write. I am skeptical that you can even do it.

By the way, what drugs do you use, and how long have you been using?

Re:Invisible? Problem of "restore" program disks

[Anonymous Coward]

Amen. This, of course, is part of MS' business plan that the Anttitrust Division of the Department of Justice should have looked hard at and forced them and the hardware makers to change during the last show "investigation" of and proceedings against MS.

A local computer shop and I once created boot disks for their, my, and some other customers' computers. Unfortunately, somewhere along this way, both the shop and I had picked up a delightful virus, very possibly installed during a burglary of my law office and some other sabotage, and, you guessed it, it got included on the boot disks and a lot of others.

This thing could also infect my off-site backup whIch I finally did get after two successive burglaries where nothing but data was stolen and damaged, and the destruction of my law office by what the fire marshal told and showed me was arson but, for political reasons, he would list officially only as "suspicious" and the police never opened a file.

I guess everybody but me understands all this stuff. I don't. One thing I have never figured out is how people with the kind of technical knowledge involved, which should have a value in the legitimate market (though some of my friends' incomes have collapsed), and the time and capital needed to create and propagate these things, make any money at these activities.

U R Full of it troll (point by point)

[Anonymous Coward]

"Please explain how quoting me backwards makes me look bad. I think it makes you look silly and childish." - by gottabeme (590848) on Friday July 01, @04:56AM (#36631474)

I already did - my Python code did reversal of strings, you said yours did but it won't because you put in the wrong stuff into the shebang. ERROR...

U FAIL #1

---

"Actually, I never mentioned Ars Technica--you did." - by gottabeme (590848) on Friday July 01, @04:56AM (#36631474)

Right I did, because I remember after MANY YEARS still that Arstechnica accused me of being this CyborDeath character (and I am NOT he), per the below statement you made, you lying jackass:

"So, APK, or cybordeath, or AlecStar, or Alex, or Alexander--I suspect APK are your initials, but I've had enough of googling you: game over." - by gottabeme (590848) on Thursday June 30, @05:41PM (#36628132)

So don't try to "fool me" - you're not: You try to make ME look badly, and just because you couldn't:

---

1.) Disprove my points backed by solid information on Linux

2.) You put the wrong path into the 'shebang' (and yes, jackass - I know what that is, so don't even begin to try to patronize me, after YOUR screwup on it in the Python code)

---

U FAIL #2

---

"Actually, my typo was not in the Python code, but in the shebang. It's a Unix thing. The Python code works "JUST FINE". - by gottabeme (590848) on Friday July 01, @04:56AM (#36631474)

Ahem: BULLSHIT -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36627676

( Then, why did you say "Oops" there? without that being correct it is a mistake on your part... period. )

U FAIL #3

---

"Please explain which Python exceptions your code could raise." - by gottabeme (590848) on Friday July 01, @04:56AM (#36631474)

WTF? Talk about easy (not that I have to answer it but I will and so will YOU with your own words, of 'Oops' etc.):

---

Structured exceptions built into python (via exceptions as e which would be raised)

OR

Custom exception/b>, by the one I printed out in the reverse function myself (a custom exception that would signal the error occurred there))...

---

Clue: I've been using error trapping vs. unexpected abends since the 1980's you santimonious little patronizing jackass (and on what grounds you act that way is beyond me - you failed here, not I).

AND, not that I have to answer to a JACKASS like yourself that couldn't disprove my points backed by FACTS in Linux, or that made a mistake in his Python work.

U FAIL #4

---

"Please explain how typing in ALtErNaTiNG CaPs makes you appear mature." - by gottabeme (590848) on Friday July 01, @04:56AM (#36631474)

Awwww, poor baby - gottebeme came in here trolling me and now he tries to "act the mature person"... lol!

(Think that fools anyone? NOT!)

U FAIL #5

---

"By the way, what drugs do you use, and how long have you been using? - by gottabeme (590848) on Friday July 01, @04:56AM (#36631474)

Ooohhh, the little troll thinks he's clever - new NEWS/NewsFlash: QUIT PROJECTING!

U FAIL #6

---

"I have a challenge for you" - by gottabeme (590848) on Friday July 01, @04:56AM (#36631474)

I have a challenge for you - try not to make me laugh (because you do, & on all fronts noted above).

U FAIL #7

(Above all else by this point? I don't have to answer a damn thing from you from this point on you troll... you lose.)

APK

P.S.=> U FAIL TROLL - period (now go away, shoo troll, lmao!)

... apk

Re:U R Full of it troll (point by point)

[gottabeme]

You ignored my challenge, so I will ignore all of yours.

gottbeme made mistakes & ran

[Anonymous Coward]

gottabeme says "Oops" here, lol http://it.slashdot.org/comments.pl?sid=2282088&cid=36627676

Trying to correct apk, and apk's string reverse program worked fine already, see here http://it.slashdot.org/comments.pl?sid=2282088&cid=36628334

For a guy that does "horribly ugly and inefficient GUIs tacked together to do really basic stuff" as you said, then how come apk was able to do this list below (copied from a post of his I bookmarked) and perhaps you can speak that way when you can show you've done better troll:

---

Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue, page 61

(&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row 2000-2002, in its HARDEST CATEGORY: SQLServer Performance Enhancement).

WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)

PC-WELT FEB 1998 - page 84, again, my work is featured there

WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there

PC-WELT FEB 1999 - page 83, again, my work is featured there

CHIP Magazine 7/99 - page 100, my work is there

GERMAN PC BOOK, Data Becker publisher "PC Aufrusten und Repairen" 2000, where my work is contained in it

HOT SHAREWARE Numero 46 issue, pg. 54 (PC ware mag from Spain), 2001 my work is there, first one featured, yet again!

Also, a British PC Mag in 2002 for many utilities I wrote, saw it @ BORDERS BOOKS but didn't buy it... by that point, I had moved onto other areas in this field besides coding only...

Being paid for an article that made me money over @ PCPitstop in 2008 for writing up a guide that has people showing NO VIRUSES/SPYWARES & other screwups, via following its point, such as THRONKA sees here -> http://www.xtremepccentral.com/forums/showthread.php?s=ee926d913b81bf6d63c3c7372fd2a24c&t=28430&page=3

---

When you can show you've done better maybe then you can talk troll.

The driver name to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling & tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

Re:The driver name to disable is...

[Anonymous Coward]

Just reinstall and save yourself this idiocy.

The driver name to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command, from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling & tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

The driver name to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling OR tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

The driver name to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling, or tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

The driver name to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling & tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

The driver name to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling or tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

The driver name to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling/tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

Oh, but they ARE relevant SanityInAnarchy

[Anonymous Coward]

Here is how/when/where/why, regarding botnets like these (blended threat type that uses both a driver AND the bootsector):

"The thing is, it's been a long time since anyone's found viable remote exploits, and as much as APK would love to believe otherwise, the kind of local exploits Linux has now aren't nearly as serious, and also aren't that relevant to this discussion" -

This rootkit/botnet combination?

IT HAULS IN OTHER THINGS!

Mainly malwares that operate in Ring 3/RPL3/Usermode (in Windows)!

(Yes, it can be "taken out" - I've written it here NUMEROUS TIMES to show others how & why too)

I.E.-> Recovery Console bootup, listsvc (to find the hello_tt.sys bogus MBR protecting driver), disable to disable it, reboot to RC again, fixmbr to refresh the bootsector (since it's no longer being protected vs. this thing)

Fact is - The only thing that scares me & I noted it in my posts here, is IF the creator of this botnet begins protecting the registry area that drivers LOAD from (which is what disable overwrites, & it only takes on REBOOT) - so, if they protect it vs. overwrite? Disable won't even help... because it doesn't take until reboot!

NOW, back on track:

Since this thing hauls in other malware to attack you with? It's "INSIDE" Troy, so-to-speak... & any LOCAL EXPLOITS, become ESSENTIALLY, remote ones due to botnet control that CAN EXPLOIT THEM...

Get it??

Heck, I'll give you another example thereof on the SAME CONCEPT that actually happens to a former "co-worker/colleague" of mine, recently too!

Even "good guys" like Dr. Mark Russinovich had his wares exploited recently (psexec) by the CoreFlood botnet this way -> http://www.installsoftware.com/microsoft-admin-tool-used-by-coreflood-to-infect-computer-networks/network_software

So... do you SEE MY POINT? Once botnets are "inside the gates of the city"? They can do ANYTHING you can do really (take advantage of apps, OR LOCAL SECURITY VULNERABLITIES TOO!)

Plus - Rootkits ORIGINATED in UNIX, and they do exist for Linux...

Now, they are out there for Linux, just not as much due to lesser amounts of use on end-user less expert desktops... SO, they start being designed LIKE THIS ONE IS??

* EVEN LOCAL EXPLOITS BECOME "REMOTE ONES" used by botnets!

APK

P.S.-> Only a matter of time too, & I've told you this before (plus, ANDROID shows you all that Linux can be exploited as well) - "Security-By-Obscurity" is the ONLY THING PROTECTING LINUX, period, on desktops for end users... malware makers are out to take out the BIGGEST TARGET THEY CAN, from a single shot: That's Windows, because it has the most end-user market/mind share... they are JUST LIKE PICKPOCKETS: Pickpockets don't operate on "crowds of 1", they go to trainstations, subways, crowded streets & thoroughfares, to do their work (victimize others)... malware makers? NO DIFFERENT! You get Linux higher marketshare?? It will be attacked more, period (ANDROID shows this much easily) & LOCAL EXPLOITS, can become REMOTE ONES (in a manner of speaking, because the enemy IS INSIDE THE CITY WALLS, ala Troy)...

... apk

Re:Oh, but they ARE relevant SanityInAnarchy

[SanityInAnarchy]

Since this thing hauls in other malware to attack you with? It's "INSIDE" Troy, so-to-speak... & any LOCAL EXPLOITS, become ESSENTIALLY, remote ones

Nope, they don't magically become remote because you say so. They're still local, and they're still being exploited locally.

You still need to get inside troy first.

Plus - Rootkits ORIGINATED in UNIX, and they do exist for Linux...

Your point?

plus, ANDROID shows you all that Linux can be exploited as well

Android's a lot different than desktop Linux. Unless they're exploiting the kernel, I'm not sure I see your point here.

And how many Android exploits are actual drive-bys? How many could've been avoided simply by not installing something?

Step inside, I'd like to discuss something w/ U

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36639318

And I really do NOT like you talking behind my back, either... but, show up there, and we can discuss what I brought up (see you there).

APK

SanityInAnarchy? Addendum (READ)...

[Anonymous Coward]

You put a LOT OF FAITH in Chrome's sandbox? Hey - Sandboxes CAN and HAVE BEEN BROKEN (you even alluded to that much)!

So - Do you want to REALLY be "sure" of Chrome? Cut down on the indiscriminate use of javascript everywhere (only use it where you ABSOLUTELY need it), because even javascripted adbanners have been found to house malware - & it's one of the MAIN avenues whereby infectors/malware-in-general make their entrance into a system from!

Until the way this thing is getting into systems IS CLEARLY IDENTIFIED (be it an app that poses as a legit one, ala a Trojan (hence, my TROY analogy here) OR via scripted websites or adbanners etc.)? It's a GOOD IDEA to cut off that possible avenue of infestation as well in indiscriminate javascript usage "everywhere" as well as just using "any app there is under the sun"

(Good job on cutting listening services with vulnerabities or not though, as well as patching on your end, it's much as I do on Windows, see below).

ALSO - You're also NOT accounting for the other parts of Linux that come in the distro itself that have bugs that are NOT SANDBOXED!

(Things like other browsers & programs, Windows Managers (possibly even the new UNITY itself because it's new & NEW THINGS USUALLY HAVE SECURITY ISSUES/BUGS that pop up eventually as well)), Shells (KDE/Gnome), etc./et al)

All those things that come in a Linux distro, that YES, have security bugs/issues themselves that CAN be taken advantage of (remote AND LOCAL ones).

Couple all THAT, together with the fact I noted in my last post that a rootkit/botnet "blended tech threat (uses both driver & bootsector style rootkit tech) HAULS IN OTHER MALWARES ONTOP OF ITSELF BEING THERE TOO?

Again - Once inside "the walls of Troy" (& I do salute you for doing what I do, cutting off other possible points of "ingress for infestation" ala my guides for securing Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE )?

It can do what it wants - up to the creativity of the botnet makers...

* Including take advantage of local apps (ala my example with CoreFlood & Dr. Mark Russinovich's psexec.exe program, from my last post to you in regards to this, which this is an addendum to), OR LOCAL SECURITY BUGS UNPATCHED!

Period...

---

On that note?

Let's compare HOW MANY security issues remain unpatched on Windows (heck, ALL of what Microsoft gives you for business & development even) vs. THE LINUX 2.6x MAINSTREAM KERNEL ONLY:

This data's ALL from a respected source for known security vulnerabilities unpatched:

---

Vulnerability Report: Microsoft SQL Server 2008: (07/02/2011)

http://secunia.com/advisories/product/21744/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (07/02/2011)

http://secunia.com/advisories/product/17543/

Unpatched 0% (0 of 6 Secunia advisories)

Vulnerability Report: Microsoft Exchange Server 2010: (07/02/2011)

http://secunia.com/advisories/product/28234/

Unpatched 0% (0 of 0 Secunia advisories)

Vulnerability Report: Microsoft SharePoint Server 2010: (07/02/2011)

http://secunia.com/advisories/product/29809/

Unpatched 0% (0 of 0 Secunia advisories)

Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (07/02/2011)

http://secunia.com/advisories/product/34343/

Re:SanityInAnarchy? Addendum (READ)...

[SanityInAnarchy]

You put a LOT OF FAITH in Chrome's sandbox?

I don't put faith in anything.

Hey - Sandboxes CAN and HAVE BEEN BROKEN (you even alluded to that much)!

Thus, layered security.

But then, what kind of breaks have we seen? Plugin exploits.

You're also NOT accounting for the other parts of Linux that come in the distro itself that have bugs that are NOT SANDBOXED!... All those things that come in a Linux distro, that YES, have security bugs/issues themselves that CAN be taken advantage of (remote AND LOCAL ones).

Be specific. Which of these actually have legitimate remote exploits? I mean, you mentioned Unity, which is laughable. What is Unity doing accessing the network in the first place?

And please try not to confuse local exploits with remote ones, or be specific about why this local exploit is a problem. Which can a sandboxed Chrome tab touch?

Let's compare HOW MANY security issues remain unpatched on Windows

Let's not.

Goodbye, troll. It's been fun, but this is entirely offtopic at this point, and not a discussion I'm interested in having right now. I have so many better things to spend my time on than dealing with you -- even responding to trolls with better manners than you. (I think your capslock key is broken, and I never once used M$ or any other pejorative, while you continue to use "open sores" at every opportunity.)

Step inside, we need to discuss something...

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36639318

Additionally, I don't like how you "talked behind my back" either, but... we can discuss that TOO, once you get to that link above & read it: See you there...

APK

Step inside: Need 2 discuss something w/ U

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36639318

Additionally, I don't like how you "talked behind my back" either, but... we can discuss that TOO, once you get to that link above & read it: See you there...

APK

Step inside: Need 2 discuss something w/ U

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36639318

Additionally, I don't like how you "talked behind my back" either, but... we can discuss that TOO, once you get to that link above & read it: See you there...

APK

The name of the rootkit driver to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling or tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

The name of the rootkit driver to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling or tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

The name of the rootkit driver to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling & tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here! ... apk

The name of the rootkit driver to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling & tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

The name of the rootkit driver to disable is...

[Anonymous Coward]

hello_tt.sys

(Disable that using the disable command from Recovery Console, THEN, reboot to RC again, & use fixmbr to restore a normal bootsector (because it's no longer being "protected" by this driver anymore than from overwrite))

FROM -> http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E

APK

P.S.=> Despite the jackasses (countertrolling & tomhudson) down modding my posts, this was meant to help other techs combat this thing & with good intentions from myself - despite the trolls around here!

... apk

Re:ListSvc, Disable, & Fixmbr from RC can kill

[Sardaukar86]

Surely we only need your hosts file trick to fix this problem, right apk?

No?

One might think it was the cure-all for every IT issue, from the number of times you vomit that rubbish up.

My "PROACTIVE MEASURES" inside...

[Anonymous Coward]

Norton DNS or my HOSTS file would block it, but I wouldn't worry about that (say if my nephew or brother who uses my system @ times infest it by accident)?

Well - Typical virus/spyware/trojans/malware-in-general, I'd knock it off using Process Explorer IF I had to!

(That's my "never fail tool" that can be used vs. malware-in-general that possibly std. tools like antivirus/antispyware doesn't kill - that IS because their signatures/mugshots of known offenders sometimes doesn't HAVE new stuff in it (&, that's usually only a matter of time too with submissions from millions all over the globe & what-not)).

Process Explorer (for std. "Ring3/RPL 3/UserMode" malware that is) is EXCELLENT for killing unknown ones (& you can always spot them, even IF they hide beneath another exe they hook (via libs) or services (libs or exes)).

You tell it to "freeze" the culprit, which it sends HLT commands to, & then? You destroy it on disk... simple!

---

Many times here in the past, I have said most security is "reactive" in nature before here, antivirus/antispyware too - but the rest of it, comes from the user being diligent patching OS & apps, PLUS, being smart about surfing!

Case in point?

E.G.-> Another PROACTIVE measure that cuts of a vector of infestation @ the root?

Disabling javascript's "all the time" - only use it, where you absolutely NEED it!

Say for ecommerce or reputable sites only!

(Opera allows for this excellently, as it has a BY SITE PREFERENCES setup, & globally I surf w/ out script active by default, plugsins too (e.g.-> Adobe Flash going thru hell all the time is why with bugs)) another PROACTIVE way to avoid trouble too!

E.G.-> Since 2004, I can show you a slew of reports on adbanners ALONE that infected folks by the 1,000's if not millions via malicious scripting, & bogusly scripted sites (which Norton DNS' DNSBL & HOSTS files block & my hosts file? Updated EVERY 15 minutes, automatically for me as I stated, via a Python system I built/co-built/rebuilt))

The rest of what I do "PROACTIVELY"? Is in my p.s. below... it works!

Would you like tesimonials to that effect? Ok:

I "preach" layered security, & have since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:

http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text

AND, more currently, the MOST viewed & highly rated one there is for years now since 2008 online:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

Which has well over 300,000++ views online (actually MORE, but 1 site with 75,000 views of it went offline/out-of-business) & it's been made either:

---

1.) An Essential Guide
2.) 5-5 star rated
3.) A "sticky-pinned" thread
4.) Most viewed in the category it's in (usually security)
5.) Got me PAID by winning a contest @ PCPitStop (quite unexpectedly - I was only posting it for the good of all, & yes, "the Lord works in mysterious ways", it even got me PAID -> http://techtalk.pcpitstop.com/2007/09/04/pc-pitstop-winners/ [pcpitstop.com] (see January 2008))

---

Across 15-20 or so sites I posted it on back in 2008... have YOU done better, troll?

---

SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:

Re:My "PROACTIVE MEASURES" inside...

[cbiltcliffe]

... have YOU done better, troll?

You're a cocksucking douche. Yes, that sounds like flamebait.

It's not. It's the truth.

You know absolutely jack shit about me, and when I call you out on a completely illogical statement you made, you start going back to previous things that you've done, and how "you must be right because look at your credentials!"

Ever heard of the appeal to authority logical fallacy?

I don't give a damn what you've done, and how many security guides you've authored.

When your machine is infected, you can no longer trust your DNS settings. Period. End of story.
Saying that you check them is irrelevant.

Now, as to what I've done in this area? Well, let's see....I am the author of an anti-malware tool that uses 40+ different antivirus engines to scan a machine. It does this scan offline, rather than within the infected system, and I can do it remotely, over the Internet. This, of course, means I can use this system to remove rootkits remotely, even on a computer that will not boot.

Remote service on a computer where Windows (or for that matter OSX or Linux, too) will not start. Gee. Have you done better, troll?

Another USEFUL tool by "The Good Doctor"?

[Anonymous Coward]

TcpView... now, say (as I did in my last post above) that while letting my nephew, brother (or even little niece, she's into computing too (good sign)) use my system, & say they infect it via a USB stick, and my antivirus/antispyware in place resident doesn't catch it? I can monitor who/what/when/where/how my system is "talking to" other machines online (inclusive of botnet C&C servers).

(Yes, Microsoft Security Essentials SHOULD "catch that" here & I update it religiously - but, then, that's assuming their reactive security signatures have it in the 1st place, & that their heuristics would find it too).

In that case?

I can watch who/what/when/where/how my system "talks" to other systems online, & if I see one I am NOT talking to? It gets added to my firewall list (by IP address), and the offending unknown interloper malware/botnet gets "BLOWN AWAY" by ProcessExplorer.exe, as I noted in my last post/other post in reply to YOUR last post.

It's THAT simple (assuming anything could even BEGIN to "get thru" here, & the ONLY way that would happen, is by downloads I might use here (never does though - not for roughly 15++ yrs. now in fact...)).

APK

P.S.=> Detection of malware (even C&C servers) isn't that tough...

Plus, knocking out botnets? Even easier (even "supposedly indestructable ones" (b.s., it's VERY destructable currently @ least), like this one where I showed everyone here a way to do that too, easily & guaranteed on ALL levels vs. this botnet/rootkit's current design, to work)...

Then, if need be?

Process Explorer takes care of the rest, if need be!

... apk

Re:Another USEFUL tool by "The Good Doctor"?

[cbiltcliffe]

You're still not getting it, because you're still running all your diagnostic utilities within the infected system.

How you you trust the TCP connections listed in TCPview (which is a great program, by the way) when TCPview itself is running on an infected system? A rootkit will hide its own network connections from this program.

HOSTS are versatile & help here too

[Anonymous Coward]

IF you have the hosts-domain name for the C&C servers this botnet uses!

(And, I do have all of them for TDSS, Zeus, SpyEye, CoreFlood, & MANY others, & ones for this one also that are known from past models of it mind you)

In fact, as of RIGHT NOW (slow day today on updates, but it's a holiday weekend too)?

My HOSTS file protects me vs. 1,466,975++ known bad sites/servers/adbanners/hosts-domains... as of this writing & checking its temp file before OVERWRITE COMMIT to my actual HOSTS file (not in std. location either, I point it to another location in fact, to fool most malware that don't do the correct check for it beyond std. default location (QHosts being an example virus that did that in fact in the past)).

Then, yes - HOSTS can help see this from a /. member here in fact as a testimonial thereof to that effect above & beyond my own:

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

HOSTS, work, & help... especially in combination with:

---

A.) DNSBL protection I get from Norton DNS which filters vs. malware and updates around every 1/2 hr. or so, & that I can attest to with proof if needed

B.) Firewall rules tables (software or hardware type, vs. IP Addressed threats that do NOT use hosts-domain names)

---

* It's ALL about "layered security" & I've been practicing it, & remained infestation free, since 1996 or so in fact... because of this:

I "preach" layered security, & have since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:

http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text

AND, more currently, the MOST viewed & highly rated one there is for years now since 2008 online:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

Which has well over 300,000 - 500,000++ views online, last I checked (actually MORE, but 1 site with 75,000 views of it went offline/out-of-business) & it's been made either:

---

1.) An Essential Guide
2.) 5-5 star rated
3.) A "sticky-pinned" thread
4.) Most viewed in the category it's in (usually security)
5.) Got me PAID by winning a contest @ PCPitStop (quite unexpectedly - I was only posting it for the good of all, & yes, "the Lord works in mysterious ways", it even got me PAID -> http://techtalk.pcpitstop.com/2007/09/04/pc-pitstop-winners/ [pcpitstop.com] (see January 2008))

---

Across 15-20 or so sites I posted it on back in 2008... have YOU done better, troll?

---

SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

I neglected 2 note another benefit of HOSTS files

[Anonymous Coward]

You can avoid DNS lookups period using them (For 250 of my fav. sites? I have their IP resolved locally, which is FASTER than calling out to remote DNS servers & safer (in that DNS servers that aren't kept up on as they should be can be "dns poisoned"-redirected)).

Another speed, security, AND even to an extent (vs. DNSBL when applied say, unjustly as is in the case in say, China vs. political unrest), anonymity as well (lightening DNS servers loads too, bonus for DNS admins!).

APK

I neglected 2 mention this on HOSTS files

[Anonymous Coward]

You can avoid DNS lookups period using them (For 250 of my fav. sites? I have their IP resolved locally, which is "Hardcoding" their hostsname-to-IP Address into HOSTS, which results in not only FAR FASTER performance acting as your OWN DNS SERVER, locally (faster by FAR than calling out to remote DNS servers & safer (in that DNS servers that aren't kept up on as they should be can be "dns poisoned"-redirected)).

I do that for 250 of my fav. sites in fact, the ones I go to 90% of the time... so, DNS issues? Lessened even moreso here... by HOSTS files.

(That's YET another speed, layered-security, AND even to an extent (vs. DNSBL when applied say, unjustly as is in the case in say, China vs. political unrest), anonymity BONUS as well (lightening DNS servers loads too, bonus for DNS admins!)).

* Beat THAT with a stick...

APK

U FAIL troll

[Anonymous Coward]

U cannot disprove apk data on Linux vs. Windows http://it.slashdot.org/comments.pl?sid=2282088&cid=36621618

Re:U FAIL troll

[gottabeme]

I don't need to--The Register did years ago:

http://www.theregister.co.uk/2004/10/22/security_report_windows_vs_linux/

"So why have there been so many credible-sounding claims that Linux is actually less secure than Windows? There are glaring logical holes in the reasoning behind the conclusion that Linux is less secure. It takes only a little scrutiny to debunk the myths and logical errors..."

Re:U FAIL troll

[gottabeme]

Also:

http://secunia.com/advisories/product/2719/?task=statistics_2011
"The most severe unpatched Secunia advisory affecting Linux Kernel 2.6.x, with all vendor patches applied, is rated Less critical "

http://secunia.com/advisories/product/27467/?task=advisories
"The most severe unpatched Secunia advisory affecting Microsoft Windows 7, with all vendor patches applied, is rated Highly critical"

Oops, your own source disproved your point.

Not only that, but Secunia's statistics are incorrect and out-of-date. I checked some of the CVEs for Linux, and Secunia lists them as unpatched, while Googling the CVEs shows that they were patched a long time ago.

You'll have to find a less erroneous source to support your erroneous claims.

Hm...I proved your wrong, using your own data. I guess I "win" now.

"Is there no one else? Is There NO ONE ELSE??"

[Anonymous Coward]

Play 2:58 on, says it for me better than I can -> http://www.youtube.com/watch?v=SP74aJBbIoY

AKhilleus (greek spelling of Achilles) , son of Peleus (middle names are usually that of the father or paternal grandfather) "KNOCKS THE CHOCOLATE OUT OF YET ANOTHER /. OFF-TOPIC 'Agreus' TROLL!", as-per-my-usual...

  * You KNOW you've gotten the best of a troll, when trolls resort to adhominem attacks, spelling & grammar checks, + going off-topic blatantly... as gottabeme, clearly has.

(APK "FTW" as usual, vs. trolls...)

APK (The "Invincible Winner" vs. /. trolls...)

P.S.=> This? Ah, I just GOTTA say it, as is my usual in my own INIMITABLE 'style' -> This was just "too, Too, TOO EASY - just '2EZ'"

... apk

Re:"Is there no one else? Is There NO ONE ELSE??"

[gottabeme]

Greek, eh?

Îá½ ÎÏ...νá ÏÎÎÎá-ν ÎÏOEÎÎν.

Re:"Is there no one else? Is There NO ONE ELSE??"

[gottabeme]

Aww, no Unicode on Slashdot. Oh well, you can see it here:

http://pastebin.com/E6HPwie1

You have still ignored my challenge, so I will ignore all of yours.

My code's in COMMERCIAL SOFTWARE

[Anonymous Coward]

"?llort ,retteb enod uoy evaH .eeG .trats ton lliw )oot ,xuniL ro XSO rettam taht rof ro( swodniW erehw retupmoc a no ecivres etomeR .toob ton lliw taht retupmoc a no neve ,yletomer stiktoor evomer ot metsys siht esu nac I snaem ,esruoc fo ,sihT .tenretnI eht revo ,yletomer ti od nac I dna ,metsys detcefni eht nihtiw naht rehtar ,enilffo nacs siht seod tI .enihcam a nacs ot senigne surivitna tnereffid +04 sesu taht loot erawlam-itna na fo rohtua eht ma I....ees s'tel ,lleW ?aera siht ni enod ev'I tahw ot sa ,woN .tnavelerri si meht kcehc uoy taht gniyaS .yrots fo dnE .doireP .sgnittes SND ruoy tsurt regnol on nac uoy ,detcefni si enihcam ruoy nehW .derohtua ev'uoy sediug ytiruces ynam woh dna ,enod ev'uoy tahw nmad a evig t'nod I ?ycallaf lacigol ytirohtua ot laeppa eht fo draeh revE !slaitnederc ruoy ta kool esuaceb thgir eb tsum uoy woh dna ,enod ev'uoy taht sgniht suoiverp ot kcab gniog trats uoy ,edam uoy tnemetats lacigolli yletelpmoc a no tuo uoy llac I nehw dna ,em tuoba tihs kcaj yletulosba wonk uoY .hturt eht s'tI .ton s'tI .tiabemalf ekil sdnuos taht ,seY .ehcuod gnikcuskcoc a er'uoY" - by cbiltcliffe (186293) on Sunday July 03, @09:36AM (#36646308) Homepage

"???"

Uhm... Could we get a translation of that off-topic "troll-speak" of yours, please?

* And, you're an off-topic troll - no questions asked...SEE MY SUBJECT LINE ABOVE!

APK

P.S.=> Yes, it must have just have been another off-topic done nothing of significance with his life troll spewing his off-topic b.s. again & not contributing to the ongoing conversations. Oh well - No biggie!

("ReVeRsE-PsYcHoLoGy", for trolls - Courtesy of this code by "yours truly" in less than 1 second flat):

---

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
try:
trollstring = ""
for apksays in s:
trollstring = apksays + trollstring
except:
print("error/abend in reverse function")
return trollstring

s = ""
print reverse(s)

try:
s = "Insert whatever 'trollspeak/trolllanguage' gibberish occurs here..."
s = reverse(s)
print(s)
except Exception as e:
print(e)

APK

P.S.=> Rotating DNS servers, and pinging them against the TLD that maintains the directories for it, giv

Re:My code's in COMMERCIAL SOFTWARE

[cbiltcliffe]

"My code's in commercial software, so you must bow before me, as I know what I'm talking about, because my code's in commercial software."

Yet again, the appeal to authority logical fallacy.

Not only do you not understand how malware can screw with your system, but you can't argue for shit.
When you'd rather reverse the text of what I said than actually argue the point I've stated, repeatedly, and has been ignored by you every single time; instead preferring to rely on your record of software that you wrote years ago.....

You just don't get it. You can call me a troll all you want, but your head is in the sand. You refuse to even acknowledge my point, let alone refute it, which leads me to believe you either do not have facts to support your position, or maybe that you don't even understand my point.

If you refuse to debate the issue at hand, which has been repeatedly stated by myself, then you're not worth wasting /. database space on.

And in answer to your question "Is mine in commercial software?"
This particular software of mine is used in an entire commercial service, which has been used in various parts of the world, to clean malware from infected machines. This service/software is used by other commercial entities as a better alternative to virus scanners traditionally used on a single scan/online basis by computer service companies. This software and service hasn't been reviewed by some computer magazine editor who knows jack about the industry, but rather by techs who actually use this type of thing in the trenches, as one of the best, if not the best malware detection program they've ever seen.

As to other software? Yes, I've written a bunch. But your idiotic debate methods aren't worth wasting my time on.

I show how to remove this rootkit (days ago)

[Anonymous Coward]

See subject-line, & these steps to knock out this rootkit/botnet from a read only media (Windows installation media on DVD or CD):

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver (hello_tt.sys)
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

And, "eat your words" now flavored with the "bitter taste of YOUR OWN DEFEAT"...

* This absolutely WILL work, no questions asked/period... vs. the CURRENT design of this botnet/rootkit that is...!

(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )

Fact is, I first posted on it here 2 days ago in fact:

http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272

* I see you're trying to "sell your wares" here, but they are non-sequitur, & unneeded... folks already HAVE the tools to dispatch this thing & yes, others like it...

APK

P.S.=> Also, Since my systems don't get "sick" with malware in the 1st place because of this guide & its points:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

What do I have to worry about? I never GET malware in the first place & haven't in decades, because of that guide's points!

(Others have experienced the same, after they have applied that guide's points + practice its techniques to avoid infestations, & I believe I posted their testimonials to that effect here as well!)

Plus, I can "knock out" malwares like this rootkit/botnet blended theat tech utilizing rootkit/botnet before it gets to do anymore damage & remove it completely first on systems that do!

(Then knockout other malware it brought in later into Ring3/RPL3/Usermode GUI shell via ProcessExplorer IF need be)

Your point's moot... and you KNOW it!

... apk

Apparently UR not aware of HOSTS/DNSBL

[Anonymous Coward]

They also block out KNOWN BAD DNS Servers too (so do firewall rules tables in software OR hardware firewalls)...

In fact, on THAT account?

DO check the DNSBL & HOSTS file lists youself, I use 17 reputable & reliable sources for it here!

I.E.-> They have TONS of ns*.*, ns1*.* etc. (bogus domain name servers) entries in mine!

E.G. -> So if they even TRY to put in a bogus DNS or use one? I am protected on that front as well, easily! I wouldn't be able to GET TO THEM @ ALL!

Plus, again:

To verify mine?

I "ping" the ones I use, thus doing a "reverse dns lookup:" (Norton DNS, OpenDNS, ScrubIT DNS, Google DNS) against the TLD that maintains that information and not only from MY system, but those of others & my work rigs too (triple verified really).

Lastly: HOSTS also make going to DNS period, for me, a "non-sequitur" issue almost, because I put in 250 of my favorites into my HOSTS file (speeding up access to my fav. sites by many orders of magnitude, and avoiding that which you speak of - DNS "poisoning" redirections).

* So, go "hawk" your essentially obsolete 'ware' in this situation & others like it vs. rootkits "1 hit wonder" disk elsewhere man!

(Simply because folks do NOT need it to blow away this rootkit in its entirety (both @ driver level & bootsector level) using a read-only media in the Windows install CD/DVD & tools present on them)... see below:

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver (hello_tt.sys)
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

APK

P.S.=> And, for ANY OTHER MALWARE it may "haul in", which it CAN do?

Well:

Then, You can use Process Explorer to "knockout" those also, even IF they are unknown to std. antivirus/antispyware systems out there (signatures based & if heuristics in them fail (not usually the default setting to have THAT active either too, mind you, in many of them))

... apk

Re:Apparently UR not aware of HOSTS/DNSBL

[cbiltcliffe]

I'm perfectly aware of DNS blacklists and the host file, thank you very much.

Apparently you can't read, however. My post had nothing to do with the hosts file. You keep harping on your custom hosts file, rather than actually READ what I WROTE.

Maybe you could actually TELL ME how YOU propose to detect a ROOTKIT running on an infected system with TCPview, which is what I asked in the first place.

And ON TOP of that , maybe YOU COULD stop with the annoying CAPS and bold changes, as they make your posts even harder to read than your tortured logic does.

Your "1 hit wonder" tool? Obsolete/Non-Sequitur

[Anonymous Coward]

I don't have to detect anything: I don't catch malware of ANY KIND in the first place, & neither do others, see this:

---

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

---

SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

AND

"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3

"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRONKA, user of my guide @ XTremePcCentral

---

& in my guide? I post a NUMBER of reliable tools for rootkit detection:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

(And, there you are - TcpView is only for checking WHERE it communicates back to... as a possible way of seeing that, for adding the bogus C&C server destinations to HOSTS &/or Firewall rules tables - that's all!)

NOW, & IF THAT FAILS due to encryption (which is WHY "deep packet inspection" doesn't work for ISP/BSP on https communications)?

I already block out its older C&C servers & bogus DNS servers as well, already, which I do in this rootkit/botnet's previous incarnations (along with all other known botnets), done via firewall rules tables (hardware & software BOTH) & in HOSTS, & I get NEW ONES given me by 17 reliable sources online, EVERY 15 minutes via my Python system (via HOSTS overwrite, not append, so hosts is CLEAN too for sure))

Oh, & as I said before, I rotate DNS server & block out the known bad ones too, & literally TRIPLE VERIFY via ping for a reverse DNS lookup to the TLD's that maintain that information online... & I do it from my systems, others systems I have applied t

Re:Your "1 hit wonder" tool? Obsolete/Non-Sequitur

[Anonymous Coward]

Fuck it , man.

Stop trying to argue with APK. He obviously can't read plain English, and keeps harping about your one hit wonder, while repeated posting the same single positive comment about his own one hit wonder.
Did he even answer your question in another thread? Or have you just got this crap from him everywhere?

I know what you mean, though, cbiltcliffe, as if you are infected, (which is always possible, since 100% doesn't exist, regardless of what this idiot thinks.) then output from procexp.exe or tcpview.exe, or any other utility, for that matter, cannot be trusted.The fact that this fucknut doesn't understand that is plain as day, and you'll never win an argument with someone who's head is full of bricks.

Just ignore him. You can even cut out having to view AC posts, anyway. Maybe you should do that.

You haven't been where I have & that's that

[Anonymous Coward]

LOL, See subject-line above: I've done well in software commercially and in freeware/shareware (as well as multimillion line systems you have probably been a customer of (ever go to McDonalds, Burger King, or Boston Market to eat for example? I have others as well, 27 or so to my credit, "Enterprise Class" MIS/IS/IT business systems!)

Now - I can't removal malware for shit as you said? Will this work??> Yes, it does!

Does it need your "1 hit wonder" tool that I suspect uses the tools of others to do its job?? No.

---

1.) Recovery Console bootup from Install CD/DVD (read only)
2.) listsvc command to spot offending bogus MBR protecting driver (hello_tty.sys)
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

ProcessExplorer.exe takes care of the rest (freezing any other malware in userland hidden under services or exes even as a lib/dll implementated malware even).

---

* No, this much is obvious - You're just worried that things like that show what I have told you before - in this case & probably others? Your "1 hit wonder" tool you made allegedly, is obsolete & non-sequitur.... period!

APK

P.S.=> My guides for security hardening Windows, & showing users what to use & behave like online to avoid infestations:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

Can put guys like YOU, if they're done right & followed to the letter, right out of business... & you KNOW it:

SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

AND

"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3

"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRONKA, user of my guide @ XTremePcCentral

"Eve

Exploited locally to be ABUSED remotely

[Anonymous Coward]

See subject-line, & realize that once they're "Inside Troy's walls", it's "all she wrote" (local exploits are JUST as dangerous in terms of rootkits like this one - once a malware maker learns HOW to "exploit an exploit", even a local one? He could send in scripts or code via the botnet's communcation systems for that much... turning local exploits, essentially, into REMOTE ones for things to abuse, remotely):

"Nope, they don't magically become remote because you say so. They're still local, and they're still being exploited locally. - by SanityInAnarchy (655584) on Sunday July 03, @05:50PM (#36648410)

To be ABUSED remotely, by a botnet communicating BACK to "the mothership" sending in the things to abuse said system LOCALLY (it's abuse either way, & the commands & control structure? REMOTE!)

That's why I listed what happened to Dr. Mark Russinovich's works being abused even (no, not a local OS app or lib security issue, but an argc/argv parameterizable & abuseable application instead - even happens to "the good guys" who meant well in the creation of their tools).

---

"You still need to get inside troy first." - by SanityInAnarchy (655584) on Sunday July 03, @05:50PM (#36648410)

Agreed, 110%, absolutely - & HERE IS WHERE YOU and I SEE QUITE ALIKE - layered security & all that it entails (stopping openings or stupid surfing mainly) IS the "Trick" here... but, in your very stating that?

You seem to be conceding my point!

---

"Your point?" - by SanityInAnarchy (655584) on Sunday July 03, @05:50PM (#36648410)

That once a botnet gets its hooks inside (or really, ANY malware - mostly due to PEBKAC & poor default setups with a lot of listening services to get ahold of)? It's got "Free Reign" & can make local things be abused by its REMOTE C&C systems.

(And, my point is, that Linux has a forebear in UNIX (it's classified as a form of UNIX in fact) & if it's ancestor could be taken advantage of? Don't think LINUX can't be... ANDROID shows us all THAT much, easily!)

---

"Android's a lot different than desktop Linux. Unless they're exploiting the kernel, I'm not sure I see your point here." - by SanityInAnarchy (655584) on Sunday July 03, @05:50PM (#36648410)

They don't HAVE to exploit the kernel... they're exploiting JAVA mainly, & it's GUI 'shell' from what I understand... but, that was my point - Linux itself has more holes in its kernel alone, than does most ALL of what MS gives you to do business & development with.

Toss on the OTHER PARTS of a Linux distro, with their attendant security vulnerabilities (many remote, many not, doesn't matter once the malware's inside)? The point is there alone...

---

"And how many Android exploits are actual drive-bys? How many could've been avoided simply by not installing something? - by SanityInAnarchy (655584) on Sunday July 03, @05:50PM (#36648410)

Mostly "PEBKAC" type, users either unaware of what they're hauling in being bogus, I won't argue that much... but, that is the MAIN PROBLEM on WINDOWS TOO!

APK

P.S.=> Users, unaware or lackadaisical on security? They'll keep us working till "kingdom come" I imagine... but, that doesn't mean they can't be educated vs. it (once they spend enough ca$h buying new systems (many times unnecessarily due to malware infestation "slowings" thinking it's the rig being 'busted down & old' for example), OR getting malware removed? They start learning, fast - I've seen it, 1st hand, I am sure you have as well)

... apk

Re:Exploited locally to be ABUSED remotely

[SanityInAnarchy]

You seem to be conceding my point!

Ok. You win. Happy?

No, of course not.

See, when you make a valid point, I "concede". What's weird is that we start out agreeing on some things, and disagreeing on others. Then we spent days arguing over semantic bullshit like whether an attack is local or remote, because you want to point to some local escalation vulnerability as evidence of how bad Linux security is when Windows security has an actual remote exploit. If you can say they're both "remote" in some sense, that puts them on the same level, when we both know they're not.

So we actually agree on the fundamentals, I'm just pre-empting that trick.

I also don't have much patience for the Windows vs Linux thing right now.

They don't HAVE to exploit the kernel... they're exploiting JAVA mainly,

Since when is the actual Java language on Android? Wouldn't it more technically be a Dalvik exploit?

I'm not sure how this can end well for you. If you want to say that it's Java they're exploiting, then those exploits would work equally well anywhere Java has been ported to, and can trivially be avoided by not using Java. If it's the Dalvik VM, that's something which no one has ever suggested using in desktop Linux, which makes Android even farther removed from desktop Linux.

If you want to say that Android exploits prove something about Linux, you're going to have to show that they're exploiting the kernel, since that's about the only thing Android shares with the Linux running in my laptop right now. And you've just admitted (assuming you're correct) that they exploit the GUI shell and not the kernel.

So no, Android exploits prove nothing about "Linux" the operating system. Absolutely best case for you, they prove you can build an insecure system on top of the Linux kernel. I've never disputed that -- any kernel you can't build an insecure system on top of is likely useless.

But, really? Is that really happening? It seems like it's more this part:

Mostly "PEBKAC" type, users either unaware of what they're hauling in being bogus, I won't argue that much... but, that is the MAIN PROBLEM on WINDOWS TOO!

And what does this have to do with what we're discussing?

I'm really done reading or replying to your posts which seem so intent on picking up the argument we had before. It is true that users are the biggest security issue. It is not true that Linux vs Windows is interesting here, or relevant.

Ordinarily, I'll happily follow a digression, but you'd happily take days of my time, and it's hard to think of a less useful way to spend those days.

Especially since you're still doing this:

if it's ancestor could be taken advantage of? Don't think LINUX can't be...

That is at least two fallacies, one of them likely personal:

Non-sequitur. It's trivial to show a program (sufficiently simple) which once had a vulnerability and now has none. I am not claiming Linux is flawless, only that the origin of rootkits has zero to do with whether Linux has flaws or not.

Red herring. WTF does this have to do with anything any of us are talking about? I was talking about security, and why I think end-users should bear a bit of the responsibility. Now we're (unfortunately) discussing Linux security, and occasionally hinting at how it might compare to Windows security. Unless you mean to imply that I think Linux can't be taken advantage of, or was ever stating or implying anything of the sort, in which case, you're left with...

Strawman. When did I ever say Linux cannot ever be taken advantage of? Of course it can. I "concede" that. Go have your victory dance or whatever, but next time, deal with what I actually said, not what you wish I said so you can prove me wrong.

Otherwise, you're just playing with yourself, and I'm sorry, that's not my scene.

I'm done with you. Grow up, or don't write back.

Better yet, do both.

You suggested Chrome: Does it have a...

[Anonymous Coward]

"BY SITE" preferences setup like Opera does? If not?? Then:

"I don't put faith in anything." - by SanityInAnarchy (655584) on Sunday July 03, @06:00PM (#36648464)

Javascript exploits can be used vs. it - because without that type of "granularity" of control of javascript, by site? You're using it globally (thanks for the answer here) - javascript's the MAIN DELIVERY SYSTEM by malscripting out there too, no denying it!

I mean, for example... because IE's a real S.O.B. that way, & why I don't use it (even in IE9) - I don't know of ANY way native to browser in IE where I can tell it:

"Use javascript on these sites only, but the rest by default have javascript off"

Like I can, & do, in Opera!

---

"But then, what kind of breaks have we seen? Plugin exploits." - by SanityInAnarchy (655584) on Sunday July 03, @06:00PM (#36648464)

I noted turning those off globally too... you can do that in Opera, & yet on CERTAIN SITES ONLY, activate plugin usage (trusted/reputable sites preferably, lessens attack "Surface Area" that way).

So - can you do that in CHROME the way you can in OPERA, just as you can by site on javascript in Opera also??

(Thanks for the answer).

---

"Which of these actually have legitimate remote exploits? I mean, you mentioned Unity, which is laughable. What is Unity doing accessing the network in the first place?" - by SanityInAnarchy (655584) on Sunday July 03, @06:00PM (#36648464)

Doesn't HAVE TO BE "REMOTE" classified once something like a rootkit's inside & with botnet capabilities... it can use ANY LOCAL EXPLOIT by sending what takes advantage of it locally, from a botnet C&C server, remotely.

ALA "TROY" - 'once inside the city walls', etc./et al!

---

"Let's not." - by SanityInAnarchy (655584) on Sunday July 03, @06:00PM (#36648464)

I figured as much - NO DENYING there are 3.5x as many exploits on the LINUX KERNEL ALONE (not counting the other parts of Linux with security bugs/issues either that remain unpatched) than there are in nearly ALL of what MICROSOFT GIVES YOU TO DO BUSINESS & DEVELOPMENT WITH... period.

APK

P.S.=> Now, THIS IS HOW & WHERE I KNOW I HAVE GOTTEN THE BEST OF A "TRUE TROLL" (who spoke behind my back here mentioning me to others in posts I was not even in mind you): The inevitable "adhominem attack" directed MY way:

"Goodbye, troll. It's been fun, but this is entirely offtopic at this point, and not a discussion I'm interested in having right now. I have so many better things to spend my time on than dealing with you -- even responding to trolls with better manners than you. (I think your capslock key is broken, and I never once used M$ or any other pejorative, while you continue to use "open sores" at every opportunity.) - by SanityInAnarchy (655584) on Sunday July 03, @06:00PM (#36648464)

You give away the fact you CANNOT dispute facts from a reputable security site, possibly that your browser "weapon of choice" does NOT have "granular by site exceptions" for both javascript &/or plugins as Opera does, & that you must resort to name-tossing... effete & WEAK man... seriously!

... apk

That's not Greek, geek

[Anonymous Coward]

See subject-line above, & better luck next time. You need it.

gottabe me ran because he couldn't disprove

[Anonymous Coward]

Apk's security data on Linux vs. Windows 7 http://it.slashdot.org/comments.pl?sid=2282088&cid=36628536 when the challenge was issued first to gottabeme? No surprise. Trolls always run from facts.

Re:gottabe me ran because he couldn't disprove

[gottabeme]

You're a hypocrite, because you ignored the facts I pointed out from your own chosen sources.

You're a hypocrite, because you "ran from" my challenge.

You're a hypocrite, because you called me a "lying jackass", but you're pretending to be someone else. I can't even count how many times you have criticized others for impersonating you, and here you are pretending to be someone else.

If you think that people don't see through you, you are delusional.

Your data = STALE & The Reg shows diff. too

[Anonymous Coward]

About LAMP stacks: LAMP setups are the favorite of spammers/phishers PER THE REGISTER no less (more recently):

http://www.theregister.co.uk/2011/06/10/domains_lamped/
---

PERTINENT QUOTE:

"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey.

Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers,"

---

* LMAO!

So much for your "years ago" stale data... my data below is FAR MORE CURRENT as well (today's date), & the ENTIRE MS stack for business & development has less bugs than the Linux 2.6x mainstream kernel ONLY, by itself, lol...

(Pitiful showing on YOUR part, as per usual)

APK

P.S.=> You've been "blown away", yet again... & this even MORE CURRENT DATA from a respected security site in SECUNIA.COM that I used before just puts more "icing on the cake":

---

Vulnerability Report: Microsoft SQL Server 2008: (07/03/2011

http://secunia.com/advisories/product/21744/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (07/03/2011

http://secunia.com/advisories/product/17543/

Unpatched 0% (0 of 6 Secunia advisories)

Vulnerability Report: Microsoft Exchange Server 2010: (07/03/2011

http://secunia.com/advisories/product/28234/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft SharePoint Server 2010: (07/03/2011

http://secunia.com/advisories/product/29809/

Unpatched 0% (0 of 0 Secunia advisories)

Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (07/03/2011

http://secunia.com/advisories/product/34343/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Office 2010: (07/03/2011

http://secunia.com/advisories/product/30529/?task=advisories

Unpatched 0% (0 of 7 Secunia advisories)

Vulnerability Report: Microsoft Virtual PC 2007: (07/03/2011

http://secunia.com/advisories/product/14315/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Internet Explorer 9.x: (07/03/2011

http://secunia.com/advisories/product/34591/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Visual Studio 2010: (07/03/2011

http://secunia.com/advisories/product/30853/?task=advisories

Unpatched 0% (0 of 2 Secunia advisories)

Vulnerability Report: Microsoft DirectX 10.x:
(07/03/2011

http://secunia.com/advisories/product/16896/

Unpatched 0% (0 of 3 Secunia advisories)

Vulnerability Report: Microsoft .NET Framework 4.x
(07/03/2011

http://secunia.com/advisories/product/29592/

Unpatched 0% (0 of 5 Secunia advisories)

Vulnerability Report: Microsoft Silverlight 4.x: (07/03/2011

http://secunia.com/advisories/product/28947/

Unpatched 0% (0 of

Prove it & put up quotes from your sources

[Anonymous Coward]

Anyone can "talk a good game", I'd like to see your proof of this:

"Hm...I proved your wrong, using your own data. I guess I "win" now." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

NOW, comes the FUN part though!

(Turning your own words/tactics against you, on your data from "The Register" with more current data on LAMP stacks & phishing/spamming):

http://www.theregister.co.uk/2011/06/10/domains_lamped/

---

PERTINENT QUOTE:

"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey.

Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers,"

---

* LMAO!

So much for your "years ago" stale data... my data from SECUNIA.COM is FAR MORE CURRENT as well (today's date), & the ENTIRE MS stack for business & development has less bugs than the Linux 2.6x mainstream kernel ONLY, by itself, lol... 3.5x less in fact.

(Apparently, the LAMP stack, lol, makes it WORSE for Linux and I'd hate to see say, Gnome or KDE, Konqueror & other tools Linux distros ship with in the mix... it'd be still worse YET for Linux... anyhow, see above!)

(Pitiful showing on YOUR part, as per usual)

APK

P.S.=> Again, prove what you said, because anyone can "talk a big game", I want to see proof that SECUNIA's data on Linux is inaccurate... because IF it is, & I doubt it? I'd write them with your post to refer to in fact!

FUNNIEST PART IS TURNING YOUR YEARS OLD REPORT TO 'MUSH' ON LAMP STACKS ABOVE USING THE REGISTER & MORE CURRENT DATA ON IT!... apk

Re:Prove it & put up quotes from your sources

[gottabeme]

You conveniently ignored the two quotes I put up from Secunia--"your" "far more current" data--because they prove you wrong. Again, the source you chose contradicts your assertion.

Regarding this LAMP article, the fact that LAMP-stack sites are often compromised has nothing to do with Linux. Most often, these sites are compromised because of insecure PHP code--nothing to do with Linux. In fact, there is even a comment on that article by a guy who runs a WAMP stack who says that his server was compromised. For example, WordPress is full of security holes and is constantly compromised and patched--and it can run on Windows, Linux, FreeBSD, Mac OS X, etc. The issue there is poorly-written PHP code, SQL injections, etc. Apache runs on Windows, too.

Also, it's highly likely that many of these sites were not current on patches and security updates--an issue irrelevant to the OS being used. Most of these sites are on shared hosting, with preconfigured "easy-install" packages of popular software like WordPress--setups that are often not kept up-to-date. The issue there is hosting companies with poor security practices--again, irrelevant to the OS being used.

In conclusion, your LAMP article doesn't support your assertion that Windows is more secure, because it's not relevant to the choice of OS. It's not even fair for you to compare Windows 7 to Linux in one comment, and then lump Apache, MySQL, and PHP--software that is also used on Windows servers--in with Linux in your next comment. You're being disingenuous.

Surely a knowledgeable person like yourself understands the difference between a security hole in the OS and a security hole in third-party software.

You avoid my question on CHROME!

[Anonymous Coward]

"Ok. You win. Happy?" - by SanityInAnarchy (655584) on Monday July 04, @02:39AM (#36650480)

I thought you were gone before? Back now?? Now, on "my being happy"?

Yes, I am & I am not: YOU AVOIDED MY QUESTION ON CHROME COMPLETELY!

I suppose so, now that you've said that actually... but, let's review your points anyhow!

See this "adhominem attack adios" from you yesterday:

(Since you're "wont to use logic", or try to (forums "illogic-logic" is more like it when it suits you, or you *THINK* it does... have you even taken logic formally? I asked you that before, & You did not answer...)

"Goodbye, troll. It's been fun, but this is entirely offtopic at this point, and not a discussion I'm interested in having right now. I have so many better things to spend my time on than dealing with you -- even responding to trolls with better manners than you." - by SanityInAnarchy (655584) on Monday July 04, @02:39AM (#36650480)

I'm no troll - I was here and saw you use MY NAME in a conversation with others, where I was not even present (that's lame & yes, it's talking behind my back man).

Also - Funny you couldn't "keep your word", eh?

(That's ok though, I understand - I am "too good to resist", lol! Pretty "sneaky" (ahem - dishonest) saying that, & then sneaking back in after I "hit the sack" since you said that...but, oh well!)

(AH, anyhow... "onwards & upwards"!)

---

"Since when is the actual Java language on Android? Wouldn't it more technically be a Dalvik exploit?" - by SanityInAnarchy (655584) on Monday July 04, @02:39AM (#36650480)

AHEM: It uses JAVA classes!

http://en.wikipedia.org/wiki/Dalvik_(software)

---

PERTINENT QUOTE/EXCERPT:

A tool called dx is used to convert some (but not all) Java .class files into the .dex format

---

Good enough for me, & You complained about "arguing semantics"? Please... "pot calling the kettle black"!

---

"If you want to say that it's Java they're exploiting, then those exploits would work equally well anywhere Java has been ported to, and can trivially be avoided by not using Java." - by SanityInAnarchy (655584) on Monday July 04, @02:39AM (#36650480)

It is JAVA they are exploiting, & JAVA's got holes, big holes (despite being in a sandbox etc./et al)... but that's my point:

THAT point, was about the OTHER PARTS of Linux being exploited TOO, not just the unpatched security vulnerabilities in its kernel (which outnumber those in ALL OF WINDOWS/AN ENTIRE WINDOWS "DISTRO", so-to-speak, by 3.5x, per SECUNIA.COM data!)

AND, yes - ANDROID & JAVA on it (Dalvik VM & Java bytecode classes since you want to nitpick)... the same would hold true for std. Linux distros for PC's &/or Servers too, and the other parts in Linux above & beyond the KERNEL ONLY ITSELF!

(THUS, It shows that the other parts of Linux's would compound the security vulnerability holes present, and would allow for Linux to be attacked & abused... period!)

---

"Absolutely best case for you, they prove you can build an insecure system on top of the Linux kernel. I've never disputed that" - by SanityInAnarchy (655584) on Monday July 04, @02:39AM (#36650480)

Very Good, because it was PART of my point - the rest was that Linux has 3.5x more known security vulnerabilities unpatched per SECUNIA.COM data for that information, than not only Windows 7, but nearly THE ENTIRE OFFERING OF SOFTWARES (dev/business stack) MICROSOFT GIVES YOU TO DO business & development WITH!

---

LASTLY, on LOGIC (or rather, your own "forums' brand 'illogic-logic'", lol):

See top of this page...

Re:You avoid my question on CHROME!

[SanityInAnarchy]

See this "adhominem attack adios" from you...

You keep using that word. I don't think it means what you think it means. From Wikipedia:

An ad hominem (Latin: "to the man"), short for argumentum ad hominem, is an attempt to link the truth of a claim to a negative characteristic or belief of the person advocating it.

I haven't done that. That you are a known troll and a waste of time has nothing to do with whether your arguments are valid, it's whether it's worth my time to find out. It really isn't, especially given how little respect you have for the time of others. For example:

YOU AVOIDED MY QUESTION ON CHROME COMPLETELY!

You've now written at least two posts to me stressing this point and asking this question, yet you can't be bothered to download it and find out for yourself? Why should I do your homework for you?

Then there's this:

have you even taken logic formally? I asked you that before, & You did not answer...

I did answer. I pointed out that what you're doing now is an argument from authority. You don't know that I've taken logic formally. What does that have to do with whether my argument is valid? If it doesn't have anything to do with that, it's a red herring. If you're trying to say it does, it's an argument from authority of the formally fallacious kind.

Oh, and it looks like you like YouTube videos? Have fun.

Prove CVE Linux errors are patched then

[Anonymous Coward]

After all, you said this ->

"Hm...I proved your wrong, using your own data. I guess I "win" now." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

Well, prove it - show me that the security vulnerabilities in Linux that SECUNIA.COM shows are indeed, ALL patched &/or less than what is present on Ms stuff, 5 total errors on an entire software stack!

(Because there are 3.5x as many in the Linux KERNEL ALONE, than is present in nearly ALL OF WHAT Microsoft GIVES YOU FOR BUSINESS & DEVELOPMENT, per Secunia data on that much).

AND

"You're a hypocrite, because you ignored the facts I pointed out from your own chosen sources." -

Ok, again - see subject above, & PROVE IT... I want to see that SECUNIA.COM's data is inaccurate & that the vulnerabilities shown there are patched as you said!

---

"You're a hypocrite, because you "ran from" my challenge." - by gottabeme (590848) on Monday July 04, @01:15AM (#36650260)

Your 'challenge'? It was more of an ORDER from you, telling me not to write as I do...

Tough cookies - I don't take YOUR ORDERS, get it??

However, once more:

I do challenge you to prove your words though that SECUNIA.COM's data is inaccurate & that the Linux unpatched security vulnerabilities they show as unpatched in fact ARE, & ALL OF THEM in their entirety!

(Show us also, that there are less of them than is on Windows 7, & not ONLY Windows 7, but the entire software stack MS gives you to do business & development with (which has only 5 unpatched, vs. 17 on Linux in its KERNEL ALONE (would go up if you include the rest of what comes in a Linux distro mind you as well)).

Back up your "mere words" & anecdotal evidence (which I suspect to be lies)...

Especially since your STALE OLD DATA from the register in 2004 was later shown to be bogus & old, plus inaccurate...

By the way?

LAMP = Linux, Apache, MySQL, PHP... that's the 'business & development stack' from the Open SORES side of things... & it has even MORE bugs being actively exploited no less, in the Linux kernel alone unpatched, than does the ENTIRETY of what MS gives you for the same, period...

(Unless YOU can prove your words, & show differently, that is... funny you have not & did not!)

APK

P.S.=>

"If you think that people don't see through you, you are delusional.." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

Yes, yes... the INEVITABLE "adhominem attack", invalid in logical debate, & always the "last resort of the fallen troll", lol... please:

Prove to us then, you are not & not a liar as well... see subject-line above, answer the question with proof! (prove it)

... apk

Re:Prove CVE Linux errors are patched then

[gottabeme]

You continue to neglect to comment on the much-higher severity of the unpatched Windows bugs as mentioned in your own source. You still haven't addressed that or offered a counter-argument for it. So I won't post any more data until you address that--since you ignore whatever data is inconvenient for your argument, it would be a waste of my time. I don't think you're after the truth here, only ego-inflating "wins" against "trolls"--wins and trolls as defined by you.

You also conveniently ignored the fact that you hypocritically called me a "lying jackass" and then lied about your identity. You then accuse me of ad hominem attacks while ignoring your own, unsubstantiated ad hominem attacks and your own hypocrisy. At least my pointing out your lack of credibility and integrity are based upon your actions here.

LAMP = nothing to do w/ Linux? Beg 2 differ

[Anonymous Coward]

"nothing to do with Linux." - by gottabeme (590848) on Sunday July 03, @11:17PM (#36649894)

LAMP = Linux, Apache, MySQL, PHP... that's the 'business & development stack' from the Open SORES side of things... & it has even MORE bugs being actively exploited no less, in the Linux kernel alone unpatched, than does the ENTIRETY of what MS gives you for the same, period...

(Funny that, eh? I see "LINUX" in there!)

---

"In fact, there is even a comment on that article by a guy who runs a WAMP stack who says that his server was compromised" - by gottabeme (590848) on Sunday July 03, @11:17PM (#36649894)

AHEM: Which is WHY I showed that MS' stack for the same as LAMP has NO UNPATCHED SECURITY VULNERABILITIES KNOWN PRESENT CURRENTLY & for years now, see here:

---

Vulnerability Report: Microsoft SQL Server 2008: (07/03/2011

http://secunia.com/advisories/product/21744/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (07/03/2011

http://secunia.com/advisories/product/17543/

Unpatched 0% (0 of 6 Secunia advisories)

Vulnerability Report: Microsoft Internet Explorer 9.x: (07/03/2011

http://secunia.com/advisories/product/34591/

Unpatched 0% (0 of 1 Secunia advisories)

Vulnerability Report: Microsoft Visual Studio 2010: (07/03/2011

http://secunia.com/advisories/product/30853/?task=advisories

Unpatched 0% (0 of 2 Secunia advisories)

Vulnerability Report: Microsoft Windows 7: (07/03/2011

http://secunia.com/advisories/product/27467/?task=advisories

Unpatched 7% (5 of 72 Secunia advisories)

---

vs. THE LIINUX KERNEL ALONE SHOWING 3.5x as many unpatched vulnerabilities BY ITSELF:

--

Vulnerability Report: Linux Kernel 2.6.x (07/03/2011

http://secunia.com/advisories/product/2719/?task=advisories

Unpatched 7% (18 of 270 Secunia advisories)

--

(Mind you, again: That's NOT even counting what the other parts of a Linux distro have, & certainly not those being exploited in the LAMP stack as shown by the register ONTOP OF THOSE TOO)

Which, again, you used STALE OLD DATA from 2004, & FROM THE REGISTER TOO NO LESS, but mine's FAR MORE CURRENT from "The Reg", & shows LAMP being exploited RAMPANTLY by phishers/spammers as their fav. to exploit no less vs. my current data shown above!

APK

P.S.=> You also said that you saw Linux's vulnerabilities shown @ SECUNIA.COM ARE PATCHED... prove it:

"Secunia's statistics are incorrect and out-of-date. I checked some of the CVEs for Linux, and Secunia lists them as unpatched, while Googling the CVEs shows that they were patched a long time ago." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

You said that, NOW PROVE IT, because I am genuinely interested in seeing it (and seeing you back your words (possibly lies, but... we'll see, shall we?))...

... apk

Re:LAMP = nothing to do w/ Linux? Beg 2 differ

[gottabeme]

I'm not going to post any more data to prove my assertions as long as you choose to ignore the data I pointed out from your own source that shows that Windows is less secure than the Linux kernel. If you're truly curious about that, search Google for some of the CVE numbers listed on Secunia, and you'll find ones that were patched in Linux distros a long time ago.

You also don't seem to understand that tracking current security vulnerabilities in "Linux" is not a matter of looking at a single list, and that compiling a single list is a real-time effort. It's disingenuous to compare the kernel.org kernel with Windows 7; one should instead compare security bugs in the kernel and GNU-type system utilities from specific Linux distros, like RHEL and Debian. You'd complain if people pointed out bugs in internal Windows development snapshots--and that's practically what the kernel.org kernels are, compared to ones prepared and constantly-patched by distros like RHEL and Debian. It's like comparing apples and oranges. You're either ignorant about this or dishonest about it.

Also, Secunia is not an impartial source. They are in the business of selling Windows security software--as far as I can tell, they don't even sell software for Linux. That necessarily makes them unsuitable as an impartial source for such data. Of course they wouldn't want Linux to appear more secure than Windows, because then people would have less incentive to use Windows and pay for Secunia's software. They also have no incentive to keep their data on Linux up-to-date, because they don't serve Linux users, and out-of-date Linux security info will serve their interests better.

Therefore, Secunia is an invalid source for the purposes of this debate. As I said before, you'll have to find a better source to support your assertions.

You also tried to sidestep the fact that MySQL and PHP run on Windows servers and can be compromised on those systems just as well as they can on Linux systems--and they are, as I mentioned. Buggy PHP code is buggy whether it's running on Linux or Windows. The difference, in fact, is that Linux systems' tend to keep all the software on the system up-to-date automatically, whereas Windows will not update MySQL or PHP automatically. Some Linux distros even have packages for software like WordPress, integrating security updates for it into the rest of the system's updates.

The article on The Register showed logical flaws in the Windows-is-more-secure arguments, flaws which are still valid today--those are not out-of-date.

It's also asserted that Microsoft often fixes more bugs in its patches than it publishes information about. Makes sense to me, since full-disclosure would only hurt Microsoft's image more.

A final anecdote: It's interesting that just in the past two weeks, my Windows 7 installation has installed more security updates for the OS than my Ubuntu 11.04 systems have installed. Doesn't prove anything, but it's interesting.

Will this work vs. this rootkit/botnet?

[Anonymous Coward]

Yes - My technique works against it from a read-only Windows install media RC tools (recovery console), which are PROVEN (& inviolate due to being on CD/DVD media):

STEPS TO TAKE TO ERADICATE THIS ROOTKIT/BOTNET. NON-DESTRUCTIVELY:

---

1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver (hello_tt.sys)
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)

---

* Which works against ANY rootkit, both bootsector originating type, or driver driven type (or like this one, a combination of BOTH), 100% guaranteed - NO QUESTIONS ASKED, period...

APK

P.S.=> Then, IF this thing "hauls in" any more malware, which it CAN do?

Then - You "mop it up" using Process Explorer completely once the rootkit is destroyed!

(ProcessExplorer.exe works vs. ANY malware, even hidden ones beneath other std. processes hooked by libs/dlls, or services even)

I.E./E.G. -> You use its "suspend" feature to send HLT instructions to the offending malware, & then?

Then, you can delete it on disk & it's "Gone With The Dawn"...

This works too, when other "std. tools" fail miserably (such as antivirus/antispyware IF their signatures are not present to ID said malware, and if their removal process won't work vs. said malware also).

"Here endeth the lesson"...

... apk

Re:Will this work vs. this rootkit/botnet?

[cbiltcliffe]

"Here endeth the lesson"...

Listen, you arrogant, obnoxious, simple-minded gimp.

I'm not asking you how to eliminate the rootkit. I never once asked you how to eliminate a rootkit. I already knew how to eliminate a rootkit. Stop harping on it, as you're making yourself look like a complete and total fool, by repeatedly answering a question that was never asked.

My issue has always been with your claim that could detect a root kit with Process Explorer and TCPview. This is what I stated in my very first post to you, and the only thing I've repeatedly stated that you're wrong about. This is also the only aspect of this rootkit removal that you haven't clarified.

Instead, you choose to go off on irrelevant and off topic rants about how you're an expert because you're an expert, and how your instructions to remove a rootkit will work every time, and how this one guy left a comment about how he never got malware once he used a hosts file.

Guess what? I don't give a fuck about all that.

Here is the question I want you to answer, in plain English, that even, apparently, ACs can understand, but you can't:

How do you propose to detect a rootkit using Process Explorer and TCPview, when the output of these programs cannot be trusted when running in a rootkitted environment?

If you can't answer this question, then all your removal instructions are moot.

"Run, Forrest - RUN!", lmao... apk

[Anonymous Coward]

See subject - You can't back your words? You're FULL OF IT, liar. Put up, or shut up... it's THAT simple!

APK

P.S.=> You said this before, and now suddenly you're unwilling to back it up & show us proofs of it:

"Secunia's statistics are incorrect and out-of-date. I checked some of the CVEs for Linux, and Secunia lists them as unpatched, while Googling the CVEs shows that they were patched a long time ago." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36649602

You run from proving that above? That makes you nothing more than a trolling liar then... period & a sneaky little bastard too, coming & posting back here days later (didn't think I'd see it? You're also a fool then too)...

... apk

Re:"Run, Forrest - RUN!", lmao... apk

[gottabeme]

Didn't think you'd see it? Why am I posting here if I don't think you will see it? I might as well go yell in my bathroom. If you don't see it, who will? No one else is watching this conversation.

As I told you, I won't post any more data on that until you address Secunia's own data that shows Windows has higher severity bugs than Linux does. You continue to ignore that--at least I say why I'm not responding to your claim.

You continue to show hypocrisy by calling me a liar when you are the one who has posted pretending to be someone else.

You continue to show hypocrisy by criticizing me for ad hominem attacks when you continue to call me a liar, a bastard, and a fool.

We can't make any progress until you are willing to be honest and logical and stop acting hypocritically.

"Run, Forrest - RUN", Part deux... apk

[Anonymous Coward]

Just because Linux in its KERNEL ONLY, lol, has more bugs than Windows does by 3.5x, and in cases like this rootkit? Local bugs are exploitable remotely by said botnet this rootkit also has/is!

The Linux kernel only has MORE BUGS THAN NEARLY THE ENTIRETY OF WHAT MS GIVES YOU DO TO BUSINESS & DEVELOPMENT WITH, period!

(Which only shows even MORE BUGS when you toss on the rest of what comes in a Linux distro and worse yet when you see that LAMP (Linux, Apache, MySQL, PHP) make it worse yet by my having shown that it's the PRIME TARGET that GETS ABUSED by phishers/spammers whereas by way of comparison, SECUNIA DATA showed that the Microsoft "business software & development stack" has 0 bugs thru ALL OF ITS TOOLS by comparison to the swiss cheese in LAMP!)

(LMAO - & you tried to post stale old data from 2004 from the register saying Windows was less secure than Linux? LOL, I posted more current data from The Register showing that Linux/LAMP gets rampantly exploited by phishers/spammers, AND, that it's their favorite target for abuse for days @ a time, & then again, repeatedly!)

* You also said SECUNIA.COM's data is no good? Prove it... right here, again, for the 2nd time where you "Ran, Forrest - U RAN" -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36669620

APK

P.S.=> Show me ones I can't produce a valid working "work-around" to on the ones Windows has... ok?

(9/10 times I usually can do that easily - quite often by turning off services I don't need to be in a "listening/active" state anyhow (burning CPU cycles, memory, & various forms of I/O + electricity either))...

Windows 7's got 3.5x less than the bugs present in a KERNEL ONLY, in Linux no matter HOW you slice it - & a kernel alone "doth not an OS make" by itself...period!

That's why Linux is in "last place" in the PC-Server world, & has to find alternate markets - & why it's being shown for what it REALLY IS in the ANDROID mobile phone market: A SECURITY NIGHTMARE!

... apk

Re:"Run, Forrest - RUN", Part deux... apk

[gottabeme]

Linux is last in the PC-server world? LOL! You really are delusional. Yeah, it's only what Google, Yahoo, Facebook, NYSE, NASDAQ, etc. use on their servers, as well as the majority of web sites on the Internet. Not to mention that it runs on everything from DVRs to phones to automobiles.

You show your utter ignorance by comparing Android to any other form of Linux. Android is all about the Dalvik VM and is irrelevant to Linux on any other platform.

I already explained how Secunia is not a valid source for your arguments. I don't need to refute its data because it itself is invalid. It would be obvious to anyone that there are indeed plenty of bugs in the Microsoft server stack, and the fact that Secunia claims that there aren't any and haven't been for years shows how useless it is as a reference. It also has commercial interest in Windows software and none in Linux software--it's completely biased. You need to find another source for your claims.

You still won't admit that MySQL and PHP run on Windows and get compromised there--that they are irrelevant to the discussion of Linux vs. Windows. More delusion or dishonesty.

It's pointless to have a discussion when you won't be honest. It'd also be nice if you could discuss without hyperbole.

Why I show MS business stack vs. WAMP

[Anonymous Coward]

or LAMP, w/ ZERO KNOWN UNPATCHED SECURITY VULNERABILITIES:

"You also tried to sidestep the fact that MySQL and PHP run on Windows servers and can be compromised on those systems just as well as they can on Linux systems" - by gottabeme (590848) on Wednesday July 06, @12:30AM (#36668926)

So much for "Open 'SORES'" then, eh? See proof thereof below:

---

Vulnerability Report: Microsoft SQL Server 2008: (07/05/2011))

http://secunia.com/advisories/product/21744/

Unpatched 0% (0 of 1 Secunia advisories)

---

Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (07/05/2011)

http://secunia.com/advisories/product/17543/

Unpatched 0% (0 of 6 Secunia advisories)

---

Vulnerability Report: Microsoft Exchange Server 2010: (07/05/2011)

http://secunia.com/advisories/product/28234/

Unpatched 0% (0 of 0 Secunia advisories)

---

Vulnerability Report: Microsoft Office 2010: (07/05/2011)

http://secunia.com/advisories/product/30529/?task=advisories

Unpatched 0% (0 of 7 Secunia advisories)

---

Vulnerability Report: Microsoft Internet Explorer 9.x: (07/05/2011)

http://secunia.com/advisories/product/34591/

Unpatched 0% (0 of 1 Secunia advisories)

---

Vulnerability Report: Microsoft Visual Studio 2010: (07/05/2011)

http://secunia.com/advisories/product/30853/?task=advisories

Unpatched 0% (0 of 2 Secunia advisories)

---

* No "side stepping" involved - I compare software of LIKE TYPES & then some above from Microsoft, vs. LAMP (Linux, Apache, MySQL, PHP)... period!

Or, was this a lie?

---

http://www.theregister.co.uk/2011/06/10/domains_lamped/

PERTINENT QUOTE:

"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey. Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers"

---

* LMAO! It's certainly more current than your b.s. from the same site that was from 2004, "super-stale & OLD" which had its roots on a report that showed Linux was LESS SECURE THAN WINDOWS WAS THAT YEAR TOO, no less... more "spin-master b.s." from the "Open 'SORES'" world!

(Wonder WHY your stuff is in "dead last place"? Don't!)

APK

P.S.=> You also run from & failed to produce proof of the Linux security vulnerabilities unpatched that YOU SAID are patched?

Back this up & show us proofs of it:

"Secunia's statistics are incorrect and out-of-date. I checked some of the CVEs for Linux, and Secunia lists them as unpatched, while Googling the CVEs shows that they were patched a long time ago." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36649602

You run from proving that above? That makes you nothing more than a trolling liar then... period!

( ... & a sneaky little bastard too, coming & posting back here days later (didn't think I'd see it?))

You're also a fool then too!

That - along with your posting STALE OLD DATA from 2004 from the Register, & I put out more current data showing that LAMP setups are RAMPANTLY EXPLOIT

Re:Why I show MS business stack vs. WAMP

[gottabeme]

LAMP sites are compromised because of insecurely-written PHP and MySQL code--it's irrelevant to Linux. You can pretend all you want that it's not--but it is. It makes as much sense to say that it is as it would for me to say that poorly-written ASP sites are compromised because of Windows itself, rather than because of bad ASP code.

Until you're willing to argue logically and honestly, we can't make any progress in the discussion.

"Is there no one else? Is There NO ONE ELSE??"

[Anonymous Coward]

Play 2:58 on: Says it better than I can -> http://www.youtube.com/watch?v=SP74aJBbIoY

I.E. (by video analogy) -> AKhilleus (greek spelling of Achilles) , son of Peleus (middle names are usually that of the father or paternal grandfather) "KNOCKS THE CHOCOLATE OUT OF YET ANOTHER /. OFF-TOPIC 'Agreus' TROLL!", as-per-my-usual...

Yes - You KNOW you've gotten the best of a troll, when trolls resort to adhominem attacks, spelling & grammar checks, + going off-topic blatantly...

(As SanityInAnarchy clearly has 3-4 times now... despite his attempted usage of "forums' 'illogic-logic'" + the fact he has NEVER TAKEN LOGIC FORMALLY afaik (he won't answer when I ask that), vs. facts I posted he was unable to combat...)

---

Especially this one about CHROME not having a "by site" preferences ability natively as Opera does vs. iframe, plugin, or javascript exploits:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36648788

---

* APK "FTW" as usual, vs. trolls...

APK (The "Invincible Winner" vs. /. trolls...)

P.S.=> This? Ah, I just GOTTA say it, as is my usual in my own INIMITABLE 'style' -> This was just "too, Too, TOO EASY - just '2EZ'"

... apk

FREE = why Linux is used as a server

[Anonymous Coward]

& the only reason. How's it doing as a server in business (where cost = everything)?

Let's see from the source YOU USED, in "The Register", once again:

---

http://www.theregister.co.uk/2011/06/10/domains_lamped/

PERTINENT QUOTE:

"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey. Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers"

---

LMAO - ALSO?

What about desktops? 94++% of the world's PC's use Windows, period, and everyone knows it!

Hence why for 15++ yrs. now, I have been hearing "is this the year of Linux on the desktop" & it NEVER happens... free, or not!

APK

P.S.=> Yes, you DO have to prove this:

"I already explained how Secunia is not a valid source for your arguments. I don't need to refute its data because it itself is invalid." - by gottabeme (590848) on Wednesday July 06, @08:16AM (#36670630)

Ok, "sure" (sarcasm) - PROVE IT!

(Put up, or SHUT UP)...

... apk

How'd Linux do @ LSE & NASDAQ?

[Anonymous Coward]

IT FAILED 2nd DAY ON THE JOB:

http://linux.slashdot.org/story/11/02/19/0147232/London-Stock-Exchange-Price-Errors-Emerged-At-Linux-Launch

---

NOW on NASDAQ?

WRONG - Where you said NASDAQ uses Linux? Oh, really?? LMAO (wrong):

"Yeah, it's only what Google, Yahoo, Facebook, NYSE, NASDAQ, etc. use on their servers

- by gottabeme (590848) on Wednesday July 06, @08:16AM (#36670630)

Instead - Try it's Windows Server 2003 + SQLServer acting as "the OFFICIAL TRADE DATA DISSEMINATION SYSTEM" @ NASDAQ instead!

---

NASDAQ Migrates to SQL Server 2005:

http://www.windowsfs.com/enews/nasdaq-migrates-to-sql-server-2005

---

and here:

NASDAQ Uses SQL Server 2005 â" Reducing Costs through Better Data Management:

http://blog.sqlauthority.com/2007/09/17/sqlauthority-news-nasdaq-uses-sql-server-2005-reducing-costs-through-better-data-management/

---

(In fact, It's been running 24x7 in fail-over clusters for coming up on a DECADE NOW in fact... check the Microsoft "GET THE FACTS" pages @ MS!)

* Man... LMAO!

APK

P.S.=> Small wonder it's also doing "SO WELL" here too on this note as a server also:

---

http://www.theregister.co.uk/2011/06/10/domains_lamped/

PERTINENT QUOTE:

"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey. Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers"

---

... apk

"Put up, or SHUT UP" & no more NASDAQ lies

[Anonymous Coward]

Yes, you DO have to prove this:

"I already explained how Secunia is not a valid source for your arguments. I don't need to refute its data because it itself is invalid." - by gottabeme (590848) on Wednesday July 06, @08:16AM (#36670630)

Ok, "sure" (sarcasm) - PROVE IT, because YOU SAID THIS BEFORE THAT:

"Secunia's statistics are incorrect and out-of-date. I checked some of the CVEs for Linux, and Secunia lists them as unpatched, while Googling the CVEs shows that they were patched a long time ago." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

Prove it... show us that data then - why do you keep "RUNNING" from doing that? Because it's another LIE from you, like the one on NASDAQ?? (See below).

In fact - I can show EASY workarounds for the 2 remote errs in Windows (they don't affect home PC's even if they're setup right for security, that is, or even corporate workstations) the same for the 3 local ones...

(Funny part is 1 is caused by Apple softwares!)

* SO - Can you show the same for the 17++ errors in Linux, WHICH DO HAVE A REMOTE SECURITY VULNERABILITY UNPATCHED ALSO!

APK

P.S.=> Or, are you going to be as "accurate" as you were ABOUT NASDAQ USING LINUX?

See here on that account folks & get read to laugh:

"Yeah, it's only what Google, Yahoo, Facebook, NYSE, NASDAQ, etc. use on their servers - by gottabeme (590848) on Wednesday July 06, @08:16AM (#36670630)

Instead - Try it's Windows Server 2003 + SQLServer acting as "the OFFICIAL TRADE DATA DISSEMINATION SYSTEM" @ NASDAQ instead!

---

NASDAQ Migrates to SQL Server 2005:

http://www.windowsfs.com/enews/nasdaq-migrates-to-sql-server-2005

---

and here:

NASDAQ Uses SQL Server 2005 â" Reducing Costs through Better Data Management:

http://blog.sqlauthority.com/2007/09/17/sqlauthority-news-nasdaq-uses-sql-server-2005-reducing-costs-through-better-data-management/

---

(In fact, It's been running 24x7 in fail-over clusters for coming up on a DECADE NOW in fact... check the Microsoft "GET THE FACTS" pages @ MS!)

"Put up, or SHUT UP"... & not your inaccurate LIES about things... I want to see CVE data that shows the data from SECUNIA is inaccurate!

... apk

"Run, Forrest - RUN!!!" Part #3... lol! apk

[Anonymous Coward]

It's not Linux being used for that @ NASDAQ, fact!

"Yeah, it's only what Google, Yahoo, Facebook, NYSE, NASDAQ, etc. use on their servers - by gottabeme (590848) on Wednesday July 06, @08:16AM (#36670630)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36670630

Instead - Try it's Windows Server 2003 + SQLServer acting as "the OFFICIAL TRADE DATA DISSEMINATION SYSTEM" @ NASDAQ instead!

---

NASDAQ Migrates to SQL Server 2005:

http://www.windowsfs.com/enews/nasdaq-migrates-to-sql-server-2005

---

and here:

NASDAQ Uses SQL Server 2005 Ã" Reducing Costs through Better Data Management:

http://blog.sqlauthority.com/2007/09/17/sqlauthority-news-nasdaq-uses-sql-server-2005-reducing-costs-through-better-data-management/

---

(In fact, It's been running 24x7 in fail-over clusters for coming up on a DECADE NOW in fact... check the Microsoft "GET THE FACTS" pages @ MS!)

---

"Until you're willing to argue logically and honestly, we can't make any progress in the discussion." - by gottabeme (590848) on Wednesday July 06, @08:27AM (#36670680)

Yea... tell me about it, & call me a hypocrite again (I called you a liar, because you ARE A LIAR on NASDAQ running Linux (epsecially when it fell "agreus style" FLAT ON ITS FACE 2nd day on the job @ LSE!)). I call a spade, a spade... simple!

You can "redeem yourself"... prove the data from SECUNIA.COM on Linux unpatched security vulnerabilities is indeed, inaccurate - show us the CVE's you said that show they are patched!

Again - "Put up, or SHUT UP"...

( & not your inaccurate LIES about things... I want to see CVE data that shows the data from SECUNIA is inaccurate!)

APK

P.S.=> "Put up or SHUT UP" & no more NASDAQ lies... or what I suspect is yet another lie out of you here next:

PROVE IT, because YOU SAID THIS:

---

"Secunia's statistics are incorrect and out-of-date. I checked some of the CVEs for Linux, and Secunia lists them as unpatched, while Googling the CVEs shows that they were patched a long time ago." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

---

Prove it... Show us that data then - why do you keep "RUNNING" from doing that? Because it's another LIE from you, like the one on NASDAQ??

In fact - I can show EASY workarounds for the 2 remote errs in Windows (they don't affect home PC's even if they're setup right for security, that is, or even corporate workstations) the same for the 3 local ones...

(Funny part is 1 is caused by Apple softwares!)

* SO - Can you show the same for the 17++ errors in Linux, WHICH DO HAVE A REMOTE SECURITY VULNERABILITY UNPATCHED ALSO! Because I can show this, from a source YOU TRIED TO USE WITH STALE OLD DATA from 2004, & here is more current info. on that note:

---

http://www.theregister.co.uk/2011/06/10/domains_lamped/

PERTINENT QUOTE:

"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey. Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers"

---

... apk

gottabeme on "honesty" (not) & hypocrisy (LOL)

[Anonymous Coward]

It's not Linux being used for that @ NASDAQ, fact!

"Yeah, it's only what Google, Yahoo, Facebook, NYSE, NASDAQ, etc. use on their servers - by gottabeme (590848) on Wednesday July 06, @08:16AM (#36670630)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36670630

Instead - Try it's Windows Server 2003 + SQLServer acting as "the OFFICIAL TRADE DATA DISSEMINATION SYSTEM" @ NASDAQ instead!

---

NASDAQ Migrates to SQL Server 2005:

http://www.windowsfs.com/enews/nasdaq-migrates-to-sql-server-2005

---

and here:

NASDAQ Uses SQL Server 2005 Ã" Reducing Costs through Better Data Management:

http://blog.sqlauthority.com/2007/09/17/sqlauthority-news-nasdaq-uses-sql-server-2005-reducing-costs-through-better-data-management/

---

(In fact, It's been running 24x7 in fail-over clusters for coming up on a DECADE NOW in fact... check the Microsoft "GET THE FACTS" pages @ MS!)

---

"Until you're willing to argue logically and honestly, we can't make any progress in the discussion." - by gottabeme (590848) on Wednesday July 06, @08:27AM (#36670680)

Yea... tell me about it, & call me a hypocrite again!

(E.G./I.E.-> I called you a liar, because you ARE A LIAR on NASDAQ running Linux (epsecially when it fell "agreus style" FLAT ON ITS FACE 2nd day on the job @ LSE!)).

I call a spade, a spade... simple!

You can "redeem yourself" (lol, not - your blunder on NASDAQ alone blew you away)!

Go on... Prove the data from SECUNIA.COM on Linux unpatched security vulnerabilities is indeed, inaccurate - show us the CVE's you said that show they are patched!

I suspect that's another LIE from you, and you talked of "honesty"?? Please...

Again - "Put up, or SHUT UP"...

( & not your inaccurate LIES about things... I want to see CVE data that shows the data from SECUNIA is inaccurate!)

APK

P.S.=> "Put up or SHUT UP" & no more NASDAQ lies... or what I suspect is yet another lie out of you here next:

PROVE IT, because YOU SAID THIS:

---

"Secunia's statistics are incorrect and out-of-date. I checked some of the CVEs for Linux, and Secunia lists them as unpatched, while Googling the CVEs shows that they were patched a long time ago." - by gottabeme (590848) on Sunday July 03, @09:44PM (#36649602)

---

Prove it... Show us that data then - why do you keep "RUNNING" from doing that? Because it's another LIE from you, like the one on NASDAQ??

In fact - I can show EASY workarounds for the 2 remote errs in Windows (they don't affect home PC's even if they're setup right for security, that is, or even corporate workstations) the same for the 3 local ones...

(Funny part is 1 is caused by Apple softwares!)

* SO - Can you show the same for the 17++ errors in Linux, WHICH DO HAVE A REMOTE SECURITY VULNERABILITY UNPATCHED ALSO! Because I can show this, from a source YOU TRIED TO USE WITH STALE OLD DATA from 2004, & here is more current info. on that note:

---

http://www.theregister.co.uk/2011/06/10/domains_lamped/

PERTINENT QUOTE:

"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey. Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers"

---

... apk

I thought U said U were gone (2x now)?

[Anonymous Coward]

Ahem: *cough* (bullshit), **COUGH** (BULLSHIT):

"That you are a known troll and a waste of time has nothing to do with whether your arguments are valid, it's whether it's worth my time to find out." - by SanityInAnarchy (655584) on Wednesday July 06, @05:57PM (#36676092)

If THAT is not an ad hominem attack, I don't know what is (to the man, you're attacking MYSELF in that, just as you did "behind my back" in other posts in this thread). You can't even KEEP YOUR WORD you are gone or not... ever heard of honor or dignity?

---

"You've now written at least two posts to me stressing this point and asking this question, yet you can't be bothered to download it and find out for yourself? Why should I do your homework for you?" - by SanityInAnarchy (655584) on Wednesday July 06, @05:57PM (#36676092)

I have it, I just want to hear it FROM YOU (you were good enough to help me out with Chrome vs. Chromium before, so... why be "hesitant" to answer if either has a by SITE preferences ability vs. IFRAMES, PLUGINS, COOKIES, or JAVASCRIPT NOW? Hmmm??)

(Cat got your tongue???? Didn't before... "odd that" eh????? (not))

---

"I did answer. I pointed out that what you're doing now is an argument from authority." - by SanityInAnarchy (655584) on Wednesday July 06, @05:57PM (#36676092)

Yes, you're the "authority" on Chrome/Chromium, so answer the simple question on if they have "by site" preferences like Opera does then!

(Pretty simple!)

---

"You don't know that I've taken logic formally." - by SanityInAnarchy (655584) on Wednesday July 06, @05:57PM (#36676092)

I've asked you before IF you have in debates with you... you never answered iirc... & in fact? I'm fairly certain you never did! Doesn't matter though - you call me "troll" repeatedly thru this exchange, & you spoke behind my back to others as well on this page... good enough for me to KNOW you are performing "forums' 'illogic-logic'", in an adhominem attack on myself... rather than my points!

---

"What does that have to do with whether my argument is valid? If it doesn't have anything to do with that, it's a red herring. If you're trying to say it does, it's an argument from authority of the formally fallacious kind." - by SanityInAnarchy (655584) on Wednesday July 06, @05:57PM (#36676092)

Nothing - JUST ANSWER THE QUESTION ON CHROME/CHROMIUM PLEASE

(Man - YOU COULD GIVE AN ASPIRIN A HEADACHE!)

* I'll tell you right now, that Javascript, IFrames, & Plugins ARE a potential "major hazard" on the "Information Super-Highway" (but I don't think I have to tell YOU that, you alluded to Chrome being attacked that way already): Again - so it sinks in: DOES CHROME/CHROMIUM HAVE A BUILT IN "by site preferences" TO LIMIT USING THOSE POSSIBLE HAZARDS ON SITES YOU REALLY NEED IT FOR, ONLY!

APK

P.S.=> Thanks for your time in answering - a SIMPLE "Yes" or "No" will do...

... apk

Re:I thought U said U were gone (2x now)?

[SanityInAnarchy]

Ahem: *cough* (bullshit), **COUGH** (BULLSHIT):

And here you just repeat yourself, clearly ignoring my actual response and the definition of ad-hominem, something you've done before, I might add. Did you even read my comment?

I certainly feel no need to read the rest of yours.

Seems "troll" here solved the problem too

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36621818

* For NON-DESTRUCTIVELY removing this "blended threat" combined rootkit/botnet, from an inviolable read-only media with proven tools for doing so by 1st destroying the hello_tt.sys driver it uses, & then reloading a correct bootsector afterwards (since it is no longer protected by said kernelmode/Ring 0/RPL 0 driver anymore).

Any malware it may haul in later?

Simple - Suspend sending HLT commands to it via ProcessExplorer in Ring 3/RPL 3/Usermode, to "mop it up", completely... even if it's an UNKNOWN one hiding beneath other processes as a child process!

("Here endeth the lesson")

APK

P.S.=> Call me what you like but... proof & truth's up there on that note AND "on topic" as well!

(Please - Just answer the question on Chrome, because I am genuinely interested @ this point - because IF Chrome/Chromium doesn't have it, then Opera IS @ the advantage, for security's sake on that note)

In fact, on that note? Well... that might be something to spend time on rather than uselessly debating me & not doing that well, on YOUR end via say, an addon of some sort actually since I know you code too, like myself (I *think* our "kind" around here's an actual rarity for the most part)...

Consider THAT suggestion, "Food 4 Thought" 4 U, & a useful something YOU, the Chrome Person, could contribute to society in general!

... apk

2 things 4U 2 refer to & answer/note

[Anonymous Coward]

Respectively: You avoid my question on CHROME & if it has a "by site prefs" like Opera does (so you can set javascript, iframes/frames, cookies, plugins etc.) to run on SOME sites, & NOT others, for security's sake!

and

http://it.slashdot.org/comments.pl?sid=2282088&cid=36676422

* Kept it "short & sweet" for you...

APK

P.S.=> I.E.-> Kindly answer the 1st, & DO note the 2nd (it being the topic of this article, after all) - Thanks 4 UR time...

... apk

Facebook Trapped In MySQL (Worse Than Death)

[Anonymous Coward]

Facebook Trapped In MySQL Fate Worse Than Death http://developers.slashdot.org/story/11/07/09/1256241/Facebook-Trapped-In-MySQL-a-Fate-Worse-Than-Death

* "Read 'em & Weep"...

APK

Correcting you, point-by-point

[Anonymous Coward]

1st of all - I don't get malware, ever, due to my guide's points I follow here -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

"No. You stated that "if" you were to suck in one of these" - by cbiltcliffe (186293) on Saturday July 02, @09:45PM (#36644570) Homepage

I don't ever GET malware in the 1st place though, ever... ever since I started doing "layered security" back in 1996 in fact to present! Even IF I did? It couldn't talk back to the mothership, because I am updated vs. known bogus DNS servers + botnet C&C servers, by overwrite of my HOSTS, every 15 minutes here, "automagically"!

Secondly, see above, "rinse, lather, & repeat", & I am not the only one experiencing freedom from infestation, others who follow its points do as well (even only those that use HOSTS):

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

AND

"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3

"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRONKA, user of my guide @ XTremePcCentral

---

"then the update to Norton would prevent it from being able to talk back to it's C&C." - by cbiltcliffe (186293) on Saturday July 02, @09:45PM (#36644570) Homepage

Again -> My updates to my HOSTS & firewalls (in software, & in hardware) occur every 15 minutes from 17 reputable sources too... "automagically" by OVERWRITES, from a temp copy of the original, & not by appends, via a Python Script. No chance of poisoning them either.

And

My DNS serv

LOL- Tossing names now/adhominem attack?

[Anonymous Coward]

Mr. "FruStrAteD" troll? Case in point is your first sentence here quoted:

"Listen, you arrogant, obnoxious, simple-minded gimp." - by cbiltcliffe A FRUSTRATED TROLL (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

Awwww.... poor little "1 hit wonder" (not even a hit, or I suspect, YOUR OWN WORK but the work of others you merely used) disk being shown to be "obsolete" & not needed/useless here got your gander, did it? LOL!

---

"I'm not asking you how to eliminate the rootkit. I never once asked you how to eliminate a rootkit.." - by cbiltcliffe A FRUSTRATED TROLL (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

There's NO DENYING my technique will get rid of this rootkit and others like it, is there? Apparently not, because you avoid that like the plague when I ask the question if it works or not... lol!

---

"I already knew how to eliminate a rootkit.." - by cbiltcliffe A FRUSTRATED TROLL (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

Sure, sure... then, why didn't you post the simple technique I did, of using PROVEN Recovery Console tools (not MSRT as you stated iirc), from an inviolate read only media in the Windows installation CD/DVD then?

---

"Stop harping on it, as you're making yourself look like a complete and total fool, by repeatedly answering a question that was never asked.." - by cbiltcliffe A FRUSTRATED TROLL (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

NO, I will harp on it, and show that YOU are the "complete and total fool", because you're unable to answer a question put to you on if my technique for elimination rootkits works (and it does, no questions asked).

---

"My issue has always been with your claim that could detect a root kit with Process Explorer and TCPview.." - by cbiltcliffe A FRUSTRATED TROLL (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

I never said that - they are useful for checking to see what your systems' communicating with in TcpView (netstat -ano will do that also from a DOS Windows/tty terminal/console session also) first of all...

AND

That ProcessExplorer is useful once rootkits driven by drivers or bootsector "VM's" (using the term loosely here) type rootkits use are destroyed, FIRST, & then if they haul in more malware, even UNKNOWN malware (which antivirus/antispyware would fail against because they don't have signatures or removal techniques for it (& their heuristics are not set "on" or "max" & they aren't usually by default)??
It can be used to destroy those, too... and it works (nothing can be hidden from it once a rootkit that performs API call hooking intercepts is gone).

---

"This is what I stated in my very first post to you, and the only thing I've repeatedly stated that you're wrong about.." - by cbiltcliffe A FRUSTRATED TROLL (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

NO, I have answered it, and you either are just "conveniently trolling" or you are illiterate & skimmed over my points each time!

---

"This is also the only aspect of this rootkit removal that you haven't clarified.." - by cbiltcliffe A FRUSTRATED TROLL (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

I said that IF you read my security guide for Windows? I list several reliable and reputable ROOTKIT DETECTING TOOLS THERE...

(Awful "convenient" that you seem to omit that point of mine, eh? NOT! It shows us all who the "total fool" is here, and it's NOT myself!)

---

"Instead, you choose to go off on irrelevant and off topic rants about how you're an expert because you're an expert" - by cbiltcliffe A FRUSTRA

Re:LOL- Tossing names now/adhominem attack?

[cbiltcliffe]

TcpView... now, say (as I did in my last post above) that while letting my nephew, brother (or even little niece, she's into computing too (good sign)) use my system, & say they infect it via a USB stick, and my antivirus/antispyware in place resident doesn't catch it? I can monitor who/what/when/where/how my system is "talking to" other machines online (inclusive of botnet C&C servers).

According to your statement here, said in a thread about rootkits, you can use TCPview to detect errant connections caused by malware. In the context of a rootkit conversation, it can only be assumed that you're talking about rootkits.

Again, I ask you: How do you detect a rootkit using TCPview. You maybe didn't state outright that you could, but you certainly strongly implied it with the context of your statement.

There's NO DENYING my technique will get rid of this rootkit and others like it, is there? Apparently not, because you avoid that like the plague when I ask the question if it works or not... lol!

Will it get rid of an MBR rootkit? Yes. Will it get rid of a driver-based rootkit with a discrete .sys file for the driver? Yes.

Will it get rid of a driver-based rootkit that uses a patched tcpip.sys, or atapi.sys? No, because listsvc doesn't verify file signatures, and there's no way for you to do it manually using hashes, or the like, within the recovery console.

You also claimed that:

even IF I were to 'suck in' this beastie? As soon as they get its C&C servers, I get them... every 1/4 hour, & it won't be able to "talk back to HQ"...

Notice that word "this"? That means you're specifically referring to the rootkit that was the topic of the conversation. This rootkit will be blocked by your Norton DNS settings. That's what you claimed. But you still haven't explained how you can trust the DNS settings on a rootkit infected computer, either.

I never once did state what you "inferred" above, dolt!

Ooooh! Ad hominem attacks!

<APK-like voice>I'm such a big man because I know how to spell ad hominem!!</APK-like voice>

  BTW, it's two words, just in case you're interested. But you're not, because you're more interested in saying:
"Look at my commercial software! I've written security guides! I've shown you how to remove this rootkit 12 times, so why does it matter that I haven't given a reliable method to detect it!!! Shut up!"

Show us a direct quote of my stating this

[Anonymous Coward]

First, see subject-line above:

"My issue has always been with your claim that could detect a root kit with Process Explorer and TCPview" - by cbiltcliffe (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage

Second: Produce proof of my stating that TcpView &/or ProcessExplorer are for detecting rootkits!

(I said they're respectively useful for detecting communications of botnets or malwares, and for eliminating them in UserMode/Ring3/RPL3 operations, once a rootkit's destroyed in Ring0/RPL0/Kernelmode (so it cannot perform deceiving API call intercepts on usermode wares))

Fact is - I never once did state what you "inferred" above, dolt! Learn to READ!!!

In fact - Here is where I mention TcpView & what I stated about it, AND ProcessExplorer also (not in regard to rootkits, but malwares rootkits can haul in as this one does):

---

PERTINENT QUOTE, VERBATIM FROM MYSELF:

"I can watch who/what/when/where/how my system "talks" to other systems online, & if I see one I am NOT talking to? It gets added to my firewall list (by IP address), and the offending unknown interloper malware/botnet gets "BLOWN AWAY" by ProcessExplorer.exe, as I noted in my last post/other post in reply to YOUR last post." - by Anonymous Coward on Saturday July 02, @11:35PM (#36644860)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36644860

---

And as to detecting rootkit's presence? I said this

---

PERTINENT QUOTE, VERBATIM FROM MYSELF:

"& in my guide? I post a NUMBER of reliable tools for rootkit detection:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE [bing.com]

(And, there you are - TcpView is only for checking WHERE it communicates back to... as a possible way of seeing that, for adding the bogus C&C server destinations to HOSTS &/or Firewall rules tables - that's all!)" - by Anonymous Coward on Sunday July 03, @03:08PM (#36647626)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36647626

---

Which now after your quoted statement @ the top of my reply here make you look to be either:

1.) ILLITERATE on, or skimming

or

2.) Just "trying to get the last word a week later" like a FOOL would when I said nothing of the KIND as you state!

APK

P.S.=> Go on though, show us a quote of my stating what you said I did... good luck - because I show QUITE OTHERWISE above, complete with quotes of myself and the links they came from in this very exchange (quit deluding yourself here - U "FAIL", badly, because putting words in others' mouths is NOT valid debate @ all, period!)

... apk

Did I use the word rootkit? No, not once.

[Anonymous Coward]

In regards to TcpView OR ProcessExplorer? No. So haha to you: See subject-line above...

U FAIL #1...

---

"Will it get rid of a driver-based rootkit that uses a patched tcpip.sys, or atapi.sys? No, because listsvc doesn't verify file signatures, and there's no way for you to do it manually using hashes, or the like, within the recovery console." -

The ONLY way to use those, would be to do what this botnet did, a filtering/hooking driver... otherwise, Windows SFP/WFP (Windows File & System File Protection) would detect for it & replace them IF they were bogusly replaced... period!

U FAIL #2...

---

"Ooooh! Ad hominem attacks!" - by cbiltcliffe (186293) on Tuesday July 12, @03:12PM (#36738656) Homepage

LMAO - you started it, & your mistakes here constantly DO make you out to be a DOLT, period... I only call a spade, a spade is all, & I fight fire WITH hotter fire, especially if it's done to myself, first...

U FAIL #3...

APK

P.S.=> This? This was just "too, Too, TOO EASY - just '2EZ'", as per my usual, vs. trolls like yourself...

... apk

Re:Did I use the word rootkit? No, not once.

[cbiltcliffe]

"Ooooh! Ad hominem attacks!" - by cbiltcliffe (186293) on Tuesday July 12, @03:12PM (#36738656) Homepage

LMAO - you started it,

I started it? Really? You can't even remember what you've written in this thread, can you? The first insult to fly in this thread came from you, in the form of this comment:

* So, go "hawk" your essentially obsolete 'ware' in this situation & others like it vs. rootkits "1 hit wonder" disk elsewhere man!

Besides, I haven't used a single ad hominem attack. I've called you a douche, among other things, but I haven't said that you're incorrect because you're a douche. I've said that you're a douche because you're incorrect, but you can't see it. Do you even know what an ad hominem attack is?

I only call a spade, a spade is all, & I fight fire WITH hotter fire, especially if it's done to myself, first...

Your "hotter fire" is a sputtering candle, but you can't even see it's burning out.

* You KNOW you've gotten the best of a troll, when trolls go "silent" - APK "FTW", as usual, vs. /. trolls...

Are you hearing yourself? Obviously you can't hear anybody else, due to the sheer amount of self-cheerleading you do, so you assume they've all gone silent. Tell me, do you wear a skirt and wave pompoms when you do that? .APK is a troll.APK is a troll.APK is a troll.APK is a troll.APK is a troll.APK is a troll.APK is a troll.APK is a troll.
APK is a n00b.APK is a n00b.APK is a n00b.APK is a n00b.APK is a n00b.APK is a n00b.APK is a n00b.
cbiltcliffe is invincible!!cbiltcliffe is invincible!!cbiltcliffe is invincible!!cbiltcliffe is invincible!!cbiltcliffe is invincible!!cbiltcliffe is invincible!!

Nope. Doesn't really do anything for me. I guess I don't feel my knowledge is so limited that I need to trumpet it to anybody who'll listed so as to try to make myself feel better about being borderline incompetent.

The ONLY way to use those, would be to do what this botnet did, a filtering/hooking driver... otherwise, Windows SFP/WFP (Windows File & System File Protection) would detect for it & replace them IF they were bogusly replaced... period!

Once again, you're wrong. I've seen patches like this happen, and WFP did not fix it. The problem is, once the file is patched, and the hostile code loaded into memory, WFP can be disabled by that hostile code, even if only for that file.
True, this does mean you have to get infected in the first place, and you've assured me that your m@d skillz would prevent anything like that from ever happening.

Did I use the word rootkit? No, not once.
In regards to TcpView OR ProcessExplorer? No. So haha to you: See subject-line above...

So basically, what you're saying is:
"I made a statement completely unrelated to the conversation, but made it sound like it was part of the conversation going on, and since you assumed I was actually talking about what everybody else was talking about, you must be an idiot."

That's even more childish than the rest of your fellow trolls, so you've mastered the art. At least I'm honest when I'm being childish, assmuncher. You'd probably be good in politics, because you can say something that has a totally different meaning than anybody listening will take from it, and then seem honestly surprised when people misinterpret you.

Now, since you've responded to my single post with 4 of your own, but still managed to avoid the very first question I asked you in this thread, I'm going to ask it one more time:

If you're relying on Norton DNS to prevent such a "beastie" - as you so eloquently put it - from talking to its C&C server, how can you trust the DNS settings on the infected computer?

Now, since you've spent the entire thread with your hands over your ears going "LALALALA

Re:Did I use the word rootkit? No, not once.

[Anonymous Coward]

APK didn't say Process Explorer + Tcpview are for detecting rootkits. It's a problem in your reading comprehension cbiltcliffe. You couldn't produce proof of it either though you said he said that. You're wrong and saying he implied it is incorrect is just trying to cover your own mistake. APK always said here that those 2 programs are for malware not rootkits and proved it here with his own words quoted in his other posts. I'd accept you lost here and write it off as that cbiltcliffe.

Re:Did I use the word rootkit? No, not once.

[cbiltcliffe]

Hey, APK!

You didn't sign this post with apk!

You're slipping. Or are you just trying to astroturf, and make it seem like other ACs agree with you?

That just shows how desperate you are.

"Rinse, Lather, & REPEAT" as to what I

[Anonymous Coward]

Actually said, w/ backing quotes of myself http://it.slashdot.org/comments.pl?sid=2282088&cid=36731660 in regards to TcpView &/or ProcessExplorer, vs. your blunders & reading comprehension difficulties, lol...

* PLEASE - Either learn to read, OR, get "hooked on phonics" (you need it, lol).

APK

P.S.=> Ah, I just GOTTA say it, as-per-my-usual, vs. trolls like yourself: This? This was just "too, Too, TOO EASY - just '2EZ'", & your blunders, skimming, & technical knowledge inadequacy makes it so for me! Thank you for making ME, look GOOD, as usual vs. trolls like yourself!

... apk

In addition 2 WFP? This helps (posted days ago)

[Anonymous Coward]

On the subject of bypassing unsigned driver installs http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes...

There's possibly even a "Group Policy" entry for this as well, but I have not looked! If not, there should be (but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

However - The nice part is here?

Well - Windows "warns you" when you enter this mode!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..." (and endeth cbtcliffe the wannabe, too, lol!)

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus, son of Peleus, the INVINCIBLE WINNER (when middle names are usually those of the father or grandfather = APK):

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

... apk

"Is there no one else? Is There NO ONE ELSE??"

[Anonymous Coward]

Play 2:50 on, says it for me better than I can -> http://www.youtube.com/watch?v=SP74aJBbIoY

I.E.-> AKhilleus (greek spelling of Achilles) , son of Peleus (middle names are usually that of the father or paternal grandfather) "KNOCKS THE CHOCOLATE OUT OF YET ANOTHER /. OFF-TOPIC 'Boagrius' TROLL!", as-per-my-usual... in this case? cbtcliffe, the wannabe.

  * You KNOW you've gotten the best of a troll, when trolls go "silent" - APK "FTW", as usual, vs. /. trolls...

APK (The "Invincible Winner" vs. /. trolls...)

P.S.=> This? Ah, I just GOTTA say it, as is my usual in my own INIMITABLE 'style' -> This was just "too, Too, TOO EASY - just '2EZ'"

... apk

Wrong again on WFP (Have to disable it 1st)

[Anonymous Coward]

First of all, PROVE your "anecdotal b.s." here:

(And, if that happened via malware code? No biggie: I showed a preventative method for THAT TOO, right here, days ago, vs. invalid installation turn off by an app's code -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36740882 )

U FAIL AGAIN!

(LMAO!)

"Once again, you're wrong. I've seen patches like this happen, and WFP did not fix it. The problem is, once the file is patched, and the hostile code loaded into memory, WFP can be disabled by that hostile code, even if only for that file." - by cbiltcliffe (186293) on Tuesday July 12, @10:29PM (#36744054) Homepage

First of all - Windows File Protection would reject it, just like is seen here:

http://www.msfn.org/board/topic/84128-windows-file-protection-popups-when-installing-drivers/

AND, the ONLY WAY you can get around a hassle like that, is to disable WFP, period...

Now - unlike yourself, & your "I've seen it" anecdotal b.s.?

Well - I can actually produce a result for a tool that shows that done (WinPCap driver, to use it, you have to ALLOW IT to disable the WFP protection)...

QUESTION FOR PROOF: Can you produce something that does it on its own proving it does via its own code??

Funny you omit any proofs, as per your usual!

So much for your usual b.s.!

* Once again, the "amateur" tries his best, has only "anecdotal b.s." as is cbtcliffe's usual, & FAILS!

APK

P.S.=> AND, if you do manage to produce a valid result of that as I have in WinPCap installations, or an actual malware that does it?

Again - SEE my FIRST link above @ the start of this reply, it will stop it by turning it on again... AND?

Then, guess what saves the day once again??

You guessed it - The Windows install media - it has the original files

OR

You can get latest service packed versions of them by manually extracting out the latest valid models from MS using the switches on Service Pack patch files OR open them with say, WinRAR, then extract them onto another form of media, preferably a CD (read only) & load them from a bootup into Recovery Console, flipping to the copy you have on CD!

(Again - using a CD is preferred because of read-only access AND, by default, unless you change it? RC only allows you to access the Windows ROOT folders %WinDir% & %SystemRoot% iirc)

AND... There you go...

All fixed once again (IF need be too in the case you're proposing!) - because, face it:

There's nothing "the likes of you" can *THINK* of, that I can't fix easily in a second's moment of thought!

SO, as usual for myself, vs. you? This?? This was just "too, Too, TOO EASY - just '2EZ'", lol...

... apk

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

I think

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

you need to

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

form your thoughts

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

before you hit

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

submit so that you

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

don't have to put

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

so many replies to

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

cover your rambling, incoherent thoughts.

Re:Wrong again on WFP (Have to disable it 1st)

[cbiltcliffe]

Anecdotal evidence, ad hominem attacks...all these words you are throwing around, and you don't even understand basic logic.

You say drivers cannot be patched without warnings. Well, it's a logical impossibility to prove a negative, because one weird edge case can throw your whole argument out the window.
There is no anecdotal evidence when you're proving a negative theory incorrect. A single data point completely invalidates the theory.

The question I have is, why do I need to provide you with proof when such flaws have been widely publicized regarding both Windows Vista and Windows 7. Do your own Googling.

Debating with someone who has such a tenuous grasp on reality is fruitless, as the most logical arguments will be completely ignored, some irrelevant BS thrown back, along with "IT's just too TOO eZ, 2EzZzZzzz121!!1111!11!!1111!!1eleevenety"

The only reason you think it was too easy, is because you're too simple to understand the argument. You don't even realize you've completely failed to counter anything at all.

You can't show I said TcpView/ProcessExplorer

[Anonymous Coward]

Were for detecting rootkits can you? Nope... U FAIL!

LMAO - Man:

You screwed up TOTALLY saying I said TcpView + ProcessExplorer are for "detecting rootkits" & I NEVER SAID THAT EITHER!

In fact, I asked you to show where I did verbatim, literally, & I proved otherwise with MY OWN WORDS here:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36731660

(U FAIL AGAIN!)

---

Also - My telling U your "1 hit wonder" CD Isn't needed is not an adhominem attack! It's just truth! A truth you even ADMIT by saying my technique with proven RC read only tools works, no less!

(A CD that you use others' tools for I suspect, isn't useful here (and you didn't write the tools on it either completely yourself, I suspect))...

That's not an adhominem attack on my part - it's just truth!

Again - YOU EVEN ADMIT MY TECHNIQUE FOR KILLING THIS COMBINED ROOTKIT/BOTNET WORKS!

---

"* So, go "hawk" your essentially obsolete 'ware' in this situation & others like it vs. rootkits "1 hit wonder" disk elsewhere man!

Besides, I haven't used a single ad hominem attack. I've called you a douche, among other things, but I haven't said that you're incorrect because you're a douche. I've said that you're a douche because you're incorrect, but you can't see it. Do you even know what an ad hominem attack is? - by cbiltcliffe (186293) on Tuesday July 12, @10:29PM (#36744054) Homepage

Sure I do, and yes, you have, right here quoting you now in it:

---

"Listen, you arrogant, obnoxious, simple-minded gimp." - by cbiltcliffe (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage Journal

---

IF THAT'S NOT AN AD HOMINEM ATTACK, I DON'T KNOW WHAT IS!

(Your lies are once again your undoing boy!)

Besides - My technique works for burning away this rootkit, & you admitted that much - AND said rootkits' possible attendant malwares it can suck into Ring3/RPL3/Usermode can be killed off using ProcessExplorer.exe once you burn out the Ring0/RPL0/Kernel mode portions of this rootkit, AND YOU EVEN ADMITTED IT DOES!

(E.G.-> hello_tt.sys using listsvc + disable, & rebooting to RC again, then, burn the bogus bootsector using fixmbr from RC!)

* You also said I am wrong? HOW SO?? My stuff works, YOU ADMIT IT DOES, & your "1 hit wonder" (not), isn't even NEEDED @ ALL!

APK

P.S.=> LMAO - Your "1 claim to fame" (not even fame, especially if you didn't write the tools, & I've never heard of it (was it featured in any publications @ least, commercially sold wares, or even tech trade shows of great note like MS-TechEd as my work has been?)>?

Hey - it NOT needed here, period!

Face it - In comparison to MY technique for removing this rookit??

I.E.-> Your "1 hit wonder" is totally "obsoleted" by my proven technique with proven tools from the RC, on a read-only inviolate media... period!

... apk

Last "nail in your coffin here" on DNS (again)

[Anonymous Coward]

Especially this since you admitted my technique 4 killing this works vs. this rootkit/botnet combo:

"If you're relying on Norton DNS to prevent such a "beastie" - as you so eloquently put it - from talking to its C&C server, how can you trust the DNS settings on the infected computer?" - by cbiltcliffe (186293) on Tuesday July 12, @10:29PM (#36744054) Homepage

Simple - again:

Kill it off using my technique that actually works & you EVEN ADMIT IT DOES, to kill this rootkit!

NO problem @ all then, because just like having to do so FIRST, so ProcessExplorer can't be deceived?

Again - You have to knock out the Ring0/RPL0/kernel mode stuff first, so it can't deceive Win32/64 API calls that apps in Ring3/RPL3/Usermode use!

(And, I even suggested to others here http://it.slashdot.org/comments.pl?sid=2306598&cid=36698436 that Dr. Mark Russinovich write up a protective driver for the bootsector, & to call it "APKBootSectorProtector.sys" in fact, using the mechanics of this very rootkit to protect against it!)

APK

P.S.=> There you go... once again, the final "nail in your coffin" was just TOO EASY to pound into place & you helped me do it (because you admit you KNOW my technique for removing this rootkit/botnet using RC tools & the malware afterwards, using ProcessExplorer, actually works!)

... apk

WFP would also state UR in "TEST MODE" too

[Anonymous Coward]

WARNS YOU IN WINDOWS: Says it's in "TEST MODE"... you'd KNOW if a program did it!

I already mentioned this, but as usual, like when you missed the fact I never ONCE stated ProcessExplorer or TcpView are for detecting rootkits, not once (only malwares)!

* In fact, as a test? Try what I said as an actual example you can SEE (unlike your "anecdotal b.s." of "I have seen it") install WinPCap as I noted

(E.G.-> You get warned when it tries to do an unsigned driver installation in fact as it tries - & it's used in various network sniffer type tools)

THEN, once you reboot? You get TOLD you are in "TEST MODE" (same as if you're developing drivers mind you)...

I.E.-> Which WOULD be your warning "something's up/not right"

(In my case, FOR SURE I'd know it, because my systems' NOT currently setup with a debug build of Windows nor the MS-DDK for driver development either!)

APK

P.S.=> Between this, and my last post on this here:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36744408

(Where I also show how to defend vs. this using bcdedit commandlines as well)?

You're "all done" @ this point!

Even though you've "wandered off topic" on other types of rootkit possibles, & admitted MY TECHNIQUE FOR REMOVING THIS ROOTKIT ACTUALLY WORKS, & your "1 hit wonder" CD? Is not needed, period...

Simply because RC's native proven tools from a read-only environs of the Windows install CD/DVD in listsvc, disable, & fixmbr do the job already - period!

... apk

Group Policy stops unsigned driver install too

[Anonymous Coward]

As I originally noted was most likely possible, here:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36740882

Guess what? I was right yet again:

GROUP POLICY CAN STOP UNSIGNED DRIVER INSTALLS!

In fact, I'd use it in combination with the bcdedit commandlines I noted can (& WFP would protect vs it, and then Windows itself also SIGNALS you're in "TEST MODE" as well indicating something's "wrong" if you're not doing that kind of thing (like when doing driver dev work too!))

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

---

* Fact is, My last few posts have "done in" your GIANT "book sized" post, with ease, as per usual! This one only adds the "icing on the cake"!

Topping off GIANT BLUNDER/FAIL, in your stating I said TcpView &/or ProcessExplorer are for "detecting rootkits" & I NEVER EVEN STATED or IMPLIED THAT! Not once

Fact is - I explicitly stated, and had proof of that much quoting myself here as well:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36731660

(You did yourself in, nobody else, IN YOUR TRYING TO PUT WORDS IN MY MOUTH THAT I NEVER SAID EVEN ONCE or EVEN IMPLIED!!!)

Face it - "U FAIL"...

APK

P.S.=> Ah, yes... you KNOW I just GOTTA say it: This? This was just "too, Too, TOO EASY - just '2EZ'", always is... vs. noob amateurs like cbiltcliffe!/quote)... apk

Stop unsigned drivers installs as this rootkit

[Anonymous Coward]

Does, & you have 2 options (use both 4 "layered security protection" (bcdedit commandlines + Group Policy)):

Also - Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes...

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + BCDEDIT can stop

[Anonymous Coward]

Unsigned driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well! See my post parent to this one...

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes...

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can stop

[Anonymous Coward]

Unsigned driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well! See my post parent to this one...

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can stop

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well! See my post parent to this one...

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can STOP

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well! See my post parent to this one...

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also easily!)

... apk

Group Policy + bcdedit can STOP

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can STOP

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can STOP

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, since "Boagrius" there was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can STOP

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, since "Boagrius" there, was "SO 'bad'" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can STOP

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

Group Policy + bcdedit can STOP

[Anonymous Coward]

Unsigned device driver installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:

---

Configure Driver Signing Through Group Policy Editor:

http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/

You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!

(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!

---

AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!

I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs

http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960

PERTINENT QUOTE/EXCERPT:

---

"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?

Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):

ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:

---

bcdedit /deletevalue loadoptions

bcdedit -set TESTSIGNING OFF

---

* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)

---

Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)

---

(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)

---

However - The nicest part is here?

Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!

(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)

* Once more/Again? "Here endeth the lesson..."

APK

P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):

---

"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:

http://www.youtube.com/watch?v=SP74aJBbIoY

---

Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"

(For what I feel I've done to this rootkit, & others like it via my techniques, mostly since "Boagrius" was "so bad" there, & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)

... apk

UR the one running from my posts

[Anonymous Coward]

You're the "desperate one", as you ADMITTED my technique for removing this rootkit, works (& your 'so-called tool' on CD isn't even NEEDED here, period):

Ahem: I'm also not the one running from this, YOU ARE where you tried putting words in my MOUTH I NEVER SAID (On TcpView &/or ProcessExplorer being used to "detect rootkits" which I never ONCE said (learn to read/get "hooked on phonics")):

http://it.slashdot.org/comments.pl?sid=2282088&cid=36744554

----

OR, this (Group Policy layered with bcedit commandline can stall unsigned driver signings in layered security protective manner):

http://it.slashdot.org/comments.pl?sid=2282088&cid=36745080

----

or this (WFP warning you & Windows says "TEST MODE" on unsigned drivers installed + WFP disabled):

http://it.slashdot.org/comments.pl?sid=2282088&cid=36745014

----

AND, this too (on DNS not being deceived if a rootkits "knocked-off" first in Ring0/RPL0/Kernelmode operations):

http://it.slashdot.org/comments.pl?sid=2282088&cid=36744624

---

* And, now you're also trying to "bury my replies" via doing nonsense posts with 2 words in them too, here tons of times (burning up your post limit too probably):

http://it.slashdot.org/comments.pl?sid=2282088&cid=36748960

http://it.slashdot.org/comments.pl?sid=2282088&cid=36748982

http://it.slashdot.org/comments.pl?sid=2282088&cid=36749052

http://it.slashdot.org/comments.pl?sid=2282088&cid=36749064

http://it.slashdot.org/comments.pl?sid=2282088&cid=36749144

http://it.slashdot.org/comments.pl?sid=2282088&cid=36749198

http://it.slashdot.org/comments.pl?sid=2282088&cid=36749220

http://it.slashdot.org/comments.pl?sid=2282088&cid=36749310

As you are now... pitiful!

AND, I have to post multiple times, because you write "book long" evasions & spin master b.s. trying to avoid the fact that you TRIED TO PUT WORDS IN MY MOUTH I NEVER SAID ONCE HERE!

(Where you thought I used ProcessExplorer &/or TcpView as "rootkit detectors" & when I confronted you on that? You could NOT produce a quote of my stating or even IMPLYING THAT!)

Pitiful on your part, in addition to accusing me of posting as others, when I clearly do NOT HAVE TO in the 1st place @ all!

---

Incorrect (I alway sign my posts) & Look at the time of that post for Pete's sake! I'm dead asleep @ that hour of the a.m.!

"That just shows how desperate you are." - by cbiltcliffe (186293) on Wednesday July 13, @11:22AM (#36748938) Homepage

"Run Forrest... RUN!"

APK

P.S.=> Please - talk about "getting desperate" - especially when you ADMITTED MY TECHNIQUE FOR REMOVING THIS ROOTKIT ACTUALLY WORKS here:

"Will it get rid of an MBR rootkit? Yes. Will it get rid of a driver-based rootkit with a discrete .sys file for the driver? Yes." - by cbiltcliffe (186293) on Tues

Re:UR the one running from my posts

[cbiltcliffe]

Stop putting words in my mouth, hypocrite.

I didn't agree that your method of removing rootkits would work. I stated that it would work for certain types of rootkits, but not all. You conveniently left off the part of my quote about the type it wouldn't work on, so you could pretend that I completely agreed with you. I didn't, and you know it.

And are you trying to tell me that some AC just happened to be reading this thread from a story over 2 weeks old, and just decided randomly to agree with you? Bull.

And for your information, I don't have a post limit. Or at least, I've never run across it, as my karma is excellent. The only person on here who can't seem to wrap their head around the fact that I'm right is you.

"Rinse, lather, & repeat" - U FAIL!

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36749334

AND?

"You say drivers cannot be patched without warnings." - by cbiltcliffe (186293) on Wednesday July 13, @11:59AM (#36749568) Homepage

1.) WFP is in the way, & if it gets "circumvented" (which this rootkit does), but the user MUST have consented to it as is shown when WinPCap is installed (Hooking/Filtering driver for tcpip.sys iirc))... that's a warning NOT TO DO IT in the 1st place, unless you KNOW what's going on & what the driver's for!

---

2.) Group Policy is set by default to NOT allow driver signings OR to warn, and you can BLOCK IT COMPLETELY even!

---

3.) bcedit commandlines I posted days ago here can act as another layer of defense vs. unsigned driver installs too if applied as I showed it (boot.ini work in older Windows versions prior to VISTA does the same also).

---

4.) DNS settings, if a rootkit is removed, can not be fooled (especially if rotated & checked on as I do it) + in combination with HOSTS files (especially mine, with 1,483,522++ KNOWN BAD sites/servers/hosts-domains blocked, botnet C&C servers blocked, bogus DNS servers blocked & even adbanners (that have had malicious code in them since 2004 many times)).

---

5.) My "layered security guides" if used, actually work to keep myself, & many others, 100% malware-in-general (inclusive of rootkits) FREE... the main weapons there are patching, using HOSTS, not using JAVA/Javascript "everywhere indiscriminately", firewalling + antivirus, & app patching too (and FAR more): BOTTOM-LINE on that much?

I NEVER HAVE TO REMOVE A DAMNED THING BECAUSE MY SYSTEMS NEVER GET INFESTED

(and, neither do those of my friends, family, or others I applied it to on paid contracts also... plus, many others in my guides attest to the same)

"Layered Security"? It WORKS!

---

So - Talk about "getting desperate" on YOUR part - Especially when you ADMITTED MY TECHNIQUE FOR REMOVING THIS ROOTKIT ACTUALLY WORKS here:

"Will it get rid of an MBR rootkit? Yes. Will it get rid of a driver-based rootkit with a discrete .sys file for the driver? Yes." - by cbiltcliffe (186293) on Tuesday July 12, @03:12PM (#36738656) Homepage Journal

QUOTED VERBATIM FROM and YOUR ADMITTANCE MY TECHNIQUE FOR REMOVAL OF THIS ROOTKIT/BOTNET WORKS -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36738656

---

AND, that your "1 hit wonder" disk is not even NEEDED in this case... period, as I said!

APK

P.S.=> Yes, "U FAIL" - badly: Most of all, in your trying to put words in my mouth I NEVER ONCE STATED, shown here:

YOU tried putting words in my MOUTH I NEVER SAID (On TcpView &/or ProcessExplorer being used to "detect rootkits" which I never ONCE said (learn to read/get "hooked on phonics")):

http://it.slashdot.org/comments.pl?sid=2282088&cid=36744554

AND, vs. that, here is what I actually said, proven in my OWN WORDS QUOTED HERE:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36731660

---

A.) I said that ProcessExplorer is for ONLY FOR REMOVING MALWARE running in Ring3/RPL3/Usermode NOT rootkit detection...

B.) I said that TcpView only shows what you are communicating with back & forth, not for rootkit detection as you said erroneously... period!

---

Above ALL else:

YOUR TRYING TO PUT WORDS IN MY MOUTH THAT I NEVER STATED or even IMPLIED? THAT ISN'T WINNING AN ARGUMENT - IT'S A SIGN OF DESPERATION & LOSING, OR ILLITERACY & SKIMMING ON YOUR PART, PERIOD!

... apk

Re:"Rinse, lather, & repeat" - U FAIL!

[cbiltcliffe]

The WinPCap driver gets installed using legitimate means. Of course it's going to give you the warning. What the hell has that got to do with rootkits?

As I stated, there have been plenty of reports of flaws with WFP and code signing, which I'm not going to point out to you, since you're obviously too lazy or braindead to find yourself.

Whether you want to admit it or not, my statements regarding you implying TCPview could show connections from rootkits are true. You did imply it. You injected the comment directly into a conversation about rootkits, and you in no way stated that you were only talking about malware other than rootkits. You either knowingly and disingenuously completely changed the subject, knowing it would be misinterpreted, or you meant it as I took it, and are now trying to backtrack.

In the first case, you're a childish ass. In the second, you're a wannabe noob.

Re:"Rinse, lather, & repeat" - U FAIL!

[Anonymous Coward]

Upset APK's system in removing this rootkit works and your CD's unneeded? You admitted it. You also tried to put words into apk's mouth he never said on processexplorer and tcpview. You then go further offtopic noting other rootkit methods but apk's methods versus that's shown in his past posts with proven tools one has on the Windows install media. I know it's why you keep on trolling here because you said he was ad hominem attacking you on your cd tool being unnecessary here. Using truth isn't an ad hominem attack. You simply can't take the truth your tool's not needed here at all and angry you fail. Be angry at yourself cbtcliffe.

Re:"Rinse, lather, & repeat" - U FAIL!

[cbiltcliffe]

Hey, APK. Good to see you astroturfing again...

If U get an unsigned rootkit driver this fixes

[Anonymous Coward]

It, even IF it slips past WFP & group policy (if not bcdedit commandline protections I showed also) & even with a "patched driver"!

(Which Windows would tell you that you are in TEST MODE in as well - First, You'd have to consent to it, stupidly I might add (especially if you don't know what the drivers' doing in the 1st place))?

Then, guess what saves the day once again??

---

1.) The Windows install media - it has the original files

OR

2.) You can get latest service packed versions of them by manually extracting out the latest valid models from MS using the switches on Service Pack patch files OR open them with say, WinRAR, then extract them onto another form of media, preferably a CD (read only) & load them from a bootup into Recovery Console, flipping to the copy you have on CD!

---

(Again - using a CD is preferred because of read-only access AND, by default, unless you change it? RC only allows you to access the CD/DVD itself, the Windows ROOT folders %WinDir% & %SystemRoot% iirc)

There you go - All fixed once again (IF need be too in the case you're proposing!)!

* Face it: There's nothing "the likes of you" can *THINK* of, that I can't fix easily in a second's moment of thought!

APK

P.S.=> Between this & my last post to you in reply here:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36750982

You're TOAST...

Especially for your trying to put words in my mouth I never even stated OR IMPLIED once on TcpView & ProcessExplorer being used as rootkit detectors... this disproved that easily with my OWN WORDS QUOTED no less:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36731660

SO, as usual for myself, vs. you? This?? This was just "too, Too, TOO EASY - just '2EZ'", & "U FAIL", lol...

... apk

Pot calling the kettle black now, are we?

[Anonymous Coward]

You tried that with me on ProcessExplorer & TcpView saying I said they're for "rootkit detection" quoted here:

---

"My issue has always been with your claim that could detect a root kit with Process Explorer and TCPview." - by cbiltcliffe (186293) on Tuesday July 12, @06:04AM (#36731236) Homepage Journal

QUOTED VERBATIM IN YOUR OWN WORDS FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36731236

---

So - Show me where I said that TcpView &/or ProcessExplorer are for rootkit detection... ok?

(You can't, you know it, & I know it (others posting here do as well, which I think is hilariously funny too))...

AND, I never once said that OR even IMPLIED it, period & here is where my words were quoted with their sources at to what I actually SAID:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36731660

And my actual words stating TcpView &/or ProcessExplorer are respectively for:

---

A.) I said that ProcessExplorer is for ONLY FOR REMOVING MALWARE running in Ring3/RPL3/Usermode NOT rootkit detection...

B.) I said that TcpView only shows what you are communicating with back & forth, not for rootkit detection as you said erroneously... period!

---

Period!

You were then asked to show me stating EXPLICITLY that I said they were for rootkit detection, you INFERRED THAT YOURSELF - you could not do that & tried to say I "implied it", that's b.s.!

(Please - Learn to read, & stop skimming... it really "did you in" here, badly!)

---

"Stop putting words in my mouth, hypocrite." - by cbiltcliffe (186293) on Wednesday July 13, @02:19PM (#36752140) Homepage

See above in your own words captured in quotes where you tried to put words in my mouth I never ONCE STATED EXPLICITY or even IMPLIED!

U FAIL HUGELY THERE ALONE!

---

So, that all "said & aside":

What's the topic here? This particular rootkit/botnet right??

"I didn't agree that your method of removing rootkits would work." - by cbiltcliffe (186293) on Wednesday July 13, @02:19PM (#36752140) Homepage

Funny, but I have you quoted right here, saying it does and ON THE ROOTKIT/BOTNET IN QUESTION, the topic here in fact:

---

"Will it get rid of an MBR rootkit? Yes. Will it get rid of a driver-based rootkit with a discrete .sys file for the driver? Yes." - by cbiltcliffe (186293) on Tuesday July 12, @03:12PM (#36738656) Homepage Journal

QUOTED VERBATIM FROM and YOUR ADMITTANCE MY TECHNIQUE FOR REMOVAL OF THIS ROOTKIT/BOTNET WORKS -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36738656

---

Funny that, eh? You're being a HYPOCRITE to YOURSELF!

---

"I stated that it would work for certain types of rootkits, but not all." - by cbiltcliffe (186293) on Wednesday July 13, @02:19PM (#36752140) Homepage

Then, you're also going "off-topic"...period!

Plus, I have other methods for removing other types as well, using the Windows Install media, shown here:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36751240

U FAIL AGAIN

Using what's in that link above & in combination with my 1st method especially, this other technique can "wash clean" any rootkit (especially if you install the RC to HDD and use the CD/DVD installation media version, even IF can you manage to slip past Group Policy & WFP)

---

"You co

Re:Pot calling the kettle black now, are we?

[cbiltcliffe]

That's not the TCPview/Process Explorer quote that I referred to. Sure, you said it there, but the one I responded to first, you didn't. You stated "malware" which implies all malware, in a conversation about rootkits. To a sane individual, that also implies rootkits. Obviously you are not sane, since it didn't imply that to you. However, now you'll claim that I'm ad hominem attacking you, because it's a word you know how to spell.

(others posting here do as well, which I think is hilariously funny too)

No....you know what's really funny? I mean, really, really, really funny?

All this time I've kept you spastically OCDing over this thread, when you could have been updating your hosts file.

Now THAT'S FUNNY!!!!

This BLOWS YOU AWAY on that too

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2282088&cid=36751240

Better luck next time, even IF something slips past WFP, Group Policy (and my bcdedit commandline layered protection method to top those off too) as well as Windows warning you are in "TEST MODE" if unsigned driver installation is set to be "ok" by a hacker/cracker!

APK

P.S.=> This 'takes the cake' lol:

"Whether you want to admit it or not, my statements regarding you implying TCPview could show connections from rootkits are true. You did imply it." - by cbiltcliffe (186293) on Wednesday July 13, @02:27PM (#36752240) Homepage

No, your reading comprehension obviously sucks... or you skimmed!

Simply because I can show, here, EXACTLY what I said EXPLICITY on this account also where you tried to put words into my mouth I NEVER SAID or even IMPLIED (quoting myself yet again to disprove you):

PERTINENT QUOTE, VERBATIM FROM MYSELF:

"I can watch who/what/when/where/how my system "talks" to other systems online, & if I see one I am NOT talking to? It gets added to my firewall list (by IP address), and the offending unknown interloper malware/botnet gets "BLOWN AWAY" by ProcessExplorer.exe, as I noted in my last post/other post in reply to YOUR last post." - by Anonymous Coward (Myself, APK) on Saturday July 02, @11:35PM (#36644860)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36644860

---

And as to detecting rootkit's presence? I said this

---

PERTINENT QUOTE, VERBATIM FROM MYSELF:

"& in my guide? I post a NUMBER of reliable tools for rootkit detection:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

(And, there you are - TcpView is only for checking WHERE it communicates back to... as a possible way of seeing that, for adding the bogus C&C server destinations to HOSTS &/or Firewall rules tables - that's all!)" - by Anonymous Coward (Myself, APK) on Saturday July 02, @11:35PM (#36644860)

FROM -> http://it.slashdot.org/comments.pl?sid=2282088&cid=36647626

---

Which now after your quoted statement @ the top of my reply here make you look to be either:

1.) ILLITERATE, or skimming

or

2.) Just "trying to get the last word a week later" like a FOOL would when I said nothing of the KIND as you state!

... apk

Hey cbtcliffe good 2C U blown away 2x

[Anonymous Coward]

In a row here http://it.slashdot.org/comments.pl?sid=2282088&cid=36752608 (using your reading comprehension problems & quotes of YOUR WORDS, against you, vs. WHAT I ACTUALLY SAID about TcpView &/or ProcessExplorer (not for detecting rootkits on either one, just for checking usermode malware communications, & removing them respectively))

LOL - You, in your trying to put words in my mouth I never stated is LOSING badly (& you only did that to yourself)

And here too!

http://it.slashdot.org/comments.pl?sid=2282088&cid=36752716

(Where you went off the topic into other "theoretical rootkit methods" because you admitted my technique works vs. the botnet/rootkit @ hand):

AND I EVEN HAVE WORKING VALID METHODS vs. THOSE TOO, using the Windows Install Media or Service Pack files & a CD you burn proper versions on it & repatch your files (even IF a malware can slip past WFP, Windows warnings you are in "TEST MODE", Group Policy protection, or even extra layered protection via bcdedit commandlines I showed)...

* You fail, badly, on all accounts noted - period!

APK

P.S.=> "U FAIL", badly... & mostly because you skim and didn't read what I wrote on TcpView + ProcessExplorer stating I said they were for "rootkit detection" when I never ONCE said that EXPLICITY or inferred it (my own words quoted show that much in the 1st link above too, vs. yours quoted in erroneous reading comprehension difficulties you have)

... apk

This rookit 'Hauls In' usermode malware

[Anonymous Coward]

It's what ProcessExplorer removes & TcpView can see what it talks to, period (I said that EXPLICITLY here many times - you inferred incorrectly & misinterpreted my words also (intentionally I think)) once you destroy the Ring 0/RPL0/kernel mode rootkit (which you admit here that my technique works for vs. this rootkit):

"That's not the TCPview/Process Explorer quote that I referred to" - by cbiltcliffe (186293) on Wednesday July 13, @03:22PM (#36752958) Homepage

Can you show me EXPLICITY stating that ProcessExplorer &/or TcpView are for "detecting rootkits" as you said I did? No, you cannot... period!

Please - DO PROVE OTHERWISE WITH A QUOTE OF MY OWN WORDS IN THIS EXCHANGE & THE SOURCE LINK FOR IT!

(You haven't managed that yet, because you cannot to do it!)

Fact is - I never even IMPLIED they are for "rootkit detection" or removal from Ring 0/RPL0/kernel mode operations of rootkits... only usermode/RPL3/Ring 3 malware operations, period!

And, you can remove usermode malwares then, which once you blow away the rookit in kernel mode?

You can do using ProcessExplorer to remove usermode malware... ( & even TcpView can show communications they use to block out in your firewalls or HOSTS files too!)

Prove otherwise... with a quote of MY OWN WORDS! I proved you wrong with YOUR WORDS and my actual words quoted too! Feel free to do the same to me, but then, I have asked you to many times here... you cannot!

---

"Sure, you said it there, but the one I responded to first, you didn't." - by cbiltcliffe (186293) on Wednesday July 13, @03:22PM (#36752958) Homepage

You've been asked to show myself EXPLICITLY STATING that ProcessExplorer &/or TcpView are for "detecting rootkits"... you can't, I never said it OR implied it... prove otherwise!

You have problems with either your reading, or memory, obviously... go on, show us where I said anything other than what I quoted myself in in the post you replied to, OR what I state above now in this reply to you!

---

"You stated "malware" which implies all malware, in a conversation about rootkits" - by cbiltcliffe (186293) on Wednesday July 13, @03:22PM (#36752958) Homepage

That's YOUR PROBLEM in reading comprehension & inferring that... not mine! I explained THOROUGHLY what I meant many times now, & You blew it... I mean, do I have to TELL YOU that ProcessExplorer &/or TcpView operate in UserMode/RPL3/Ring 3 & can be deceived by Ring 0/RPL 0/Kernel mode rootkits?

Ones I show can be blown away (as this one you admit my technique works perfectly for no less in your own words quoted) & even FURTHER methods using the Windows Install media & Service Pack files for even vs. your rather "off topic theoretical rootkits" too??

APK

P.S.=> Accept it, "U FAIL" vs. myself... badly! Putting words into my mouth I never once stated? POOR JOB OF DEBATE on your part...

... apk

Re:This rookit 'Hauls In' usermode malware

[cbiltcliffe]

Can you show me EXPLICITY stating that ProcessExplorer &/or TcpView are for "detecting rootkits" as you said I did? No, you cannot... period!

Please - DO PROVE OTHERWISE WITH A QUOTE OF MY OWN WORDS IN THIS EXCHANGE & THE SOURCE LINK FOR IT!

(You haven't managed that yet, because you cannot to do it!)

Ok, fine. Since your memory is so short, and you can't seem to remember what you've said, here:

ahref=http://slashdot.org/comments.pl?sid=2282088&cid=36618008rel=url2html-5260http://slashdot.org/comments.pl?sid=2282088&cid=36618008>

This is the quote I originally responded to, which I then didn't find. In this post, you state:

Besides, there isn't a botnet (or even ROOTKIT) I can't deal with effectively for removal anyhow - & I don't use the same tools others do...

Well, @ first I do, & when those fail? Out come the "big guns" in Process Explorer & Recovery Console - & there's nothing I can't "dust" between them...

Yes, you do explicitly state that Process Explorer is a "big gun" for dealing with botnets (or even ROOTKITS).

Let's see...I believe the words are:

Reading comprehensions.....hahaha.....lol...2ez....U FAIL!!

Fact is - I never even IMPLIED they are for "rootkit detection" or removal from Ring 0/RPL0/kernel mode operations of rootkits... only usermode/RPL3/Ring 3 malware operations, period!

You didn't start blathering on about Ring0 vs Ring3 until after I already had you on the defensive and reeling from a couple of well-placed hits. Your first mention of either term was in this post:

http://slashdot.org/comments.pl?sid=2282088&cid=36731660

and that was well after I'd already called you on your statement that I just proved you made, that Process Explorer was useful for removing rootkits.

So now, not only are you putting words in other's mouths, you're also attempting to retroactively put them into your own.

Reading comprehensions.....hahaha.....lol...2ez....U FAIL #2!!

See, the problem is, you've got such delusions of grandeur, that you can't entertain the possibility that you might actually be wrong. Even when it's a certainty.

Re:This rookit 'Hauls In' usermode malware

[cbiltcliffe]

/code fucked up the first URL in my last post.

http://slashdot.org/comments.pl?sid=2282088&cid=36618008

The rest of my comment stands.

U admit my use of RC tools kill rootkit

[Anonymous Coward]

Not ProcessExplorer parts: You are dead in the water right there - so who're U trying to fool? YOU ADMIT RC TOOLS I USE WORK VS. THE ROOTKIT PROCESS PARTS THAT RUN IN RING0/RPL0/KernelMode are RECOVERY CONSOLE TOOLS!

(Not ProcessExplorer - that's just for the usermode ring3/rpl3 parts)

---

"Yes, you do explicitly state that Process Explorer is a "big gun" for dealing with botnets (or even ROOTKITS)." - by cbiltcliffe (186293) on Wednesday July 13, @07:06PM (#36755834) Homepage

Again - The botnet part of it runs in Ring3/RPL3/Usermode, NOT THE ROOTKIT - what have I said I use to kill the rootkit? RC tools (listsvc, disable, fixmbr)...

What have I said I use to kill the malware it hauls in that runs in usermode/ring3/rpl3??

ProcessExplorer!

(But only AFTER you kill the rootkit first, so it cannot deceive ProcessExplorer by API call intercepts)!

What about that is "so difficult for you to understand"? Nothing I suspect...

You are only using it to try to "cover your ass" for putting words in my mouth I never stated once (see my ps below on that account).

First - I stated that I don't use the same tools everyone else does, quoted verbatim, here:

"Besides, there isn't a botnet (or even ROOTKIT) I can't deal with effectively for removal anyhow - & I don't use the same tools others do... Well, @ first I do, & when those fail? Out come the "big guns" in Process Explorer & Recovery Console - & there's nothing I can't "dust" between them... Well, @ first I do, & when those fail? Out come the "big guns" in Process Explorer & Recovery Console - & there's nothing I can't "dust" between them..." - by Anonymous Coward on Wednesday June 29, @09:11PM (#36618008)

Again - Does this rootkit haul in malware that runs in Usermode/Ring3/RPL3? Yes it does!

Recovery Console's 1 part I use (vs. rootkit portions in Ring0/RPL0/Kernel Mode parts)

&

Process Explorer's the other (vs. botnet malware running in Ring3/RPL3/Usermode)...

Once more/IMPORTANT:

1 (RC) is for the rootkit itself, which YOU ADMIT MY TECHNIQUE WORKS VS. THIS ROOTKIT FOR in listsvc, disable, fixbmr - ALL RC TOOLS, not those of ProcessExplorer!

And, Process Explorer is for dealing with the malware's that run in Ring 3/RPL 3/UserMode this rootkit (and others) haul in too!

* WHAT IS IT ABOUT THAT, THAT YOU CANNOT UNDERSTAND?

APK

P.S.=> Lastly: How come you cannot show us a direct quote of my stating that I use ProcessExplorer &/or TcpView to DETECT ROOTKITS as you also stated I said... & I never ONCE did... I didn't even IMPLY it, ever!

(Once more - putting words in others' mouths they never stated is a big FAIL on your end also)

... apk

Re:U admit my use of RC tools kill rootkit

[cbiltcliffe]

What is it about "I use Process Explorer and Recovery Console for dealing with rootkits and botnets" that you can't understand means "I use Process Explorer and Recovery Console for dealing with rootkits and botnets"?

Admit it. You're wrong. You lost. Badly. Your statement that I quoted (which was not stated to be only for Ring3 malware at all, until well after you'd been called on it, and started backpedalling like an ass-covering politician) is as clear as day.

Go back to updating your host file, little boy. There are thousands of malware domains registered daily, and according to a post of yours on another thread, it takes you 30 seconds to add one to your hosts file. Since you're so fond of links back to those posts, even though you apparently cannot understand the very words you wrote, here's the link:

http://it.slashdot.org/comments.pl?sid=1932290&cid=34743648

Well, even 1000 hosts per day is over 20 per minute. You'd better get updating that hosts file, because even if you work on it 24 hours a day, you've got less than 3 seconds per host to get it into your file. If you want to do 2000 per day, you only get 1.4 seconds per host. Get typing!!
And that doesn't even take into account the ones that you have to verify are there, just to make sure you're protected from them.

Maybe you don't get malware because, between the ungodly amount of time you must spend updating that hosts file, and the amount of time you spend trolling and stalking on /., you don't have time to do anything else that could get you infected.

Just out of curiosity, how do you have time to do all that high end programming you claim to do, since hosts file editing and /. trolling is obviously taking up all your time? Or is that why the list of previous accomplishments you're so fond of posting basically ends at 2003? Is that when you had the aneurysm that turned you into the psychotic raving lunatic you are today?

P.S. => That last bit isn't an ad hominem attack. Ad hominem is attempting to invalidate the message due to some unrelated characteristic of the messenger. Your message (at least the part of it I was concerned with, as well as your irrational support of maintaining a hosts file which is provably unworkable) has already been completely invalidated due to being factually incorrect. That makes that last bit, rather than an ad hominem, just a plain old insult.

P.P.S => One more question: when you get all worked up, typing furiously into a /. post box, putting in your irrational formatting, and all the nonsensical b.s. that you do, do you actually start foaming at the mouth? Maybe you should get that looked at.

U admit my use of RC tools kills rootkit part

[Anonymous Coward]

Not ProcessExplorer parts: Thus, You're dead in the water right there - who're U trying to fool? YOU ADMIT RC TOOLS I USE WORK VS. THE ROOTKIT PROCESS PARTS THAT RUN IN RING0/RPL0/KernelMode are RECOVERY CONSOLE TOOLS!

(Not ProcessExplorer - that's just for the usermode ring3/rpl3 parts)

---

"Yes, you do explicitly state that Process Explorer is a "big gun" for dealing with botnets (or even ROOTKITS)." - by cbiltcliffe (186293) on Wednesday July 13, @07:06PM (#36755834) Homepage

Again - The botnet part of it runs in Ring3/RPL3/Usermode, NOT THE ROOTKIT - what have I said I use to kill the rootkit? RC tools (listsvc, disable, fixmbr)...

What have I said I use to kill the malware it hauls in that runs in usermode/ring3/rpl3??

ProcessExplorer!

(But only AFTER you kill the rootkit first, so it cannot deceive ProcessExplorer by API call intercepts)!

What about that is "so difficult for you to understand"? Nothing I suspect...

You are only using it to try to "cover your ass" for putting words in my mouth I never stated once (see my ps below on that account).

First - I stated that I don't use the same tools everyone else does, quoted verbatim, here:

"Besides, there isn't a botnet (or even ROOTKIT) I can't deal with effectively for removal anyhow - & I don't use the same tools others do... Well, @ first I do, & when those fail? Out come the "big guns" in Process Explorer & Recovery Console - & there's nothing I can't "dust" between them... Well, @ first I do, & when those fail? Out come the "big guns" in Process Explorer & Recovery Console - & there's nothing I can't "dust" between them..." - by Anonymous Coward on Wednesday June 29, @09:11PM (#36618008)

Again - Does this rootkit haul in malware that runs in Usermode/Ring3/RPL3? Yes it does!

Recovery Console's 1 part I use (vs. rootkit portions in Ring0/RPL0/Kernel Mode parts)

&

Process Explorer's the other (vs. botnet malware running in Ring3/RPL3/Usermode)...

Once more/IMPORTANT:

1 (RC) is for the rootkit itself, which YOU ADMIT MY TECHNIQUE WORKS VS. THIS ROOTKIT FOR in listsvc, disable, fixbmr - ALL RC TOOLS, not those of ProcessExplorer!

And, Process Explorer is for dealing with the malware's that run in Ring 3/RPL 3/UserMode this rootkit (and others) haul in too!

* WHAT IS IT ABOUT THAT, THAT YOU CANNOT UNDERSTAND?

APK

P.S.=> Lastly: How come you cannot show us a direct quote of my stating that I use ProcessExplorer &/or TcpView to DETECT ROOTKITS as you also stated I said... & I never ONCE did... I didn't even IMPLY it, ever!

(Once more - putting words in others' mouths they never stated is a big FAIL on your end also)

... apk

U admit RC tools part kills rootkit

[Anonymous Coward]

Right here, regarding my use of RC tools listsvc, disable, & fixmbr to KILL THE ROOTKIT PART:

"Will it get rid of an MBR rootkit? Yes. Will it get rid of a driver-based rootkit with a discrete .sys file for the driver? Yes." - by cbiltcliffe (186293) on Tuesday July 12, @03:12PM (#36738656) Homepage Journal

I don't mention ProcessExplorer in my technique on the rootkit portion of this botnet @ all...

NOW, since this rootkit:

---

1.) "Hauls in" other malware for the BOTNET portion running in Ring 2/RPL 2/Usermode?

2.) Once you kill the rootkit part in Ring 0/RPL 0/Kernel Mode, using RC tools which you ADMIT MY TECHNIQUE FOR WORKS ON THIS ROOTKIT/BOTNET COMBINATION (rootkit part)?

3.) Then, you "mop up" using ProcessExplorer once the rootkit's dead, to kill in the malware it hauls in, THAT RUNS THE BOTNET PORTION in Ring 3/RPL 3/UserMode!

---

No, your either trouble in reading comprehension, OR, simply trolling to cover your behind because of your false accusations & mistakes regarding both ProcessExplorer & TcpView stating I said I use them to "detect rootkits", when I use them BOTH vs. botnets & other malware in usermode, period!

Simply/Again, because you admit my technique WORKS FOR KILLING THE ROOTKIT PORTION using RECOVERY CONSOLE TOOLS!

(And I don't use ProcessExplorer for that @ all on the rootkit part)

In fact? Show me where I said I do use ProcessExplorer, explicitly, on the ROOTKIT PORTION of this rootkit/botnet!

Ok??

---

"Go back to updating your host file, little boy." - by cbiltcliffe (186293) on Wednesday July 13, @10:23PM (#36757884) Homepage

First of all? I'm 6' 2" & 230 lbs. currently... that's NOBODIES' "Little Boy" (are you larger? Doubt it!)

Secondly, I just did...

The commit to my HOSTS file now has me guaranteed protected vs. 1,483,950 known bad sites/servers/hosts-domains, botnet C&C servers, bogus DNS servers, & even adbanners in hosts-domain names

(Yes even adbanners on 2 accounts too - as they have been shown as infested with malicious scripts too & they slow you down for what you pay for online in bandwidth)...

So - Can you say the same without such a protective shield that also yields more speed?

Between my HOSTS file & Norton DNS (primary DNS here), and ScrubIT DNS (secondary DNS), & OpenDNS (third DNS), all of them do "filtering"?

* Well...If you're NOT doing the same, you're letting yourself down on protection... as well as speed online you pay for too!

Between HOSTS, DNS servers, & firewalls vs. IP address threats? It's no small wonder I never get infected/infested, & the rest of what's in my highly rated layered security guide for Windows does the rest:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

(Have YOU done a better guide for layered security than that?)

---

"There are thousands of malware domains registered daily, and according to a post of yours on another thread" - by cbiltcliffe (186293) on Wednesday July 13, @10:23PM (#36757884) Homepage

WTF? I never said that # are out there daily... your link doesn't show it either... that's quite old also - what are you doing??

Stalking me via diff. usernames???

The username/person I replied to was "Haedrian" & it is over 7 MONTHS OLD TOO!

---

"Maybe you don't get malware because, between the ungodly amount of time you must spend updating that hosts file" - by cbiltcliffe (186293) on Wednesday July 13, @10:23PM (#36757884) Homepage

I don't get malware, & neither do others I showed the effectiveness of my security guide to who apply it (posted that her

Re:U admit RC tools part kills rootkit

[cbiltcliffe]

(Have YOU done a better guide for layered security than that?)

BWAHAHAHAHAHAH!!!! HOHOHOHEHEHLAOLOLOROFL!!

Wow...let me wipe the tears from my eyes here.....hang on....

BWAHAHAHAHAHAHAHA!

Wow....thanks for the laugh! I'll be chuckling for weeks over that one....

I just read part of your "highly rated security guide" and it's pure comedy gold. Most of it can't be used by anybody who actually uses a computer in a normal way, but aside from that, I then got to the section about running services as LocalService, rather than LocalSystem.

Let me ask you a question: What's the total antecedent to good security?

Any ideas?

I'll tell you: Having programs or services running that are not necessary, have no function, and are not used. Every one is a potential security hole waiting to happen.

Anyway, in this section, you say you've personally tested all these services, and know they run fine under the different account.
One you list for running under LocalService is the Remote Registry service. I can guarantee you that this service does not run properly under LocalService. Sure, it will run, but its entire functionality is nullified, because the whole point of the service is to provide remote access to the registry in domain/remote admin situations, and the LocalService account has no network privileges. So you've got a service running where the entire point of that service is killed by your stupid security permissions, but it's still running, providing the possibility of local exploits, and also taking up resources. So the way you're recommending to set up this particular service, the service provides zero benefit, and significant drawbacks. Yeah...great security advice, there, buddy.

Can you say "STUPID"? I quit reading after such an obvious and fundamental security failure. See, in order to properly secure technology, you have to actually understand what that technology is doing, and how it works. You fail at understanding, so you fail at security.

This service is recommended to be turned off in any security advice I've ever given, except in a domain environment. Maybe you need to go back to school.

FAIL #1

1.) "Hauls in" other malware for the BOTNET portion running in Ring 2/RPL 2/Usermode?
-------
3.) Then, you "mop up" using ProcessExplorer once the rootkit's dead, to kill in the malware it hauls in, THAT RUNS THE BOTNET PORTION in Ring 3/RPL 3/UserMode!

Make up your mind. Is Ring 2 usermode? Or is Ring 3 usermode? You seem to be getting flustered and confused with all the frantic backpedalling you're doing.

"There are thousands of malware domains registered daily, and according to a post of yours on another thread" - by cbiltcliffe (186293) on Wednesday July 13, @10:23PM (#36757884) Homepage

WTF? I never said that # are out there daily... your link doesn't show it either... that's quite old also - what are you doing??

Stalking me via diff. usernames???

Of course not. You're not worth the effort, as you're an ineffectual, intellectually deficient waste of skin.

I simply did a search for "apk troll" on google, to see how long you'd been pulling this BS. It was both enlightening, and hilarious. Seems you can't get into a conversation at all without pissing off just about everybody around you. Maybe that should tell you something.

Now, back to what you quoted me saying:
You've got a parsing error there. Reread it. I didn't say that you said there were thousands of malware domains registered daily. I'm telling you that there are thousands of malware domains registered daily. You obviously didn't know this, because it seems to have caught you completely by surprise. You said that it takes 30 seconds to add a new domain to your hosts file. That means, as I said, if you wanted to even remotely keep up, you'd have to be adding a new domain to your hos

Re:U admit RC tools part kills rootkit

[Anonymous Coward]

You haven't done a better guide 4 windows security than apk and adhominem attacks all you have now? You have failed at every turn and we all know it. When you are reduced to attacking the person rather than his points, you fail. You tried attacking his points on telnet and setting possibly dangerous services to a logon entity that will not allow that potentially dangerous service to run only helps his case. The rest of his guide must be even better because there are around 25 more useful points you can't even begin to touch either. It's hilarious watching you try and seeing apk annihilate you on it each time you try. The big fails you made were trying to put words in his mouth on tcpview and processexplorer saying he said they were for detecting rootkits. You couldn't produce a quote of apk saying that. You fail basic reading comprehension or it only proves you are trolling. Take your pick. You fail either way. The funniest one is when you said apk said he uses processexplorer for killing rootkits. You agreed his method for killing this rootkit works, but he doesn't use processexplorer to do it. Either you are again an illiterate fool, or a troll resorting to trying to twist what others say into complete lies on your end. Either way you fail again. Give up. You are not in his league and never will be which is why he can put up things he's done that help others in security guides or that he's done well and worked for more giants than you ever will in the industry over time. You lose, you fail, and you make us all laugh.

Moved on to BIGGER things (ones you probably use)

[Anonymous Coward]

"Or is that why the list of previous accomplishments you're so fond of posting basically ends at 2003? Is that when you had the aneurysm that turned you into the psychotic raving lunatic you are today?" - by cbiltcliffe (186293) on Wednesday July 13, @10:23PM (#36757884) Homepage

Those were my shareware/freeware days, fresh out of my 2nd degree in CSC in Academia (first was way earlier with MIS minor)... I did well too!

I managed things, decades ago while you were probably STILL IN DIAPERS I wager, & things YOU haven't managed to do, that's certain, lol... and you most likely NEVER will either!

(If you have @ least 5 yrs. of time in this art & science, usually you do 'great things' by then @ least, or, you never will, ever!)

Also as to what I've been doing since those days (& my last noted accomplishments were last year, & 2008 before that, etc. - every once in awhile now, I have time for that stuff even now too!)?

I.E.-> Well - For instance: Ever been a customer of McDonalds, Burger King, or Boston Market? They have franchises out there by the many multiple thousands worldwide internationally...

Guess who wrote part of their Client-Server bump-bar system? Yours truly! I've been a Fortune 100-500 employee full-time or on contract more than a few times since 1994 professionally coding alone in fact!

APK

P.S.=> Still, You putting words in others mouth they never said, as you did to myself, which you ran from proving them? Bogus & lame...

That, as well as screwing up after admitting I use RC tools vs. Ring 0/RPL 0/kernel mode portions of this threat in its ROOTKIT portion which you admitted works, & then saying I use ProcessExplorer to kill the rootkit later when I don't @ all (ProcessExplorer's used for malware it hauls in that runs the botnet portion in Ring 3/RPL 3/Usermode)

  Please... lol!

It's as bad as when you said I use TcpView &/or ProcessExplorer to DETECT ROOTKITS, which you cannot produce a quote of my saying THAT either!

Man... U FAIL, & that's all here in my last post to you with backing quotes from yourself & sources of my words too:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36758338

... apk

U FAIL AGAIN (multiple times, lol)

[Anonymous Coward]

U FAIL #1: - I've been cutting OFF services I don't need since oh, 1994-1995 on Windows-NT based OS, for starters... & you say I haven't apparently (pure comedy GOLD):

"'ll tell you: Having programs or services running that are not necessary, have no function, and are not used. Every one is a potential security hole waiting to happen." - by cbiltcliffe (186293) on Thursday July 14, @06:43AM (#36760610) Homepage

So much for THAT statement from you, & the funniest part is, I can prove it with the ORIGINAL older model of my security guide too, @ Neowin (where it was picked up on in 2000-2001 no less) -> http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text

AND I even noted why I do it, verbatim, here in another copy of the more current guide (same as the ones you saw):

http://www.pcreview.co.uk/forums/secure-windows-2000-xp-server-2003-and-even-vista-make-fun-do-t3511888p3.html

"services cutoffs for speed + security in DETAIL" - by APK

On that very page link url above... lol!

Fact is - Originally, I cut off services I don't need for SPEED though (to not consume RAM, CPU time, &/or other forms of I-O needlessly, but also later for security on the grounds you stated too (double BONUS)).

In fact?

Go over to the TechPowerUp forums also - while doing speed tests & benchmarks there, ScienceMark & WinTune tests?

Well - I showed their forums members how to get another 20%++ out of their scores BY CUTTING OFF SERVICES in our benchmark tests using ScienceMark &/or WinTune... in turn, they showed me how to FULLY OverClock AMD systems (I already knew how to do Intel ones).

---

U FAIL #2: - Why do you *THINK* I put "remote registry" running as a LocalService for? It can still function that way, but not as a SECURITY RISK anymore (I cut it off totally in fact, set disabled actually, but if it were to be activated again by some interloper malware, it'd be SAFE(r) because it was set as "LocalService" logon entity - "get it"?):

"Anyway, in this section, you say you've personally tested all these services, and know they run fine under the different account. One you list for running under LocalService is the Remote Registry service. I can guarantee you that this service does not run properly under LocalService. Sure, it will run, but its entire functionality is nullified, because the whole point of the service is to provide remote access to the registry in domain/remote admin situations, and the LocalService account has no network privileges" - by cbiltcliffe (186293) on Thursday July 14, @06:43AM (#36760610) Homepage

Hence, my point above, lol... SO, that all "said & aside": WHAT WAS YOUR "so-called POINT"?

---

"Of course not. You're not worth the effort, as you're an ineffectual, intellectually deficient waste of skin." - by cbiltcliffe (186293) on Thursday July 14, @06:43AM (#36760610) Homepage

LMAO - post the wrong link & tell another LIE here? Of course... that's just what you do!

---

"I have done some work for Seimens and BMW, though, both of which I'm sure you've heard of." - by cbiltcliffe (186293) on Thursday July 14, @06:43AM (#36760610) Homepage

Let's see, here is a list of mine (both fulltime & contract in LARGE companies, some are Fortune 100-500 over time):

Lockheed Martin (coding)
AXA MONY (forensics & security work)
NEC (coding)
NCR (coding)
CableVision (network technician @ NOC)
BellSouth (during Olympics 1996 contract to setup RAS gateways)
IKON (tech)
Goulds Pumps (coding)
BurgerKing
McDonalds
Boston Market

Re:U FAIL AGAIN (multiple times, lol)

[cbiltcliffe]

Did you check your links?

Well, let's see, your first "proof" link, leads to:

"The page you were looking for could not be found"

Guess neowin didn't think it was important enough to keep around, huh?

And the second leads to a thread that starts out with a section on "securing telnet" that was posted in 2008.

Really? You're trying to secure telnet 3 years ago? Anybody with a lick of sense hasn't been using telnet at all in any environment with secure requirements for well over a decade, and 3 years ago you're giving advice on how to secure this decade-broken, unsecurable protocol?

ULTIMATE FAIL

There's really, absolutely nothing else that needs to be said. You are a complete and total loser when it comes to security. You know nothing. You understand nothing. You are incapable of doing anything technical with any competence whatsoever.

Not only that, but you bitched about my "1 hit wonder" cd (while knowing nothing at all about it) that "must have used other people's software", as if you wrote everything you've ever done from scratch, including all libraries, and probably your own compiler, FFS.
The first section of this thread shows this information actually comes from " a Mr. Markuss Jansson on his point on TELNET service", and "He also has more on things like "EFS" (encrypting filesystem) ".

Not only are you a complete loser, you're a complete hypocrite, also.

(BTW, my CD will let a tech run the recovery console on a machine remotely, over the Internet, with no KVM over IP hardware. No technical knowledge is required by the end user. Network connections, encryption, etc, are all handled automatically. It will also allow remote repair of corrupt filesystems that prevent the computer from booting with an UNMOUNTABLE_BOOT_VOLUME error. It can also do remote investigation on a computer, with forensically sound methods, transferring a hard drive image over the network from a remote PC for local analysis, if required. It can also do a pile of other things, most of which are probably beyond your comprehension. Even if it was the only thing I'd ever done, which it's not, it's so versatile, it could never be called "1 hit".)

The version of your guide that I read was the first link on your Bing search that you're ever so proud of. You know, this one?

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

This is the one I read:

http://forums.pcpitstop.com/index.php?showtopic=150310

This was posted in 2007, so it's not like it's really old, or anything.

In it, you recommend to run the Remote Registry, and telnet (which I didn't notice the first time) as the LocalService Account, rather than LocalSystem. You do not recommend to turn them off, as you claim in your post I'm replying to.
These services require, for their only functionality, to have network access. Running them as LocalService therefore kills their entire useful functionality, while still leaving the service running, taking resources, slowing the system down, and potentially offering local exploits.

Why do you *THINK* I put "remote registry" running as a LocalService for? It can still function that way,

But that's the whole point. It can't function that way. Its function requires network access, which running as LocalService denies. It will not work for it's intended function. Same with telnet. Both services cannot function that way, at all.

but if it were to be activated again by some interloper malware, it'd be SAFE(r) because it was set as "LocalService" logon entity - "get it"?):

Ok..so let's assume for now that you completely messed up your security guide, and you actually meant to have people turn this service off, whi

Proof of my cutting services 4 speed/security

[Anonymous Coward]

"Read 'em & weep" & from as far back as 1997 -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml

(In fact, I was one of, IF NOT *THE* FIRST PERSON DOING IT OUT THERE + telling others to do so, for speed AND SECURITY GAINS, & have documented PROOF of it right there from "the wayback machine")

And, You're trying to "preach to me" on how/why it's done?

LMAO - UTTERLY Hilarious!

"I'll tell you: Having programs or services running that are not necessary, have no function, and are not used." - by cbiltcliffe (186293) on Thursday July 14, @06:43AM (#36760610) Homepage

You're "preaching to the choir" boy... &, I mean *THE* choir on THAT ACCOUNT (the original, here).

* Unbelievable...

(You are really messed up and cannot read properly, & say things that are such TOTAL bullshit, without thinking WHO IT IS YOU'RE SPEAKING TO, that it's unreal!)

MOST especially In THAT area?

I am probably THE ORIGINAL LITERAL AUTHORITY & can show it from way, Way, WAY BACK in time no less as I have now!

---

"While you've been reading this post, 43 new malware domains have been registered that you missed putting in your hosts file, because you were reading this post, instead. You're vulnerable. OH NOES!!!!" - by cbiltcliffe (186293) on Thursday July 14, @06:43AM (#36760610) Homepage

I don't miss any from 17 reputable & reliable sources for HOSTS &/or DNSBL data, and I don't even have to raise a finger anymore since I wrote the Python program automator of it for myself...

See - in case you haven't noticed and I doubtless doubt you have, since you've shown your reading comprehension sucks?

Since we've been in this debate for a few days now??

I've added like 4,000++ new known bad sites/servers/hosts-domains (and IP addresses to my firewall rules tables in software (Windows native one)) to my HOSTS file & I tend to post the # of blockages each time I post it...

It happens here, completely "AutoMagically" too, since I automated it years ago (Delphi first) & then into Python code (multiplatform too) months back!

(Yes - U FAIL AGAIN, per your usual, on ALL accounts noted, & with proofs showing, like below in my p.s. as well!)

APK

P.S.=> Still, You putting words in others mouth they never said, as you did to myself, which you ran from proving them? Bogus & lame...

That, as well as YOU screwing up after admitting I use RC tools vs. Ring 0/RPL 0/kernel mode portions of this threat in its ROOTKIT portion which you admitted works, & then saying I use ProcessExplorer to kill the rootkit later when I don't @ all (ProcessExplorer's used for malware it hauls in that runs the botnet portion in Ring 3/RPL 3/Usermode)

Please... lol!

It's as bad as when YOU said I use TcpView &/or ProcessExplorer to DETECT ROOTKITS, which you cannot produce a quote of my saying THAT either!

Man... U FAIL there and YET AGAIN HERE TOO, & that's all here in my last post to you with backing quotes from yourself & sources of my words too:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36758338

... apk

U fail & have U done more/better/earlier? No

[Anonymous Coward]

An even earlier link, from 1997-2001:

http://it.slashdot.org/comments.pl?sid=2282088&cid=36761268

From "The wayback machine" no less...

"Guess neowin didn't think it was important enough to keep around, huh?" -

No biggie, it went on to "bigger & BETTER things:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

Much bigger & MUCH better... as well as more comprehensive: AND YOU CERTAINLY HAVE NOT DONE BETTER, now have you? Nope...

---

"Really? You're trying to secure telnet 3 years ago? Anybody with a lick of sense hasn't been using telnet at all in any environment with secure requirements for well over a decade, and 3 years ago you're giving advice on how to secure this decade-broken, unsecurable protocol?" - by cbiltcliffe (186293) on Thursday July 14, @10:10PM (#36771200) Homepage

Actually, that's a remnant of my OLDEST guide, see link @ the top, from 1997-2001, but, it's there "just in case", that's all... so, your "point" is again, moot.

AND YOU CERTAINLY HAVEN'T DONE BETTER YOURSELF IN SUCH A GUIDE, now have you?? Nope again...

---

"The first section of this thread shows this information actually comes from " a Mr. Markuss Jansson on his point on TELNET service", and "He also has more on things like "EFS" (encrypting filesystem) ". - by cbiltcliffe (186293) on Thursday July 14, @10:10PM (#36771200) Homepage

Yes, but the other methods are mine... & they work, just as his do. The point was NEVER ABOUT MYSELF, it was to help others vs. the possibility of attack on any front I could think of... that's all!

And, of course, once more - YOU CERTAINLY HAVEN'T DONE BETTER YOURSELF IN SUCH A GUIDE, now have you?? Nope yet again...

---

"In it, you recommend to run the Remote Registry, and telnet (which I didn't notice the first time) as the LocalService Account, rather than LocalSystem. You do not recommend to turn them off, as you claim in your post I'm replying to." - by cbiltcliffe (186293) on Thursday July 14, @10:10PM (#36771200) Homepage

NO, it's stated to turn it to "manual" which unless you INVOKE IT, does not run... trying to put words in my mouth I NEVER SAID YET AGAIN?

(You're so dumb you can't be real... lol, the "2 prime examples" of you doing that earlier are in my p.s. below & U RAN FROM THEM!

LMAO!

---

"But that's the whole point. It can't function that way. Its function requires network access, which running as LocalService denies. It will not work for it's intended function. Same with telnet. Both services cannot function that way, at all." - by cbiltcliffe (186293) on Thursday July 14, @10:10PM (#36771200) Homepage

Which IS MY POINT - to secure them, even if "set to manual", those services cannot be accessed remotely if set to another logon entity (in this case, LocalService).

So once again like usual, your "so-called point"? Moot & nullified, easily...

---

"let's assume for now that you completely messed up your security guide, and you actually meant to have people turn this service off, which is not at all what you said" - by cbiltcliffe (186293) on Thursday July 14, @10:10PM (#36771200) Homepage

No, let's not ASSUME anything - I show folks how to effectively nullify potentially dangerous services is all, & you even ADMIT that my methods do so, easily enough!

(This is your "big problem", you ASSUME things (see my p.s. below, those are your two HILARIOUS blunders!)).

---

"You really do have no comprehension of reality at all"

RU protected vs. @ least 1,493,325++

[Anonymous Coward]

KNOWN bad sites/servers/hosts-domains, botnet C&C servers, & bogus DNS servers? I am, guaranteed...

Via layered security at the HOSTS file level alone!

The rest is done by:

Norton DNS (filters the SAME STUFF as my hosts does)

OpenDNS (another DNSBL filtering DNS system)

ScrubIT DNS (yet another filtering DNS system)

Firewall rules tables vs. IP address based examples of the same here...

My layered security guide's practices as well:

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

Which produce results the likes of these testimonials attest to:

---

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)

SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

AND

"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3

"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRONKA, user of my guide @ XTremePcCentral

AND

http://forums.theplanet.com/index.php?s=80bbbffc22d358de6b01b8450d596746&showtopic=89123&st=60&start=60

"the use of the hosts file has worked for me in many ways. for one it stops ad banners, it helps speed up your computer as well. if you need more proof i am writing to you on a 400 hertz computer and i run with ease. i do not get 200++ viruses and spy ware a month as i use to. now i am lucky if i get 1 or 2 viruses a month. if you want my opinion if you stick to what APK says in his article about securing your computer then you will be safe and should not get any viruses or spy ware, but if you do get hit