Archive for Malware – Page 4

GoDaddy Services Down

Go Daddy

Earlier this afternoon (Monday Sept 10, 2012) GoDaddy acknowledged via their Godaddy Twitter site that they are experiencing a major outage. GoDaddy-registered web sites are offline.  At around 4pm (EST) they tweeted the following:

GoDaddy Update: Still working on it, but we’re making progress. Some service has already been restored. Stick with us.

As far as I can tell, this outage does not affect any sites that are just using GoDaddy’s SSL certificates.

Windows Defender Offline Error 0x80508007

Microsoft’s Windows Defender Offline (WDO) product should be in the toolkit for every I.T. technician. If you are trying to run this on a very old Windows XP computer with less than 768KB of memory, WDO will display error 0x80508007 when starting up.

The error message displayed does not tell you what’s wrong, but the cause is not enough memory. WDO requires a minimum of 768KB of memory.

Microsoft’s article KB 2520970 includes a list of error codes you may encounter.

Get Data Back from Crashed Drive

You know the drill – someone calls you in a panic because their computer won’t reboot. You ask if they’ve been experiencing problems recently. And they go on to tell you how the computer had been crashing more frequently of late, and that sometimes they have to reboot it several times, etc, etc, etc!

I had a neighbor who stopped me and said “You’re the computer guy, aren’t you?”. Long story short, his computer had been acting up and finally would not boot. He had two different people/places take a look at the drive and declared that the drive was dead and the data was not recoverable. One of those people said that he had a vast array of expensive tools at his disposal, and could not do anything with the drive.

I asked if I could take a look at it. I brought the drive back to my workbench, hooked it up to a computer, and ran my trusty GetDataBack utility from Runtime Software. Sure, it took 4 hours to run, but once it did, it located over 800 documents, photos and music files!

image

Don’t let the $79 price scare you away. Unlike a lot of software, this is a one time $79 price with free lifetime updates! If you’re an I.T. technician, you should have this in your I,.T. toolkit!

Yes, I have also heard of the trick of putting the drive in a sealed air-tight bag and put it in the freezer for 15 minutes. I’ve tried that several times, without success.

Finally, my good MVP buddy Mick from Down Under suggested looking at some of the freeware offered by MiniTool. I’ll write more about those in another blog post.

WHS Restore, 64 bit workstations and Realtek

I have Microsoft Windows Home Server (WHS) installed in the majority of my customers, both business and residential. WHS is great as a full image backup solution for these environments. Restoring a computer whose disk has crashed, or has been overrun with malware/viruses, is usually a piece of cake.

But there are certain steps required, especially if the workstation you are restoring is running a 64 bit version of Windows O/S (Win 7/64, Vista/64)

Pre-Requisites:

  • Windows WHS Restore Computer Wizard CD
    • Note: make sure you have the Computer Restore CD and not the Server Restore CD!
    • If you cannot find your CD, you can download the latest here, and burn it to a CD.
  • USB 2.0 Thumb Drive
    • I suggest having two thumb drives, one for the WHS Restore Folder, and one for the vendor-specific NIC card driver
  • Access to another workstation on the network that is also connected to the WHS server
  • Knowledge of the make/model of the installed NIC card on the workstation, and access to the NIC card vendor’s website.
    You can find out your NIC card device by accessing Device Manager.

    • Click Start –> Run –> and type in: mmc devmgmt.msc
    • Click Device Manager, then drill down Network adapters
      image

Process (Summary):

  • Download the WHS Home Server Drivers for Restore to a USB thumb drive from a  working computer
  • If workstation is running Win 7/64 or Vista/64, download appropriate 32-bit NIC driver from vendor site onto a USB thumb drive
  • Replace hard drive in the computer, if required
  • Boot from the WHS Restore CD
  • At the Detect Hardware screen, load in drivers from USB stick
  • Follow the prompts to restore the computer

Process (Details):

Download Restore Folder to USB thumb drive:

  • From another workstation, right click on the WHS icon on the lower right of the task bar, then click Windows Home Server Console.
  • Click on Computers & Backup, locate the computer to be restored, right click on it and then click View Backups.
  • Select the backup you want to restore from, and click Open from the ‘Restore or View Files from:’ section.
  • Now copy or drag the entire contents of the folder named Windows Home Server Drivers for Restore to your USB thumb drive.
  • We will call this USB Thumb Drive #1.

Obtain 32-bit NIC card drivers:

  • Question: if I’m restoring a 64-bit workstation, why do I need to download a 32-bit driver for the NIC card.
  • Answer: The WHS Restore CD itself is running in 32-bit mode. The 64-bit driver stored within the Windows Home Server Drivers for Restore folder is the 64 bit driver, and won’t work when doing the restore process.

Example:

  • In my case, the workstation that needs to be restore has a Realtek PCIe Gigabit Family Controller network card installed.
  • Go to the Realtek website, click on Downloads
  • Click on Realtek PCIe GBE Family Controller Series Drivers from the Quick Links section on the right.
  • Locate and download the WinXP/Win Server 2003 Driver to your computer. I created a folder called Realtek Drivers for this purpose.
    image
  • Unzip the download file and copy it to a second USB thumb drive.
  • We will call this USB Thumb Drive #2.
    image

Perform the WHS Restore:

Boot from WHS Restore CD:

  • Boot up the computer using the WHS Restore CD.
  • You will be prompted to select the appropriate memory configuration.
  • It will take a few minutes for the Restore CD to load and run.
  • You will eventually be asked to confirm time format and keyboard.
  • Click Continue.

Detect Hardware:

  • Now we come to the all-important Detect Hardware screen.
  • Click Details.
  • Plug in USB Thumb Drive #1 into the computer, click Install Drivers and then click Scan.
  • Once that is completed, repeat the process with USB Thumb Drive #2.
  • Once drivers have been installed click OK.

Proceed with Restore:

  • At this point, we should be ready to rock-n-rill.
  • You will get the Welcome to the Restore Computer wizard.
  • You will be prompted for the WHS server password.
  • You will confirm which computer you are restoring, and which backup to use.
  • If restoring because of virus or malware, you will want to select a backup dated prior to the infection.

Good luck!

Here’s a link to another web site showing the step-by-step screenshots of restoring a computer using WHS:
http://www.howtogeek.com/?post_type=post&p=12642

July 9 Malware Alert

Note: This is a slightly revised and updated version of my blog post from 4/23/2012

There have been many reports that on July 9, 2012 there is the possibility of a widespread Internet blackout due to the FBI shutting down several rogue Internet DNS servers. When that happens, any computer previously infected from these rogue servers will lose access to the Internet. You can read more about the details of threat and the cause  at the FBI website.

There’s good news and even more good news.

The first good news is that the FBI identified this threat late last year and immediate took steps to clean up and lock this threat from doing any real damage. And, as long as you keep your computer up-to-date with virus & malware protection, you should be good.

The second good news is that you can do an immediate test to see if your computer is infected with this rogue software! Just click on this website link below to perform a quick check your computer:

http://www.dns-ok.us/

Please note – the website listed above may be heavily accessed this weekend. If you get a “page cannot be displayed”, press the “Refresh” button on your browser, or try again in a few minutes.

No software is installed and no changes to your computer is made. You will get either an immediate Green (good) or Red (infected) message.

If you are infected, the website will explain how to fix it, or you can contact me for assistance.image

LinkedIn Security Breach

Please do not take this lightly!

LinkedIn reported today (June 6, 2012) that a list containing 6.5 million encrypted passwords of LinkedIn users was stolen and posted to the Internet. They say hackers are busy trying to unencrypt these passwords.

I strongly encourage you to go to LinkedIn’s website and change your password ASAP. For more information, please read this PCWorld article on the security breach.

Windows Defender Offline

Microsoft recently released Windows Defender Offline (WDO), which is a standalone CD/USB bootable rootkit/malware scanner program. If you have a computer that will not start up properly because of malware, try WDO.

WDO is essentially the new name for the Microsoft’s Standalone System Sweeper (MSSS).

There are separate versions of WDO for scanning 32-bit and 64-bit systems. From a “good” computer, download the appropriate version of WDO and run the executable. It will prompt you to install it on a CD, create an ISO image, or create a bootable USB stick. You can then use the CD/USB on the infected computer.

WDO can be used to scan Windows XP (SP3), Vista, and Windows 7 systems.

My recommendation for I.T. technicians is to grab two USB sticks, and install the 32 bit version on one, and the 64 bit version on the other, and keep them in your toolkit.

One nice thing with WDO is that if the infected computer does have internet access, when you boot up WDO, it will go out and look for updated definition files.

Finally, you may find Microsoft Resources and Guidance for Removal of Malware and Viruses helpful.

DNS Changer Malware Check-Up

I will keep it simple, without a lot of detail. On July 9, 2012 there is the possibility of a widespread Internet blackout due to a malicious piece of software that is lying dormant on many computers. You can read more about it at the FBI website: http://www.fbi.gov/news/stories/2011/november/malware_110911.

The good news is that you can do an immediate test to see if your computer is infected with this rogue software! Click on this website link: (http://www.dns-ok.us/) to quickly check your computer. No software is installed and no changes to your computer is made. You will get either an immediate Green (good) or Red (infected) message. If you are infected, the website will explain how to fix it, or you can contact me for assistance.

image

Watch out for those Fake Emails

I have alerted my customers several times in the past few months to be on guard against fake emails. These fake emails appear to come from your bank, from the IRS, from PayPal, from FedEx, or one of your credit cards.

Generally these emails are telling you that a payment you just made is being processed. Here’s an example of one I received today.

One way to tell if it’s a fake email is to hover your mouse over one of the links. The popup window should display the “real” location of where it will take you if you click on the link.

Two things in the example below:

(1) You would think that an email from Paypal would be taking you to a PayPal.com web site, but not in this case!  Take a close look – it’s taking me to a website “air-maxes-shop.com”.

(2) the URL displayed in the box is not even using an https protected address, but an unprotected http site.

So, please be vigilant! The best suggestion I can make is that if you cannot tell if the email is real or fake, then do NOT click on any links within the email. You can always call the company (IRS, FedEx, Bank, etc.) and speak to someone to clarify if this is a real or fake email.

image

MalwareBytes Crashing

For those of you who use MalwareBytes, you should be aware they just came out with a new version (1.60.xx) and a new database definition naming convention. I’ve installed it on several systems with no problems.

But tonight I was working on a system, and did the regular in place upgrade of MalwareBytes. However, upon completion of the update process, MalwareByrt crashed on start up. Rebooting the computer did not help. So I uninstalled MalwareBytes, rebooted and then installed it clean. It still crashed on startup.

Fortunately, a quick Internet search identified that several other people had encountered this same issue with the new version of MalwareBytes. Fortunately, someone had a fix to the problem. I was not aware that MalwareBytes had their own standalone uninstall/cleanup utility program. So I downloaded it, ran it, rebooted, reinstalled MalwareBytes and now it starts up fine.

Here’s the link to the cleanup utility, straight from MalwareBytes’ web site:
http://www.malwarebytes.org/mbam-clean.exe.