Month: October 2007

We found something interesting recently — a variant of the Zlob fake codec which checks to see if you’ve visited a number of sites. Now, this isn’t unusual, but one thing we did see was the addition of the SunbeltBlog.

What does this mean? If the Trojan sees that Sunbeltblog has been visited, it won’t pull down extra malware.

The Trojan contains two exportable functions:

1. GetVerID
Returns the version of the Trojan installer to the Trojan installer script by reading it from the installer executable file.

2. CheckIEHistory
Calls the function which lists URLs from the ‘visited’ browser cache.

It checks for a number of addresses, such as ?ozyfrog(dot)com, adultchamber(dot)com, askdamagex(dot)com… and sunbeltblog.com.

If none of these addresses are found in the browser cache, it will search for them in the following registry key:
[HKCUSoftwareMicrosoftInternet ExplorerTypedURLs]

If any of the addresses are found, then the installer script will return “1” as the string variable. If none of the addresses are found, then “0” will be returned”. If 0 is returned, then the Trojan makes an http get request to download the additional malware components.

One can speculate that the Trojan looks for the other sites to possibly protect certain affiliates (who don’t want to have the extra malware coming down to their users). But the addition of the Sunbeltblog is interesting, as this blog has historically been quite vocal on the subject of fake codecs. Perhaps they don’t want readers of the blog (many of whom are in the security space) to get the “additional” features…

If you read the blog / you won’t get zlob.

Alex Eckelberry

Vista Downgrade Followup
Last week, we reported that Microsoft is allowing PC makers to provide an XP downgrade to users who want them for new computers that have certain versions of Vista installed. Now we have a few more specifics. Here’s how it works: if you buy a computer from Dell, HP or Lenovo that comes with Vista Business or Ultimate edition, you can request that an XP recovery disk be included with the purchase. You may have to pay $15-20 for the recovery disk (although if you complain enough, you might even get it for free). More here.

First Looks at Vista SP1
Some brave souls have already installed Service Pack 1 and not all of them had the same bad experience as Chris Pirillo (shown in the link at the end of this week’s Followup segment). According to several reports, SP1 improves performance on Vista machines; that will be a welcome change. We recommend that the average user wait until the service pack is in final release, but if you’d like to get a look at some screenshots showing minor interface changes made by the beta, click here.

How to get around the new sig line restrictions in Outlook 2007
A recent article in the Network World Security Strategy newsletter discusses one of the changes in Outlook 2007 that has some users unhappy. In past versions, you could use the signature feature to create a lot more than just sigs. You could construct boilerplate messages, for instance, and then just select them from the signatures list to insert them into messages. You might want to insert several such boilerplates into a single message (as well as your real sig line).

This doesn’t work in Outlook 2007, because suddenly you’re only allowed one sig per message. If you insert a signature, then select and insert a different one, the second one replaces the first. I actually like this feature because it prevents having to then highlight and delete the first one – but I only use signatures as signatures, not as boilerplate. I think Microsoft should have made it user configurable so you could choose whether to replace or add.

Meanwhile, you can still use boilerplate (and in my opinion, more effectively) by using Outlook 2007’s “Quick Parts” feature. Here’s how:

1. Open a new message window and click the Insert tab.
2. Type the text you want to set as a boilerplate in the message body and highlight it.
3. Click Quick Parts in the Text section of the ribbon, and then select Save Selection to Quick Parts Gallery. Give it a name to identify it.
4. Now whenever you want to insert that same block of text in any message, just click Quick Parts and choose the name you gave it. It will be inserted into your new message.

Photo Email wizard closes when you try to send a picture
You can send photos directly from Windows Live Photo Gallery via email in XP or Vista, but if you attempt to do so and the windows closes instead of sending the pictures, it may be because you haven’t set a default email program. To find out how to do so, see KB article 939812.

Slow performance when viewing certain files in Windows Live Photo Gallery
If you try to view multipage .tiff files in the Windows Live Photo Gallery with XP or Vista, you may find that system performance slows down and memory usage goes way up. What’s up with that? It has to do with the precaching feature, and to fix the problem, you may need to disable precaching. You can find out how in KB article 939815.

Deb Shinder

XP Downgrade Option May be Available from Some PC Makers
Want to buy a new computer but don’t want to go to Vista yet? One solution is to buy the Vista machine, format the hard disk and install XP yourself; most any computer powerful enough to run Vista will run XP with no problems. However, some folks aren’t comfortable with doing that, or don’t want to pay for a copy of XP when they’ve already paid for Vista as part of the price of the new computer. Word’s out this week that Microsoft has agreed to allow PC manufacturers to offer a “downgrade” option to customers who buy Vista Business or Ultimate machines. Read more here.

Take Total Control over Windows XP with TweakAll 3.0
Those of you who are real Windows XP tweakers and tuners are always looking for something to help you take total control over your computer. If you’ve tried programs like TweakUI then you’re ready to move up to the next level. Try out TweakAll if you want to control hundreds of settings that would otherwise require you to enter the Registry and suffer the risk of making a typo! I’ve been playing with it on my Windows XP Pro computer and it’s the good stuff. Download it free here. Link to the classic PowerToys and TweakUI here.

Save Desktop Settings Before a Crash
If you spend a lot of time arranging the files and folders on your desktop you’ll really appreciate this tip. You might have noticed that if you set up your desktop in a certain way, it stays that way after you reboot. But if you’re forced to reboot by a system crash, all the changes you made to your desktop are lost. Not good! Save those desktop settings before a crash loses them by right clicking on the desktop and clicking the Refresh command. Now your desktop settings will remain intact even if you crash later.

Getting XP Back to a Working Configuration
Every week we get a few questions from people who’ve noticed that something isn’t working the way it used to. If you notice that something in your Windows XP setup isn’t working right anymore, maybe what you need to do is “roll back” to a time when things did work. You can do this with the System Restore Tool. System Restore won’t overwrite your data (as long as you keep it in the My Documents folder) and can bring your machine back to where it was when things worked. Try this:

1. Click Start and point to All Programs. Point to Accessories and then point to System Tools. Click System Restore.
2. The first page is the Welcome to System Restore page. Read the info on this page. Make sure the Restore my computer to an earlier time option is selected and click Next.
3. On the Select a Restore Point page, pick the most recent date where things worked. This might take some guessing, but if you’re wrong, you can always pick another date or even return to where you are. Click on a date and click Next.
4. On the Confirm Restore Point Selection page, read the dire warnings and description of what’s going to happen. When you’re ready, click Next.

The computer configuration is restored. You might have to restart the computer. If you guess right about the date when things worked, then everything should work again. Note that if you installed any programs after the date of the restore point you used, you’ll have to reinstall those programs.

Windows Live Search 2.0 is right around the corner
The next version of Windows Live Search is to be officially unveiled later this week at the “Searchification” event sponsored by Microsoft in California, but some early screenshots have already been leaked to the Web and it looks as if we can expect some major improvements in search results. Get a sneak preview here.

And the Bott goes on: Ed continues to debunk the Vista DRM myths
We’ve reported before on the ongoing discussion some of our friends over at ZDNet have been having regarding a widely distributed paper by Peter Gutmann that many have taken as the gospel condemning Vista’s Digital Rights Management technology. For the most comprehensive counter arguments to Gutmann’s position, see Ed Bott’s three-part article titled “Everything You’ve Read about Vista DRM is Wrong.” Start here with Part One.

Windows Vista Hardware Assessment 2.1
The Windows Vista Hardware Assessment Solution Accelerator is an inventory, assessment, and reporting tool that will find computers on a network and determine if they are ready to run the Windows Vista(tm) operating system or the 2007 Microsoft Office System. This is an especially handy tool for network administrators who need to find out how many new PCs they’ll need to buy to run Windows Vista.

Windows Fax and Scan makes things easy
Windows Fax and Scan, available in the Business, Ultimate, and Enterprise editions of Windows Vista, makes it very easy to send and receive faxes, scan documents and images, and share those items with others-right from your computer. Whether you are a home user or a business professional in a small or medium-size business, the new enhancements in Windows Fax and Scan can help you send information, handle documents, and save time. I think you’ll love Vista Fax and Scan if you’ve ever had to fight with your integrated fax and scanner to get it to work with Windows – it’s truly plug and play!

How to publish photos to the Web from XP
You can publish pictures to the web directly from a scanner or digital camera with Windows XP. Here’s how:

1. Click Start, then click My Pictures.
2. In the left pane, click Get picture from camera or scanner.
3. Click Next on the Welcome to the Scanner and Camera Wizard page.
4. Go through the wizard until you get to the Select a Picture Name and Destination page. Type the picture name and set your preferences.
5. On the Other Options page, click Publish these pictures to a Web site.
6. Click Next. On the Change your file selection page, then click the files you want to publish.
7. Click Next and on the Where Do You Want To Publish These Files page, choose your preferred Internet Service Provider (you might need to create an account at this point).
8. After the transfer is complete, you will see the Completing the Scanner and Camera Wizard page. At the bottom of the window is a link showing the location from which the pictures were uploaded. Note the location and then click Finish.

Critical Security Flaw in Acrobat Reader affects Windows, Linux and Mac
A security flaw has been discovered in Adobe’s Acrobat Reader, which is installed on a huge number of PCs. The vulnerability allows attackers to compromise Windows computers, including XP SP2 and Vista, as well as Linux and OS X systems. This problems affects Acrobat Reader versions 7, 8.0 and 8.1. An attacker can use the exploit to automatically run an executable program on your computer if you open a PDF file that’s been crafted to do so. Read more here.

Can I make the Vista Start Menu look like XP’s?
QUESTION: I know that Vista is the cat’s meow and is tons more secure than Windows XP or any other operating system, but I’ve been using Windows 2000 and Windows XP for years and I don’t really like changing the way I do things. Last week you told us how to make Windows Explorer look more like XP’s. Well, the Vista Start Menu looks really cool, but I like the old Start menu a lot better. Is it possible to get my tried and true Start Menu back again? Thanks! — John Q. Luddite

ANSWER: Yes! Of course you can have your old Start Menu back. Right click the task bar and click Properties. In the Taskbar and Start Menu Properties dialog box, click the Start Menu tab and select the Classic Start Menu option. You can then click the Customize button to get it working the way you had it with your Windows XP computer.

You cannot uninstall Windows Vista by using the “Uninstall a program” option of the Programs and Features Control Panel tool
You upgrade Microsoft Windows XP to Windows Vista. After you upgrade, you cannot uninstall Windows Vista by using the Uninstall a program option of the Programs and Features Control Panel tool. This problem occurs because Windows Vista does not provide the Uninstall Windows Vista option in the Uninstall a program option of the Programs and Features Control Panel tool. To resolve this problem, check out KB 925809.

You cannot connect to a Cisco ASA Series VPN server by using an L2TP/IPsec-based VPN connection in Windows Vista
You cannot connect a computer that is running Windows Vista to a Cisco ASA Series VPN server by using a virtual private network (VPN) connection that is based on the “Layer 2 Tunneling Protocol with IPsec” (L2TP/IPsec) protocol. This problem occurs if another Windows Vista-based computer is already connecting to the VPN server through a L2TP/IPsec-based VPN connection. You cannot connect to the VPN server until the other computer disconnects from the VPN server. This behavior does not occur on a computer that is running Windows XP or Windows Server 2003. This KB article explains the problem, here.

Windows Vista displays the incorrect dedicated video memory size for certain display adapters
Windows Vista displays the incorrect dedicated video memory size for certain display adapters. The incorrect dedicated video memory size appears in the system display settings and in the Windows System Assessment tool. This problem occurs if the dedicated video memory size is not a power of 2. For example, if a display adapter has 320 megabytes (MB) of dedicated video memory, Windows Vista shows that only 256 MB of dedicated video memory is available for the display adapter. Get the hotfix here.

Cumulative time zone update for Microsoft Windows operating systems
Starting in the spring of 2007, daylight saving time (DST) start and end dates for the United States will transition to comply with the Energy Policy Act of 2005. DST dates in the United States will start three weeks earlier, at 2:00 A.M. on the second Sunday in March. DST will end one week later, at 2:00 A.M. on the first Sunday in November. This is a cumulative update that all DST and other time zone changes since the last release of the DST update. Even if you previously installed a time zone update, you should get this latest update.

Windows Easy Transfer Companion
Windows Easy Transfer Companion transfers your programs from your Windows XP- based PC to your new Windows Vista based-PC. Easy Transfer Companion is designed to be used in addition to Windows Easy Transfer, and can transfer the programs with either an Easy Transfer Cable or a network. Easy Transfer Companion is currently available in Beta version for the U.S. English market. Download the beta version of Windows Easy Transfer Companion here.

Vista Windows Explorer is Driving Me to Drink!
QUESTION: The Windows Vista Explorer is driving me to drink! It’s bad enough that they took away the lines that connected the folders to each other, but something that’s really sending me over the edge is that absent menu bar! I’ve had menu bars ever since DOS 5.0. I need them! Please tell me that there’s hope for me. Thanks! – Jim from Peoria.

ANSWER: I have good news for you Jim, there is hope! Open Windows Explorer and click the Organize button. Hover over the Layout command and click on Menu bar. Voila! Now you have menus again.

Enabling Vista Search for Compressed Archives
QUESTION: I keep a lot of information in zip files on my Vista computer. The problem is that when I’m doing a search for information on my computer, the search doesn’t look into the .zip files. Is there anything I can do to make Vista search inside zip files? Thanks! -Larry from Sonoma.

ANSWER: Yes! You can configure Vista to search inside .zip files. Open Windows Explorer and click the Tools menu and then click Folder Options. Click the Search tab in the Folder Options dialog box. On the Search tab, put a checkmark in the Include compressed files (ZIP, CAB, …) checkbox in the When searching non- indexed locations section. Click OK. Now Vista search will check the contents of your zip files when doing a search.

Availability of the Windows Vista Secure Digital (SD) rollup package
Secure Digital (SD) cards are getting increasingly popular. You can use them to store information and share that information across a wide variety of devices. Here’s an update that will allow you to use larger SD cards, and also allow you to use a new type of SD card, called SDIO cards. Get the update here.

A Windows Vista-based computer stops responding when you resume the computer from hibernation
A Windows Vista-based computer stops responding when you resume the computer from hibernation. Note that this problem may occur if a system device configuration changes when the computer is in hibernation. This problem occurs because the Peripheral Component Interconnect (PCI) device driver does not correctly update the device settings to reflect the new configuration. If you’re having this problem, download the hotfix here.

Windows Vista cannot obtain an IP address from certain routers or from certain non-Microsoft DHCP servers
This issue occurs because of a difference in design between Windows Vista and Microsoft Windows XP Service Pack 2 (SP2). Specifically, in Windows XP SP2, the BROADCAST flag in DHCP discovery packets is set to 0 (disabled). In Windows Vista, the BROADCAST flag in DHCP discovery packets is not disabled. Therefore, some routers and some non-Microsoft DHCP servers cannot process the DHCP discovery packets. To fix the problem, follow the steps here.

A USB telephony device that is installed on a Windows Vista-based computer is unexpectedly set as the default audio device
After you install a universal serial bus (USB) telephony device on a Windows Vista-based computer, this device is unexpectedly set as the default audio device. The USB telephony device can be a USB telephone, a USB handset, or a USB headset. This behavior occurs even though other audio devices are already installed on the computer. In this situation, the computer cannot correctly play media or record media. If you’re having this problem (we have), then go this link to download a fix.

Deb Shinder

Long arm of the law nabs Media Motor adware scammers:

Operators who infected more than 15 million computers with destructive, intrusive spyware will give up $330,000 in ill-gotten gains from their venture to settle FTC charges that their scam violated federal law. The settlement will bar the defendants from downloading software onto consumers’ computers without disclosing its function and obtaining consumers’ consent prior to installation, bars them from downloading software that interferes with consumers’ computer use, and bars false or misleading claims.

In November 2006, the FTC charged ERG Ventures, LLC and its principals with tricking consumers into downloading malevolent software by hiding the Media Motor program within seemingly innocuous free software, including screensavers and video files. Once downloaded, the Media Motor program silently activated itself and downloaded “malware” that was intrusive, disruptive, and made it difficult for consumers to use their computers. The software changed consumers’ home pages, tracked their Internet activity, altered browser settings, degraded computer performance, and disabled anti-spyware and anti-virus software. Many of the malware programs installed by the Media Motor program were extremely difficult or impossible for consumers to remove from their computers.

The FTC charged that ERG Ventures and its principals violated the FTC Act, which bars unfair and deceptive practices. Specifically, the FTC alleged that the defendants failed to disclose to consumers that the free software they offered was bundled with malware. The agency also charged the defendants with using a deceptive End User License Agreement, which gave consumers the option to halt the installation of all software from ERG Ventures, but secretly installed malware whether consumers accepted or rejected the terms of the agreement. The agency also charged the defendants with unfairly downloading software that causes substantial harm to consumers. At the request of the FTC, the U.S. District Court for the District of Nevada froze the defendants’ assets and ordered a halt to their spyware operation pending trial.

The stipulated final order announced today ends that litigation with these defendants.

The order will permanently bar the defendants from distributing software that interferes with consumers’ computers, including software that tracks consumers’ Internet activity or collects other personal information; generates disruptive pop-up advertising; tampers with or disables other installed programs; or installs other advertising software onto consumers’ computers. The defendants will also be required to fully disclose the name and function of all software they install on consumers’ computers in the future, and to provide consumers with the option to cancel the installation after viewing the disclosure. The defendants will give up $330,000 in ill-gotten gains. Should the court find that the defendants misrepresented their financial status, $3,595,925 – the total revenues from their scam – will be due.

The order names ERG Ventures, LLC, as well as Elliott S. Cameron, Robert A. Davidson II, and Garry E. Hill d/b/a Media Motor, Joysticksavers.com and PrivateinPublic.com.

More here.

Alex Eckelberry

This is a really nice upgrade, with slick new dashboard widget-thingies, improved reporting and faster console performance.

The console performance improvements are pretty dramatic, as one new user pointed out on our forum.

Some pics:

Company propaganda here, product website here.

Alex Eckelberry