Category: Jake

I’ve written here a few times about the various times I’ve removed malware from various computers. Generally you don’t hear about me actually having it on my system because I have a ton of safeguards in place. Today, that changed not because of what I did but because of what a co-worker did to my laptop (which is supposed to be off limits). Said co-worker just wanted to play a practical joke, as he thought he was just doing some harmless fun, I guess, or something. Actually, I don’t know what he was thinking, but if I were him, I’d be thinking he won’t have a job soon.

I’ve spent a total of 5.5 hours today eradicating whatever the hell it was (there were several that got picked up by AVG). It required this post (and the thread attached to it) to get rid of the more annoying one (most of that was spent trying to find that thread, as the file names were all different, but the unique key was the same). AVG managed to kill the bulk majority that popped up (which included Trojan horse Dailer.BZB, Trojan horse Downloader.Generic2.CWC, Trojan horse Generic WUE, Trojan horse PSW.Ldpinch.XL, Trojan horse Downloader.Istbar.4.P, and Trojan horse Dropper.Generic.FRP), though a couple of them were spawned from other processes that had to be manually scrubbed and scanned.

And the thing is, after thinking I have it all clean, something still pops up: Trojan horse Dialer.BZB. AVG is killing it from doing anything, but I guess I get to go find out what’s causing that.

Meanwhile, co-worker’s going to get a serious beating and I’m going to be locking my desktop if I’m away from my desk for more than a few minutes. Meanwhile, I want to find the script-kiddie who wrote these stupid things and shoot them. All of them. Seriously. I know I’ll sleep better.

Update at 4:15: OK, I think the Trojan horse Dialer.BZB is dead. There was a strange DLL tying itself into the winlogin.exe process upon start up. Looking at the properties for the DLL, it was totally blank, and a google search for the DLL’s name didn’t turn up anything. I unbound it from the process, ran killbot to get rid of it on next boot, and it hasn’t appeared yed.

However…. now Trojan horse generic.WUE is popping up again in the cache files for MSIE (getting an AVG popup), and I haven’t even used MSIE during this whole process and it’s not running in the background. Cripes….

Update at 10:20: I think the thing is finally cleaned off. I ran Trend Micro’s online scan and it found some stuff that none of my stuff on my hard drive found, and I think it irradicated the last of it.

My co-worker apologized profusely, and said he got the idea from a geek friend of his who gave him the file to download (he obviously have no idea what it was). I was the one that actually (unintenntionally) did the most damage, thinking it was a file I downloaded.

So as long as there’s no long-term damage (which there isn’t, so far), he won’t be getting an a$$ kicking — he just knows better than to get near my laptop now.

And as much as I’d like to retaliate, I can’t. I’m the only one in the office that has my own seperate system. We have a Citrix Metaframe setup at the office that powers every desktop in the office (they’re all thin terminals). It’s a stupid system, yes, but basically anything I do to him also (for the most part) gets done to everybody else. Obviously I can change that, but I’ve got better things to do with my time than to set him up in a seperate permission profile just so I can screw with him.

Update on 7/5: Forgot to mention, these are the ones that Trend Micro’s scan came up with, in addition to what I found before (I think the httpsniff is a false positive as I do indeed have an HTTP sniffer installed on here for troubleshooting):

SPYWARE_TRAK_ACEPSTL.12

SPYWARE_TRAK_HTTPSNIFF.A

SPYWARE_KEYL_BOSSEVERYWARE

Aliasnames: PAK:PEData (BitDefendr); Trojan-Spy.Win32.BewLoader.b (Kaspersky)

SPYWARE_KEYL_ASTLOG

Aliasnames: Tools.Nirsoft (PestPatrol)

ADWARE_ABETTERINTERNET

Subsequent scan have come up clean, so I’m assuming this got all cleared up.

I’ve been busting my butt recently on a few huge projects (if you’ve noticed, my post quantity has gone done considerably the last several months), and finally have a major part of one of them done, and I can breathe a sigh of relief.

I’m working on the back-end for a site that is going to serve as a central Web site for the rental homes from four different companies here in Sunriver. It’s been a nightmare trying to get the inventory and availability data from four different companies, all of whom have different software systems, servers, and ways they do things. Today was the final phase of it, trying to figure out an automated way to pull availability data on an automated fashion from an Excel spreadsheet accessible via a URL. To complicate matters, the Excel file was behind non-standard password protections that checked if you were using MSIE before it even allowed you to login (it’s a very stupid system, but it’s what they have an it works for them). I gave up trying to figure it out myself, so I got a programmer off ScriptLance and had him deal with the mess (and a mess it was — cripes, I can’t translate what that code is doing for the life of me, thanks to Excel’s complicated file format).

But it works, and I have the home and availability data for all the companies loading and synchronizing properly. Now if the front-end guys will hurry up and do their thing (I was just in charge of the back end), I can sleep much better. But it’ll be by far the best vacation rental site out here (it’ll be fully AJAX-powered — it’ll be really sweet).

Meanwhile, I’ve got a busy weekend with the aforementioned concerts (with several rehearsals), appointments on Friday, my sister-in-law’s high school graduation, my niece’s ballet recital, and so much more. We’ll just have to see how it goes.

Why is this one different? Because I’m hosting it. Why? Because I use shorter URLs in e-mails quite a bit and didn’t want to always have to rely on tinyurl.com or the multitude of other services out there (not that there’s anything wrong with any of them, I just don’t want to always have to rely on them). I just decided to make my own using a short domain I already use.

So I present sh.orty. Get it, “Shorty”? Kind of like the other types of services that use periods in their name (the most popular, as far as I know, being del.icio.us

I took the script from here, the CSS hacks from here, and color scheme from just a random color I picked here.

The script is simple, slick, and fast, uses MySQL for the data, and also will reuse URLs if a URL you’ve submitted has already been submitted before. But my goal was to make it simple and fast, and I think it’s doing that just fine.

I was just going to use this for my own purposes, but I figured I’d make it public. If there is any abuse of the thing, I will take it down and ban the IP of the person who abused it — simple as that.

But go ahead, try it out, and let me know if you encounter anything weird.