Lavasoft's ARIES Rootkit Remover

"Lavasoft is pleased to launch a new Project ECO Tool, the ARIES Rootkit Remover, to get rid of the rootkit developed by First4Internet used by Sony BMG to hide their DRM (Digital Rights Management) software. "

Mac Virus Hits the Streets!

Contrary to some pronouncements, Macs can get a virus. I'm disinfecting one of this virus right now.

As with so many virii, user interaction is necessary to get infected. This one arrives via Apple's iChat instant messenger.

The link above is to a story at The Inquirer and will point you to Sophos, who have more information.

Jack

Microsoft patch fails to install for some users | InfoWorld | News | 2006-02-15 | By James Niccolai

We were talking about this in Independent Computer Users Group chat. Did you get it installed?

Newsletter #53 February 2006

I found this on digg.com and found it very interesting. I've copied what I see as the BIGGEST IT opportunity. But, go to the page and he has some superb tips on troubleshooting network problems.

Separate the C and Si Problems

I've solved a lot of network problems, but this one was a toughie.

"I've got a DHCP server that is delivering IP addresses to two segments. The systems on the same segment as the DHCP server are getting IP addresses with no trouble, but the systems on the other segment, none of them work!"

My first question (and probably yours, if you're a network techie) is, "does the router between the two segments pass DHCP requests?" (In geek-ese, you may know that the other way to say this is "does the router support RFC 1542 BOOTP forwarding?") Or alternatively, I ask, "is there a DHCP forwarder on the second segment?"

"Yes," the person replies, explaining that the router passes BOOTP packets.

Hmmm. So what else might it be? Check IP connectivity -- does the router block any particular port? If it's in a network with an Active Directory and the DHCP server is on a 2000 or 2003 server, has that server been authorized in AD? No port blocks, and yes, it's been authorized. That's when I realize that it was a stupid question -- if DHCP weren't working, the first segment wouldn't have IP addresses. Ah, but what if -- a eureka moment! -- somehow (1) the DHCP server hadn't been authorized for the past six days and for some reason all of the systems on the nearby segment still had lease time left but all of the ones on the second segment had their leases run out earlier, and so were the canaries in the coal mine? So I tell the person to try to do an IPCONFIG /RENEW on one system on each segment. The one of the first segment succeeds, the one on the second doesn't.

Ready for the answer? It's simple: the guy had no idea what the heck BOOTP forwarding was, figured that his router guys must have allowed for that -- after all, they did go to a CCNA boot camp -- and just told me what I wanted to hear. In other words, it is always possible that the carbon-based parts of the network ("C" is the symbol for the element carbon) don't report reliable information, and so the problem lay not in the silicon part of the network ("Si" is the symbol for the element silicon) but in the carbon component. To paraphrase Shakespeare, "the fault, dear Brutus, lay not in the chips but in the people."

Don't misunderstand me, I'm not saying that everyone lies or is incompetent. But I am saying that under stress people don't always think as clearly as they should, and that network support people have had a lot of new things thrown in their laps in the past few years -- remember when we "discovered" security in 2001, or that we all need database servers whether we want them or not in 2004? -- without receiving a concomitant increase in staffing. We're all just human. We make mistakes. Think about how we make silicon-based systems more reliable: we cluster them. The same thing works for carbon-based units: more eyeballs looking at a problem often make for a more quickly-solved problem.

And -- this is important -- remember that we techies tend to think of computer problems in terms of the silicon side sometimes more than we do the carbon side. In fact, sometimes we see the carbon side as being sort of minimal, and only relevant in a few cases. But if you sit back and think about most of the things that you have to fix, you'll end up seeing that most of those problems have a carbon component that is at least as important as the silicon component. I mean, Trojans don't write themselves, y'know?

I think that IT requires mostly people skills, so I dispute that geeks are *NOT* good with people. :P

--MissM
update: corrected to include *NOT*, oops.

Newsletter #53 February 2006

AJAX Poses Security, Performance Risks

The link is to a short article at eWeek. In it, the author comments on how much AJAX (and particularly the XML portion of it) can increase network traffic. Since Peter and I talked about that on the show, two weeks ago) I have been finding accounts of such systems increasing network traffic by figures spanning the range between 3.5 and 12 times! That really is a lot. Plus, outside of the increased packet transmissions and receptions, there are significant processing loads on the server side. No free lunch here, folks.

Even so; not all the hype surrounding AJAX is misleading. There are significant benefits to using the technologies in many cases. The problem is one of choosing when these technologies are appropriate to use and when they are not.

Jack

Who Said MegaHertz Don't Matter Any More?

Apple has just begun shipments of their MacBook laptop using the Intel Core Duo cpu. Apple is offering three different clock speeds; 1.83, 2.0 and 2.16 GHz. I've been to the stores to see one and without exception, the customers, or prospective customers are speaking in terms of GHz, again. To me, it seems they are more comfortable doing that than measuring performance in terms of flops or throughput or any other metric.

Now AMD is pushing the Opteron 256 at 3.0 GHz and I hear that spoken of in terms of clock speed, as well. The chip companies have no one but themselves to blame for this, of course, but I do believe these last two releases have reversed all the changes in consumer thinking that they had labored so hard to foster. One slip of the lip, as it were.

I'm really interested in whether Intel, IBM and AMD will try to reinstate other metrics or simply give in and go back to clock speeds to differentiate their models in the pubic eye.

Jack

Site Advisor

This sounds like a good idea and if implemented well, I think it will improve web security for a lot of users.

Basically, Site Advisor gives you the results of automated searches which rate the conduct of the web site you want to view. Should it deliver adware, spyware or (Heaven forbid)something worse, the application will alert you. There will be two versions of the software; one paid for and one free. I'm not quite clear on the differences so I can't comment on that.

Done well, this could mean a virtual end to "drive-by downloads" and spyware bundled with desireable applications. All the user has to do is pay attention, though I must admit I know more than a few who will not do so, no matter what. Versions are available for Internet Explorer and Mozilla Firefox and function as browser extensions.

I intend to install and test this and if any or our listeners want to do so, we can pool our experiences for a report on the show in a week or three.

Jack

tech.memeorandum @ 11:05 AM ET, February 13, 2006

Microsoft's Anti-Spyware program is causing troubles for people who also use Symantec's Norton Anti-Virus software; apparently, a recent update to Microsoft's anti-spyware application flags Norton as a password-stealing program and prompts users to remove it.
[snip]
Update: 10:58 p.m. ET: I heard from Microsoft, and they say the problem is limited to customers running Symantec Antivirus (SAV) Corporate Edition versions 7, 8, 9 or 10 or Symantec Client Security (SCS) versions 1, 2 or 3 in combination with Windows AntiSpyware Beta 1. "The beta software will prompt and allow the user to remove a registry key containing subkeys belonging to these Symantec products. The deletion of these registry keys will cause all versions of the SAV and SCS software to stop operating correctly. No files are removed in this situation, only registry keys."

The rest of the statement Microsoft sent me says: "Once this issue was discovered, Microsoft quickly released a new signature set (5807) to remove this false positive. Both companies are working jointly together to identify the number of affected customers, which we believe to be very limited. Microsoft and Symantec are working jointly on a solution to restore normal operation of the Symantec software. Until this solution is available, customers can utilize System Restore in Windows XP to restore to an earlier point prior to the removal of the registry keys, or reinstall their client software."

--MissM

tech.memeorandum @ 11:05 AM ET, February 13, 2006

OnComputers Radio show Podcast 02-12-06

This is the On Computers Radio show podcast for 02-12-06. If you prefer, you can download the same file here via ftp.

A Fix for Zone Alarm Phoning Home

I haven't used Zone Alarm in a while and so missed when the story broke. However; it appears ZA phones home to servers controlled by Zone Labs. No one has given a satisfactory explanation of why this behavior was coded in, to the best of my knowledge. There are four servers involved.

This little article in The Inquirer details how to block this behavior, using the hosts file in ZA itself. It's easy to implement.

Jack

Microsoft Security Bulletin Advance Notification

From the MSRC [MS resource center] Advanced Notification of upcoming February MS updates.
--MissM

Microsoft Security Bulletin Advance Notification

99 performance tips for WinXP

Massive list of simple tweaks to improve your rig's performance.

I was reminded of everybody searching their memory trying to figure out how to get to System Restore during a recent OnComputers Radio Show, and I thought that having a handy dandy bookmark/favorite (You're not really still using IE are you? ;) ) "archived" on the blog, would be a good thing.

--MissM


read more | digg story

AND another kewl digg post about Nano Coatings. They will be able to protect your ipod screen and your car, its environmentally friendly, and cheaper!!

"liquid solids" composed of extremely tiny particles, possess unique characteristics -- like extreme flexibility, easy adhesion and resistance to corrosion and microbial growth -- that could profoundly change the manufacturing process.

read more | digg story

99 performance tips for WinXP

Massive list of simple tweaks to improve your rig's performance.

I was reminded of everybody searching their memory trying to figure out how to get to System Restore on OnComputers Radio Show, recently, and I thought that having a handy dandy bookmark/favorite (You're not really still using IE are you? ;) )



read more | digg story

I'll Stay "Small Time", Thank You

It's a story about the woes of computer and tech journalism. As one moves up the ladder of prominence, more and more of this stuff starts to happen.

I just turned down a gig with a noted cell phone handset maker because of the NDA (Non-Disclosure Agreement) they wanted signed. I simply didn't see why I should sit two whole days in my wheelchair (not to mention the travel difficulties) and then not be able to write or talk on the show about it until everyone else can, as well.

The company's reaction to this was to offer all sorts of goods for test as an inducement to attend. I have no idea whether anyone else got offered anything, but I think they were all slated to get the same goody bag as I got, just later in the process.

To the writer of the article cited above, this is a matter of journalistic integrity. To me, just a waste of my time. (You all know how little journalistic integrity I really have, so there's no sense in my trying to fly that lie past you, right?)

The article is worth a read for the way it tells you how some journalists, including those we depend on, are pressured.

Don’t use Google toolbar, says EFF

The link above is to a synopsis in The Inquirer. The Electronic Frontier Foundation warning is here.

The problem is, to put it very succinctly, that in order to index your computer for search, Google has to have copies of the docs indexed. These are open to subpoena from the government and subsequent data-mining. This whole deal must have federal security people salivating like a dog does over a steak.

Jack

For All Geek Kittys

Catproof your computer. Got this from an email to Fred Langa's newsletter, as the correspondent says: "I thought it was a joke at first, but its real"

The real question as Fred puts it is, "Will my own typing activate it?"
Joe, hally??? ;)


PawSense helps you catproof your computer.

--MissM

Microsoft Security Response Center Blog! : Two new security advisories posted

Two new security advisories posted

Hi folks, Mike Reavey here. Just wanted to point out two new security advisories that we posted late last night.

The first is related to a WMF vulnerability in older versions of Internet Explorer. This is different from the issue addressed by MS06-001 and only impacts older versions of Internet Explorer – if you’re using IE6SP1 or later, you’re protected from this issue. The second is related to a research paper regarding default services behavior that has already been addressed in Windows XP SP2 and Windows Server 2003 SP1. For more information, check out the advisories located here:

http://www.microsoft.com/technet/security/advisory/913333.mspx

http://www.microsoft.com/technet/security/advisory/914457.mspx

-Mike

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Published Wednesday, February 08, 2006 5:42 PM by stepto

Microsoft Security Response Center Blog! : Two new security advisories posted

--MissM

Why I Do Not and Will Not Use GMail

The link is to an article in MIT's Technology Review. In it, the author details just how much of a leap of faith users must make to use GMail. Google has far and away the most comprehensive privacy policy in the business, but it does not go nearly far enough. The repositories of email on Google's servers are a tempting target for everyone from law enforcement to divorce lawyers trawling for evidence. Users have so little control over deletion of email that unwanted copies can (and probably do) lay about for months after the deletion command is given.

So, even though I have nothing to hide (except an ugly mole here or there, which is another story entirely) I refuse to use GMail. I simply do not trust the system or the owners of it enough to allow my personal business to be deposited there.

You might want to read this article, just so you are making an informed decision on whether or not to use GMail.

Jack

How Much RAM Do You Need?

It seems as if every computer user, plus their dogs, has an opinion on this. The show cast is pretty well in agreement on the subject, but so many variables apply that our opinions can hardly be said to apply globally.

In an article at XBit Labs.com, Ilya Gavrichenkov reveals some testing designed to measure up against the the common wisdom. While not conclusive at all, it certainly is food for thought and on that basis I recommend reading it.

Jack

OnComputers Radio show Podcast 02-05-06

This is the On Computers Radio show podcast for 02-05-06. If you prefer, you can download the same file here via ftp.