Why, apart from laziness, would you plump for a PC to run this display?
Friday, 16 January 2009
More PCs being used where they shouldn't
Sunday, 4 January 2009
Virtumonde - Getting rid of a persistent trojan
In one of my worst Sundays for a long time, I spent most of today trying to prise the persistent trojan 'Virtumonde' a.k.a. 'Vundo' out of my Windows laptop.
The trojan has tens of thousands of variants, and only the more common ones are caught by virus scanners. I was unfortunate to get one of the rarer ones, which managed to elude even Kaspersky Anti-Virus 2009 (one of the best). Although Kaspersky recognised and blocked attempts to download dodgy files from the net, it didn't recognise the trojan that was behind the attempts. When I discovered the trojan's location using Spybot Search & Destroy, I tried pointing Kaspersky straight at the dodgy file, and it still passed it clean. And yes, this was with today's virus definition updates.
That said, if Kaspersky wasn't pro-active in scanning the contents of internet traffic, I wouldn't have even realised I had the trojan, and probably would have continued thinking the slowness was just because my laptop was old. Other scanners would have missed this completely.
To make my Sunday as bad as possible, the trojan had hooked itself deep into Windows. In addition to the usual load-at-startup stuff, it had made itself a Windows service (which didn't appear in the Services list) and become memory-resident. When I deleted the hooks it had placed in the Windows Registry, identified by the tools Spybot and HijackThis, they would appear back within seconds.
The files I deleted kept re-appearing with new (randomly generated) names. I ran the Spybot and HijackThis tools a few times to try and weed it out, but it persisted. It was no use making Spybot start before the rest of Windows, because the trojan would load even before that. Therefore I couldn't delete it's main DLL file (also randomly named) because it was always in use, even when I booted in safe mode.
I tried using KillBox, which can move/delete in-use files, but the DLL file stubbornly stayed put. KillBox queued the file for deletion at Windows boot-up, but this instruction was immediately removed by the trojan process! In desperation I downloaded OTMoveIt3 by OldTimer, which also attempts to move in-use files, but without the nice interface (see image below with example syntax). Somehow it managed what Killbox couldn't, and move the file to safe location where I could delete it.
The trojan was still resident in memory though, and was still replacing it's registry hooks soon after I deleted them - but this time the hooks were pointing to the now non-existent DLL file. A restart took the trojan out of the memory, which enabled me to delete it's hooks in the Registry once and for all - a good half-day after identifying the problem.
At least it didn't attempt to spread to other PCs or delete files - which is some consolation, as re-installing everything would have taken days.
It's experiences like these that make me think of switching to a *nix platform, like Linux or Mac OS X.
Mac users have been relatively lucky - vulnerabilities clearly exist but it's nowhere near the same numbers or nastiness as it is with Windows. That said, there's a lot of unprotected Macs out there, and malware writers will look to target this population as Mac usage increases.
Most Mac users seem to only use a single user account - the one they created when they first switched on their Mac. The problem with this user account is that it's an administrator account - which makes things much easier for malware writers, as it enables them to do more damage without user intervention. If this applies to you, create a standard user profile and switch to it. As with all *nix platforms, an administrator account should only be used when strictly necessary (such as when installing new programmes, or fiddling with hardware or with system settings).
The trojan has tens of thousands of variants, and only the more common ones are caught by virus scanners. I was unfortunate to get one of the rarer ones, which managed to elude even Kaspersky Anti-Virus 2009 (one of the best). Although Kaspersky recognised and blocked attempts to download dodgy files from the net, it didn't recognise the trojan that was behind the attempts. When I discovered the trojan's location using Spybot Search & Destroy, I tried pointing Kaspersky straight at the dodgy file, and it still passed it clean. And yes, this was with today's virus definition updates.
That said, if Kaspersky wasn't pro-active in scanning the contents of internet traffic, I wouldn't have even realised I had the trojan, and probably would have continued thinking the slowness was just because my laptop was old. Other scanners would have missed this completely.
To make my Sunday as bad as possible, the trojan had hooked itself deep into Windows. In addition to the usual load-at-startup stuff, it had made itself a Windows service (which didn't appear in the Services list) and become memory-resident. When I deleted the hooks it had placed in the Windows Registry, identified by the tools Spybot and HijackThis, they would appear back within seconds.
The files I deleted kept re-appearing with new (randomly generated) names. I ran the Spybot and HijackThis tools a few times to try and weed it out, but it persisted. It was no use making Spybot start before the rest of Windows, because the trojan would load even before that. Therefore I couldn't delete it's main DLL file (also randomly named) because it was always in use, even when I booted in safe mode.
I tried using KillBox, which can move/delete in-use files, but the DLL file stubbornly stayed put. KillBox queued the file for deletion at Windows boot-up, but this instruction was immediately removed by the trojan process! In desperation I downloaded OTMoveIt3 by OldTimer, which also attempts to move in-use files, but without the nice interface (see image below with example syntax). Somehow it managed what Killbox couldn't, and move the file to safe location where I could delete it.
The trojan was still resident in memory though, and was still replacing it's registry hooks soon after I deleted them - but this time the hooks were pointing to the now non-existent DLL file. A restart took the trojan out of the memory, which enabled me to delete it's hooks in the Registry once and for all - a good half-day after identifying the problem.
At least it didn't attempt to spread to other PCs or delete files - which is some consolation, as re-installing everything would have taken days.
It's experiences like these that make me think of switching to a *nix platform, like Linux or Mac OS X.
Mac users have been relatively lucky - vulnerabilities clearly exist but it's nowhere near the same numbers or nastiness as it is with Windows. That said, there's a lot of unprotected Macs out there, and malware writers will look to target this population as Mac usage increases.
Most Mac users seem to only use a single user account - the one they created when they first switched on their Mac. The problem with this user account is that it's an administrator account - which makes things much easier for malware writers, as it enables them to do more damage without user intervention. If this applies to you, create a standard user profile and switch to it. As with all *nix platforms, an administrator account should only be used when strictly necessary (such as when installing new programmes, or fiddling with hardware or with system settings).
Monday, 29 December 2008
Unnecessary use of technology?
If you really had to use a proper computer operating system to run a lift info display, surely a compact Linux distribution would be more appropriate for the job?
Friday, 26 December 2008
Running Microsoft Windows in a window in Mac OS X... in order to use a Windows-only printer
Soon after setting the Mac Mini up, I found out that my friend also had a Windows-only application he needed to use for his work, as well as a laser printer that only worked in Windows (it was a Canon with a proprietary printing system, no PostScript/PCL or anything like that, and drivers for Windows only). Argh.
You could simply buy a new printer (you're in the Apple world now, money is no object). But why replace a perfectly good printer? The printer was also a multi-function device - and good ones, incorporating laser printers, aren't so cheap.
Apple does publicise the fact that you can install Windows alongside Mac OS X using Boot Camp, but this involves re-booting your PC to run Windows. This will get tiresome if all you need Windows for is a single application and a printer.
Thankfully, there is a solution - which is geeky but straightforward - that lets you run both Mac OS X and Windows at the same time and, with a bit more work, enables you to hit 'print' in any Mac application and print seamlessly.
You can achieve this in 3 big, but not too big, steps:
1) Use VirtualBox to create a virtual PC, and install Windows in it
VirtualBox is a top-notch virtualisation product which is free to download. You can read the background on virtual machines and virtualisation on Wikipedia, so I'll jump straight to what you can use VirtualBox to do. With VirtualBox installed, you can run Windows in a window in Mac OS X! The only condition is that your Mac needs to be a reasonably recent one with an Intel processor. You can download it at the VirtualBox website.
VirtualBox comes with a very good user manual, so I won't go into too much detail here, but I'll outline the steps:
2) Set up the printer in Windows
Having followed the above steps - specifically the USB filter one - the virtual PC would now be connected to your printer. Without drivers installed, it will most likely appear as an unknown device within the Device Manager (under Control Panel > System).
Head to the manufacturer's website, download the Windows drivers in the usual way and install them, and print a test page from within Windows.
3) Set up PostScript emulation in Windows, and share the PostScript driver with your Mac
If all's well, you can start setting up the bridge to Mac OS X, beautifully documented by Robert Harder - click through for his step-by-step instructions.
Please note that step 5 is slightly different in the latest version of Mac OS X - you should go to 'System Preferences' in your Mac, then 'Print & Fax', and then add the IP printer from there. If you're willing to experiment, you may be able to skip a few steps by looking at the advice given in the users' e-mails posted on that page.
Once you've followed those instructions, it's done! You can now hit print in any Mac application and it will print seamlessly.
A few notes...
You could simply buy a new printer (you're in the Apple world now, money is no object). But why replace a perfectly good printer? The printer was also a multi-function device - and good ones, incorporating laser printers, aren't so cheap.
Apple does publicise the fact that you can install Windows alongside Mac OS X using Boot Camp, but this involves re-booting your PC to run Windows. This will get tiresome if all you need Windows for is a single application and a printer.
Thankfully, there is a solution - which is geeky but straightforward - that lets you run both Mac OS X and Windows at the same time and, with a bit more work, enables you to hit 'print' in any Mac application and print seamlessly.
You can achieve this in 3 big, but not too big, steps:
1) Use VirtualBox to create a virtual PC, and install Windows in it
VirtualBox is a top-notch virtualisation product which is free to download. You can read the background on virtual machines and virtualisation on Wikipedia, so I'll jump straight to what you can use VirtualBox to do. With VirtualBox installed, you can run Windows in a window in Mac OS X! The only condition is that your Mac needs to be a reasonably recent one with an Intel processor. You can download it at the VirtualBox website.
VirtualBox comes with a very good user manual, so I won't go into too much detail here, but I'll outline the steps:
- You'll obviously a Windows CD, and if you're a PC user you should be able to free up a Windows licence to use.
- Fire up VirtualBox, and create a virtual box for the version of Windows you're going to install.
- RAM - Based on my experience with Windows XP, 256MB is enough, and if it's solely for printing, then you can probably use less (e.g. 192MB) without issues.
- CD drive - Make sure you initially give the virtual box control over the CD drive, so you can run the Windows install CD from it. After the installation's done, you can easily change the virtual box set-up so the CD drive isn't handed to the virtual box by default.
- Network - Set your networking option to 'host interface', so that the virtual box appears just like another computer on your home network. Also set the network adapter to the Intel Server one, as this is immediately recognised by Windows without the need to install drivers.
- USB - Set up a USB device filter, so that the virtual box is given control of the attached printer. If your printer doesn't have a USB port, parallel-to-USB adapters are available cheaply from eBay.
- Finish the set-up, and start the Windows virtual box with the Windows CD in the drive. VirtualBox will 'mount' your CD drive, so the CD icon will disappear from your Windows desktop. VirtualBox will display messages about what your 'keyboard/mouse capture' keys are - make a note of this, as initially you'll need to hit a key to 'release' your keyboard/mouse from the virtual box.
- Wait for the virtual PC to boot from the Windows disc. Follow the instructions to install Windows just like you were installing Windows on a normal PC. While Windows is installing, you can just minimise the VirtualBox window and do whatever you want on the Mac itself while it installs. Cool eh?
- Once the Windows installation is complete, use the VirtualBox Devices menu (in the Mac's menu bar, not in the virtual PC window) to unmount the Windows installation CD, so it appears on your Mac desktop again. You can now eject the CD in the normal way.
- From the same VirtualBox menu, click the option to install the 'guest additions'. Now you don't need to worry about 'releasing' your keyboard/mouse anymore. You can go to Display Properties to change your screen resolution (and therefore the size of the VirtualBox window).
2) Set up the printer in Windows
Having followed the above steps - specifically the USB filter one - the virtual PC would now be connected to your printer. Without drivers installed, it will most likely appear as an unknown device within the Device Manager (under Control Panel > System).
Head to the manufacturer's website, download the Windows drivers in the usual way and install them, and print a test page from within Windows.
3) Set up PostScript emulation in Windows, and share the PostScript driver with your Mac
If all's well, you can start setting up the bridge to Mac OS X, beautifully documented by Robert Harder - click through for his step-by-step instructions.
Please note that step 5 is slightly different in the latest version of Mac OS X - you should go to 'System Preferences' in your Mac, then 'Print & Fax', and then add the IP printer from there. If you're willing to experiment, you may be able to skip a few steps by looking at the advice given in the users' e-mails posted on that page.
Once you've followed those instructions, it's done! You can now hit print in any Mac application and it will print seamlessly.
A few notes...
- If you minimise VirtualBox, the only hint of the complex solution will be it's icon in the tray at the bottom. The downside is that VirtualBox needs to be always running in order for you to print (though that's no big deal if it's minimised), and more importantly whatever RAM you've allocated to Windows will be lost to Mac OS X while VirtualBox is on. That said, this is unlikely to cause you a problem - on a Mac with 1GB RAM, I gave 256MB to the Windows virtual box without noticing a performance hit to applications running on the Mac.
- There's no need to go to all this trouble if your printer has Mac drivers, or if that Windows application you need has a Mac alternative. Use Google and manufacturers' websites to exhaust all Mac options first.
- Obviously the Windows virtual box will be susceptible to viruses/malware etc. just like an average Windows PC, but as long as you use it only as a printing pass-through, you don't need to worry about this. But how do you prevent kids from opening up the virtual box and messing about with Windows? You may want to consider installing SteadyState (free from Microsoft) to lock down Windows and prevent anything you don't want from being installed.
- When connecting your Mac to the printer on Windows, if you specified an IP address rather than the computer's name, you will probably want to ensure this IP address is static. Most routers will have an option to assign static LAN IP addresses to computers on the network, identified by their MAC addresses. Fortunately, your virtual box will have it's own unique MAC address (viewable from the VirtualBox set-up), enabling you to do this.
Thursday, 25 December 2008
First impressions of a Mac Mini.. and getting a British PC keyboard working properly on it
I recently helped set up a friend's new Mac Mini, which doesn't come with a keyboard, mouse or display - instead you use your old PC keyboard, mouse (as long as they have USB connectors) and display with it. It's a good choice for those who might want a Mac, but are put off by the high price (especially considering the fact that nowadays a Mac is just a PC with the Mac OS X operating system). It also very small and comes with a remote control, so it's also great as a media computer connected to a HDTV.
I plugged everything in; set-up was very quick and it was ready to go in minutes. But then I hit my first problem.
I had plugged in a standard British PC keyboard, the sort that you get with any Windows PC sold in the UK. Despite recognising the keyboard, and having it set-up to use a British layout, it still gave me quote marks when I wanted the @ sign (and vice versa), and the \ key was in a different place. The problem was that it thought I was using the British keyboard supplied by Apple - the standard UK Windows PC keyboard isn't supported out-of-the-box.
Thanks to a helpful Mac user at work, I was pointed to Phil Gyford's excellent post on the subject - check out the simple 4-step instructions under the "Moving punctuation keys" section. If you've got a new Mac Mini with the latest version of Mac OS X, in step 1 you'll want to download Andy Pearce's keyboard layout file instead. In step 2, the new layout will then appear as "windows-uk" at the end instead of "British - Windows - 2".
I plugged everything in; set-up was very quick and it was ready to go in minutes. But then I hit my first problem.
I had plugged in a standard British PC keyboard, the sort that you get with any Windows PC sold in the UK. Despite recognising the keyboard, and having it set-up to use a British layout, it still gave me quote marks when I wanted the @ sign (and vice versa), and the \ key was in a different place. The problem was that it thought I was using the British keyboard supplied by Apple - the standard UK Windows PC keyboard isn't supported out-of-the-box.
Thanks to a helpful Mac user at work, I was pointed to Phil Gyford's excellent post on the subject - check out the simple 4-step instructions under the "Moving punctuation keys" section. If you've got a new Mac Mini with the latest version of Mac OS X, in step 1 you'll want to download Andy Pearce's keyboard layout file instead. In step 2, the new layout will then appear as "windows-uk" at the end instead of "British - Windows - 2".
Subscribe to:
Posts (Atom)