Virus found – explorer.exe crashes when loading cmd or regedit – antivirus won’t update

We’ve had a spate of customer’s machines get infected with this over the last week. Had us scratching our heads for a few hours … thought it was conficker or some variant but it seems not. Looks like it was actually Trojan:Win32/Daonol.B

Symptoms

Causes some or all of the symptoms below :-

1. Antivirus software won’t update from the Internet (Sophos, Kaspersky, AVG, F-Secure)

2. Some google/yahoo searches get redirected to other dodgy looking sites!

3. Loading cmd or regedit causes explorer.exe to crash (the start bar disappears for a few seconds and then reappears)

4. Sometimes on starting up the PC it just arrives at a blank blue screen with no icons or text at all. Pressing Ctrl-Alt-Delete and doing File-Run-Explorer.exe will usually bring up the windows desktop & start menu.

5. Access to many antivirus / security websites is blocked

6. The windows firewall gets mucked up and various strange things start to happen with both outbound and inbound traffic. Some PCs prevent web access completely or prevent access from other network PCs.

7. We tried multiple AV programs and nothing detected it – Sophos, Kaspersky, F-Secure, AVG, OneCare. Tried online scans and scans from a bootable Bart PE cd with no success.

8. HijackThis showed up nothing of interest.

9. It continued to operate when in safe mode with every possible process shutdown (which was the key to establishing it had to be something at driver rather than process level)

Cause

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\Aux (or Aux1, Aux2, Aux3 etc) has strange value like :-

C:\WINDOWS\system32\..\ppfrvd.waq
C:\WINDOWS\system32\..\ryqkue.idb
C:\WINDOWS\system32\wdmaud.sys
C:\docume~1\%user%\locals~1\temp\..\adfdpj.dsa

(Note: c:\windows\system32\wdmaud.drv & c:\windows\system32\drivers\wdmaud.sys are legit files!)

 

Resolution

1. Fix registry

• Start-Run->”command”   (note: NOT cmd!)
• cd \windows
• copy regedit.exe regedit1.exe (because you cannot load regedit.exe directly)
• Run regedit1 & navigate to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
• Make a note of the dodgy filename and then set the value of aux key to wdmaud.drv

2. Delete file

• Run HijackThis
• Select More Options – Delete on Reboot
• Browse to the file listed in regedit above. Choose file . (Note \.\ designates parent folder – ie a folder level up from temp.
• Allow to reboot.

3. Update Antivirus and run a full scan - preferably from more than one vendor to ensure the machine is clean.

Correct data value for Aux should be like this,

 

Resources

HijackThis

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdaonolfam.html

http://www.threatexpert.com/threats/trojan-win32-daonol-b.html

Update 13/05/2009

Found another blog with some more information here :- http://miekiemoes.blogspot.com/2008/10/fake-sysaudiosys-causes-searchengine.html

Has some info on how it works and where it comes from:-

As far as I know.. this one is getting installed via a “Yahoo! Counter starts here” javascript (which is a malicious script and not related with Yahoo) injected on many forums/sites/blogs.

Record useful tweets in Evernote

Here’s a brilliant new feature from Evernote …

I was actually just thinking about this earlier today. There is so much cool & useful stuff that gets posted on twitter that I don’t have time to read/review/pursue most of it during the day when it’s live – but would like to refer to again. I wanted an easy way to record it for future perusal.

And behold tonight I find the new Evernote / Twitter integration has been launched.

Follow @myen
Evernote will follow you back and send a direct message
Click the link in the message – link the accounts – and away we go.

Just include @myen in any public tweet – or dm @myen and it will end up in your evernote inbox.

Wonderful! I love it!

More info – http://blog.evernote.com/2009/04/14/evernote_twitter/

Choosing between Live Mesh / Live Sync / Live Drive for synchronising files between PCs

We’ve been using Microsoft Groove for a couple of years now to synchronise a shared company folder between our geographically distributed users. It hasn’t been touched since it was set up two or three years ago and I’ve been wanting to revisit and look at alternatives for a while.  Groove is overkill for us and is a bit of a resource hog – so some users tend to leave it closed which causes all the obvious problems of conflicting files & out of date data folders.

Our shared folders are also in a bit of an organisational mess as shared folders tend to become! Time for a spring clean.

We’re also considerably less “distributed” now and I liked the idea of having the folder shared locally from our server for internal users but then sync’d out to a few external users. Also wondered if there was some merit in us having a synchronised copy in “the cloud” to access from mobile devices etc.

So my Easter weekend project has been a bit of research on what’s available. As usual there are a dozen different options – with Microsoft’s apparently self-competing products particularly confusing!

So here’s my “take” on each of the services I’ve tried with some pros & cons. My choice for our situation is Microsoft Live Sync to share out the company shared folders, and also to sync my personal docs between Home, Work & Laptop. And Jungle Disk for online backup & versioning.

Live Mesh (http://www.mesh.com/)

Still in beta – this has the potential to be a very slick system in time. The main difference between Live Mesh & Live Sync is that Mesh stores a copy of your documents online in the MS data centre and files can therefore be accessed even when all your PCs are switched off.

• Unfortunately 5Gb isn’t really enough for us and at the moment there’s no option to buy more space.
• Fairly nice mobile optimised web access from mobile devices – but no native apps yet which is a bit of a downside.
• It doesn’t run on anything other than XP Sp3 or Vista so it won’t run on my Windows 2003 Server. Not a disaster but it is nice to have a sync’d copy on our server and I do want to share this folder out locally.
• Provides the ability to remote control PCs using RDP – nice – but not really that useful for us – we have multiple ways to do that already.
• For now it’s free of charge to use but it’s still in beta with no real indication of potential pricing plans etc
• No versioning so it’s not really much use as a backup system
• However it’s potentially much bigger than just “file synchronisation” – essentially becoming a mesh platform for all sorts of applications, and I’ll be keeping a close eye on this one in the future.

Live Sync (https://sync.live.com)

Used to be called FolderShare – just simple file synchronisation between multiple computers. No online storage.

• A simple & tidy interface
• Small footprint – it certainly doesn’t seem to be too resource intensive in my initial testing
• You can share folders to be accessible to other LiveSync users which enables us to have separate folders accessible by all users – and some accessible to just selected users.
• No real limits on space for us – 20 folders & 20,000 files in each.
• No online storage – but at least one of our servers/PCs will always be switched on so that’s not a huge deal for us. And we use JungleDisk to maintain an online backup anyway with full versioning.
• I like the activity dialog which shows clearly what’s going where
• It would be really nice if it had the option to include the SkyDrive / S3 or something to maintain an online copy but for now it’s effective, simple & cheap way to do basic file synchronisation.

Livedrive (http://www.livedrive.com/)

I was very tempted with this one. It’s a very nice system. Essentially like Live Sync but with online “cloud” storage. The founder of Fasthosts is involved which lends it some credibility. There are some fairly unique features :-

• Ability to edit a lot of “normal” documents online without downloading to the PC and therefore without requiring the application to be installed on the PC before you can edit documents.
• Facebook/Youtube integration for publishing files
• FTP access to files
• Optimised mobile access to files
• iTunes, video playing online without download, unlimited storage … and lots of nice things!

I would have gone for this except that I think they fall badly between two stools on their pricing policy :-

The Standard pricing option is £39 per year – this gives 100Gb storage which is more than enough – but only allows use on 1 PC. That’s a fat lot of use as a synchronisation tool! This would be a very fair price if we even could sync say 2 or 3 PCs. As it stands I’d have to go for the Pro version at £90 per year. Too expensive for my personal usage given that I only have a few Gb of data.

The £90 Pro account would be cheap for company use – and the Pro version can be installed on up to 10 PCs. But there’s no security – so it’s access to all or nothing. Unless we sign up all our users individually – and at £90 per user that’s definitely too expensive. Particularly given that we can get a slightly less functional system for pretty much zero cost with Live Sync.

However …  there is a small business version coming out which will give us multi-user, user security & crucially file versioning. I’ve applied to join the beta program and if it works like they say and comes in at a sensible price point of a few hundred pounds for say a 5 or 10 user licence with 100Gb of space then I’ll likely be their first customer!

Jungle Disk on Amazon S3/Rackspace

We’ve been using this for a while for online backups. Seems robust and very economical 0.15c per Gb. We’ve had very few issues with it. Now owned by RackSpace. It doesn’t do any multi-PC synchronisation but I believe that is on the development roadmap.

We’ll probably change over our datastore from Amazon S3 to the Rackspace option to see how that goes. But for now we’ll be continuing to use this for backups and keeping an eye on what it comes up with on the synchronisation side of things.

Humyo (http://www.humyo.com/)

This looks quite nice also but I haven’t had time to review it properly yet. From first glance though I’d still prefer LiveDrive if they can sort out their pricing. I’ll hopefully post something on this shortly.

Conclusion.

For us at the moment it’s Microsoft Live Sync doing the multiple PC synchronisation at zero cost – with Jungle Disk / Rackspace for backups & versioning. But this could well all be replaced with LiveDrive if they can sort out their pricing plans on the small business option.

 

Some other resources

http://www.pcpro.co.uk/reviews/249423/livedrive.html

http://blogs.technet.com/james/archive/2008/11/25/live-sync-live-mesh-skydrive-and-why-patience-is-a-virtue.aspx

http://www.cloudave.com/link/live-mesh-live-sync-microsoft-branding-problem-one-of-many

http://www.labnol.org/internet/compare-windows-live-sync-mesh-and-skydrive/6166/

http://blogs.zdnet.com/microsoft/?p=1355

It’s all about thin clients on a grand scale

We definitely seem to be heading back around the thin-thick cycle except this time it’s going to be on a massive scale … and includes the consumer market. The technology has evolved so much recently that we now have all the same benefits and far less of the negatives of “thin computing” from 15 years ago. Our “mainframe” has become “the cloud” – and our “terminal” has become the browser.

Garrick Schmitt says,

The future is about to get a lot more interesting — very soon — and the stakes are high for everyone.

http://www.digitaldesignblog.com/2009/02/25/the-browser-wars-redux-why-safari-chrome-firefox-and-ie-matter-more-than-ever/

I agree, although I’m not altogether sure that the actual browser matters all that much – let’s face it they all do pretty much the same thing quite well! It’s more about the fact that it is in the end …. a browser.

Software As A Service / The Cloud!

I’ve resisted this for a long time, preferring the traditional self-hosted, outright purchase model and have been a very reluctant convert! But over the last few months I’ve been starting to use more applications that operate on a SAAS basis.

• Evernote
• Remember The Milk
• SourceAnywhere Hosted
• Net Intelligence
• Google Apps

Why?

1. These applications are VERY good at what they do – they are fast, efficient, & cost effective – I’ve bought the Premium subscription to most of them and they are still excellent value for money.
2. Synchronised data available anywhere – Stick your “stuff” in the “cloud” and it’s instantly accessible from anywhere on a variety of devices.
3. Bandwidth & accessibly is no longer an issue. It’s very rare that I’m not online in some way whether at home, at work, in the car, at a clients or even in a hotel or airport.
4. I don’t need to worry about infrastructure – about servers – bandwidth requirements – security updates – patches – software upgrades. That’s a huge cost & time saving.
5. Reliability / Uptime is great. Ok – so these systems fall over once in a while – but so do my in-house systems – the difference is I have to fix those myself!!

Of course – my old skeptical self ensures that any information stored in these systems is either backed up elsewhere or stuff that I can easily afford to lose.

And BTW – if I’m buying any shares this year it will be in companies with an interest in network infrastructure  & data centres! I suspect that we’re just seeing the tip of an iceberg …

Blackberry 4.5 OS

In an attempt to sort a different problem I downloaded the new Blackberry Desktop Manager last night and it prompted me to upgrade the Core Blackberry software to 4.5. Never one to hold back on the latest of anything I fired it on. Not sure how I missed this upgrade last year but there are some really nice features :-

HTML Email – at long last! Works well on Orange in the UK.

Nicer fonts makes things a bit more readable – default sizes are massive mind you so you’ll probably need to knock everything down a few notches!

WiFi / UMA seems a lot more stable – no real evidence for this apart from the fact that it’s working a lot better now.

Music player multitasking – hooray! Click on the menu button on the home page and go straight to now playing screen.

Voice notes recorder

I did have a bit of a dodgy moment when the device wouldn’t start up and upgrade stalled while trying to restore the app settings backup! Took the battery out for a few minutes, plugged back into the PC and all was well … panic over!

Get it here :-

http://na.blackberry.com/eng/services/devices/#tab_tab_overview

Companies that "get it!"

What do 3CX, Plus.net & Skyscanner have in common?

They (or some representative of) have all responded to my blog posts or twittering recently. I think it’s well impressive that these companies are clued up and proactive enough to be interacting in this way with the online community.

Plus.net in particular are doing great things with customer service recently – I twittered yesterday when they had a widespread ADSL network problem – they replied on twitter! And I love the fact that we get clear transparent information when they have a problem – we don’t want a load of BS or problem avoidance tactics! – just clear frequent updates like this will be just fine – http://www.plus.net/support/service/problems/problem.php?intProblemId=54847

It’s more than can be said for a couple of other online retailers (pro-audio equipment) who are bugging me today because they can’t seem to be bothered to even respond to direct emails! Better give them another day before the name & shame!

Windows / Linux / Mac

People continually badger me (in a completely good natured way of course!) for concentrating on the Windows platform.  I have tried Mac OS (briefly) & Linux of various persuasions over the years. Want to know why I’m still stuck with MS?

1. It’s what all our customers use 

We work in the SME sector in the UK – here is the breakdown of people accessing our web site – 99.29% using Windows! 93% using IE of some variety – and the 0.3% using Chrome is probably me! Of course just because everyone else uses something doesn’t make it technically “better” – but market saturation is a valid consideration when you’re trying to sell software!

The alternatives just aren’t all that good! Sorry!

I’m not a complete Linux newbie – I do try and keep my hand in a little. But recent attempts at running a simple Linux server at home with some simple streaming audio, file sharing, and home automation software turned into a complete hacking session. The same setup under windows was up and running in less than 2 hours without days spent trawling forums for scraps of information that may or may not help point in the right direction.

• Maybe I’m just a bit thick but trying to do even the simplest things in Linux is often a right pain in the proverbial!
• The UI is poor – clunky – ALL of the media centre applications look horrible compared to the latest MS UI – and when it’s in my living room the UI is a major factor.
• It’s not as stable as the advocates suggest when used as a desktop. Out of the box my Ubuntu version was buggy as could be – frequent crashes.

Of course there are good things about Linux – and of course there are many applications where it’s a good tool for the job – but is it ready for the mainstream desktop? Not even nearly.

I’d love Linux to success in the mainstream but just being “not Microsoft” is simply not good enough anymore.

The Mac OS is clearly technically “good” – and the hardware is well sexy – but the closed ring-fence mentality at apple is just not for me – don’t get me wrong it’s been an inspired strategy over the last few years and has served them well. Tings like restricting their OS to their own hardware has removed the massive complications of supporting a load of 3rd party providers etc. But I want more choice than they can offer …

And as a consequence they aren’t that cheap either!

If it doesn’t “just work” then it’s costing me money. “Free software” is a complete misnomer if it takes 3 days to set up instead of 3 hours. Often people say to me “why would I pay £X for MS XX when I can get YY for free?”.

MS software is NOT expensive and I’m more concerned with Total Cost of Ownership than with the initial purchase. And I don’t subscribe to this crazy idea that software is not tangible and therefore has no value – software development is ever bit as much engineering as a tower block or bridge.

I struggled for months with “free” Open Source PBX systems – finally bought a commercial windows based  solution (3CX) for a few hundred quid which was set up in a day and has “just worked” ever since. Go figure!

So – it’ll be Windows 7 for me then – just installing the Beta today – hope I like it or I’ll really be in trouble ….!

Subscribe to my shared link blog

I’m now using Google Reader for reading most online content – I’ll be sharing any interesting stuff I come across  on my link blog – you can view or subscribe to my shared link blog here – Iain’s Link Blog.

I’m also on :-

Twitter
FriendFeed
Facebook

The ‘tech home’ project

This has been a bit of a personal project in planning for a while – and over the holidays it’s finally started moving from my head to reality!

The plan is for a whole house zoned audio system and server / remote  controlled lighting & electrics. So far I’ve got audio in the Living Room, Kitchen, Office & Bathroom. Bedrooms still to go and that should be it …. The speakers will all be turned on/off centrally – and heating etc can all be controlled remotely.

Windows Home Server

The hub of it all – It holds all the documents and also our dodgy music collection – I’m running a bit more 3rd party software on this than you’re supposed to I think. But so far so good …

SqueezeCenter / SqueezeBox

For Audio I’ve opted for the Logitech SqueezeCenter / SqueezeBox system. Based around the freely downloadable SqueezeCenter this is cheaper than the high end Sonos system but still quite flexible.

Bit of a mixture of SqueezeBox Receivers, Hauppauge MVPs, PCs & Laptops as the “clients”.

Controlled with the SqueezeBox Duet Controller which operates a bit like an IPod – or from a laptop etc. I hope to extend this to use a PDA and potentially touchscreen for control.

Harmony One

The touchscreen All-In-One remote from Logitech replaces about 6 remotes in the Living Room with one pretty neat intelligent touch screen remote.

Bye Bye Standby / Domia

X10 is still a big standard – but it is a bit old and creaky – and I didn’t like the idea of a 1/2 second latency. It’s also quite expensive in the UK. A lot of the alternatives including Z-Wave don’t seem to be readily available in the UK at a sensible cost.

Finally stumbled across the Bye Bye Standby (BBSB) range from Domia. It’s a bit more “end user” than some of these and is marketed as an energy saving system rather than a Home Automation system which is why I overlooked it for so long. It’s very economical and is RF based. I’ve got a few of the switches and remote controls etc working but no PC linkup yet – still waiting on the USB interface to arrive.

Harmony Home Automation Software

Going to use the Harmony Pro Software to control all the kit – so far it’s installed but got nothing to plug into it yet!

Lots more on this to come over the next few months ….