Microsoft TechNet - remote access trojans.

Spy Sender Trojan - removal instructions.

Labels: 2003

First off, make sure you have the GNU Tools for Win32, MinGW, and MSYS installed and working.

Then, create the following makefile in your project folder (note, any indented lines must be done using the TAB character, not spaces):

############################################

# MAKEFILE FOR main.exe -- last rev 2003-11-14 TGH



# NOTES: 

# - This makefile was designed for compilation using MinGW under Win32

# - Get GNU tools for Win32 (http://sourceforge.net/projects/unxutils/)

# - Get MinGW (http://www.mingw.org/)

# - Get MSYS (http://www.mingw.org/msys.shtml)

# - Make sure that the GNU tools and MinGW are in your PATH= statement 

# - Start the MSYS shell, cd to your project file and type "make all" to compile



############################################

# MACRO DEFINITIONS 

# (hint: "make -p" will spit out a default list for your environment)

# $@ - name of the file to be made (e.g. "main.o")

# $? - names of the changed dependents



CC=gcc

LINK=$(CC)



#COMPILE FLAGS - CFLAGS2 appears at the end of the command

CFLAGS1= 

CFLAGS2=

#CFDEBUG= -Wp,-DDEBUG

CFDEBUG=



#LINK FLAGS - LFLAGS2 appears at the end of the command

LFLAGS1=

LFLAGS2=



#OBJS is the list of all object files created by the compiles

OBJS=module1.o module2.o main.o

PROGNAME=main.exe



############################################

# IMPLICIT RULES

# $< - name of the related file that caused the action (e.g. "main.c")

# $* - prefix shared by both the target and the dependent (e.g. "main")



.c.o:

	$(CC) $(CFLAGS1) $(CFDEBUG) -c -o $@ $*.c $(CFLAGS2)

	

.o.exe:

	$(LINK) $(LFLAGS1) -o $@ $? $(LFLAGS2)



############################################

# MAKE TARGETS (all, clean, install, etc)

# - all: should be the first link target within the make file



all: $(PROGNAME)



clean: 

	-rm $(OBJS)

	-rm $(PROGNAME)



install:

	@echo No action taken.



############################################

# MODULES TO BE COMPILED



module1.o: module1.c module1.h

module2.o: module2.c module2.h

main.o: main.c module1.h module2.h



############################################

# PROGRAM TO BE COMPILED (.EXE)



$(PROGNAME): $(OBJS)

	$(LINK) $(LFLAGS1) -o $@ $(OBJS) $(LFLAGS2)



### END OF MAKEFILE ###

Once that's finished, and you've changed things like main.exe, module1.c to match your project, open up the MSYS window and type the following commands to compile:

UserName@MACHINENAME ~
$ pwd
/home/UserName

UserName@MACHINENAME ~
$ cd /c/dev/projects/test/src

UserName@MACHINENAME /c/dev/projects/test/src
$ make clean
rm module1.o module2.o main.o
rm main.exe

UserName@MACHINENAME /c/dev/projects/test/src
$ make all
gcc -c -o module1.o module1.c
gcc -c -o module2.o module2.c
gcc -c -o main.o main.c
gcc -o main.exe module1.o module2.o main.o

UserName@MACHINENAME /c/dev/projects/test/src
$ ls *.exe
main.exe

Labels: 2003

Getting started with MinGW

So I'm trying to dust off my very rusty (and crusty) C and C++ skills and I've downloaded the MinGW compiler and the MSYS package. On the plus side, compiling with MinGW means that you don't need the Cygwin stuff in order to distribute windows-only binaries - but on the down side, MinGW has very little documentation (I have yet to find a central site). I guess you could try the GCC home pages since MinGW is a port of the GCC compiler collection.

Anyway, it took me a bit to figure out how to compile and link a C application where I have (1) module (usage.c and usage.h) and (1) program (main.c). To compile this into a working .exe file requires the following steps if you're doing it by hand:

gcc -c -o usage.o usage.c
gcc -c -o main.o main.c
gcc -o main.exe main.o usage.o

Now that I know those basics, I need to remember how to use makefiles...

Labels: 2003

OpenSTA is a decent tool for testing out websites. The learning curve for it is a bit steep until you manage to figure out exactly what bits are which and how to do a simple test. However, it was good enough to test a web application that I wrote at work that depends on a value passed back and forth to maintain session state (rather then depending on a server-issued session cookie).

Labels: 2003

Silent PC Review is a site dedicated to finding the quietest PC components and systems.

Labels: 2003

We're currently running NovaNet8 Alliance at work for our tape backups, but we're looking to upgrade to gain some additional features that weren't in 8.00. Unfortunately, they won't let us upgrade to 8.50 which would serve our needs but are forcing us to upgrade to v9 - and they've changed the licensing model so we'll have to pay twice as much for the upgrade compared to previously.

So now we're ticked off - and since NN8 seems to be really finicky about whether or not it will successfully backup to tape every night anyway, we're exploring alternatives. So here's the short list of the products that I know about that support tape, backup to disk, multiple O/S (Windows, Netware at the moment), do media management. Basically, enterprise level backup software. It also has to support our Sony SDX-500C AIT2 tape drive (NovaNet 8 didn't bother reading the AIT memory chip, and just played the tape like a dumb tape).

ArcServe by Computer Associates
NovaNet by NovaStor
Backup Exec by Veritas
Tapeware by Yosemite(?)

Labels: 2003

Ewwww, ne'r rains but it pours. Installed the latest Windws Update from MS for my Windows 2000 Server (fixes the DirectX flaw by upgrading to 9.0b) and upon reboot was presented with:

STOP: C000026C Unable to Load Device Driver ... \redbook.sys

Which according to Microsoft's web site supposedly means that there's a damage device driver on the hard disk. My copy of redbook.sys was dated Jun-19-2003 and was 35,344 bytes - on the other Win2K server it's 35,344 bytes. So it's the same size, but perhaps not the same content.

One solution says to boot the setup CD, then go to Recovery (R) and Console (C), pick the number of the installation you wish to use and enter the administrator password. Then type disable xxxxxx.sys where "xxxxxx.sys" is the name of the driver that failed.

Well, I got an error saying that it couldn't find the registry entry for service redbook.sys. I also was unable to copy redbook.sys from \WINNT\$NTServicePackUninstall$ and get it to boot. So finally, I renamed redbook.sys to redbook.bad and got the server to boot.

Not 100% sure what the next step is - guess I'll try copying the redbook.sys from the other Win2K server and see if I can get a boot. (But first, I'll update my ERDs!) -- Well, copying the file from the other server results in BSOD again, so the file that I had on the hard drive was already the proper file. That points to registry as the problem (probably have to uninstall/reinstall the CD-ROM driver as a guess).

So, searching through the registry on the other server for "redbook.sys", I see it occuring under a key that also has "Digital CD Audio Playback Filter Driver" as a value (good find), as well as entries under the EventLog where the different events are defined by the various applications (not important find). Kind-of confirms my guess that I'll need to uninstall/re-install the CD-ROM drivers.

Uninstalling/reinstalling CD-ROM caused the error again. pcAnywhere is also refusing to load the host service when I try to remote in rather then stand at the console. At this point, I've renamed the driver file again, have the system booted up and I'm going to spend some time doing backups and getting the data safely stored before I try other things. (This is my 275Gb RAID5 box, so I'll be rather peeved if I have to rebuild it or I should happen to scramble the disks. I already use an external 120Gb USB2.0 drive as a backup for the contents, so I'd never lose more then a single day.)

Update: Ultimately, I never managed to find/fix the root cause of the issue. Renaming redbook.sys out of the way using the Recovery Console allowed me to boot the server and continue using it normally except for functionality provided by redbook.sys. The server finally crashed hard over the Labor Day weekend requiring me to rebuild it anyway.

Labels: 2003

Various articles relating to Windows2000/XP/2003 Encrypted File System:

Decrypting EFS - Winter 2000 issue of Win2000 Magazine

LabMice.net index of EFS articles

Labels: 2003, WindowsEFS

Promise's SX8000/RM8000 unit which holds (8) IDE drives in a RAID5 configuration, total cost for 1.5Tb of storage was $3.44/Gb.

Well, they also make an RM15000 unit ($4000) which holds (15) IDE drives. Figure (1) drive for the parity bit and (1) drive for a hot-spare and you have theoretical capacity of 3.17Tb at a cost of $2.62/Gb. Using the 160Gb drives (currently $160 each in bulk) you'll end up with a 2.03Tb array at a cost of $3.08/Gb.

FYI, the largest SCSI drive on the market is 180Gb at a cost of $1300 each, so figure the cabinet and hardware to hold the drives would be $2000, and total drive cost of $19500. Resulting cost for 2.28Tb of storage is $9.21/Gb -- which is 3x the cost of the equivalent IDE solution. But the SCSI solution is more suited for primary storage (speed, reliability, warranty).

Labels: 2003

Prepare for Gigabit Ethernet networking
By Brian M. Posey, TechRepublic, March 19, 2003 -- Good article explaining some of the pitfalls about the move to gigabit ethernet.

So I'm getting ready to switch over to Gigabit Ethernet both here at home and at work. Netgear makes an 8 port hub that is only $600 or so (NetGear 8-port Copper Gigabit Switch, GS508TNA) and the ethernet cards are only $125 or so. I've been doing some bench testing of read/write speeds to my local drives vs across the network, and even on an empty (just me and the server) ethernet segment I'm only seeing throughput of 2.0-2.5 Mb/sec when average over a 5 minute interval. The servers on the other hand are able to provide 8-20 Mb/sec reads and 4-12 Mb/sec writes (IDE drives, SCSI drives are 40-50 Mb/sec read and 6-10 Mb/sec writes).

My goal for the office is to switch over to gigabit between the hubs with gigabit to the servers.

Labels: 2003

We've been considering switching to using a huge array of IDE drives instead of backup tapes for the office (tape drives being notoriously fickled unless you baby them *every* day). Anyway, I priced out a low-cost, secondary storage system to get a feel for pricing.

SuperMicro SC830 server case (pedastal style). It has (9) externally accessible 5.25" drive bays, 2x400W power supply, (3) 3.5" bays and is only $750. The case design looks very good, plus since the 5.25" drive bays are external, I can use the Promise SuperSwap 1000 drive bays ($80) to get hot-swap capability. Add in the Promise SX6000 raid card ($300) and I can chain together (6) ATA/100 drives. Figure about $750 for guts (CPU, RAM, MB) and $750 for the O/S.

$750 SuperMicro SC830 server case
$750 CPU, RAM, MB, etc.
$750 O/S
$300 Promise SX6000 raid card
$640 (8) SuperSwap 1000 bays
$160 (2) 80Gb HDs for the O/S and Apps
----------
~$3500 base cost

IBM 120Gb $140x6 = $840 - net 480Gb $9.04/Gb
IBM 180Gb $220x6 = $1320 - net 720Gb $6.67/Gb
WD 250Gb $320x6 = $1920 - net 1000Gb $5.50/Gb

So, for about $5500 you can setup a server that will house 1000Gb of secondary storage using plain old IDE drives. Pricing using SCSI drives would be around 3x that as a rough guess.

There's also the alternative of using one of the Promise Tech external SCSI-IDE RAID units, which will house (8) IDE drives and connects to the SCSI port of the server. Pricing for the Promise SX8000 unit is $2600, but all you need to add then is (8) IDE drives. This is actually a lot cheaper as you're able to make the array 50% larger by just adding 2 more disks. Personally, I like the idea of the external unit because you don't have to fiddle with setting up another server and the cost per Gb really drops.

IBM 120Gb $140x8 = $1120 - net 720Gb $5.17/Gb
IBM 180Gb $220x8 = $1760 - net 1080Gb $4.04/Gb
WD 250Gb $320x8 = $2560 - net 1500Gb $3.44/Gb

Labels: 2003

Internet Transfer Control ActiveX control sounds like what I'm looking for (trying to find out how to read the contents of a URL into a string variable to be processed.

google search

VBIP - control is only available in VB/VS v5 and v6 (Pro and Enterprise editions)

Labels: 2003, VisualBasic