Rogue Infection: WARNING! YOUR’RE IN DANGER!

One of our clients received a link via an e-mail from a friend saying that they needed to purchase, download, and install a product to help keep their system running great!

• Rogue AntiSpyware blog: Registry Defender

Now, the machine is virtually unusable due to constant battering by pop ups from a product called System Security 2009 (also a Rogue AntiSpyware blog link). The rogue also prevents any .EXE from running on the system except an IE window that takes us to the “online activation system”.

We are going to flatten this system, extract their data from an earlier ShadowProtect image, and start fresh.

Since much of the infections legitimately found on the system are Trojan related, there can be no guarantees that removing them does not leave a backdoor of some sort into the system.

The desktop as it is now:

And:

Our client new something was well out of sorts due to the misspelling of “YOUR’RE” when the background started showing up.

Note the constant fight between the malware and AVG Free.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

Vista - A New Question for Troubleshooting - iTunes 8?

It seems that Apple is surreptitiously delivering and installing software without a user's permission.

One of the components of the recent iTunes 8 "update" is a known bad driver ... GEARAspiWDM.sys ... you draw your own conclusions on that one. BSODs are also indicating usbaapl64.sys as per the forum posts linked below.

Now, when we are receiving complaints about erratic behaviours, especially lately, we need to ask if the user has iTunes 8 installed and recently updated.

If iTunes 8 is installed, we need to remove the software and reinstall it, remove any unneeded software that was installed with the so-called update, then replace the bad drivers with known good ones or use System Restore to back things off.

Links to more:

• Ed Bott: An inside look at Apple’s sneaky iTunes 8 upgrade (original heads up).
• Ed Bott: Apple's sneaky iTunes 8 install pictorally.
• Apple Forums: Itunes 8 - Connecting Ipod cause Blue Screen on Vista.
• Live search for the offending driver: GEARAspiWDM.sys

We do not have a high iTunes install base with our clients, but we will be paying particular attention to whether a user has it installed or not until Apple fixes things.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Sage Accpac ERP - Version Mismatch Error - Refer to Solution ID 22331

A recent SBS Premium setup needed to have Sage Accpac ERP installed and configured with a SQL backend on the server.

This setup came after the fact.

The actual setup of the databases, connectivity, DSNs, and more will be in a separate post when we have a little more time.

For now, we had the following error on every workstation:

Sage Accpac ERP

Version mismatch. Two Microsoft support files (SQLSRV32.DLL and ODBCBCP.DLL) are different versions. Please refer to Solution ID 22331 for more information

A search for said Solution ID turned up nothing.

Since we were working with a SQL 2005 installed database, the thought was that something within Accpac was expecting an older SQL version, or some files were updated while others were not.

So, we searched the server and found the following files:

• SQLSRV32.DLL = Version 2000.86.1830.0
• ODBCBCP.DLL = Version 2000.86.1830.0

Since the versions on the server were seemingly the same, we moved onto the workstation and found the following:

• SQLSRV32.DLL = Version 2000.85.1117.0
• ODBCBCP.DLL = Not Found

We made sure to shut down Accpac, then we placed a copy of the SQLSRV32.DLL from the server on a network share.

Both files were found under %windir%\System32 on the server.

We copied the SQLSRV32.DLL off the share to the same %windir%\system32 location on the workstation after making sure Accpac was shut down properly.

We then tried to run Accpac and received the same Version Mismatch error.

So, we copied the ODBCBCP.DLL file off of the server to the same share location. We then copied the file from the share to the %windir%\System32 on the workstation.

We fired Accpac up again, logged on to the company file and we were connected successfully.

Here is a screen shot of what both the server and the workstation file compare after completing the file copy to the workstation:

Correct file versions on both the Server and Workstation

By the way, while searching for the solution, we came upon one so-called solution site promising a video of it. We were invited to install an ActiveX component before we could view the video though. We were not permitted to close the Tab that the site was in nor were we permitted to click the X to close the browser. That browser and its tabs could only be shutdown via the Task Manager and an End Task. As always, Internet "Street Smarts" are important!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Internet Explorer - Surreptitious Entry in the User Agent String

What does the Internet Explorer User Agent String say?

You can check it here: User Agent String.com.

By default on XP IE 7:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)

Okay, so it tells us that the browser is IE 7, on Windows XP and it has the three versions of .NET installed.

By default on Windows Vista IE 7:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506)

Again, it is quite simple. We have IE 7 as a browser, Vista as the OS, something about SLCC1, and the .NET components.

Now, what do we have here:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; TheFreeDictionary.com; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.04506.30)

We have it seems, some free advertising for a particular Web site going on. Somehow, whether by software install, spyware or malware install, the above .com site is in the User Agent String that IE shows to the world.

The InfoPath entry would have come by an InfoPath install.

To get rid of any unwanted entries, navigate to the following locations in the registry:

Windows XP:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

Windows Vista:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform

Delete the offending key and close all IE windows. Open an IE session again and navigate to User Agent String.com and verify that it is gone.

It only seems fair that the offending site ask permission for their name to be carried around the Internet. If the offending entry's permission came via some small print in a Terms & Conditions somewhere, then this situation demonstrates why we should be reading them!

This is one more little indicator for us to use to keep an eye on system health and integrity.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Surreptitious Software Install - SpyDawn

A client called complaining about some sort of spyware warning he was getting:




As you can see, Windows Defender is down and nothing is picked up as being out of the ordinary by Norton either.

Double click on the Windows Defender icon, and this is what happens when we click, "Remove All":


Heh, after a reboot the Malware was still there blinking away, and directing one to their, "Buy our Software" site when the blinker is clicked on.

So, onto the next step: Find out if there are others who have killed it.

It took some weeding to find a site that actually has info on it.

I came up with the instructions and a link to a utiltiy to kill it at BleepingComputer.com.

Essentially one needs to do this:

• Download the Removal Tool to the desktop.
• Reboot into Safe Mode (F8)
• Logon using the infected user profile
• Run the tool from the desktop
  

• Run option 2: Clean
• Answer YES to the registry clean option
• Disk Cleanup may or may not run
• Once finished, do not reboot yet
• Disable the System Restore to clean out any possiblity of re-infection
• Run Disk Cleanup: Start-->Run-->CleanMgr [Enter]
• Choose all drives if necessary and let the utility run
• Go back to the SpyDawn Cleaning Utility and hit the space bar to reboot
• Enable the System Restore once into the user's profile

The system should be Malware clear after this.

Now, one must ask the question, "Is the system safe to leave the shop at this point?"

Based on the research that I have done on this particular Malware threat, it is reasonable to say yes. Has the software's writers implemented some sort of Trojan? There is no 100% guarantee that they haven't. So, the client must be made aware of this.

Now, onto the logic behind this particular scenario:

Someone browses to a Web site and picks this software up without their knowledge.

The situation BEGS the following questions:

• When the person goes to the SpyDawn Web site, purchases their "Product", downloads it, and installs it, are they truly protected from threats?
• Given, in my opinion, the below the boards method for delivering the product "advertizement" in the first place, and the subsequent trap into purchasing the "product" ... how can we expect that installed product to behave above board?

What else can be said?

A legitimate software product, or method of advertizing, gives the end user the option to install the product or respond to the ad.

In all cases of software installed on a user's system, an option should be there to totally remove the software product from their system. The user should not have to pay a professional to do it for them!

UPDATE: Okay, so I misspelled Surreptitious in the title on my original post! It has been one of those days! :D

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

Software Installed Without My Permission

I use my MSN Messenger, Windows Live Messenger, and Windows Messenger installations to keep in touch with my clients and a few suppliers that have sales reps into it.

On our client sites, these programs are restricted via ISA Firewall policies for most users.

Windows Live Messenger just nagged me to update, so I did.

I got some sort of EULA for a toolbar of some sort that I denied, along with some indication that they were going to install some other programs.

I was not given the option to say NO to those other programs! I get cranky when that happens. The toolbar at least didn't install when I denied the EULA.

I DON'T like software being installed on my system without my permission. This is especially true since I spent many hours over many years cleaning out client systems of software that surreptitiously installs itself and does bad things.

Today, we have labelled most of those programs that get installed surreptitiously as Malware, or Spyware depending on their purpose.

While I realize that these particular programs are not necessarily categorized as either of the above, it goes without saying that, in principle, software should not be installed on a person's system without their permission.

Microsoft of all companies should know better! 8*O

There are the culprits.

NOTE TO MICROSOFT AND REAL PLAYER (or whatever the chicken your company name is): If I wanted your software on MY system, I would have gone to Real's site and installed it MYSELF.

NOTE to Real Player: Your software is NOT installed on my system, that is your player, and it won't be. And soon, neither will your Rhapsody stuff either.

UPDATE: Mea Culpa, that is, I stand corrected as per the one comment. Apparently I missed the do not install check boxes as they were quite small. If that is so the case, then please accept my apologies ... however ... my opinion still stands as regards software installing without my permission.

And, for that matter, for making the, "Do Not Install" buttons too small for these old eyes to see! Not really fair, IMNSHO. :)

UPDATE 07-02-18: I couldn't resist, I needed to verify just where I went wrong. Installed Windows Live Messenger 8.0 on one of my virtual XP Pro SP2 machines and logged off. When I logged back on, I received the update request and I followed through on it.

This is what I received:

When I saw that, I went through the same process on one of the Virtual Vista machines and produced the same result.

I know the update that I went through that originally spawned this post was completely different than this, as there were a number of different steps. Fluke? I am not sure. Perhaps a lot of people did complain and things were cleaned up? Again, I am not sure.

So, for now, my quest to verify what I went through is at a stand still. This situation does reinforce the need for me to take screen shots of pretty much everything and anything that I am doing!

UPDATE 07-03-09: Okay, I stand humbled. I made mistake, and my apologies to those affected by my rant. I ran through an update today that I allowed all of the check marks to stay on with, and essentially went through what I experienced initially. Must have been a really bad day that day! 8*(

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists