Disaster preparation 101 -- Data backup

In this one I will talk about Disaster, it happens to all of us from time to time. A fire, a earthquake, a stolen laptop or any number of ways. So what happens to your data, is it stored on the laptop? Is it important very sensitive data? Could you get fired if you lost that data?

[ad#ad2-right]These are all questions you must ask yourself when you have laptop. How do you backup your data or even do you have a backup? Having seen this with my own clients, I must wonder if there are people out there who just don't care. I had a client the other day who gotten a virus and this was a really mean virus. Deleted some very important files when you tried to clean the virus out. She called me in a panic because she couldn't load up windows? I asked if she had any backups, she said "what's a backup" . So I sat there discussing this with the client for over 20 minutes. Finally she started to understand, she said she had the OEM Backup DVD but nothing else. She also said she needed help with getting data off the computer. I told her that I would be able to come the next day and I was lucky the virus didn't do anything else to her data. We were able to retrieve the data from her system. That is where I start my rant , Why would anyone not have backup of there most important data?

So How do you backup your data? This is controversial and somewhat depends on how much people want to spend to keep there data safe and not loose pictures or music. There are several ways to do it, each way has it's pitfalls or short comings and requires a little more effort:

Kinds of Backup

Hard Medium - DVD, CD, External Hard drive

• Wikipedia's List of DVD backup Software -- This is good for beginners who want to explore how to backup options.


• Free Hard Disk Backups and Restore Software -- Gives you a list of great free backups and restore software to help you backup your system.


• GoodSync Backup --  This isn't free but helps you backup your software to an external drive and makes sure you have the most current files on your system.


• Some other Backup Software -- This is a variety of good backup software from Amazon.

Although,  The hard medium is usually used that doesn't mean you can have a backup other than hard.   Here are some ways to back up on the internet.

Internet Medium:

• Jungle Disk -- Provides online storage through the Amazon s3 service.   Only pay for what you use.   It works well with most Operating system.  I've used it on Vista so it is really nice.


• Carbonite Online backup --Another good Online storage.


• Some Other Online backup -- Here a list from Amazon to better help you find the type of software that you might need.

These are just a few options, if you want to look for other you can.  The important thing to do is BACKUP because if you need some data that gets wiped or destroyed.  You will be kicking yourself for not backing up.

Uncovering a Virus/Trojan

Getting done with the first part really got my juices flowing. I was shopping looking and thinking about this next article. I came up to only one option turning this into a 3-5 length post due to all the content that I will have.  So where did we leave off?  Oh that is right figuring out if you have a virus/Trojan.  The instant I made a post about this 12 hours later someone make a comment and here is what he said:
[ad#ad2-right]

Rene Van Belzen

I can't wait to read part two of this article. I always wondered how you'd know you're infected if a virus don't want to be detected and no virus definitions are yet available, because the virus is so new.

Now the truth is anytime a Virus does something it usually leaves a footprint somewhere and somehow.   Even the hardest working hacker can't plan for all possibilities and that is where we begin.   I have been helping people for a while with viruses and know that no matter how hard the virus tries to hide you can usually find it relatively quickly and easily do to virus check here are the ways I've done to figure out if they may or may not have a virus/Trojan.

Now if this is a client's computer and you don't want to be rude to the client, there are a few indications of user error and installing a virus.   This is relatively simple, all you do is do a quick inventory of all the start menu programs.  You'd want to look for any P2P file sharing program, If they have Firefox Installed, and if they are using Window Mail and not Thunderbird.   You see 80% to 90% of virus downloaded are installed by the End USER.  They either downloading a game and installing a virus with [ad#ad2-left]a game, or not protecting themselves by using Internet Explorer or Using Windows Mail.  That is usually my first step due to the fact, I've got to be diplomatic about finding out about security ways.  Also make sure they are up to date on there Window updates, unless they are using a really old system then you will have to work even harder.  Also you can suspect a virus if the client is talking about having problem with a program recently although this isn't always true it sometimes is the case due to the fact hackers don't have a big chance to test these viruses/Trojans out before they set them into the wild.  So there are always going to be unplanned problems associated with them.

After the first initial search of desktop, you should really know the likely hood of a possible virus getting on the system and later we will talk about counter measures to prevent virus attacks in the future.   There are a few places a hacker likes to put commands.   Hackers love to put in the Registry to run a program every time Windows starts.  It usually in:

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

Usually 50% to 70% of virus like to make sure the program to runs.  This is a flaw in Windows because hackers can edit this without much effort but there isn't many places a hacker can go to make sure a program is set to run when you boot.   So this is also a benifit to finding those little programs.

Now just like the Regisitry, Hackers also like to put programs in a few areas on the hard drive.   This is also kinda hard to hide because most of the time these are consider important to the system but if you know what to look for you can pretty much figure out if it is truelly a system file.  These areas of the hard drive are:

• C:\WINDOWS\System32[ad#ad2-right]


• C:\WINDOWS


• %programfiles%\common files\microsoft shared


• %windir%\temp\

These are just a few but if you look hard enough it can be found most of the time.   Most of the time I use the registry to tell me where these programs are so I can do a further check of the program.  Some of this is not needed with some of the programs that I recommend but this is for those who want to be a through job and make sure the virus is gone.

On my next post we will talk about some good tools for the trade to help get rid of a virus/Trojan.  This little step here is used to  better help identify a virus and also give you chance to google each name on the list of registry and the hard drive  to see if you can identify the virus.

trojan.zlob removal tricks!!

[ad#ad2-right]

Aliases:
Trojan-Downloader.Win32.Zlob.qyl (Kaspersky)
Trojan-Downloader.Win32.Zlob.qzs (Kaspersky)
Trojan-Downloader.Win32.Zlob.qzn (Kaspersky)
Trojan.Zlob.CPP (BitDefender)
Puper (McAfee)
SystemDefender (Symantec)

Trojan:Win32/Zlob.G is a component of Win32/Zlob that downloads rogue security programs, adware, and additional Win32/Zlob components.

[Via Windows Live OneCare]

[ad#ad2-left]This one just popped up today on my radar it seems to be a very low threat on everyone's radar according to my sources say "Trojan.Zlob.G is a Trojan horse that may download and execute remote files and redirect the Internet Explorer home page and search page."  So to remove this little Trojan you would want to download one an Anti-virus and firewall.   Once you install the software the program should fix the problem for you.   This one seems to be really easy to fix.   So Please read my post on how to better protect your self if you want to prevent this in the future.

Viacom and ATT layoff some people. (12,850 People)

Today, we are announcing a company-wide restructuring plan that includes staffing reductions in all divisions. This will result in a reduction of our worldwide workforce of approximately 7 percent, or about 850 positions. We are also suspending salary increases for the Company's senior level management in 2009. In addition, after a comprehensive review of our operations, we will write down certain programming and other assets. These three actions will bring us significant cost savings and other efficiencies.


[via Gawker]

[ad#ad2-left]This is a Sad day for the telecommunications industry both AT&T and Viacom are laying off people. According to reports Viacom will lay off around 850 people. ATT will layoff 12,000 Jobs. Here's the quote from Associated Press:

AT&T Inc. joined the recession's parade of layoffs Thursday by announcing plans to cut 12,000 jobs, about 4 percent of its work force.


[Via Associated Press]

So in all today total that is 12,850 people who are going to be laid off. This is another set of layoffs but isn't the last to see the whole list of of Layoffs in the Tech industry that I've talked about please click this link. You may find some usefull tidbits if you search my blog enough, I've got some great tips on getting hired and what you should do to be prepared.

Spying on Spyware.ISpynow!!

[ad#digg-right]This is another Virus that is going around and thought I'd tell you about it:

Spyware.ISpyNow monitors files, network traffic, and keystrokes. This Spyware gives the person who installed it a Web-based interface with summaries of logged information on the host computer.

[Via Symantec]

[ad#ad2-left]Now this one isn't to hard to figure out what happened.  You have to manually install it on your system to get infected.  Symantec has a great way on uninstalling this annoyance.  I also suggest checking out my other program list just in case you don't want to buy Symantec Anti-Virus programs.  Some other things to check out is:

• Avg detected Trojan Horse Generic 12.htc? - This has a great article on how to use HiJackthis program and how to make sure you no longer have the virus.
  


• Some Important programs to prevent yourself from having viruses and Malware!! -- This article gives you some other programs to use other than Symantec.   You have a wide variety of choices on Anti-virus programs and Firewall Choices.  You also have some choices on Spyware removal programs.

This is just the beginning in getting your system clean.  You have to keep all you programs up to date and one way I do that is with Appsnap.  This little program keeps you programs up to date from Virus to Firewall.  I hope this helps people prevent and control spyware.

Not so, Antivirus2008

[ad#ad2-left]On F-secure blog they talk about this rogue antispyware.

OK, so let's say the user (by some stroke of luckless chance, or courtesy of a trojan downloader) ends up with the demo installer of Rogue:W32/VirusRemover2008.C on their hands and it runs
[via F-Secure]

According to them, they have many different version of this rogue antispyware.  They have de, dk, es, fr, it, no, nl, and no, which are all attempting for you to buy this no so Virusremover2008 software.  They talk about how it tells you have a 9 infected viruses and that you need to remove them, but in truth, they use a text file to create this lie.  Check out all the details for further information.

Microsoft issues Vista patches out of Monthly Patch Cycle!

Microsoft issues Out of cycle patch for Vista.   These patches are as Followed:
[ad#ad2-right-1]

Kb957321


An update rollup is available for the Microsoft Windows Imaging Component (WIC) in Windows Vista or in Windows Server 2008. This update rollup resolves the problems that are documented in the following articles in the Microsoft Knowledge Base:

954708 An update to add support for the serialization of complex Extensible Metadata Platform (XMP) data types in the Windows Imaging Component

945060 There may be inconsistencies in the Extensible Metadata Platform (XMP) and Exchangeable Image File (EXIF) values for an image file in Windows Vista and in Windows XP

KB959108

The Windows Portable Device (WPD) API collects and transfers Software Quality Metrics (SQM) data to Microsoft servers. The SQM data is collected only on an opt-in basis through the Microsoft Customer Experience Improvement Program. An update is available that disables the collection and transfer of SQL data to Microsoft servers.



This update affects Windows Vista-based computers, Windows Vista Service Pack 1 (SP1)-based computers, and Windows Server 2008-based computers that are in the Microsoft Windows Media Player Customer Experience Improvement Program.

KB959130

On a Windows Vista-based computer or on a Windows Server 2008-based computer, you install a third-party Web browser. You set the third-party Web browser as the default Web browser. Then, you run the Connect to the Internet Wizard. However, if you select the Browse the Internet now option, Windows Internet Explorer starts instead of the third-party Web browser that you set as the default Web browser.

[ad#ad2-right]This seems to be not so important.  All of these are not really security related but it does surprise me that Microsoft wanted to release these out of Cycle.   If your planning on using your Vista laptop during the holidays you might want to update your vista machine before you go.  I don't think there is going to be any major issues with this but if there is, you can always remove these updates later.

Some program Vulnebilities Detected!!

Just got done looking at some of my security sites and according to SecuriTeam there are are several programs that have vulnerabilities. here are the Ones that I've found:

Google chrome is vulnerable to URI Obfuscation vulnerability.
An attacker can easily perform malicious redirection by manipulating the browser functionality. The link can not be traversed properly in status address bar.This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from unsuspecting users. The URI specified with @ character with or without NULL character causes the vulnerability.

[ad#ad2-right]iPhone Configuration Web Utility for Windows Directory Traversal
iPhone Configuration Web Utility lets "you easily create, sign and distribute configuration profiles using a web browser". A vulnerability in iPhone Configuration Web Utility allows remote attackers to access files that reside outside the bounding root directory of the program's files folder.

Streamripper Multiple Buffer Overflows
Streamripper "records Shoutcast and Live365 MP3 streams to a hard disk, creating separate files for each track. Runs under Unix and Windows." Secunia Research has discovered some vulnerabilities in Streamripper, which can be exploited by malicious people to compromise a user's system.

Amaya URL Bar Stack Overflow Vulnerability
A vulnerability in Amaya browser allows remote attackers to cause it to overflow an internal buffer which in turn can be leveraged to execute arbitrary code.

These are the ones that I found and wanted to let you know about these so you can make your system even more secure.   if I find any others I'll let you know!!!

AVG Detected a False Positive

[ad#ad2-left]According to Security and The Net:

An update for the AVG virus scanner released yesterday contained an incorrect virus signature, which led it to think user32.dll contained the Trojan Horses PSW.Banker4.APSA or Generic9TBN. AVG then recommended deleting this file; this causes the affected systems to either stop booting or go into a continuous reboot cycle. So far, the problem only appears to affect Windows XP, but there is no guarantee that other versions of Windows don’t have the same issue.

[Via Security and The Net]

[ad#ad2-right]I bring this up because this is a false positive according to AVG. AVG since sent out another update to there Database and you can go and update the database to get rid of this problem. If you need to restore that DLL check out the article Security and The Net, they got some excellent suggestions on fixing the problem.

If you've not been affected by this yet, you probably won't be. It is yet unknown how many people have been affected. I'm blogging about this to tell people about this and to warn people that not all of warnings from AVG are true and that is why you should always ask before you delete or do anything to your system. I always USE google when it comes to these types of questions

Avg detected Trojan Horse Generic 12.htc?

Just got a warning from AVG about, trojan horse generic 12.HTC, haven't heard of it, anyone out there hear if this one? apparently it infects explore.exe, and after months of explore.exe crashing I'd say it's a legit virus.

[Via Answer Bag]

Some tricks and tips to remove this little virus is quite simple. It is embedded in your system so how do you remove this threat? Easy follow these steps and you will have a better chance of getting rid of the virus:

1. Find out all you can on the virus -- Finding out the extent of where the virus lays is really a good idea.  Just because you found one place doesn't mean it isn't also hiding some other place.  Some good ways to figure out where it might be is to download Hijackthis and Then onces you download it and install.  Run it, and when you get the LOG file you will want to go to HijackThis Log Analysis Site 1 and HijackThis Log Analysis Site 2, and see what it says.



2. See if you can remove the Hidden Virus -- After you find out what the extent of virus may lay.  You will need to download these programs.  Run whichever ones you like to see if you can locate and delete the virus.  You may also consider using one of the several onine services to see what they might suggest or see if they can find this virus.
   


3. Check your services and reboot sequence -- After you think you've gotten rid of the virus, reboot and do a rescan.  Usually the Virus will respawn after you reboot, some of them have a command in the reboot sequence.   You may want to check your reboot sequence, by check with MSCONFIG.  Sometimes it is hidden but if you check through the MSCONFIG for any files that might not need to load.  Also check the services tab and see if there is any services that may not be needed.  The best bet is to google search each service or program that is in there and see if that might fix the problem.



4. Might be time to re-install Windows -- Although this is the hard for people, this can sometimes fix the most challenging virus.  You need not have to loose your important data.  The only thing to remember when you back up is when restore you data after you re-install windows.  Just remember one thing, if it is  an .EXE, .COM, .BAT, and .MSI extensions than that might risk you getting the virus all over again.  Although remember that you will need the other tools I talked about on #2 to keep from getting the virus again.

These are some tricks I use to get rid of a virus and now I've shared them with you and now it is up to you do the work.  If you have any tips or tricks to get rid of a virus leave a comment.

Obama Wins with McCain Leading the 2nd!

[ad#ad2-left]With Obama wining the Presidential Elections and McCain giving his concession speech.  We see a lot of potential going to be coming along.  I see the Democrats take charge of the US Senate.  I also see the House seats have gone to the Democrats.  So what is next for the next President, with the inauguration coming soon, what will the new president pick for the Chief of Staff.  I know he has some choices but which one will it be?

In some of the sites with his Bio, they talk about him being the First African American President:

• Biography.com


• Wikipedia.com

[ad#ad2-right]Some thing to consider with the Vice President is that it will be Joe Biden.  Now I don't know very much about him but what I do know comes from the internet.  I wont't say much because I don't know much but I will direct you to the pages that I know about:

• Huffinton Post


• Wikipedia.com


• CNN Election Profile


• Joe Biden Delaware Page

I will find out more in the coming weeks, but right now we are making history.  What is your responses on what happened?  Are you happy or angry?  Is the signs of even more economic instabilility?  These are all questions that we have to consider in the time to come!!

Backup your Mozzila Thunderbird profiles

So you have all this mail you want to back up in case something terrible happens to your hard drive.  So here is ways to backup your email and other programs in Vista.  I think Vista has a new way of keeping program profiles in an hierarchical setup.  So what is the HIDDEN directory it is:

[ad]

C:\Users\[USER]\AppData\Roaming\Thunderbird\Profiles

Now as you can see your Thunderbird profile is in a hidden directory in the AppData Directory.  You can easily get to the hidden directory by typing %appdata% {enter} in the search bar of Vista.  Now How do you backup and restore.   The program I use to backup is GoodSync.  I send the data to the cloud and when I need it I can restore it back to the directory. Now what about restoring, if you have to do a complete re-install of Thunderbird you can always copy over the back up to the Thunderbird Profiles directory and install Mozilla Thunder bird and it should see it.   If by chance you load up Thunderbird and you have to re add everything you would have to delete everything in that directory and then restore from the back up.

It is also a good idea to backup all the roaming directory from time to time.  This way you have every important program needed in case of a problem with your drive.    These are just a few tips and tricks to keep your data safe from having problems in the long run.

[ad]

Having trouble with I-tunes Here is way to fix the problem:

I've been having problem with I-Tunes lately and I wanted to talk about how to fix the problem that come along with using it.

Err = 8008 [A corrupt file that can't be completed due to some kind of glitch in downloading the file. It can happen to anyone at anytime.]

[ad]

To Fix the problem here are the steps you must do:

• 
  

  Go to the I-tunes Music Directory - C:\USERS\[USERNAME]\MUSIC\ITUNES\ITUNES MUSIC\DOWNLOADS

  
  


• 
  

  Look for the corrupt files, depending on the problem you can expect to see two or three directories. Find the one directory that has the corrupt file and delete the whole directory.

  
  


• 
  

  Once that is done load up I-tunes and go to the Store Tab and Check for Purchases.

  
  


• 
  

  This will get I-tunes to download the file again.

  
  

[ad]