Archive for September, 2006

Weekly Tips

paul.e.dearment.jr| September 22, 2006 6:58 pm

I got to looking as to what part of my blog gets updated the most, and one of the fastest growing parts is the tips and tricks. I mean, what better thing could there be. I know there are a lot of tip and trick websites out there, but hey, I hope to eventually have some original ones. That would be cool, but that means I need to start getting creative. So. Look for the tips and tricks section to be updated at least once a week. Who knows, maybe I will get ambitious and do it more than once!

W32.PIPELINE REMOVAL

paul.e.dearment.jr| September 20, 2006 7:05 am

I have written up instructions on how I have been able to sucessfully remove the W32.PIPELINE virus from infected systems. Thanks to John Beasly who helped in the process as well as Gina!

Click here to get to the instructions.

How to remove W32.Pipeline

paul.e.dearment.jr| 5:40 am

………Or, how I was able to remove this annoying aim virus from 2 different computers(with help from Gina and John Beasley)

Unfortunately the newest AIM virus is tricky, and therefore unable to be removed by just anyone. A little computer knowledge is needed. So if you got here because you are infected by the virus and you don’t know anything about computers you have two choices. One, you can format your hard drive and reinstall everything(works well—and is needed once in a while anyways) or you can get someone you know that is computer savy to follow my directions here.

Tools you will need:

  • Barts PE Builder CD(http://www.nu2.nu/pebuilder/download/)
  • A good file manager(Servant Salemander) for BartPE. The page where it can be found is here: http://www.hallsted.us/barts-pe-plugins-mlh/barts-pe-plugins-mlh.html
  • A good antivirus installed on BartPE Builder(winclam antivirus works well—helped to identify that the virus hides in the paging file the first time I did this)
  • Your Head
  • Your Eyes
  • A good antivirus installed in Windows(I recommend AVG: http://free.grisoft.com/doc/5390/lng/us/tpl/v5)
  • Crap cleaner(http://www.ccleaner.com/)
  • Security Task Manager(http://www.neuber.com/taskmanager/)

Ok, so to remove this nasty W32.Pipeline virus, there are a few steps. It seems like a lot on here, but once you get going, it goes by pretty fast.

The first step in the process is to create a good BartPE Builder CD. All you need is the basic cd as well as winclam antivirus and the file manager plugin. The BartPE site has an excellent tutorial on how to create their disk, so I will let you read their information on their site. I recommend that you create the disk on another person’s computer. Also, please note that there is important information on there about licensing. I can/will not be held responsible if you do not follow the licensing. This is an important legal/moral issue so I suggest you fully read and understand it. The website has an excellent FAQ, and licensing is covered under there.

The next step is to install and run Security Task Manager. This is a great program because it sorts out items by threat level based on different characteristics of the program. Go into the program, and notice any processes that are marked with a high danger level that you do not recognize on the system. Note those processes, and if you have internet access, use your favorite search engine to locate where those processes should be on the machine. If any of those processes are in the wrong location, write them down. We will remove them in a little bit.

Update your Antivirus to the latest definition files if it isn’t already updated.

Next, you need to disable system restore. How do you do this? I thought you would never ask.

In Windows XP:

    Go to your control panel(STARTSETTINGSCONTROL PANEL or (WINDOWS KEY)+R  control.exe)

    On the control panel, choose System

    Inside of System, Click on the system restore Tab

    Check the box that says: “Turn off system restore”

    It will take a moment as all the system restore items are erased. After that is done, the next item of business is to install a good antivirus program onto your system.

I recommend AVG antivirus for a good free personal antivirus. AVG FREE can be found at the following link(http://free.grisoft.com/doc/5390/lng/us/tpl/v5)

Make sure to update the antivirus fully before continuing.

Next, use Crap Cleaner

    Download and install Crap Cleaner

    Reboot the computer into safe mode

    Run Crap Cleaner and have it delete all of the temporary files

Reboot the computer, and boot to the cd created with the BART PE Builder

Load the file manager

After that is done, the real fun begins:

    Navigate to your root directory(default: c:\), or if you have a custom setup, to where your paging file is located.

    Delete the paging file. Don’t worry. It will be recreated when Windows reboots.

    Delete the files ntp or any variation on the name ntp as well as any other unusual files that are on the root of your hard drive. (again, default is C:\) The reason that this virus is so effective is that it is able to create randomly named files that sit on the hard drive, and in the paging file(sneaky little beast)

    Navigate to the system32 folder

    This is where the whole thing either goes or it fails. The system32 folder is where each of the last few executables will be. And by few, I mean many processes with long random names. An example of one of these processes names is: cjnr4r4lxitfrdp.exe You will need to make sure that the file manager is set to show hidden files as well as system files and is sorting by name. Go through the directory and delete any files that have names that are long and random like the file above. They can start with any letter of the alphabet, so it can be a long and tedious processes to find them all. After you have checked through the directory once, check it again to make sure you didn’t miss one.

    If there were any processes on the list you created earlier, delete those processes now.

    Using clamantivirus, run a full virus scan on the system. If it detects any viruses on the system, delete those files as well.

    Reboot your computer back into safe mode.

    Run a full scan with your antivirus again just to make sure that all viruses are cleaned up.
    Another way to make sure that the virus has been removed is to make sure to remove the b2_log.txt file on the root of the hard drive. If this file is removed, and then you reboot(not into safe mode) and after about ten minutes it still is not present, then you have successfully removed this annoying virus.

If you have any questions or comments, please feel free to reply below. I will check on messages that I get once in a while. Thanks for sticking in there!

What people search for….

paul.e.dearment.jr| September 19, 2006 4:50 am

Its kinda funny to look what people search for when they get to my blog. Early on it was stuff such as “my orange peed on me”(this is a quote in my quote database—don’t give me that weird look!)

Now, its pretty much all the same. Some variation on how to hack the Verizon Motorola V3c and add ringtones to it for free. I keep getting more and more people looking for that information on daily basis. Looks like people only come to the blog to get that information. ::Sigh:: Kidding. I’m glad that people are getting it. Like I said in the post about the phone. If I don’t have to pay for it, I want it! The funniest thing is, one of the top ten items(search wise) that gets people to my blog is: “Becky Blackmon”

Increase Bandwith Usage in Windows

paul.e.dearment.jr| September 16, 2006 2:09 pm

The following information is taken from the website Smartbro’s Ups and Downs I tried the steps theat were provided in the post, and you know what. I was able to perform a bit faster on the web. I love surfing the web faster. Makes my life more fun.

Quote from the site:

Broadband connection are fast. But did you know that you can still increase the speed (bandwidth) of your broadband connection (e.g. Smartbro wireless broadband). You can still speed up your bandwidth by 20% more without cost. Just follow this simple step but be extra carefull because it involves editing your registry.

Because Windows XP seems want to reserve 20% of the bandwidth for its self. Even with QoS disabled, even when this item is disabled. So why not use it to your advantage.

This is for broad band connections.Make sure your logged on as “Administrator”. Do not log on with any account that just has administrator privileges.

Click Start>run>type “gpedit.msc”

Expand the “local computer policy” branch

Click “Computer Configuration”

Expand the “administrative templates” branch

Expand the “network branch”

Highlight the “QoS Packet Scheduler” in left window

In right window double click the “limit reservable bandwidth” setting

On setting tab check the “enabled” item

Where it says “Bandwidth limit %” change it to read 0

Reboot if you want to but not necessary on some systems your all done. Effect is immediate on some systems. Some need re-boot.

Scratch and Sniff

paul.e.dearment.jr| September 14, 2006 6:25 pm

Scratch and sniff the picture below to discover what the secret scent is. Its a new technology that responds to finger motion and pressure on your screen. No special software to install. Its all handled via the web server. Try it out. It was cool when I found it!

scratchandsnif.PNG

File recover for those awful moments in life….

paul.e.dearment.jr| 2:41 pm

So I was working on putting together a memory key with a ton of portable apps on it, when I came across this interesting app on a website. The program is called Restoration and can be found here. That file there is a beauty. Now. It won’t be able to recover a file from the hdd if you, say, format it and then reinstall windows on it. But you delete it and empty it out of your trash can or you accidently hit < SHIFT >+< DEL > then this will be able to recover that file for you! Here is a tip. When recovering the file, restore it to a memory key so that you don’t accidnetly overwrite another file.

Hacking the Verizon Motorola V3c

paul.e.dearment.jr| September 13, 2006 8:57 am

EDIT: Since some people wanted direct links. Here they are in the post now!
Verizon. How I loathe thee at times. Verizon decides to lock down their phones so you have to buy music from their VCAST system thingy. We’ll I’m not into paying when I don’t have to, so here is how you can hack the Verizon Motorola V3c to play custom ringtones that are MP3 based. Please note that I have tried it with version 5 of their firmware—so others might respond differently.

Anyways. Here is what you will need.

  1. Motorola V3c by Verizon updated to version 5 of their firmware
  2. A usb cable to connect your phone to your computer
  3. BitPim(http://www.bitpim.org/)
  4. Motorola Software Update(https://rsd.motorola.com/download/Motorola_Software_Update.exe)
  5. Motorola Driver Tools(http://www.bvrp.com/Customers/Motorola/DriverTool.zip)
  6. Software to create your MP3
  7. Hex editor
  8. A little time and patience

I broke down the instructions into two categories. What you have to do one the phone, and what you have to do on the computer. This is the order in which I perform it, but you might be able to deviate a little bit on it…..

Computer:

  1. Install Motorola Software Update
  2. Install BitPim
  3. Switch to the phone

Phone:

  1. Go to your contact list
  2. Select a contact, and press the edit button
  3. Scroll down to the Ringtone and click the Set button
  4. Select the second option of “Record New” and record a five or so second “ringtone”
  5. After it says that the audio is saved scroll down to the bottom of the list and note the name of the file.
  6. Exit out of the contact without saving it.
  7. Turn off the phone
  8. After the phone has fully powered off, turn it back on
  9. Connect the phone to the computer with the USB cable

Computer:

  1. The computer will want to install some hardware. Keep clicking next and allowing the unsigned drivers to be installed. There will be around 4 devices to install. If the comptuer does not try to install more than just the Motorola USB modem driver then unplug the phone, turn it off, turn it back on, run the Motorola software Update program, and then connect the phone to the computer again. This should install the appropriate drivers.
  2. Run the driver tools program.
  3. Disconnect the phone, and turn it off
  4. Turn the phone back on
  5. Reconnect the phone. When it reconnect, it will reinstall the Motorola USB driver
  6. After all the drivers have been installed run BitPim
  7. BitPim will say that it is unable to detect the phone and will ask if you want to Run the settings, select yes.
  8. On the options menu, set the phone model to v3c
  9. Click ok to exit the options menu
  10. On the main screen, click on View
  11. Click on View Filesystem so that it is checked
  12. On the main menu, on the left hand column, click on Filesystem and then click on the arrow next to the folder in the next column over to the right.
  13. Drill down to Motorola/Shared/ringtone
  14. Find the MP3 on your computer that you wish to use as your ringtone, and rename its extension to qcp(don’t ask me why it likes qcp better than mp3)
  15. Upload the file to the folder Motorola/Shared/ringtone
  16. Drill back up to the root of the phones file system
  17. Right click on the file MyToneDB.db and select save
  18. Save the file somewhere where you can access it
  19. Leave BitPim open, and open your hex editor. Open the file MyToneDB.db with your hex editor.
  20. Scroll down to the bottom until you find a line that reads something like Motorola/Shared/Audio/071706_12511.qcp(the name of the audio recording that you made earlier)
  21. Using the hex editor, edit the line starting with motorola to the new location of the ringtone you want to use. So if you want to use the file sleigh.qcp that is stored at the location Motorola/Shared/ringtone/sleight.qcp, you would use the hex editor to change the line to read the location of the ringtone you want to use, but you would change this whild following the same pattern as the rest of the file(that is a 00 between each word) Please note that there is either a letter or number in front of the word motorola. LEAVE THIS ALONE!
  22. If after changing the file that the database is pointing to, there are leftover letters from the previous ringtone, instead of editing on the text side of the hex editor, edit the “hex” side directly and change all the left over items to 00. DO NOT DELETE THE EXTRA LETTERS, CHANGE THEM TO 00. There is a large space of just pure 00 between each ringtone listing, so it is relativly easy to see where the next one starts.
  23. After editing the file, save it.
  24. Back in bitpim, right click on the file MyToneDB.db and select overwrite.
  25. Navigate to the MyToneDB.db file on yoru computer, and select that file
  26. BitPim will overwrite the file
  27. Here is the important part. Call the phone from a phone number which has one of the standard rintones assigned to it. This will rebuild another database in the phone and allow the new ringtone to be used. Once this has been done, you now have a new ringtone on a locked Verizon Phone. :-D

Moldova

paul.e.dearment.jr| September 9, 2006 9:08 pm

For those of you that do or do not know, Ryan is going to Moldolva. So here is a link to a video with information about Moldolva
Moldolva

Moldova Video

paul.e.dearment.jr| 8:56 pm

So for those of you who don’t know. Ryan(roomate) is going in the peacecorps for two years over to Moldova. So, for those of you who want to know about this lovely little thing. Check out the video below. Just so you know, the video is a good half hour long….so when ya get a chance…watch it. The video was made by the peacecorps, so it belongs to them. There is(as far as me and Ryan could tell) no copyright on it, so thats why it is on here. If you wanna download it to keep for your personal collection or viewing offline, please follow this link to google video

TOM delays

paul.e.dearment.jr| 8:53 pm

I started out with the hope and dream to have a crude version of TOM done in about a year or so. Well, right now I haven’t had a chance to get to work on TOM too much(actually, still on the interface part of the whole thing. I hope that things will start to calm down soon enough so that I can get to work on TOM. I don’t know what the current status of it will be, but hey. Its all good. Eventually things will start to get around and along. But until then, my other projects will allow me to learn about code so that I can get TOM up and running without too much trouble. Well the planning and interface work will continue, and hopefully some real meat will come about soon. Keep tuned, and keep informed.

New Virus on the block

paul.e.dearment.jr| September 7, 2006 3:48 pm

There is a new virus on the block. It spreads via AIM and it is nasty. Nasty Nasty Nasty. In fact, it is so nasty that it installs itself inside the paging system of the infected computer. ::bleh::

I don’t know what the name of the virus is. In fact, I don’t know if anyone does. Here is how the virus works.

You receive a link from a friend on AIM stating that they posted a picture of you, and you need to go view it. You click it and it doesnt take you to a page, but instead downloads and installs two nasties which generates a third. Thats right. Three. Here are how I can see that it works:

It installs a file in the paging file which is able to regenerate the next file, NTP.exe. NTP.exe generates and then executes a random file in the directory c:\windows\system32 The file name is extremly long and makes no sense. Where this virus falls apart is that it stores a log on the C:\ named b2_log.txt This txt file shows both process that was just run, the site it tries to connect to, and to whom the virus sent spam email to. Jeesh it is busy.

So how to remove it?

1) Disable system restore
2) Delete the paging file, this has to be done outside of windows
3) Delete the file NTP.exe as well as the random files that it created in the C:\windows\system32 directory

Go back into windows and run a full virus scan again to take out the last few files.

Ah, doesn’t that feel better not to spam?