Saturday, March 01, 2003


Songs I now cant get out of my head..


Ludacris - Saturday (Oooh! Oooh!)
Talking Heads - This Must Be the Place (Naive Melody)
Ludacris - Roll Out (My Business)


Last coupla days now, I will sing a few bars of Naive Melody, then switch to the rough lyrics of Ludacris, then back to the electronic flute of David Byrne and company...

So, in my head it sorta goes like this:


Pocket fulla cash
Just seen a BIG ol' ass
*Its Saturday - OoohOooh*

Home.
Is where I want be
I guess this must be the place

How you smoke so GOOOD?
Boy, you is a SUPERSTAR
Why you still live up in da HOOOD?


*sigh* Id do Eminem's "My Dad's Gone Crazy". but I dont know the words.
--------
Scan, repeat, rinse

Very, very sneaky.

My firewall program kept telling me there were a shitload of yahoo's scanning my machine trying to access something. Scanning for the same parameters. Not just random chit.

Like there was something sending out invitiations. Like a trojan horse virus.

Hmm.. and this is after I scanned the machine several times with nothing coming up.

But, Im nothing if not stubborn and persistent. I dont ignore weird signs.

So, I kept looking.

It was right there in front of me, but I STILL couldnt figure out which one it was.

Scan, search, check task manager processes, scan, look in registry, scan, repeat..

I wish I could say I was smart and finally figured it out. No.

But I did the next best thing. I looked for an updated antiVirus update and downloaded it manually.

Note to all Norton AntiVirus users: LiveUpdate does NOT download the latest antivirus updates.
It is always a few days behind the absolute latest updates they do.
Dont be suckered into a false sense of security thinking youre being automatically updated.

The last update added THIRTY virus variants over the last update of 4 days before. Ugh.

Once I run the updater and scanned with the latest updater that came out today, all became clear


Date: 2/28/2003, Time: 21:43:04, Administrator on INSPIRON
Virus scan started.

Date: 2/28/2003, Time: 22:04:38
The file C:\WINNT\system32\iexplore.exe is infected with the Backdoor.Sdbot virus.
Unable to delete the file.



The file C:\WINNT\Temp\xnihkn.exe is infected with the Backdoor.Sdbot virus.
The file was quarantined.


I knew it. I KNEW it. I KNEW was still compromised, that the last scan hadnt gotten all of the infection.

This one was a custom engineered homebrew designed to slip past the scanners.

*sigh*

Procedure to remove it doesnt cover this one yet. Sunnabitch.

Same procedure, but look for "iexplore.exe" in the windows system32 directory (it doesnt go there normally)and look for a line that sez "Configuration Loader" in the registry .

Reboot, let Norton quarantine it, cuz you wont be able to delete it.

I think that'll do it.

And still, Im treating it like a drunken suspect.

Sometimes its not enough to simply think youre protected.. gotta be vigilant too.

No comments: