Archive for the ‘security’ Category

McAfee Auto Renewal

Thursday, July 9th, 2009

I just retired one of the old computers in the house and remembered it was running McAfee and was subscribed to their auto-renewal program. Since I no longer had use for that McAfee license I decided to opt-out of the auto-renewal now that I still remember about it. So I logged into their customer portal, clicked on the appropriate link and saw this:

McAfee Auto Renewal Page - Can't Disable This Feature

McAfee Auto Renewal Page - Can't Disable This Feature

Um… So where is the opt out button? Oh, right – they don’t have one. Apparently you need to contact the customer support to disable it. Nice one McAfee! Well done!

I did as they said – I sent an email via their online form, and I got a confirmation in the mail the next day. Apparently they canceled the renewal service on both products on my account. The email said I can always log in and re-enable this feature.

I decided to double check it myself, but to my surprise the auto-renewal link was removed from the sidebar overnight. It’s now gone and I have no way of accessing this feature. I’m not sure what this means…

It’s possible that McAfee understood the error of their ways and removed the shady auto-renewal feature altogether? Or did they just hide the incriminating page so that their customers can’t easily check up on their status. Interesting…

Needless to say, I made a note in my calendar to remind me to watch my credit card statement next year to see if they really opted me out like they said or if they will charge me again.

Luke’s Definitive Guide for Removing Malware

Monday, May 25th, 2009

I get a lot of requests from friends, family and friends of family for MS Windows support – most notably malware removal. You see, I’m a software developer and a Linux user and that somehow qualifies me for this type of work. Yes, the impeccable logic of a common luser never ceases to astound me.

Fortunately for these people I do have a good deal of experience with IT work. This post is my attempt to pass some of this arcane knowledge onto you. Despite the popular belief, removing malware is not some special skill that needs to be trained or gained via experience. I hardly ever actually hunt down the infections and remove them by hand. 90% of time, this stuff boils down to using the right set of tools, and applying a little bit of critical thinking to the task.

The Tools

Most of the nasty malware you will get infected with can be effectively removed with one of these tools:

  1. Malwarebytes Anti-Malware (shareware – free to scan, resident protection costs $$)
  2. Superantispyware.com (freeware)
  3. Combofix (specialist tool)

How did I pick these tools? I didn’t pick them at all. The vocal anti-malware community of the internets picked them. I didn’t look at any polls, benchmarks or critical reviews. I use these tools because I know they work. How do I know they work? Because I’ve seen it and because they are recommended in every single security related thread on the internet.

You see, there are dozens of message boards out there dedicated to helping people clean up their infected machines. Users go there and post their symptoms and the resident experts give them recommendations and guide them through removal steps. Do you know what is usually the first step they recommend?

You guessed it – install Malwarebytes, run a scan, post your log file in the reply. Repeat for superantispyware.com. Between the two of them, these applications can remove just about anything. Very few trojans or worms can withstand this tag team. If they do, you can usually go for broke and use ComboFix which is sort of a last resort measure.

Most of the time it will clean your computer off the nasty infection. Every once in a while however it will hose the OS while trying. It will forcefully delete infected system files other anti-malware tools are affraid to touch with a blatant disregard for system stability. This makes it effective, but a bit of a lose cannon. That’s is why it forces you to install the Recovery Console prior to actually performing an aggressive scan.

The Procedure

There is no magical procedure. You should simply follow your common sense. This is what I usually recommend doing:

  1. Boot into Safe Mode With Networking
  2. Get rid of Temp files (where malware likes to hide) using ATF-Cleaner or CCleaner
  3. Install and update Malwarebytes and run a scan
  4. Install and update Superantispyware.com and run a scan
  5. Repeat 1-2 times until you get a clean log on both
  6. If you can’t remove some infections, or you still see the symptoms reboot into normal mode
  7. Run ComboFix
  8. If you still can’t remove the infection find it’s name
  9. Fucking google it!

The last step is crucial – I can’t emphasize it enough. Unless you are extremely unlucky and you got hit by a brand new variant of the malware, someone already went through this crap. It is more likely than not that you will find a forum or blog post somewhere with detailed removal instructions. Or in worst case, you will find links to more specialized tools that may or may not work against the crapware you are facing.

That’s it. That’s how I get rid of 90% of the crap people get infected with.

It’s so easy, even a caveman could do it!

Academic Advising Facepalm

Tuesday, November 4th, 2008

My lovely university never ceases to amaze me. Every semester without fail, they do something so monumentally stupid that I can’t help but go:

FACEPALM

This has been going on since my freshman year. So 4 years of college, 2.5 years of grad school, and it will now be close to 2 consecutive years of being an adjunct. And every semester they surprise me with a brand new level of organizational stupidity. It’s always a different branch, different school, or office that does this. But it’s always entertaining. This semester the WTF moment was delivered by the Office of Academic Advising. Before I show you their email, let me give you some background.

Academic Advising likes to track the progress of students on academic probation. In the past, half way through the semester they used to send all faculty little envelopes with paper forms to be filled out. You got a separate envelope for each course your were teaching, and inside you had a short questionnaire regarding the progress of the 2-3 students in that class who were on probation. Since I’m using a general requirement course that must be taken, I always had at least 3 of these forms to fill out for each class. They were really short, 1 page things that asked about student’s grades, whether or not they turn in their work on time, whether or not they attend the class regularly and etc… It usually took me few minutes to fill them out, put them in an inter-office envelope and drop them in the Computer Science Department’s outbox.

This semester the Office of Academic Advising decided to modernize the process and have instructors fill out the forms online. That’s a good thing, right? Wrong. Please read the email they sent me:

Dear Colleague,

Each year, The Center for Academic Advising & Adult Learning administers the Student Academic Monitoring Program (STAMP). As part of the STAMP program, academically at-risk students are identified and faculty members are asked to assess the student’s performance in class. Comments submitted by faculty are then used by advisors to determine appropriate intervention strategies and support services for students. In an effort to increase the efficiency of the program, STAMP will be administered entirely online this semester. The list of students in your course(s) who are included in the Student Academic Monitoring Program this semester will be available on NetStorage, the University’s secure drive. To access your list, follow the instructions listed at the bottom of this email.

Once you’ve accessed the list, go to [URL redacted to prevent stupidity] and complete a form for each student on your list. Submission of the form by faculty will automatically generate an email to the student. This email will include ONLY the quantitative information supplied by the faculty (eg. number of absences, approximate grade in the course, assignments submitted on time, etc.). Qualitative information submitted in the Comments section will be viewed only by advisors.

Your honest evaluation of these students at mid-semester plays a key role in our efforts to assist them and to ensure their retention at the University. Please submit the online STAMP forms no later than Monday, November 3rd.

Thank you in advance for your cooperation.

Sincerely,

Center for Academic Advising & Adult Learning

Instructions:

1. Go to NetStorage
2. In the username box, enter your NetId (eg. smithj)
3. In the password box, enter your password
4. Click OK
5. Click on DriveF@GROUPS
6. Open the CAAAL folder
7. Open the STAMP folder
8. Open the FACULTY folderĀ 
9. Open the spreadsheet that corresponds to the first letter of your last name
10. Sort the spreadsheet by faculty_name (column A) to find your name. Your students will be listed in column C.

TLDR: we are lazy, and you should do all the work from now on.

So the office of Academic Advising dumped their list of students on probation into bunch of excel worksheets, then put those worksheets on a network share.

academic_advising.png

Our mission, should we choose to accept it is to weed through these spreadsheets, locate the students who attend out classes, then go and fill out a generic blank online form for each of them:

academic_advising1.png

Can you see the problems with this new scheme? Obviously it’s a pain in the ass to do. I’d much prefer to fill out my paper form and be done with it. But there are more jarring issues here.

For one, any faculty member, adjunct, graduate student teaching a class and God knows who else can go and download all these spreadsheet and get access to a list of students on academic probation and their student ID numbers. Upon merging and sorting all these files you can easily re-create class schedules for all these students. I don’t know about you but to me this is way to much personal information being accessible to way to many people. I’m pretty sure this is a privacy violation, and there is probably a rule against doing precisely this sort of thing somewhere on the books.

Second issue is that, as far as I can tell anyone can go and fill out that blank form. There doesn’t seem to be validation of any type so I could fill out forms for students that are not in my class. In fact, I could fill out this form for students who are not on probation, or who don’t even exist.

Not to mention the fact that different people will put different things into the free-form input boxes labeled “Course Name” and “Course Number”. Why? Well, let me give you an example. One of the courses I teach can be identified as follows:

  • CMPT 109-36: Fluency in Technology

There is also a “call number” associated with this course which is a unique numeric identifier students use when registering and then promptly forget. The question is, which part of the above is the course name and which one is the course number? Does the course number only CMPT 109 or do I need to specify the section number CMPT 109-36. Also how do I input this information into the box. I can think of several ways to do it:

  • CMPT109-36
  • CMPT 109-36
  • CMPT-109-36
  • CMPT-109 36
  • CMPT10936
  • CMPT 10936
  • CMPT 109 sec. 36

And etc.. I think you can see the pattern here. All of the above are somewhat valid annotations and I have seen people use most of these variations at different occasions. This effectively means that sorting and aggregating on the Course Number column in the database will not produce any useful results. The data that they will get in this form will be absolute shit, and will require to be tabulated by hand just like the paper forms were. All they really doing is eliminating the printing, mailing, hand sorting and scanning/data entry part of the process by offloading all the work onto the instructors. Not cool.

I’m being told that this new method is a slight improvement though. Apparently, in the past these spreadsheets used to be emailed from one department to another without any encryption. So at least this time around they have them locked behind some sort of user authentication screen and you must access them via SSL. :P