OT: anti-malware progs ineffective

WHS. Changed default browser to FF 1.0 a week ago. Just had a couple of sites I can't reach or actions I can't accomplish. For example, buying an ebook today from Fictionwise in MS Reader format bombed because the site failed to inform me that it would only work in MSIE - apparently dependent on ActiveX (ironically a/the prime security exposure!). Had to load up MSIE6 briefly to download my purchase. They have email. But that and other minor glitches are trivial compared to the upsides. Wish I'd changed sooner. Definitely won't go back.

Terry, you might want to try the PrefBar extension. It will allow FireFox to easily control most of the nifty features, and allow you to spoof your "user-agent" string (effectively making the website think you are using another browser. Check it out:

Yes, there are a small number of heavily-tweaked websites which FireFox doesn't like. But new extensions are being made daily and FireFox is rapidly gaining popularity, so web designers are being forced to provide compatible support. It's only a matter of time before it surpasses IE in terms of usage. Sure everyone "has" to have IE on their box, but nobody is going to be using it. ;)

/default.ida?XXXXXXXXXXXXXXXXXXX

/_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 404 307,

What the heck are all those 4.* IP's?

Aaah, verizon customers eh? I've got a few blocked from my ISP also. Nice trick: restart PC, close all apps and services, watch the firewall log. Blacklist anything that moves. :)

BTW, 0xC9 in Win32 assembler is the "Leave" instruction. According to the Win32 API reference,

------------------------------------------------ LEAVE - Restore Stack for Procedure Exit (80188+) Usage: LEAVE Modifies flags: None Releases the local variables created by the previous ENTER instruction by restoring SP and BP to their condition before the procedure stack frame was initialized. Clocks Size Operands 808x 286 386 486 Bytes none - 5 4 5 1

C9 LEAVE Set SP to BP, then pop BP C9 LEAVE Set ESP to EBP, then pop EBP

------------------------------------------------

....

How much of this could we fix using hardware? (since fixing it using software doesn't seem to be doing a particularly great job)

We put an itty bitty board between the cable and the drive.

We have to use a bit of software to move things around on the disk. And then we flip "the big red switch" and large segments of the drive are write protected.

Any attempt to write over the top of most of the executables fails.

I realize this isn't a complete solution to the problem. But it seems like it might fence in a smaller area for possible damage. And I realize we would have to provide some controlled method to allow updates to the executables.

The latest attempt by Microsoft tries to enforce rules against executing what lies in the area marked as data. This tries to enforce rules against writing in areas marked as read-only.

Firefox. Same here!. Loaded and running with no problem. Haven't had an intrusion in the past hour. I'll give it a couple of days and try the Thunderbird. regards john

Thanks, Mark, duly installed. I started this thread as 'OT', so guess it's now at least (OT)². So let's push it and try (OT)³...or I suppose strictly that should that be O³T?

Am I misusing PrefBar or expecting too much for it to handle

I have Firefox configured to prompt me before accepting any certificate. I always accept known certificates only temporarily. This is never more than a minor pain in the neck, the worst being the two certificates I have to accept to get mail from - you guessed it - hotmail. Yahoo does not attempt to install certificates. Online shopping gives me the opportunity to decline many, many certificates.

OK, watch out, I didn't mean to, but a rant popped out anyway:

I work for the Fed, and unfortunately, the Fed has mandated IE as the browser of choice, Outlook as the email client, and (my God, WHY?) MS Word as the chosen word processor. At work, I use IE only for those applications that require it, official stuff. The AFPC (Air Force Personnel Center) has a bunch of monkey boys doing their web stuff, it relies heavily on pop-up windows, can't be used with anything but IE, and is *always* screwed up to some extent.

I do my documents in Adobe, and distribute memos and such in PDF. Screw them if they don't like it. Some very important documents are required to be in MS Word, and I have spent many hours getting the outline numbering to work halfway reliably. I pushed to get Framemaker adopted, but that means spending money, so no go. Framemaker has some quirks, and doesn't have the bells and whistles of Word, but it is rock solid reliable. There's an Australian gal, a MS employee, who has a really good website devoted to getting around the stupidity of MS Word:

Still, Word is a funny beast. I get the numbering to be clear and consistent (and the user must be especially careful not to allow MS to totally screw up the document), and yet when I print selected pages, the numbering is lost completely. Paragraph headers come out 0.0, 0.0.0, and so on. Numbering that is not part of the overall scheme comes out really weird - one table numbered 1-14 prints out as 13 sixes and a seven at the end. This is Office 2003, mind you, the latest version.

I have a hypothesis that the SW writers at MS deliberately screw up Word so that other vendors, Adobe and Word Perfect for example, can't open Word documents. What a bunch of crap.

-- Al Brennan

Hmmm, I can't get that page to work either. It is using some funky Flash plugins though, that's probably where the issue lies. The site does have a section they say is for "macintosh and netscape users" which is

For that matter, Winamp's built-in streaming selection is 500x larger than this website, perhaps try that. :)

The guy who does our local web design uses Front Page. I am pushing hard to get him to try Adobe GoLive.

-- Al Brennan

Ok...

I edit Physics.html to add the proof of the existance of God.

I find more proof and in my research I've found the secret of cold fusion.

....and lost the proof of God *and* the secrets of cold fusion. If you saved the proof of God to CD *after* editing Physics.html, at least you have that. If you saved after you added the secrets of cold fusion, that copy is infected and your system is now reinfected.

Could be infected. Slow usually means it is.

You say you installed Win98. On a clean partition? Is the MBR intact?

Trying to poke holes in my own idea now, if we can't assume, or get Microsoft to support, directories not needing to be updated as well as the files in the directories then we could easily protect xyz.dll and have the net vandals change the pointer in the directory to the new infected xyz.dll.

That was roughly what I was thinking.

Probably because the quality of toasters is orders of magnitude better than what they call software today. I spent a decade of my life working on what would be called 6-sigma software today. Roughly that translates into you and two dozen of your friends using this all day every day for fifty years and there still be better than a 90% chance that not a one of you would have ever seen a bug, no matter how small.

But, we still have other issues. We need to allow "updates" on a second by second basis as Windows runs. "The Registry" inside Windows now controls most of the behavior of the machine. It has to be modified on almost literally a keystroke by keystroke basis. There likely isn't any way to provide hardware protection to the perhaps

However, there actually are products, Hard Drive Sheriff is one brand, built for places like the schools, where we are training armies of little net vandals, that attempt to provide some protection like this. I believe they keep a hot backup and when one little vandal leaves the seat and the next one takes over it restores the system from the hot backup.

Some web sites interrogate your browser to learn what version and brand, while most just check the browser ID. Prefbar fakes the browser ID, so it is not always possible to 'fool' the web page.

Most wet-behind-the-ears web designers just look at the ID and make choices based on that, so you can fool most, but not all, web sites.

There is still software that must be available for some features to work, and Mozilla-based browsers don't alway support everything.

John

Cool site. From

For an RTF it's 148 bytes.

Reminds me of an Excel purchase order form I used to have to use. Each one took 250kB of my HDD.

Shuttle OBS?

In article , Don Taylor wrote: [..me..]

yes, With a modest sized CPLD, you could have a range of tracks protected. That would do about as well as protecting a whole drive.

If you partition things right, you can protect the whole install and still allow the rest of the disk to serve as a logical D drive to be written.

Why would we have to allow updates at all? I've never updated the software in my TV or toaster.

Many years ago, I disassembled a large chunk of DOS in order to figure out a bug. After that, I have never thought Microsoft would ever make bug free software. It was obviously patches to the patches on the patches placed over someones not too bad of code. The newer the stuff the worse the coding.

BTW: I did figure out the bug and a way around it so that the 8259 didn't get munged by them.

In article , keith wrote: [...me...]

If the download file is a selfextracting file you run, it can be infected. Many viruses watch what you run and infect the files you exec. If you save the file and don't exec the saved on the virus may not see it to infect it.

I still don't see your point or perhaps you don't see mine. I'll try an example:

(1) I make a documentment called Physics.html

(2) I save Physics.html to the CD.

(3) Months pass and lots of things happen

(4) My computer gets infected

(5) I clean off my system and re-install from safe media

(6) I copy Physics.htlm from the CD

At this point my computer is not infected and I have Physics.html back.

It is hard to completely prove that there is not a hardware fault but I don't think there is one. The computer always seems to work fine until it is connected to the network. If I install Win98 on it, it works fine even when connected to the Network. Neither of these tests have been long enough to be sure.

The failures seem to follow a pattern. The first one observed is usually that the machine will not shut down or that it runs very slow. When I check it after that there is usually an extra *.VXD file.

like a >> sieve. No amount of updating can ever improve it.

Actually, an OS with an integrated GUI has a better chance of being secure. Its when M$ just laid the GUI atop the kernel, and then kept piling manure atop it, that things began to deteriorate. Of all the PC operating systems, only microsoft is so very vulnerable to any idiot who can write a few lines of code. True, it is more popular which makes it a target, but you would be hard pressed to write a virus that could extract the address book from an OS/2, Linux, or Mac system and then take over the OS and propogate itself across a network like the internet. No such thing as "can't be done" but its pretty close to impossible. This is all the fault of microsoft and its zeal to maintain is illegal monopoly.

What is really wrong here is folks trying to get the 'criminal' out of the house after he has broken in and started stealing stuff. The best solution is not in running a dozen programs three times a week to see if your computer has been 'broken into' The answer is in keeping the virus/spyware stuff out of the machine in the first place.

How many of us would buy a house that had no doors, or a car without locks? Yet we support microsoft which has no locks, and no doors, and no chance of ever seeing them. Instead, we are content to let the disease come into the 'home' and then pay more money to try to fight it with someone else's antibiotics.

Its time to stop supporting microsoft whenever possible, which starts with the browser and the mail reader, and ultimately gets to the point where you stop using the faulty software altogether. This would cause the authors of the crap to either fade into oblivion, or create software with doors and locks.

This is all really the antithesis of the old axiom about 'closing the barn door after the horse has gotten out" in that we are now looking for elegant ways to clean up the manure in the living room, instead of just closing the door and keeping the horse out in the first place :-)

John

Building a little hardware gadget that would fool Windows into believing that disk writes had been done and keep Windows running seems substantially harder than building a little gadget that just simulates a write failure when some little bit of net scum tries to scribble on a file that we have decided should be read-only.

True.

Are there any other ideas for cute small hardware defense or monitoring projects?

My cable supplier used to watch the constant hammering of his machines by the net vandals. We discussed the idea of wiring up a little sound effects machine to the log file of something like Zone Alarm. The idea was that every time it recorded an intrusion the horn would go off. When a customer would jump and ask what in the world that was he would explain it was just another net attack, "just like is happening to your computers all the time, didn't you know that?" We thought he might start selling hardware firewalls if nothing else. (I bought a cheap little plastic imitation of an English postal box, called the Email Informer. It runs off a usb port and pops up a flag every time an email message arrives, using some hook inside of Outlook I imagine. I thought we could reverse engineer the thing to accomplish a similar goal)

You are fortunate. I found less and less interest in providing the updates, few seem to care whether something is correct anymore.

But finding a way for a cheap hobby project to accomplish this seems challenging.

If you can think of a way to accomplish that without using software I'd certainly consider trying it.

I don't know the low level details of how they did that. But I thought of buying one just to protect me from myself.

So, what hardware can we feasibly build? thanks

I reckon integrating the GUI environment with the disk operating system it needs to run was the biggest disaster ever.

Graham