Second Laptop Cleanup

June 25th, 2006

Turns out the second laptop was simply ‘infested’ with Limewire and the associated crap that this program is occasionally bundled with. I uninstalled it, plus a few other things for good measure, removed and reinstalled AVG and gave it a scan with Spybot and all seems to be fine now.

One thing that piqued my curiosity was that AVG wouldn’t un/reinstall because ’some of the files were to be renamed after rebooting’. I though this was a bit dodgy but the uninstall worked in safe mode without apparent problems. A quick update and things were all back to normal.

Let this be a lesson! Don’t let kids install crap.

Sunday Morning Laptop Repair

June 25th, 2006

One of those strange coincidences happened where by I’ve got two laptops to clean up over the same weekend. The first is having problems getting rid of a popup that tries to flog the owner some dodgy antivirus crap, and the second is just running a slow as a sloth on valium.

With the home page hijacked and changed to www.syssecuritysite.com is wasn’t difficult to ascertain that the first machine had been hijacked by a Smitfraud variant. This seems to have come from a bizarre video codec downloaded which in turn was bundled (probably illegally) with Virtual Girl 2. Yes folk, the lust for desktop porn has claimed another victim.

So to cleanup – the very first thing I did was remove VG2 because this is a work’s machine and you really shouldn’t be installing this crap on a work’s PC. Next up was a standard run-through/remove with AdAware and Spybot Search & Destroy and finally I downloaded SmitfraudFix by S!ri, rebooted into safe mode and user the Scan and Clean options to get rid of the last few pieces of crap.

Interesting point to note: Smitfraud appears to launch several processes at once which keep an eye on each other so that if one of them is ended, the other(s) will relaunch it to keep the whole thing running. This means it’s pretty difficult to remove without booting into Safe Mode.

A quick reboot and scan and all’s well – now on to the next machine.

Paypal – Notification of Limited Account Access… again.

June 20th, 2006

As if it wasn’t bad enough Paypal getting me to change security questions that anyone could guess, I received the exact same email the next day asking me to do it all over again. Truly, the Department of Redundancy Department at Paypal is second to none.

The difference this time was that I didn’t have to confirm my telephone number – instead I had to enter either my full bank account or credit card number. I suppose this is marginally more secure than asking my mother’s maiden name, but not much. I had to redo the security questions and password again as well – hurrah.

But this time there was a clue! Apparently someone had tried to access my Paypal account from a foreign IP address. Still no word exactly when this occurred, but that seems to have been the problem – hacker wannabes. Unless of course Paypal’s idea of ‘foreigh IP address’ is ‘another ISP address’, in which case I could have restricted my own account simply by accessing it from work. That would be fun.

Anyway, we’ll see how this latest runaround goes. I won’t be a hundred percent suprised if I get another email tomorrow telling my account has been limited due to third-party nonesense. Sigh.

Paypal – Notification of Limited Account Access

June 17th, 2006

Everybody and his dog seems to get phishing emails purporting to come from PayPal. I get so many of these than I don’t even bother clicking the links anymore and just delete the buggers. It’s even more amusing when they send the exact same email to both paypal@ and nochex@ – making it fairly obvious that they’ve just trawled eBay for email addresses in the listings.

This morning’s email was different in two respect: the email itself was in plain text and there were no links to click in the email. A genuine email fom PayPal! Lord-a-Mercy! I set my browser to stun PayPal.com and went to see what was up.

Now apparently my account ‘may have been accessed by a third party’. While such a warning is great and all, there’s absolutely nothing that I can see that will permit me to establish exactly when this access was supposed to have taken place. If I’d know the alleged date I could possibly have told them that, yes, that was me, I done it guvnor, but I can’t. I checked the account history and there’s nothing suspicious in my recent list of transactions. Yes I really did pay £638.11 for a projector from a company in Wales, followed by £14.99 for a wireless PCI NIC from eBay – certainly nothing wrong there.

But my account remains limited, and the three steps to.. un-limit..it… are:

  1. Change Password
  2. Change Security Questions and Answer
  3. Validate my Account Informaton

Steps 1 and 2 seem beyond useless to me, since anyone who has access to my account could change the password anyway, and the list of ‘Security Questions’ in PayPal is limited to just four options – all of which are quite possibly available in public records for any Identity Thief to find. Mother’s Maiden Name, Father’s First Name and Town/City of Birth are all available on my birth certificate which as far as I recall can be viewed by pretty much anybody. The only one that may cause some grief is ‘Name of First School’, but anyone knowing my other detaild will be able to look that up on Friends Reunited or something.

The only step of note was the third and final one – PayPal’s computers would ring me up and ask me to input a number that was displayed on my screen. Presumably the phone number cannot be changed while the account is limited, otherwise my mstery third party could just change it to the number of a nearby phone box, hit the button that says ‘Call me in one minute’, note down the number and leg it outside to answer the phone. This step proved pretty simple and painless anyway – just type in the four digits and hang up after the words ‘Thank You’.

Well, my account is still limited until someone over at PayPal gets out of bed and sees that I’ve done everything required of me. All it means is that I can’t… oh wait! The warning has just this minute disappeared. Seems things are back to normal after all.

Still no word on this mysterious third-party access, however.

Servers, Firewalls and Dialup on the Powerbook. Oh my!

June 6th, 2006

The fun all started when we moved offices. We actually stayed within the same building but moved from the slightly-newer part of the building into the slightly-older part. This meant that the fibre cable transporting our Internet connection across the entire roof of the building was redundant and BT had to be called to connect it to a different – hopefully much shorter – piece of cable. BT have been called, and in their infinite wisdom they won’t help us until we find an account number for them.

So, no problem, as a temporary measure we’ll use the high speed Internet access that comes with the building. We track down Dave the Network Bloke and he fixes us up with a couple of live ports so we have Internets in t’office. Unfortunately, since several large companies have moved into the office complex it’s no longer ‘High Speed’. In fact it’s absolute shite. No matter! It’s only for a few days. Possibly.

The next problem to rear it’s ugly head was regarding sending mail using SMTP. No problem, we’ll just use our own server as usual. In order to do this I need to add the IP of the connection to the list of permitted relayers on the server – pretty straightforward stuff. Unfortunately I remember why we left the built-in (Once) High Speed Internet – they block a port required for us to configure our server. It’s an outgoing port, but they’ve blocked it nonetheless. Hnnnng!

O-Kaaay. The only available option at this point is to hook my 15in Powerbook up to my Sony Ericsson k750i via Bluetooth and create a dialup connection that will allow me to bypass this shitty firewall and configure the server. I run through the pretty little OSX configuration wizard and the Powerbook connects to the k750i without problems… but it won’t dial. It prompts for permission to connect to the Internet and does nothing. Eventually it transpires that I need to select the ‘Ericsson T39 14.4′ script, and hey presto – it dials the 123-Reg’s 0845 Dialup number and away we go.

Except that, because the walls are full of wire, I only get two bars on my phone and the connection is pretty much halved from 14.4. Eventually it crawls through the login process and I remember which buttons to click on the first go (saving me several minutes on the phone bill, no doubt) and I get to enter the IP address of the Formerly High Speed Internet Connection. Huzzah! I can send email!

Unfortunately so can everyone in the office complex, but I won’t tell them if you won’t.