Root Access

Bob

00:14

@allquixotic Doesn't have the same ring to it.

allquixotic

from 7:20pm - 10:80 pm I am supposed to enjoy movies?

10:80 = 11:20

Bob

@allquixotic ?

Anonymous

00:30

@OliverSalzburg you're a saint

allquixotic

@Bob 720p, 1080p :P

Bob

@allquixotic -_-

Anonymous

lol

Anonymous

@allquixotic please stop those attempts at humour

Journeyman Geek

@jokerdino no, its a reference to my canine alter ego's small size ;p

can we ~~maul~~ delete this? superuser.com/questions/700628/…

ekaj

01:07

Anyone have experience with pfsense? :x

@JourneymanGeek A book on power electronics, just what I need!

allquixotic

35 mins ago, by Pato Sáinz

lol

seems like it worked

Jebediah Kerman

I am on windows 7.

I need some help. Some random app is openeing a lot of web pages. It does this about once a day

It must be some spam app or something

Anonymous

then uninstall it

Jebediah Kerman

I have done a complet virus scan

I do not know what app it is

allquixotic

@JebediahKerman use UI Spy to figure out which process is hosting the webpage window, then figure out where that exe is, then kill it

Anonymous

01:15

just search your installed app list for something that looks shoddy

allquixotic

unless it's opening it up in your existing web browser....

Jebediah Kerman

all sites it open are in the same domaind

reader24h.com

Anonymous

it's easy to discern between office, firefox and ULTRAEXAWESOME PRODUCTS

Jebediah Kerman

all sties are hosted by that domain

@allquixotic I looked up UIspy

msdn.microsoft.com/en-us/library/ms727247(v=vs.110).aspx

The UI Spy tool is obsolete and no longer available. Developers should use other tools such as Inspect.exe that are available in the Windows Software Development Kit (SDK).

should I use UIspy or Inspect.exe?

allquixotic

there are MANY alternatives -- it really doesn't matter what you use

but you never answered my first question

is it opening it up in your existing browser window (if so, which browser?) or is it spawning a separate window?

Bob

01:17

@allquixotic it's more typical that they just launch a URL (shellexecute, which opens in the browser)

Jebediah Kerman

its open in the existing broweser

I adds new tabs

allquixotic

@JebediahKerman which browser does it open in? and is this your default web browser?

Jebediah Kerman

chrome

I had chomre o[pen at the time

Bob

hm

allquixotic

@Bob does event viewer have any kind of shellexecute log? that'd be nice

Jebediah Kerman

01:20

also a new window pops up with this

allquixotic

@JebediahKerman sounds like it's trying to run malicious javascript (or just a lot of javascript) and failing ... not very surprising that it's failing

Bob

@allquixotic not that I know of

but there are third party programs

rohitab.com/apimonitor

jacquelin.potier.free.fr/winapioverride32

17

Q: Monitoring certain system calls done by a process in Windows

I would like to be able to monitor certain system calls made by a process, primarily file I/O calls. On Linux I can probably get away using strace with suitable parameters, but how can I do this on Windows? I'm primarily interested in running a process and figuring out which files it has read an...

allquixotic

speaking of third party programs, you could probably use process monitor or process explorer (I always forget which does which)

Bob

this is all assuming you have malware as a separate program

if it's a browser extension or something...

oh, don't forget to check what you have running at startup

allquixotic

technet.microsoft.com/en-us/sysinternals/bb896645

Bob

01:22

anything you installed recently?

allquixotic

@Bob speaking of that, he could check his chrome extensions

Bob

@allquixotic they don't seem to trace arbitrary win32 api calls

Jebediah Kerman

me?

Bob

@JebediahKerman yes you

allquixotic

if the malware is intentionally self-limiting in just how mal it is, simply removing the chrome extension might do the trick

Jebediah Kerman

01:23

I only have 3 extensions

Bob

@allquixotic a lot of malware just goes for the lowest hanging fruit

allquixotic

@Bob yeah, exactly

it isn't going to try and rootkit you

Jebediah Kerman

Adblock
Ghostery
Magic Actions for YouTube

Bob

@allquixotic (usually)

Jebediah Kerman

this only started last week or so

did not install nothing untrusted recently

Bob

01:24

@JebediahKerman try disabling them temporarily - one might have updated silently at some point

allquixotic

@JebediahKerman so what .exe file did you download and run in the last week or so? :)

Bob

@JebediahKerman did you install anything at all? trusted or not

Jebediah Kerman

yes

one sec

nothing I do not trust as you can see

allquixotic

never heard of tune-up utilities, but apparently AVG, so, meh

Jebediah Kerman

even did a AV scan of everything, nothing popped up

could It be another site opening the tabs?

Bob

01:27

@JebediahKerman how 'bout trying malwarebytes? it's one of the more effective on-demand (i.e. not real-time) scanners

allquixotic

@JebediahKerman if you have popup blocking engaged (and not allowed for a site that's creating popups), it is definitely not another site opening the tabs

Bob

@JebediahKerman there is some possibility

Jebediah Kerman

I hear malwarebytes is shit. appearnlty its a virus itself? idk

Bob

another thing you could do - when one of those tabs open, fire up the debugger (F12) and type in window.parent.location in the console

Journeyman Geek

@JebediahKerman: Untrue

its effective enough some viruses try to block it

allquixotic

01:29

@Bob good idea

Bob

@JebediahKerman where on earth did you hear that?

ekaj

but he has that windows virus.. I heard it's a nasty rootkit

allquixotic

the problem is there are lots and lots of ways that this behavior could be happening so we have to narrow it down some

malwarebytes will help

Bob

as far as on-demand scanners go, it's the first port of call in a lot of guides, forums, tech communities, etc.

Journeyman Geek

@JebediahKerman: I'd also try opening chrome incognito

Bob

01:30

not entirely sure what gave you the impression that it was malware :\

Journeyman Geek

if it still happens, it may not be an addon

Jebediah Kerman

wait

let me try that f12 now

for f12

than where do I type window.parent?

Bob

@JebediahKerman select console in the tabs up the top

and type window.parent.location

you can add a .toString() to the end, probably easier to read

Jebediah Kerman

it returns this

reader24h.com/architecture-hide/…

Bob

hm..

Jebediah Kerman

01:34

also that out of memory on line 1 windows pops up agian after I hit okay for about 20-50 times

Bob

@JebediahKerman that's the same as the current address, yea?

Jebediah Kerman

is it a virus?

@Bob yes they are the same

I still have that message from Page pop up open

Google update is using 1.5gb of ram

wtf

Braiam

@JebediahKerman that's... not weird at all

Jebediah Kerman

yes it is

Braiam

nope...

Jebediah Kerman

01:37

its normally not even on the top part of the list

Braiam

when he's doing stuff... yes it is

probably decompressing a uncompressed 7z file

Jebediah Kerman

hmm

still somethings wrong

also look at this

any use in that???

Bob

@allquixotic wait, the window.parent thing doesn't help - it would be window.opener for popups, and it doesn't work across domains anyway

XSS protection has been more a hindrance than a help to me :P

Jebediah Kerman

I got UIspy now

Bob

@Braiam ...1.5 GB is still, uh, rather a lot

the entirety of a Chrome update seems to be about 100 MB uncompressed (which is still bloody large)

Braiam

01:42

@Bob there was a build in canary channel that used trice that amount... ASYSan or something... they bloat it on prupose

Jebediah Kerman

How do i figure out which process is hosting it?

as soon I i typed my last message

Bob

@Braiam that's the updater, not the browser itself

I wouldn't bat an eye at a browser taking 1.5 GB

though, that's total - a single Chrome process taking that much would be slightly unusual

Jebediah Kerman

@allquixotic how do I figure out which process is hosting it?

allquixotic

36

Q: What Easter Eggs do the chat sites have?

According to balpha, the SE chat sites may have individual Easter eggs, depending on the site. If you find them, please post. Edit: Because it's so easy to make this stuff up, a screenshot as proof would be nice. (Although Photoshop ain't that hard either...)

discussion chat hidden-features

Bob

@JebediahKerman I think @allquixotic suggested that one under the assumption that those were not opening in the browser

Jebediah Kerman

01:44

okay bob thanks

Bob

How often do you think this happens?

is it consistent?

does it happen while the browser is closed?

Jebediah Kerman

once a day

Bob

...

well.

Jebediah Kerman

@Bob hard to say, browser i almost always open

Bob

what I can suggest now is to set another browser (Firefox, IE) as the default for now

and see if it opens in the new default, or in Chrome

Jebediah Kerman

01:46

hmm

I will do that starting tomorrow

Bob

that will narrow it down to either a W32 ShellExecute or a Chrome extension/currently open tab, hopefully

Jebediah Kerman

I re-installed chrome btw yesterday and it still happnes

Bob

I'm leaning towards a ShellExecute

you can also grab that API Monitor

Braiam

<(?:"[^"]*"['"]*|'[^']*'['"]*|[^'">])+>

Bob

and when it happens, look at the last ShellExecute or ShellExecuteEx.

allquixotic

01:47

or if you really want to be meticulous...

Jebediah Kerman

I get some many message saying out of memory on line 1

allquixotic

go into task manager and look through every single running exe and select "open file location" and see if you trust it

and do the same for the running services

Bob

@JebediahKerman that's a script running on the site

we're trying to figure out what's opening that site

at this point, I couldn't care less what the site is or doing, as long as you close it

Jebediah Kerman

I closed all the sites

the pop-ups are still coming

Bob

it's possible there's another malicious script on the site, but that's immaterial if you have something on your computer already

@JebediahKerman end all Chrome related processes

Jebediah Kerman

01:49

this on too?

Journeyman Geek

hmm

Michael Frank

Should probably call a priest.

Jebediah Kerman

brb moving to FF

Journeyman Geek

check your chrome shortcut.

Bob

if the popups still come after that...

Journeyman Geek

01:50

some malware just changes that

Bob

then they're not actually from the browser

I'd still recommend you give MalwareBytes and/or Spybot S&D a shot.

They're fairly effective as on-demand scan and removal tools.

Not so much as realtime scanners, but meh.

Jebediah Kerman

looks like firefox also got some shit

new homepage is this

websearch.searchguru.info/?pid=34&r=2013/12/…

this pops up

Michael Frank

Obviously they want your WoW account.

Bob

@JebediahKerman seriously, just grab a malware scanner or nuke it from orbit

Anonymous

^

Bob

01:53

you have far more than the single problem at this point

Anonymous

this is the easy kind of malware ffs

Jebediah Kerman

also this is new

another one

jdm.findfor.net/sd/…

@Bob okay

what scanner should I use?

malwarebytes.org

that one ^^?

and how do I nuke it?

Michael Frank

Yes.

Bob

@JebediahKerman That's usually my first recommendation, yes.

Michael Frank

Install and full scan.

Bob

01:55

@JebediahKerman nuke from orbit == reformat, reinstall, rebuild from backup

Jebediah Kerman

I do not use backups

Bob

probably not something you want to do, but it's actually the only truly safe way (if you're slightly paranoid)

Jebediah Kerman

imma uninstalled all cracked software I have now

Bob

@JebediahKerman That would be your own fault/problem, then. Now would be a good time to start. Well, after sorting this.

@JebediahKerman ...that may or may not help anything in this particular situation, just sayin'

Here's the thing - you got a relatively benign adware type this time. At least, on the surface - there may be more crap hidden.

Jebediah Kerman

where can I download malwarzesbytez?

I keep on gettings some spam exe

Bob

01:57

There's other malware that will go and encrypt your data, holding it hostage until you pay them.

Jebediah Kerman

hmm

Bob

In those cases, backups are all you can do.

@JebediahKerman downloads.malwarebytes.org/mbam-download-exe.php

Jebediah Kerman

also I got norton

norton has this

I might run that

Bob

...good lord

as a (former, thankfully) user of norton products...

Michael Frank

@Bob Trollmuch?

Bob

01:59

yea, running that, especially without a backup... probably isn't a great idea

@MichaelFrank ?

Jebediah Kerman

why it says the actions can be undone?

Anonymous

lol norton

Bob

@JebediahKerman What says what now?

Michael Frank

@Bob Seems like you're all being trolled.

Jebediah Kerman

malwarebytesz just blocked an attack apperantly

Bob

02:04

@MichaelFrank yea, whatever

having a slow day here anyway

Jebediah Kerman

thats the result of a quick scan

Michael Frank

Ouch, infected PyInstaller? Where did you get that?

Jebediah Kerman

a link on SO

I found this in a log file

2014/01/12 21:02:33 -0500 JAN-HP Jan IP-BLOCK 50.62.128.121 (Type: outgoing, Port: 50960, Process: googleupdate.exe)

just again

is google chrome the virus?

or is it infedcted?

Bob

...that's a new one

Jebediah Kerman

I tired accessgin the ip in my browser, but I cannnot

Bob

02:11

might explain the massive memory usage

@JebediahKerman well, MB did block it

Jebediah Kerman

just popped up again

hmm

Bob

whois.domaintools.com/50.62.128.121

 ads789.com ptp22.com

yea, stinks of malware

Michael Frank

777seo.com as well

support.clean-mx.de/clean-mx/…

Jebediah Kerman

new one

Bob

forums.malwarebytes.org/index.php?showtopic=134635

may or may not be rootkit related

at this point, nuke from orbit sounds good :P

you could try a system restore to, say, two weeks ago

that sometimes works

Jebediah Kerman

02:14

162.210.192.22

Bob

depends if the malware has decided to modify the shadow copies as well

Jebediah Kerman

193.169.104.1

those just popped up as well

Bob

@JebediahKerman ...I think we get the point

Jebediah Kerman

more popped up btw

so

what are my options

re-install should be a last ditch effort

looks like firefox is also getting blocked

Bob

@JebediahKerman see above.

I'm going to lunch.

Jebediah Kerman

02:17

k

Bob

If you want more step-by-step kind of removal instructions, log analysis, whatever, try posting on the malwarebytes or bleepingcomputer forums

Michael Frank

^

Jebediah Kerman

okay thanks Bob

i gtg as well

Bob

this one seems related: forums.malwarebytes.org/index.php?showtopic=107985

Jebediah Kerman

I will be back in 12hrs

Bob

02:18

but with stuff like hijackthis, you really want to know what you're doing

or post the logs for others to look through

but we don't really have anyone in here who can do that, AFAIK

Jebediah Kerman

reinstall looks like a good optiton now

Bob

so those forums are your best bet

Jebediah Kerman

ja

bye

thanks for the help

Michael Frank

Good Luck.

Bob

what he said :P

Michael Frank

02:41

-3

Q: Need to create an antivirus application for mobile

I need to create an antivirus android application which should be able to scan and identify malwares, trojans and other unwanted files.Is there any method in Java/C# or Android that would help me do this? Please advice.I don't want to create that fake notepad antivirus though. (Please don't put t...

c# java android antivirus utility

Please don't put on -Too late!

Journeyman Geek

03:10

Emergency software development? OH NO. MY PHONE HAS BEEN COMPROMISED BY A ROGUE AI! I NEED TO WRITE AN AV APPLICATION NOW SO THAT I CAN SAVE THE WORLD! YOU FOOLS. YOU HAVE DOOMED US ALL BY DENYING ME THE ABILITY TO ASK QUESTIONS!

2

Bob

03:21

@MichaelFrank yet another guy suggesting SU when it's way off topic -_-

@JourneymanGeek Quink changed their packaging :(

went from that nice little cardboard box to some plastic monstrosity

Journeyman Geek

for the bottles?

Bob

@JourneymanGeek ya

Journeyman Geek

ahh ;p

I have enough HOD for quite a while :)

Bob

@JourneymanGeek I still need to find some way to get my hands on some :P

Journeyman Geek

03:43

@Bob: heh, I'll probably mail you a bottle when things get less crazy.

between school, family drama, and other stuff I'm just too worn out for anything :/

Bob

03:54

@JourneymanGeek wouldn't want to trouble you like that, but thanks for the offer

it'd probably be cheaper for me to ask one of the local stores to import some, anyway... shipping a bottle full of ink is surprisingly heavy => expensive :P

allquixotic

04:44

you guys are freaks... manual assembly of pens?! wat

Journeyman Geek

@Bob: or load up an international cart with it ;p

@allquixotic: not yet, no ;p

I might try building my own if I get a lathe ;p

ChatBot John Cavil

@allquixotic Command suatmm learned

Gowtham

!! suatmm

ChatBot John Cavil

allquixotic

dear Revolution @ Broken Sword 5

!!suatmm

ChatBot John Cavil

04:47

Bob

05:14

oh wow

14

A: How do I split a string??? Help plz? (code trolling)

C My homework assignment is take a string and split it into pieces at every new line. I have no idea what to do! Please help! Tricky problem for a beginning C programming class! First you have to understand a few basics about this complicated subject. A string is a sequence made up of onl...

That is brilliant

hehehe

Every VB introduction should be firmly founded in a solid understanding of monads! — Christopher Creutzig Dec 28 '13 at 20:22

@JimmyHoffa ^ :)

Journeyman Geek

ugh. My school

"t3 final exam results"

whoot

will be released from 17th january onwards

damnit

Bob

lol

@JourneymanGeek bit late

when were the exams?

we got our results over a month ago

Journeyman Geek

early december

Don't forget, they also have put off my graduation due to what I believe is a clerical error ;p

Bob

ah

that was a bit later then

@JourneymanGeek o.O

Journeyman Geek

@Bob: I could pick an elective when I started, they changed the course structure to remove the elective I think

so they told me I hadn't completed all necessary modules when I clearly had.

ekaj

05:41

cheater[

Journeyman Geek

07:03

picked up a gig-e/power line networking switch for my desk

Journeyman Geek

07:16

need to reorganise stuff here tho, I'm a little short of sockets near my desk

and someone left an old desktop at the void deck ;p

seems to be in decent shape, DIY athelon XP box by the look of things

hm, 2003ish era if the label is right, so probably a museium piece ;p

KJ4IPS

07:34

/part

Arrgggghhh...

Journeyman Geek

This isn't irc ;p

Bob

08:35

oh boyo

0

Q: How to track down if someone uses torrent in local network

We have a router , i have an admin password for his interface, so i can monitor LAN activity. But how can i be sure if some user behind some ip is using torrent? Router runs on AirOS from Ubiquiti Networks , using latest firmware (updated 2 weeks ago).

wireless-networking router bittorrent

Transcript for