Category Archives: Windows

Dissecting a Windows malware (Part 2)

Posted by on February 5, 2014 No comments

Today I looked a bit closer at the response sent from chromeupdatecenter.com to the request of the malware. The malware connects to Port 8080, most likely because the “malware webservice” runs on another HTTP server instance (the headers state nginx, while the main page is supposedly running Apache on a Ubuntu server). I figured out that the first 22152 bytes contains a bitmap. This bitmap is later on saved to the users temporary path (on Windows 7 to C:\Users\$USERNAME\AppData\Local\Temp\32239.bmp).

Desktop wallpaper after infection

Desktop wallpaper after infection

The image length also matches the header “ACC”, which states 22152. Although, the length of a bitmap is also available from its header, which would make the server code a bit easier, maybe something for their next version 😉

However, after the bitmap, there are still 493 bytes left. This should be either the encryption key or the message in the AlertEncryptor.txt files…. Read more »

Dissecting a Windows malware

Posted by on January 31, 2014 No comments

chromeupdatecenter.com Screenshot

Through a friend of my I got to this seemingly fresh malware named GoogleChromeUpdater.exe. The page (URL see at the end of the post) claims to distribute a important Chrome Update. However, the malware encrypt files and left an E-Mail address, the classic file kidnapping along with blackmailing.

Note: If you are infected by this malware your chances are bad to get back your data. The encryption key is likely only stored on the attackers server. Unless somebody breaks the encryption, you cannot restore your data. And of course, you should not feed criminals! 🙂

I could not resist and had to have a closer look at the malware…

Read more »

Database Mail issues on SQL Server 2008

Posted by on April 18, 2013 No comments

On a SQL Server 2008 (SP3) Express Edition I tried sending an E-Mail using the Database Mail feature. I kept getting an error message in the Server Logs (use Management Studio and browse to Management\Server Logs in the Object Explorer on the left side) when trying to send an E-Mail:

Exception Type: Microsoft.SqlServer.Management.SqlIMail.Server.Common.BaseException
Message: The read on the database failed. Reason: Fehler beim Laden von 'Msxmlsql.dll'.
Data: System.Collections.ListDictionaryInternal
TargetSite: Microsoft.SqlServer.Management.SqlIMail.Server.Objects.QueueItem GetQueueItemFromCommand(System.Data.SqlClient.SqlCommand)
HelpLink: NULL
Source: DatabaseMailEngine

I could resolve this issue by coping the files …\Microsoft SQL Server\msxmlsql.dll and Microsoft SQL Server\Resources\1033\msxmlsql.rll to the SQL Server instance folder Microsoft SQL Server\MSQL10.[INSTANCE]\MSSQL\Binn.

Switching Windows 7 and Ubuntu to UEFI

Posted by on December 15, 2012 No comments
UEFI Logo

UEFI Logo

After upgrading my hard disk on my Laptop I planned to switch to a GPT (GUID Partition Table). But since I’ve a Windows 7 installation as well I had to switch to UEFI boot mode because Windows 7 does not support booting from GPT using the old BIOS/MBR bootmanager/bootloader (You can find a good Q&A about GPT support of Windows at MSDN). Luckily my old HP Elitebook 8530w already includes an UEFI enabled BIOS (without Secure Boot). It supports (like many others) the old boot mode as well as the new UEFI boot mode. By selecting the “UEFI” entry in the boot menu one can make sure that the UEFI boot mode is enabled. After reading some documentation (especially the once from Roderick W. Smith) I decided to use the rEFInd boot manager and the kernel provided EFI stub bootloader (part of the mainline kernel since 3.3.0). I’m using Ubuntu 12.10 which comes with Linux 3.5 and enabled EFI stub bootloader in the stock kernel… Read more »

Samsung Series 9 13.3″ Ultrabook (NP900X3D) Review

Posted by on December 8, 2012 No comments
Samsung NP900X3D

Samsung NP900X3D

This week I got myself a Christmas gift: A shiny Samsung Series 9 Ultrabook (or Notebook, what they call it). My device came with a Sandisk SSD U100 128GB, 4GB Memory, HM75 Chipset and the Intel Core i5 3317U Processor. The device looks very nice and feels solid. I like the non reflecting screen very much, the resolution of 1600×900 feels right for the screen size (13.3″) with default DPI settings. Finger prints don’t remain on the outside of the device, but you can make them out on the keyboard. The lid shuts very well, but its a bit hard to get a grip on it to open again. The track pad is big, scrolling using multitouch gestures is very nice to use. Sometimes the track pad fires a click when I just try to move the cursor… Nevertheless, really solid hardware!

Windows 8 and some additional Software was preinstalled. After clicking through the Installer my PC was ready for the first real boot test: Boot time is really incredible, something more than 4 seconds after pressing the power button and the lock screen is visible. Well, it takes another two second to access the desktop, but still, very fast! Since I never worked with Windows 8 so far, I was happy that Samsung provided a nice Quick Start leaflets, so I know now how to access and name the new Windows 8 menues 😉 Read more »

MUI on Windows Server 2008 R2

Posted by on July 28, 2012 No comments

Today I tried to install a Language Pack (KB974587) on a Windows Server 2008 R2. This failed silently, but I found a hint in the Logfiles (C:\Windows\Logs\CBS\CBS.log):

2012-07-28 18:24:50, Info                  CSI    000005f7 Begin executing advanced installer phase 34 (0x00000022) index 4105 (0x0000000000001009) (sequence 4137)
    Old component: [l:0]""
    New component: [ml:324{162},l:322{161}]"Microsoft-Windows-WCFCoreComp.Resources, Culture=de-de, Version=6.1.7600.16385, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    Install mode: install
    Installer ID: {d82eedee-854e-4f9a-b458-ae1bc62a0e6b}
    Installer name: [16]"LodCtr Installer"
2012-07-28 18:24:50, Error                 CSI    00000022 (F) Logged @2012/7/28:16:24:50.996 : [ml:456{228},l:454{227}]"Cannot open actual INI file "C:\Windows\inf\ServiceModelService 3.0.0.0\_ServiceModelServicePerfCounters.ini" referenced in "C:\Windows\inf\ServiceModelService 3.0.0.0\0407\_ServiceModelServicePerfCounters_D.ini", error code 2."
[gle=0x80004005]

The ServiceModelService belongs to the WCF part of the .NET Framework. In the Server Manager under Features I found the “WCF-Activation” option. So I activated this option (with “Non-HTTP Activation”). Afterwards, the file in Question existed and the installation of the Language Pack succeeded!

Convert VMware growable, splitted and snapshoted disks

Posted by on December 20, 2009 No comments

In the last weeks I started to migrate my virtual machines to KVM. Until now, I used on two Servers VMware Server 2.0 on Ubuntu, which caused many problems with Disk I/O’s and performance problems. Either way, I prefer Open Source software whenever possible. KVM and libvirt, which I use to manage KVM, is in a quite mature state nowadays.

To convert the VMware images I used this How-To. This worked quite well for most of my Virtual Machines. But several had snapshots or were split into 2GB files. This cant be handled by qemu-img. I converted the files to single, flat disk file first using vmware-vdiskmanager. In the end, I wanted to have pre-allocated (single file) anyway, because it provides best performance:

$ vmware-vdiskmanager -r Ubuntu.vmdk -t 0 Ubuntu-copy.vmdk

Read more »

ISO-Dateien Booten

Posted by on December 2, 2009 No comments

Vor kurzem habe ich bei meinem Laptop eine Intel SSD Harddisk eingebaut, und deswegen mein CD-Rom ausgebaut. Dies hab ich ohnehin selten bebraucht, aber es gibt Situationen, in denen es wirklich praktisch ist, zum Beispiel um CD’s zu booten. Ubuntu hat dafür ein Tool, um Ubuntu-CD’s auf USB-Sticks zu schreiben. Dies brauche ich auch öfters und funktioniert ganz ordentlich. Jedoch gibts manchmal auch andere ISO-Dateien die ich booten möchte. Dafür hab ich nun eine Lösung gefunden: Es wird ein Linux mit einem angepassten GRUB-Bootloader auf einen Memorystick geschrieben. Dieser Bootloader kann dan die ISO-Datei direkt vom USB-Stick booten. Wirklich sehr praktisch, allerdings funktioniert die Anleitung nur unter Windows…

VirtualBox 3.1 Performancevergleich

Posted by on December 1, 2009 No comments

Gestern wurde VirtualBox 3.1 freigegeben. Im ChangeLog steht, dass die Performance erheblich verbessert wurde. Dies wollte ich einmal auf den Prüfstand stellen, und habe ein paar Messungen auf meinem Notebook gemacht (HP EliteBook 8530w, Core 2 Duo T9400, 4 GB Ram mit Ubuntu Karmic 64-Bit). Dazu habe ich die Boot-Zeit zweier virtuellen Maschinen gemessen. Dafür habe ich die Maschine zuerst einmal gestartet, so dass alle Daten im Ram vorhanden sein sollten. Dannach habe ich zwei Durchläufe gestoppt, jeweils vom Startklick bis zum Login-Bildschirm. Die erste Maschine im Test war Windows 7 Ultimate 64-Bit von meiner SSD (Intel SSD 80GB X18-M G2), die zweite Maschine Windows XP Professional 32-Bit von meiner Magnetplatte (Seagate Momentus 320GB 7200upm). Beiden Maschinen sind mit S-ATA und Hardwarevirtualisierung konfiguriert. Die Resultate finden Sie nach dem Sprung. Read more »

Error 80070005 bei Windowsupdate unter Windows Vista

Posted by on March 31, 2008 No comments

Seit längerem habe ich geschäftlich Windows Vista Enterprise im Einsatz. Leider funktionierte Windowsupdate schon nach kurzer Zeit nicht mehr. Es erschien immer der Fehler 80070005, mit welchem auch Google nicht viel anzufangen wusste. Heute habe ich mich deshalb nochmals mit diesem Thema befasst, und fand über www.vistaheads.com heraus dass es sich um ein Registry-Problem handelt. Grundsätzlich bedeutet der Code “Permission Denied”, wobei diese Zugriffsverletzung von einem Registryzugriff her rührt. Mit dem von Microsoft zur Verfügung gestellten Tool “Process Monitor” (ehemals Sysinternals) kann dieser Zugriff sichtbar gemacht werden. Bei mir wurde der Fehler vom Prozess TrustedInstaller.exe ausgelöst. Ich musste daraufhin bei einigen Registryeinträge die Berechtigung für den Benutzer “SYSTEM” neu setzten, worauf es dann wieder funktionierte!

Zwischendurch hatte ich noch den Fehler 80242014, welcher legedlich einen Neustart fordert… Dannach werden die Updates wieder installiert…