Journal Copying Trick?

An interesting find:

When completing writeups if you are just copying quickly from another journal, mostly you just copy it blindly word to word (if u r not skipping words and even if u r, u might do the skipping also blindly, not caring for grammatical mistakes).
You tend to copy word to word, buffering a small amount, without making sense of what you are reading or writing. Sometimes you don't even realize if the sentence you are copying has grammatical mistakes coz u don't buffer the entire sentence. This is like xeroxing. So it might look like its a no-brainer. You don't need to think or do processing.

The interesting find is: If you understand while reading and then write, it requires lesser processing!

Accidental experimental Proof:
I was copying a writeup at 2.30AM, tired. I was following the xeroxing method as always and was doing quite well and not sleepy. Then I tried understanding the sentences and writing. And I relaxed and sleepy! Plus I required lesser time to write the same amount of content.

That was not an intentional experiment so there r no psychological effects.

There's a con though to the 2nd method of copying: You can't sing or hum your favourite tune while understanding (reading) though u can do that while writing. So in other words, u can't multi-task efficiently. But maybe girls wont find even doing that difficult as I hear, girls are better at multi-tasking :)

---

Share

winupd01.exe Virus Complete Removal

I had mentioned in my last post that I had removed the winupd01 virus but not completely. And yesterday, it returned as feared. However I realized it was a silly mistake of mine to miss 2 more of its files that were starting up even after removing the winupd01.exe

So here is the removal process:

(I should mention, this is for Windows XP as I have XP and have never used vista or windows 7. I don't know if this is applicable for Vista and win7 as the paths may be different.)

First, get this tool: "Autoruns" http://technet.microsoft.com/hi-in/sysinternals/bb963902(en-us).aspx
It shows all the programs that run automatically when you start your computer. Extract the zip file to some folder. Now again, the virus auto-closes this software so just rename the Autoruns.exe to any other name like Autorunsss.exe and run it. There will be several startup entries of the viruses which are as follows:

1) In "Image Hijacking" tab: winupd01.exe
2) In "Winlogon" tab: 1 or 2 entries for szywo.exe and/or knauct.exe and/or ahrg.exe
(All these files are in C:\Documents and Settings\[username]\Application Data\
OR C:\Documents and Settings\[username]\)
3) In "Logon" tab: (Somewhat same as those in Winlogon tab but more entries.
4) In "Drivers" tab, there might be 1 or 2 .sys files of the virus. The name is random. So you will need to find any suspicious .sys file. In the list, check for those entries for which the 'Publisher' and 'Description' column has no value. For such an entry if the filename is totally weird like ijlocpvb.sys or lbrtfdc.sys, note it down.

Do not delete these startup entries for now as its no use deleting them now; the virus will simply rewrite them. Now to delete these files, start your computer in another OS like linux. You can use a linux live DVD like Ubuntu live so that you dont have to install it. Just put the dvd/cd in and boot up your computer. (Make sure the first boot device is CDROM in your BIOS setting to boot from the cd. Google it if you don't know how to do it.)

Then delete the following:
1) Delete C:\Windows\System32\winupd01.exe
2) Delete all .exe files in C:\Documents and Settings\[username]\
3) Delete all .exe files in C:\Documents and Settings\[username]\Application Data\
(This is probably where you'll find the szywo.exe)
4) Delete all .exe files in C:\Documents and Settings\[username]\Local Settings\Temp\
5) Delete all .exe files in C:\Documents and Settings\[username]\Local Settings\Temporary Internet Files\
6) If you had noted down any suspicious .sys file from the Drivers list, then remove it also. It will be in: C:\Windows\System32\drivers\
Just to be on the safe side, take a backup copy of that file before deleting it so that after restarting into windows if u find something not working properly, you realize that .sys file was actually a Windows needed file and you can restore it back.

Thats it, now restart in Windows again.
The virus wont be running now. Now delete all its startup entries using the Autoruns tool.

*The virus may have made changes to the hosts file (C:\Windows\System32\drivers\etc\hosts) which affects internet browsing.
Check the size of the hosts file. If it is about 4.7mb then open it with notepad and delete all its contents and add this line which is the default content:
127.0.0.1 localhost

If you have multiple users on your XP, then you should check for and delete the exe files in all the users' Documents and Settings folder as given above. Also, delete the startup entries for each user. To delete the startup entries for another user, in the Autoruns program, click on the 'User' menu and then click the another user's name. And then delete the startup entries of the virus as mentioned above.

Thats it! You've gotten rid of the stubborn email spamming virus.

Leave a comment if you have any problems.

---

Share

Virus attack - winupd01.exe

My Friday evening was spoiled thanks to this stubborn virus. I was just browsing (just ebay and no suspicious sites) and suddenly my avira antivir detected a file called 205.exe in the Temperory Internet Files folder; i chose to deny access to it. But still my cursor changed to 'processing' indicating something running in background. After looking at the 'Temperory Internet Files' folder I found out there were in all, 5 exe files with weird names one of which was 205.exe
After some investigation of these files in my virtual machine i concluded that 205.exe was not run but another of those 5 was causing the damage.... And that was fol.exe which installed itself as winupd01.exe
I still have no idea how these files entered and executed on my system.

About winupd01.exe:
Size: 208,896 bytes
MD5 Hash: 5224bc60f8a486d895ff584d647897e7
Is a Malware!

Based on what I noticed when my system was infected and on the packets I sniffed here's some details:

What it does:
1) Keeps searching for email addresses on the net
2) Continuously sends spam viagara emails to email addresses which it found probably in step 1.
As a result ur net slows down.
3) Kills your antivirus's guard/protection. (I had avira antivir)
4) Hides itself from running processes. (That was the biggest hurdle in finding it.)
5) Auto-closes packet sniffers as soon as u open them. (I found a workaround to this by renaming the default filename of the sniffers)
6) Autocloses hijackthis, killbox.
7) Keeps ticking the 'Do not show hidden files and folders' option in folder options.
8) Writes some big crap to the hosts file making it 4.87mb

How it ensures it starts up with windows.
1) It copies itself to C:\Windows\system32\winupd01.exe
2) Adds the following registry entry to HKLM\Software\Microsoft\Windows\CurrentVersion\Run:
Name: ctfmon.exe Data: ctfmon.exe
3) Adds the following registry entry to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe
Name: winupd01.exe Data: C:\windows\system32\winupd01.exe
Thats how it starts with windows.
There are a few more entries in regedit if u search 'winupd01.exe' but i dont think they r significant.
It keeps adding these entries continuosly so u cant delete them

How to remove it:
1) Restart computer in another OS (I used a Ubuntu linux live dvd)
2) Delete the file C:\windows\system32\winupd01.exe and C:\windows\system32\ctfmon.exe
3) Delete all the crap added to your hosts file (C:\windows\system32\drivers\etc\hosts). i.e. just delete all the contents and add this line:
127.0.0.1 localhost
4) Restart your comp in windows. Now the virus wont run. But you should clean the registry of its traces. So remove the above said entries. And also search the entire registry for 'winupd01.exe' and delete all you find.

However, it seems the virus hasnt been completely removed even after I have done this... coz my explorer.exe tries downloading fol.exe from 89.149.253.xxx on startup which is nothing but the winupd01.exe file. But fortunately, it gets a File Not Found error.

Also see the PrevX info on this file: http://www.prevx.com/filenames/X1212390081188608968-X1/WINUPD01.EXE.html
EDIT: See my new post on how to remove this virus completely here.

---

Share