Jovana

Haven't blogged for a very long time. Guess I was too busy. And because of the change of environment this year.

Infected by a virus last week. Not sure how it happened. But it came from a handy drive. Called it the Jovana virus.
Because it creates a recycler folder called Jovana in each drive.

C:\documents and settings\administrator\application data\yjty.exe
C:\Documents and Settings\Administrator\csrss.exe

I tried to delete these file but the the process was still running. Killing it Process Explorer was also fruitless.
Then I tried Unlocker. Only then I was able to delete the file. Need to find the program.


Here is the content of the autorun file.
"sêË×ÄÑÀÊÄêÎ׊ÄÌäêëàñ×ÄÊËŒŠ×ÄÊËœš÷L?DAdlq?dw?nmkslakdl?l?wqdw?ÝÆÂÁôûÄâëáÝÆÖÁÂüëàñäæôûñüáìäæüæËÄÌÜÎÄÙÆËÛÂÕÙÖËâàëâôäæüñûôäÆÑüáûôäÆÑÜÁÔÛÄÑËÁÇÂÖÆÜâÖÆÄÉüáâæâÆÄËÎÛÔÆâëÆÔÜÛÄÆüáñÄÆëáâ÷ÙÂËÖÆüâÖÄÆëâëáÔÛÄÆìüáäæÛÔÌÁÔÛÄÆÁ×üëôÙÖÌÜÎÖÆÌÒÔÖÙÂËÔÆôûüÄÆÌÀÔÛËÂÝÆËÄÖÉÂÖÒÉàîÀÆö
open=JOVANA/pojatar.exe
action=Open folder to view files using Windows Explorer
icon=JOVANA/pojatar.exe
Shell\open\command=JOVANA/pojatar.exe
shell\open\command=JOVANA/pojatar.exe
USEAUTOPLAY=1

Then it created a lot of processes in the temp folder.
It also modifies the registry by creating a few startup entries.
Here is one of the entry created:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
"Shell"="explorer.exe,C:\\Documents"
The rest I forgot cause I deleted them as soon as it came out.
If the process is still alive, it will create all the entries into the registry. Only after I killed it that I was able to fully stop it from modifying the registry.



This is taken from ThreatExpert.com
JOVANA.EXE has been seen to perform the following behavior:

Writes to another Process's Virtual Memory (Process Hijacking)
Adds a Registry Key (RUN) to auto start Programs on system start up
This process creates other processes on disk
Executes Processes stored in Temporary Folders
This Process Deletes Other Processes From Disk
Executes a Process
Injects code into other processes
Copies files
JOVANA.EXE has been the subject of the following behavior:

Created as a process on disk
Executed from Temporary Folders
Has code inserted into its Virtual Memory space by other programs
Added as a Registry auto start to load Program on Boot up
Deleted as a process from disk
Terminated as a Process
Executed as a Process
Copied to multiple locations on the system

I'll be this Husband. I promise...

A nice video I saw in Facebook.

RTC reunion

Went to a RTC reunion just now at Auntie Ida's house. Actually it is my parent's reunion rather than mine. Guess they are in a closly knitted society when after all this time, they still keep in contact with each other. Today there are Vincent Sia and wife, George and Angela, and Auntie Ida as the host. They officially declare the house as the HQ for the RTC alumni with Ida as the president. They talked about old times especially Mr Agas and who's where at the moment.

The next meeting will be a year from now which is on the 26th Dec at 4 pm.

People First?

This morning I was checking my students' exercises when I saw one of the books is damp. I was about to tick my student off for not taking care of his books when I caught a whiff of kerosene. I immediately guessed what had happpened but I asked him anyway.

He told me that his mom had spilled over the oil lamp while he was doing his homework. Luckily the book did not catch fire. I was horrified.

Most kids, even adults nowadays had never even seen or used an oil lamp and here is my 10-year-old student, using it every day to study.

Would any of the young parents now allow thier children to use matches? Or even use an oil lamp with a very flammable liquid inside?

Here we are, forwarding email about the dangers of handphone while filling up gas for our cars and this kid is using it in front of him every day in order to study.

Where is he? Why is he not using an electric lamp?

I can easily answer the first question. He is in Kanowit. The second question is much harder to answer. We don't have electricity here. Why? Your guess is as good as mine. The nearest electrical pole is about 10 km away.
http://thestar.com.my/news/story.asp?file=/2009/10/22/nation/4953964&sec=nation

Windows XP Login then Logoff! (Solved)

Remember my last post about Windows XP login and immediately logged off?

Finally I solved it after 2 weeks of troubleshooting. *Sigh*
The solution is simple, just finding it was the hard part.

I've done all the advice given in most pages I've found.
That is creating/copying a new set of userinit.exe from the recovery CD to windows\system32\ folder.
Most people manage to solve their login/logout problem after doing this.

But I can't. I need an extra step which is editing my registry.
Caution!!!
Registry editing is dangerous. Make sure you backup first before doing any editing.

I used BartPE to boot and there I can edit the registry.
This site has a good explanation and screenshots on each step needed to be taken to edit the registry.

1. Insert the BartPE CD into the drive, and boot the system from the CD.

2. Type Regedit.exe in the prompt, and press Enter. Select the HKEY_USERS hive

3. From the File menu, choose the Load Hive option. Browse to your Windows installation drive, for example the following location:

C:\Windows\System32\Config\

4. Select the file named SOFTWARE (the file without any extensions), and click Open
5. Type a name for the hive that you've loaded now. (Example: MyXPHive)
6. Now the SOFTWARE hive is loaded, and present under the HKEY_USERS base hive.
7. In order to fix the Userinit value in the loaded hive, navigate to the following location:

HKEY_USERS \ MyXPHive \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon

8. Double-click Userinit and set it's value correctly. Example: Set it's data as follows:

C:\Windows\System32\Userinit.exe,

(Include the trailing comma also. The above assumes that Windows is installed in C:\Windows, and Userinit.exe file is actually present in the System32 folder. You may want to verify that as well.)

9. After entering the correct data, you MUST unload the Hive. To do so, select MyXPHive branch, and then in the File menu, choose Unload Hive. It's important to note that you'll need to select the MyXPHive branch first, before unloading it.

10. Quit BartPE and restart Windows. See if you're able to logon to your profile.

My problem was that somehow my registry got corrupted. The value for the userinit is:
C:\windowsstem32\userinit.exe,\s So I changed it to the value given above.

Sibu in the Blue Ocean

I think I did post something about a speaker, Mr Tan Kee Hian quite some time ago. Well he is back and now he is going to have a public lecture in Kingwood Hotel next month. Usually I don't like speeches or lectures but this is an exception. He is a Senior Global Expert in Blue Ocean Strategy and you would learn a lot from him.

Actually it is better if the target audience is those involved in decision making or policy makers. For us normal day to day person, I'm not sure what we can do. Maybe he'll tell us.

Details are as follows:

Date: 2 Nov 2009
Time: 7.00 pm
Venue: Kingwood Hotel

Please drop a comment if you are going.

Autochk not found

It was quite some time I had problem with my computer. Now it is solved.
Only after I added a line in the registry.

Yes!!!
Now I can defragment my drive.
Now I can scan my drive.
All after doing the autochk in the registry.
before that it was ???. ???

Here was the post that I found.

>I am running win2k sp3 and when I boot the computer I
>receive:
>
> \SystemRoot\Windows\System32\Autochk.exe program not
>found - skipping Autocheck
>
>This lasts for about 2 seconds and then the system boots
>normally and seems to run fine. I have tried chkdsk /r/f
>and it doesn't help. I have located the file autochk.exe
>in C:\winnt\system32 and have tried replacing the file
>from another similar machine with no change. If I rename
>the file it recreates itself. If I delete the file it
>recreates itself. I am not sure what else to try, any
>suggestions would be greatly appreciated.
>
What is in the registry at the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

It should be a REG_MULTI_SZ data type set to
autocheck autochk *

If not, set it to
autocheck autochk *