We support Microsoft .NET Framework 2.0 & 1.1, all versions of Access, SQL 2000, SQL 7.0, SQL 2005 Express, SOAP, FrontPage 2002, 2003, Visual Studio 2005, Index Server, XML, UDDI, & Mobile device support. We also offer great third party tools like SmarterMail, Merak Mail, SmarterStats, PHP, Perl, MySql, DeepMetrix Livestats XSP 8.0.   We support Microsoft .NET Framework 2.0 & 1.1, all versions of Access, SQL 2000, SQL 7.0, SQL 2005 Express, SOAP, FrontPage 2002, 2003, Visual Studio 2005, Index Server, XML, UDDI, & Mobile device support. We also offer great third party tools like SmarterMail, Merak Mail, SmarterStats, PHP, Perl, MySql, DeepMetrix Livestats XSP 8.0.
 Wednesday, December 27, 2006

Short for "information technology". Synonymous with MIS or CIS, which is "management/computer information systems." Term used to loosely describe computers and the management of information.

IT professionals are often looked down upon as non-social beings who fix computers all day. IT, in reality, is anything related to using technology to store and analyze information.  "The IT department is full of computer geeks." Urban Dictionary Defined:

Yet it has some how become a catch-all for every idiot who has even slightly more knowledge than the person they represent. I remember this group from the late 90's. Most were webmasters then; and it appears they have little more knowledge today.

Even though I wear many hats and have worked internet servers, and a BGP network for over 10 years there is no way I want to be referred to as a IT guy. Nor do I plan to be a webmaster anytime soon. Inspite of the fact I have developed and manage several web sites. So you got a degree in Informantion Technology, yet it appears from my experience after talking to people daily with support issues who have no concept of the basics.

If you don't know just say you don't know. If you do know please don't try to impress someone with your vast experience. You will likely find that ego's are the root of this problem in the first place.
Tip: Don't start your IT guy conversation with something is wrong with your server to the administrator. Likely you will get negitive results. Perhaps something like: I am having a problem with; "Define the Problem". Will certainly produce better results.

Typically client services and administrators only want to know the facts. Likely they do not have much time for your vast knowledge to be revealed really. Nor will they likely be impressed, since they are doing machine administration everyday.

Tip: Don't be a IT guy and put your corporate mail server on a dynamically assigned IP address. Dynamic DNS is a great service but really can have negitive results for a mail server.
Tip: If you are on a windows DC please make sure the DC dns has had some root servers added. Certainly before you tell someone else there is something wrong with their dns.

12/27/2006 11:07:21 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Tuesday, December 26, 2006

12/26/2006 5:54:09 PM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Monday, December 25, 2006

ReadyBoost is Windows Vista feature that allows the user to plug a USB flash memory device into a USB 2.0 port on the PC and use it as a cache or virtual memory.  The advantage being that it is much faster to cache to the USB drive than caching to your hard disk, speeding up your system and enhancing overall performance.  Acting as a fast store for frequently accessed data, the average random 4K read from a flash device is about ten times faster than accessing the same information from the hard drive.

Select Use this device.  Here you can also set how much space ReadyBoost should reserve for the cache - the most space you reserve, the faster things go. That’s all there is to it!  ReadyBoost is working.  You can conform this by looking at the contents of the drive through Windows Explorer.  If it’s working you’ll see the ReadyBoost file (which as the .sfcache extension).

There are two ways that you can disable ReadyBoost.  First, you can just disconnect the drive from the system.  This won’t cause any system instabilities or data loss because the flash drive is not used as an exclusive data store, only as a high-speed cache, so the only thing you’ll notice if you remove the drive is a drop in  performance.  (The only drawback to this is that the ReadyBoost cache file will remain on the drive and take up storage space until you deleted it manually.)

The best way to disable ReadyBoost is to shut it down properly.

  • Fire up Windows Explorer and find the drive
  • Right click and select Properties
  • Click on the ReadyBoost tab
  • Select Do not use this device.
  • Click OK.

This deletes the cache file for you, once again freeing up space on your flash drive.

12/25/2006 8:55:34 PM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

Here is the latest in a long stream of safety warnings that common sense would have suggested never be necessary. Attack of the Show from G4 TV has a nice video for us that I actually thought was pretty darn funny. I think this was actually the same chick who gave me my warm nuts and a coke on my flight back to visit the folks this year.

More Wii Tips here

12/25/2006 6:20:51 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Sunday, December 24, 2006

Sony BMG Music Entertainment's botched attempt to stop unauthorized music copying has cost the company another $4.25 million.

Two days after reaching settlements worth a combined total of $1.5 million with Texas and California, Sony on Thursday agreed to pay another 40 states the money to end investigations into its use of two copy protection programs: First 4 Internet Ltd.'s XCP (extended copy protection), and MediaMax, written by SunnComm International Inc.

In a statement, Sony said it was pleased with Thursday's settlements. More than 12 million Sony BMG CDs shipped with this software last year, according to a statement from the Massachusetts Attorney General.

Sony's trouble began in late 2005, when a computer science researcher disclosed that XCP used dangerous "rootkit" techniques to cloak itself after installation.

Later, investigators found that even users who declined to install the MediaMax program would have software placed on their computers, and one version of the program created a security issue, the Massachusetts statement said.

Sony has reportedly also reached a tentative settlement with the U.S. Federal Trade Commission in the matter, although nothing relating to that investigation was announced Thursday. Sony settled a class-action lawsuit over the software in May.

As with the California and Texas agreements, residents of the 40 states that settled with Sony are entitled to up to $175 in refunds for damages that may have been caused to their computers. The settlements also limit the ways that Sony can use copy protection software in the future and require that the company notify consumers if it uses this kind of software.

12/24/2006 7:00:33 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

President George W. Bush has signed legislation directing the Environmental Protection Agency to study energy use in data centers.

The bill, passed by the Senate on Dec. 8, authorizes the EPA to analyze the growth of energy consumption at data centers. The issue is a growing concern to companies that operate large groups of servers, storage devices and other computer equipment. Many data center operators find that the cost of electricity and  air conditioning that keeps servers cool rivals the cost of the servers themselves.

The EPA study should help to promote more energy-efficient solutions across the high technology industry, said Steve Kester, manager of the government relations division at Advanced Micro Devices Inc. (AMD), a maker of server processors and one of several high technology companies endorsing the bill.

"We're very pleased that the administration sees this as important," Kester said. The EPA study is expected to take about six months and could result in the agency's establishing measurements to judge the energy efficiency of servers, processors and other data center equipment.

AMD hosted a forum Dec. 6 at its headquarters in Sunnyvale, Calif., with the U.S. Department of Energy  and representatives of major technology companies, including Dell Inc., Hewlett-Packard Co., IBM, Sun Microsystems Inc. and Intel Corp. The DOE's Office of Energy Efficiency and Renewable Energy called the gathering a "tech industry working group" to exchange ideas on energy conservation.

12/24/2006 6:56:28 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

Google overtook Yahoo as the second most popular Internet destination for Web surfers worldwide in November, while Microsoft held on to the top spot, industry tracker ComScore reported.

Slightly more than 736 million people around the world traveled the Internet last month, with 475.5 million of them visiting Google websites and 475.2 million going to Yahoo online properties, according to ComScore.

Websites of Redmond, Washington-based software giant Microsoft were visited by 501.7 million people, the rating tally revealed.

Hot video-sharing website YouTube placed 10th in the ComScore Media Metrix rankings but showed the largest surge in visitors, with the number catapulting by more than 2,000 percent to 107.9 million.

Google's results did not include visits to YouTube, which it bought in October.

The popularity of Google websites was up nine percent from the same month a year earlier, while visits to Silicon Valley rival Yahoo grew by five percent and to Microsoft by three percent in the same comparison.

Online auction pioneer eBay was ranked in fourth place, with the number of visitors slipping by one percent from November 2005 to 250.8 million. Time Warner Network site visits also notched down one percent, totaling 222.1 million.

12/24/2006 6:49:07 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

StopBadware.org and the Center for Democracy and Technology (CDT) have teamed up to file a formal complaint with the Federal Trade Commission (FTC) against FastMP3Search.com.ar for distributing badware to unsupecting Internet users.

FastMP3Search.com.ar is a site that offers MP3s for download -- however, it requires users to download a plugin in order to download these songs. Unfortunately, this plugin comes bundled with a ton of adware, Trojan horses, and other forms of badware -- none of which is disclosed to the user. We've written up an in-depth report on the FastMP3Search Plugin that explains all of the bad behaviors that users are subjected to when they download this application. For a summary of those behaviors, check out our blog post. Prof. John Palfrey has also posted his thoughts on the subject on his own blog.

Related links:
StopBadware and CDT's FTC complaint
StopBadware's report on the FastMP3Search Plugin

12/24/2006 6:45:19 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

With Christmas fast approaching, Santa Claus reached out for a little help from Stopbadware.org this week.

The consumer advocacy group said it was approached by an Incline Village, Nevada, man who had legally changed his name to Santa Claus, who asked them to help figure out why his Web site was being flagged by Google's Web site filters.

It turned out that Santa's Web site had been hacked.

On Friday, the Web site was still downloading malicious software, according to Roger Thompson, chief technology officer with Exploit Prevention Labs. It exploits a bug in Internet Explorer that Microsoft  patched last August, meaning that people running older versions of the browser could be at risk, Thompson said via instant message.

"The site is hacked," he said. "If you are not patched, it uses an exploit to silently install a huge amount of adware and spyware."

The original problem was soon resolved by Stopbadware.org, but on Friday malware had again cropped up on the Web site.

12/24/2006 6:42:39 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Tuesday, December 19, 2006

I am constantly presented with some issue, how I do block this or that? It seems that not many people know how to experiment so I will take a couple of examples for Merak Mail server as to how to stop the dynamically generated images and sources that seem to make it past some filters.

Ok so you can see we are using "regular expression" in the "body".

If you view the source of the email you will find a string that will put an end to these annoying emails one by one. Since they are the most offensive emails on the web and costing everyone in time and money.

12/19/2006 8:49:25 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

Microsoft Windows Vista is designed to dramatically improve the computing experience of every kind of PC user—from people at home who use their PCs for simple web browsing, to business people. To make sure that everyone has an offering tailored to meet their specific needs, Microsoft will deliver five different editions of Windows Vista. Each edition is focused on the needs of a specific type of person. Large, global organizations with complex IT infrastructures should consider Windows Vista Enterprise Edition.

Version Comparison

12/19/2006 5:59:20 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Saturday, December 16, 2006

The feature that protects against fraudulent Web sites, new in IE 7, in some cases could bog down computers running Windows, according to an article on Microsoft's support site published Tuesday. This could happen when a Web page contains many frames or when a user browses many frames in a short time, the company said.

"When you use Windows Internet Explorer 7 to visit a Web page, the computer may respond very slowly as the Phishing Filter evaluates Web page contents," according to Microsoft. "Internet Explorer 7 evaluates the whole Web page when you browse a frame. Therefore, CPU (central processing unit) usage may be very high."

12/16/2006 7:54:24 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

Sarah Deutsch is steaming. The attorney for Verizon Communications regularly scours the Web from her Arlington (Va.) office and finds hundreds of new sites that use variations of Verizon's name. A mid-December browse uncovers a constellation of Verizon-inspired domains such as verizonpicture.com, vorizonringtone.com, and varizoncellularphone.com.

What angers Deutsch is that none of the sites have anything to do with Verizon. Instead, they're registered by companies like Nassau (Bahamas)-based Wan-Fu China and Pompano Beach (Fla.)-based Moniker.com. They're engaged in a little-known activity called "domain tasting," a legal practice that lets registrars snatch up Internet domains for five days at no cost. Typically, these companies jam the borrowed Web sites full of ads and pull in money as visitors click on the ads. Because they can use the Web sites for no charge, these firms are registering mass quantities of domain names each day, getting under the skin of companies trying to protect their brands online. "Domain tasting is destabilizing the entire domain name system," says Deutsch. "People are purposefully exploiting trademarks and misleading consumers."

The practice has soared in the past two years. In late 2004, roughly 100,000 domain names were tested on any given day, and now, the number has ballooned to 4 million, according to Jay Westerdal, chief executive officer of the domain consultancy firm Name Intelligence. Experts estimate that less than 2% of the sites that are tried out for a few days are ultimately purchased by registrants. It's a bit like being able to get clothes from a store, wear them for five days, and then return them at no charge.

With an ever-expanding menu of domains on offer, tasting will likely continue its exponential growth. There are more than 250 suffixes besides ".com" to choose from, and more companies are getting in the game of domain registration. Today search engine giant Google announced it will work with top registrants GoDaddy.com and eNom to register addresses ending in ".com," ".net," ".biz" and ".info."

12/16/2006 7:13:30 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Saturday, December 09, 2006

It is that time again and these bogus postcards are appearing once again. By now everyone should mouse over any link they think is questionable in your email. Though if anything is questionable just don't do it. Here is a prime example where clicking the link will try to execute an application. Don't find out just don't! No postcard is worth it. The return address is member@PostCard.ORG is not the same site as postcards.org. Both these domains seem legit but then who cares. No postcard or e-card should want you to run a .exe! Seems both should be warning people about the scam.

12/9/2006 6:06:32 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Tuesday, December 05, 2006

It began on Mar. 10, 2004, when a computer programmer from Oak Park, Calif., named Michael Anthony Bradley arrived at Google's offices for a prearranged meeting with the company's engineers, according to a criminal indictment filed two years ago in the U.S. District Court in San Jose. Bradley, then 32, proceeded to demonstrate new software, dubbed "Google Clique," designed to generate false clicks on Google ads. Bradley claimed his program could force Google to pay millions of dollars on false clicks and threatened to release it to others unless Google paid him approximately $150,000, according to the indictment.

Law enforcement, tipped off earlier, taped the meeting from the room next door and soon arrested Bradley. It appeared Bradley would become the first person criminally prosecuted for charges related to click fraud, the Achilles heel of the Internet-advertising industry, which costs marketers as much as $1 billion a year.

One would think that a proper way to validate clicks could be created. An option would be return a minimum of a 10% discount to all pay per click customers of all search engines. This case is pointing at google but it is known that pay per click has had its share of fraud with others as well. Why would the search engine care after all it is not hurting them? In fact they get paid either way so it does not matter to their bottom line at all. In fact it might be the reason the fraud exsits in the first place. Many businesses models do not even have a 10% margin, it would certainly not hurt the pay per click model. Full Story

12/5/2006 5:47:54 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Monday, December 04, 2006

Connection string for web.config. Attaching your uploaded database to a 2005 SQLExpress server without administrator needing to help. Make sure to insert the name of your database in the areas marked in bold.

<connectionStrings>
    <add name="DBNAMEConnStr" connectionString="Data Source=.\SQLExpress;Integrated Security=True;User Instance=True;AttachDBFilename=|DataDirectory|DBNAME.mdf"
providerName="System.Data.SqlClient"/>
        </connectionStrings>

Dev
12/4/2006 6:34:23 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Sunday, December 03, 2006

I must post this hack which has come to our attention if for no other reason to save some other administrators some time. First I found the exists of a service called network.exe within System32 though as we all know the name is not important. Look for any unknown service running. Search your regkeys and kill the reference that starts this service.

You will know you have the problem when you cannot click on anything within Enterprise Manager like a database or Logins and go to properties. The error will appear related to xpstar.dll at this point. Well you can copy them from another SQL install or simply run SP4 SQL 2000 again. But this only fixes SQL it does not get to the root of the problem.

The cause is a .bat or .cmd which has been inserted to do the dirty work. Search your system for the offending, in this case it was known as a761.bat but again it can be named anything. So remove the registry entry that tells the bat to run when you logon. Or you have not beat anything yet.

So lets look at the .bat file.

net stop mssqlserver
net stop mssqlserver /Y
DEL C:\Program Files\Microsoft SQL Server\MSSQL\Binn\xplog70.dll
DEL C:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll
DEL C:\Program Files\Microsoft SQL Server\MSSQL\Binn\xpstar.dll
del c:\PROGRA~1\MICROS~1\MSSQL\Binn\xplog70.dll
del c:\PROGRA~1\MICROS~1\MSSQL\Binn\xpstar.dll
del c:\PROGRA~1\MICROS~1\MSSQL\Binn\odsole70.dll
net start mssqlserver

So after we are done making sure the bad code has been removed then make sure the files are in place, as I said this can be done either copying them or reinstall SP4 for SQL 2000.

I won't go into how we stop the badguy from returning. That is up to each administrator what method you want to take. I offer this only as a way to get you out of trouble and allow you the time to think about how they did it and how to prevent it.

12/3/2006 6:37:21 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Friday, December 01, 2006

I recieved a request how do I block my child from going to a specific site. They did not want to load any software or block their childs use. They just wanted stop them from spending hours on MySpace. Well I kind of thought sorry for the kind but it is easy. Just a simple edit to the Host File in this path will make the URL call go right back to the source machine. The example below I added *. so that no matter what the URL of myspace.com they call, it will never leave their local machine. Many kid's would not be fooled by this! However most would just be mad at their parents and give up. This gives the path to where the file is located to edit with notepad and save. It will only trash Myspace.com if you have a list add them.

12/1/2006 9:56:39 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Thursday, November 30, 2006

A critical security vulnerability in an ActiveX control used by Internet Explorer could allow malicious hackers to use Adobe's Reader and Acrobat software to launch PC hijack attacks, according to a warning from Adobe Systems.

The San Jose, Calif., company released a security support advisory with pre-patch workarounds and warned that multiple unpatched flaws could cause software crashes and "potentially allow an attacker to take control of the affected system."

Affected software includes Adobe Reader 7.0.0 through 7.0.8 and Adobe Acrobat Standard and Professional 7.0.0 through 7.0.8 on the Windows platform. The bugs are only triggered when using Internet Explorer. Users of other browsers are not affected.

Adobe said it is working on a comprehensive patch that will ship "soon" and stressed than an upcoming upgrade to the widely used Adobe Reader program is vulnerable to this issue.

11/30/2006 5:27:27 PM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Monday, November 27, 2006

Break.com, one of the rising number of Web sites offering user-generated videos to rival the likes of YouTube, said on Sunday it would nearly double the amount of money it pays for video clips to $400.

Back in January 2005, Break.com started paying $50 per video and raised the price to $250 before Sunday's new hike, Chief Executive Officer Keith Richman said.

The money is even better for animated videos which, due to the complexity of their production, will fetch up to $2,000.

Web video payouts and increases like those unveiled by Break.com are being closely watched in the fledgling Internet arena where competitors such as Revver, BlipTV or iFilm are trying to improve content to lure viewers and advertisers.

For the most part, user-generated videos are less than 10 minutes long and show real people talking into their own cameras, dancing, singing or doing stunts. Sites like Google Inc.'s YouTube have not paid people who upload clips.

11/27/2006 8:27:51 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

It appears people still have no ability to know when they are being scammed. It those people we are going to focus on. Since you seem to not know who you are please just read this and of course look at the powerpoint presentation.

Though some useful tips are when you go to a ATM take your cell phone with you. If someone is being overly friendly take plenty of pictures. If the bank is open just go inside. What ever the situation never let your PIN be revealed, NEVER is there a need for a third hand NEVER.

If you have taken plenty of pictures of Mr. friendly trying to help. If you go outside empty handed make sure to take pictures of anyone else out in the open. It will be clear who that person is when Mr. friendly and the other person meetup and leave together. If there is a vehicle take the License number too. Though I doubt once you start clicking the person inside these people are going to feel comfortable enough to drive away. Though you still have the edge since they are assuming you are a chump.

 ATM_THEFTS.pps (557.5 KB)

11/27/2006 8:05:39 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
 Sunday, November 26, 2006
WD’s RAID Edition hard drives are the world’s most reliable server-class SATA drives in the market. With 1.2 million hours MTBF, 100% duty cycle, 5-year limited warranty, up to 3.0 Gb/s SATA technology, and best-in-class vibration tolerance, WD RE2 drives offer the best combination of superior reliability, high capacity, and optimum performance for enterprise applications. In the $175.00 range it makes this drive one of the best upgrade values world wide.

Superior reliability - Designed and manufactured to server-class standards to provide best-in-class enterprise reliability in high duty cycle environments. With 1.2 million hours MTBF at 100% duty cycle, these drives have the highest available reliability rating on a high-capacity drive.

High capacity - Up to 500 GB of storage packed with server-class features and low cost-per-gigabyte value.

Fast - With a next-generation SATA interface, up to 3.0 Gb/s data transfer rate, native command queuing (NCQ), and 16 MB cache, these drives deliver optimum performance.

Low power - Active Power Save™ delivers best-in-class seek mode power consumption through an advanced WD firmware which conserves power in active seek modes without degrading performance.

RAID-specific, time-limited error recovery (TLER) - A feature pioneered by WD, significantly reduces drive fallout caused by the extended hard drive error-recovery processes common to desktop drives.

Rotary Acceleration Feed Forward (RAFF™) - Provides best-in-class vibration tolerance by optimizing operation and performance when the drives are used in vibration-prone, multidrive systems such as rack-mounted servers or network storage.

SecureConnect™ - Provides a 500 percent stronger cable-to-drive connection than first-generation SATA hard drives and cables. Also ensures backward compatibility with legacy SATA cables and backplanes. Note: SecureConnect supports only legacy power and does not allow connection to a SATA power supply.

FlexPower™ - Connector technology that accepts power from eitherindustry-standard or new SATA power supplies.

5-year limited warranty
 
11/26/2006 6:39:45 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

Transcend's 150X SD Cards achieve outstanding data transfer rates, come in a range of capacities and are highly stable and compatible. For high-performance results from your digital devices Transcend's SD Cards are the perfect choice. In the $80.00 range it makes a great gift for anyone on your list.

Features:

  • Amazing data transfer rates: Up to 150X speeds (22.5MB/sec)
  • Supports Error Correcting Code (ECC) to detect and correct errors
  • Supports In System Programming (ISP) to load firmware
  • Support power down and sleep modes
  • Mechanical Write Protection Switch requirements
  • Manufacturer's Lifetime Warranty.

    Technical Information:

  • Size : 32mm x 24mm x 2.1mm (L x W x H)
  • Op. Voltage : 2.7V~3.6V
  • Op. Temperature : -25° C(-13° F) to 85° C(185° F)
  • Durability : 10,000 insertion/removal cycles
  • Weight : 2g
  • 11/26/2006 6:25:41 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
     Friday, November 24, 2006

    Just a few years ago Windows users, even responsible Windows users, had good reason to be fearful of the attack that would slip past their defenses or their notice. Things have changed. Nobody should ever be complacent, but a responsible user can be confident that defensive software and good habits will protect them. More interestingly, attacks just aren't what they used to be.

    A report by Alexander Gostev, senior virus analyst at Kaspersky Lab, indicates that innovation in malware development is stagnant. There have been no major developments in some time. In fact, there have been no major attacks since the release of Zotob in August 2005.

    Zotob, incidentally, targeted mainly Windows 2000 systems and XP SP1 to a lesser degree. What Microsoft has been saying about XP SP2 is true: Users are much safer running XP SP2 than earlier versions of Windows. Their own data from their Malicious Software Removal Tool (Word .doc file) shows as much, and in fact probably understates the matter.

    There have been a number of small attacks. Some of them, like the WMF vulnerability, enter in the background of the malware scene and will be with us for a long time. Perhaps the most prominent security term of 2006 was "targeted attack." We had quite a few of them, mostly centered around zero-day vulnerabilities in Microsoft Office. See the Kaspersky report for more interesting details on these vulnerabilities.

    The focus on vulnerabilities generally is another point in the report. There is little innovation anymore in malware—except where it involves the exploit of a vulnerability, especially a zero-day exploit. But even these are often less of a threat than they used to be. A few years ago vulnerabilities brought us attacks like Blaster and Sasser, where users could be infected over the Internet while they were asleep. Now the exploit usually involves substantial user action and can often be blocked by anti-virus software

    11/24/2006 7:36:48 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

    Using Mozilla Firefox's built-in Password Manager to keep track of your browser's passwords? It makes site logins faster but it also could help malicious sites steal your passwords. The bug, which has been known to Mozilla for at least 10 days, remains unpatched and exploits as well as a proof of concept exist in the wild.

    "I was shocked today to find an in-the-wild phish that uses nothing more than cross-site forms, and also extracts information from the Password Manger!" Security Researcher Robert Chapin wrote in a November 12th e-mail posted in the bugzilla bug tracking system.

    "The underlying method was so obvious that it should have raised multiple warnings," Chapin continued. "There were none at all."

    The flaw allows a maliciously crafted page to auto-fill a form with credentials intended for another site. Apparently, there is no warning in Firefox 2.0 or previous versions that the credentials are being pulled for the wrong site and submitted to a third party. Details of the flaw first became public this week. Mozilla developers do not yet have a fix.

    "Since this bug is an in-the-wild attack we're not protecting anyone by hiding the details anyway," Mozilla developer Daniel Veditz wrote in a bugzilla entry. "Up to now, browser makes have focused on user convenience and assumed sites with valuable passwords would be well-written. But they have bugs just like we have bugs so we might have to be more defensive." Solutions? Surf carefully.

    Or just don't use the feature until a fix comes out. Security outfit (FriST) recommends that users disable the "Remember passwords for sites" feature in the Options menu.

    11/24/2006 7:24:45 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

    Microsoft Corp. has initiated 97 lawsuits throughout Europe and the Middle East during its eight-month investigation into fraudulent Web pages, with another 32 criminal complaints filed in cooperation with local authorities, the company said Wednesday.

    All of the cases are against individuals who attempted to capture the login and password details of users by constructing fraudulent Hotmail and MSN.com sign-in pages, said Jean-Christophe Le Toquin, a Microsoft attorney. A total of 253 sites were investigated, he said. Microsoft's Global Phishing Enforcement program, started in March, aims to curtail fake Web sites built by criminals trying to obtain financial information or passwords by tricking users, so-called "phishing." The company uses its technology to crawl the Internet to find Web pages that look suspicious.

    Once a phishing site has been identified, Microsoft either files a criminal complaint or forwards the information to prosecutors, depending on the country’s legal requirements. By country, Turkey led the pack with 50 criminal complaints, followed by 28 in Germany and 11 in France. Legal actions were also filed in the United Arab Emirates, Italy, Morocco, the Netherlands and the U.K.

    Microsoft has settled with four phishers, all 16- to 20-year-old males, in France and Norway, Le Toquin said. Each of those pursued in France paid Microsoft $2,564, a fine the company felt is in proportion to their actions, he said.

    Many of the fake sites were created by the phishers to trick their peers into divulging their login credentials. The phishers would try to lure their friends to the fake pages through links sent by instant messaging programs. Microsoft said it will continue its investigation, particularly focusing on phishing sites connected with more sophisticated hacking.

    11/24/2006 7:20:22 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [2]  | 

    An independent vulnerability analyst working as part of the "Month of Kernel Bugs" campaign released the details necessary to attack the hole in OS X on Nov. 22, revealing the manner in which hackers could target the glitch, which affects the way Apple's software handles disk image files.

    The researcher, identified only by the screen name "LMH," issued the exploit via a post on the Kernel Fun Web site. "Mac OS X fails to properly handle corrupted image structures, leading to an exploitable denial of service condition," LMH wrote in his latest blog.

    "Although it hasn't been checked further, memory corruption is present under certain conditions." The researcher said that the demonstration exploit offered on the site would be unlikely to allow arbitrary code execution if applied by attackers, however, the analyst indicated that the flaw could be taken advantage of by malware writers by targeting the manner in which Cupertino, Calif.-based Apple's Safari browser downloads online image files.

    Apple representatives didn't comment on the exploit.

    Security researchers at Secunia rated the exploit as "highly critical," the software company's second most severe threat ranking, and said the attack could be used by local users to gain escalated privileges and utilized by malware writers to compromise a vulnerable system.

    The Copenhagen, Denmark-based firm specifically said that the vulnerability is caused due to an error in the OS X AppleDiskImageController when the system is handling corrupted image files and can be exploited to cause a memory corruption.

    Such an attack could lead to execution of arbitrary code in kernel-mode, Secunia said in a post to its Web site.

    11/24/2006 7:14:17 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
     Wednesday, November 22, 2006

    I have been asked to provide some MIME for 2003 servers so we thought it was best to provide a fairly complete list.
    The following MIME extensions can be added to IIS on Windows 2003

    MIME Maps Extension Type

    .323 text/h323
    .3gp audio/3gpp
    .3gp video/3gpp
    .IVF video/x-ivf
    .Mtx Application/metastream
    .aaf application/octet-stream
    .aca application/octet-stream
    .ace application/x-compressed
    .acx application/internet-property-stream
    .aer Application/atmosphere
    .afm application/octet-stream
    .ai application/postscript
    .aif audio/x-aiff
    .aifc audio/aiff
    .aiff audio/aiff
    .application application/x-ms-application
    .art image/x-jg
    .as text/plain
    .asd application/octet-stream
    .asf video/x-ms-asf
    .asi application/octet-stream
    .asm text/plain
    .asr video/x-ms-asf
    .asx video/x-ms-asf
    .au audio/basic
    .avi video/x-msvideo
    .axs application/olescript
    .bas text/plain
    .bcpio application/x-bcpio
    .bin application/octet-stream
    .bmp image/bmp
    .c text/plain
    .cab application/octet-stream
    .cat application/vnd.ms-pki.seccat
    .cdf application/x-cdf
    .cfg 3DVista CFG
    .chm application/octet-stream
    .class application/x-java-applet
    .clp application/x-msclip
    .cmx image/x-cmx
    .cnf text/plain
    .co application/x-cult3d-object
    .cod image/cis-cod
    .cpio application/x-cpio
    .cpp text/plain
    .crd application/x-mscardfile
    .crl application/pkix-crl
    .crt application/x-x509-ca-cert
    .csh application/x-csh
    .css text/css
    .csv application/octet-stream
    .cur application/octet-stream
    .dcr application/x-director
    .deploy application/octet-stream
    .der application/x-x509-ca-cert
    .dib image/bmp
    .dir application/x-director
    .disco text/xml
    .djv Image/x.djvu
    .djvu Image/x.djvu
    .dll application/x-msdownload
    .dlm text/dlm
    .dnl application/x-msdownload
    .doc application/msword
    .dot application/msword
    .dsp application/octet-stream
    .dtd text/xml
    .dvi application/x-dvi
    .dwf drawing/x-dwf
    .dwg image/x-dwg
    .dwp application/octet-stream
    .dxr application/x-director
    .eml message/rfc822
    .emz application/octet-stream
    .eot application/octet-stream
    .eps application/postscript
    .etx text/x-setext
    .evy application/envoy
    .exe application/octet-stream
    .fdf application/vnd.fdf
    .fif application/fractals
    .fla application/octet-stream
    .flr x-world/x-vrml
    .flv application/x-shockwave-flash
    .gif image/gif
    .gtar application/x-gtar
    .gz application/x-gzip
    .h text/plain
    .hdf application/x-hdf
    .hdml text/x-hdml
    .hhc application/x-oleobject
    .hhk application/octet-stream
    .hhp application/octet-stream
    .hlp application/winhlp
    .hqx application/mac-binhex40
    .hta application/hta
    .htc text/x-component
    .htm text/html
    .html text/html
    .htt text/webviewhtml
    .hxt text/html
    .ico image/x-icon
    .ics application/octet-stream
    .ief image/ief
    .iii application/x-iphone
    .inf application/octet-stream
    .ins application/x-internet-signup
    .ips application/x-ipscript
    .ipx application/x-ipix
    .isp application/x-internet-signup
    .ivr i-world/i-vrml
    .jad text/vnd.sun.j2me.app-descriptor
    .jar application/java-archive
    .java application/octet-stream
    .jck application/liquidmotion
    .jcz application/liquidmotion
    .jfif image/pjpeg
    .jpb application/octet-stream
    .jpe image/jpeg
    .jpeg image/jpeg
    .jpg image/jpeg
    .js application/x-javascript
    .kml Application/vnd.google-earth.kml+xml
    .kmz Application/vnd.google-earth.kmz
    .latex application/x-latex
    .lit application/x-ms-reader
    .lpk application/octet-stream
    .lsf video/x-la-asf
    .lsx video/x-la-asf
    .lzh application/octet-stream
    .m13 application/x-msmediaview
    .m14 application/x-msmediaview
    .m1v video/mpeg
    .m3u audio/x-mpegurl
    .man application/x-troff-man
    .manifest application/x-ms-manifest
    .map text/plain
    .mdb application/x-msaccess
    .mdp application/octet-stream
    .me application/x-troff-me
    .mht message/rfc822
    .mhtml message/rfc822
    .mid audio/mid
    .midi audio/mid
    .mix application/octet-stream
    .mmf application/x-smaf
    .mno text/xml
    .mny application/x-msmoney
    .mov video/quicktime
    .movie video/x-sgi-movie
    .mp2 video/mpeg
    .mp3 audio/mpeg
    .mp4 Video/mp4
    .mp4 video/mp4
    .mpa video/mpeg
    .mpe video/mpeg
    .mpeg video/mpeg
    .mpg video/mpeg
    .mpp application/vnd.ms-project
    .mpv2 video/mpeg
    .ms application/x-troff-ms
    .msi application/octet-stream
    .mts Application/metastream
    .mvb application/x-msmediaview
    .mw2 Image/x.mw2
    .mwx Image/x.mwx
    .nc application/x-netcdf
    .nsc video/x-ms-asf
    .nws message/rfc822
    .ocx application/octet-stream
    .oda application/oda
    .ods application/oleobject
    .odt application/vnd.oasis.opendocument.text
    .p10 application/pkcs10
    .p12 application/x-pkcs12
    .p7b application/x-pkcs7-certificates
    .p7c application/pkcs7-mime
    .p7m application/pkcs7-mime
    .p7r application/x-pkcs7-certreqresp
    .p7s application/pkcs7-signature
    .pbm image/x-portable-bitmap
    .pcx application/octet-stream
    .pcz application/octet-stream
    .pdf application/pdf
    .pfb application/octet-stream
    .pfm application/octet-stream
    .pfx application/x-pkcs12
    .pgm image/x-portable-graymap
    .pko application/vnd.ms-pki.pko
    .pma application/x-perfmon
    .pmc application/x-perfmon
    .pml application/x-perfmon
    .pmr application/x-perfmon
    .pmw application/x-perfmon
    .png image/png
    .pnm image/x-portable-anymap
    .pnz image/png
    .pot application/vnd.ms-powerpoint
    .ppm image/x-portable-pixmap
    .pps application/vnd.ms-powerpoint
    .ppt application/vnd.ms-powerpoint
    .prf application/pics-rules
    .prm application/octet-stream
    .prx application/octet-stream
    .ps application/postscript
    .psd application/octet-stream
    .psm application/octet-stream
    .psp application/octet-stream
    .pub application/x-mspublisher
    .qt video/quicktime
    .qtl application/x-quicktimeplayer
    .qxd application/octet-stream
    .ra audio/x-pn-realaudio
    .ram audio/x-pn-realaudio
    .rar application/octet-stream
    .ras image/x-cmu-raster
    .rba 3DVista Audio
    .rdf application/xml
    .rf image/vnd.rn-realflash
    .rgb image/x-rgb
    .rm application/vnd.rn-realmedia
    .rmi audio/mid
    .rmvb application/vnd.rn-realmedia-vbr
    .roff application/x-troff
    .rpm audio/x-pn-realaudio-plugin
    .rtf application/rtf
    .rtx text/richtext
    .scd application/x-msschedule
    .sct text/scriptlet
    .sea application/octet-stream
    .setpay application/set-payment-initiation
    .setreg application/set-registration-initiation
    .sgml text/sgml
    .sh application/x-sh
    .shar application/x-shar
    .sit application/x-stuffit
    .ski 3DVista SKI
    .skz 3DVista SKZ
    .smd audio/x-smd
    .smi application/octet-stream
    .smx audio/x-smd
    .smz audio/x-smd
    .snd audio/basic
    .snp application/octet-stream
    .spc application/x-pkcs7-certificates
    .spl application/futuresplash
    .src application/x-wais-source
    .ssm application/streamingmedia
    .sst application/vnd.ms-pki.certstore
    .stl application/vnd.ms-pki.stl
    .sv4cpio application/x-sv4cpio
    .sv4crc application/x-sv4crc
    .svg image/svg+xml
    .svg2 image/svg+xml
    .svgz image/svg+xml
    .swf application/x-shockwave-flash
    .t application/x-troff
    .tar application/x-tar
    .tcl application/x-tcl
    .tex application/x-tex
    .texi application/x-texinfo
    .texinfo application/x-texinfo
    .tgz application/x-compressed
    .thn application/octet-stream
    .tif image/tiff
    .tiff image/tiff
    .toc application/octet-stream
    .tr application/x-troff
    .trm application/x-msterminal
    .tsv text/tab-separated-values
    .ttf application/octet-stream
    .txt text/plain
    .u32 application/octet-stream
    .uls text/iuls
    .ustar application/x-ustar
    .utx Text/xml
    .vbs text/vbscript
    .vcf text/x-vcard
    .vcs text/plain
    .vdx application/vnd.visio
    .vml text/xml
    .vsd application/vnd.visio
    .vss application/vnd.visio
    .vst application/vnd.visio
    .vsw application/vnd.visio
    .vsx application/vnd.visio
    .vtx application/vnd.visio
    .wav audio/wav
    .wax audio/x-ms-wax
    .wbmp image/vnd.wap.wbmp
    .wcm application/vnd.ms-works
    .wdb application/vnd.ms-works
    .wks application/vnd.ms-works
    .wm video/x-ms-wm
    .wma audio/x-ms-wma
    .wmd application/x-ms-wmd
    .wmf application/x-msmetafile
    .wml text/vnd.wap.wml
    .wmlc application/vnd.wap.wmlc
    .wmls text/vnd.wap.wmlscript
    .wmlsc application/vnd.wap.wmlscriptc
    .wmp video/x-ms-wmp
    .wmv video/x-ms-wmv
    .wmx video/x-ms-wmx
    .wmz application/x-ms-wmz
    .wps application/vnd.ms-works
    .wri application/x-mswrite
    .wrl x-world/x-vrml
    .wrz x-world/x-vrml
    .wsdl text/xml
    .wvx video/x-ms-wvx
    .x application/directx
    .xaf x-world/x-vrml
    .xbm image/x-xbitmap
    .xdr text/plain
    .xla application/vnd.ms-excel
    .xlc application/vnd.ms-excel
    .xlm application/vnd.ms-excel
    .xls application/vnd.ms-excel
    .xlt application/vnd.ms-excel
    .xlw application/vnd.ms-excel
    .xml text/xml
    .xof x-world/x-vrml
    .xpm image/x-xpixmap
    .xsd text/xml
    .xsf text/xml
    .xsl text/xml
    .xslt text/xml
    .xsn application/octet-stream
    .xwd image/x-xwindowdump
    .z application/x-compress
    .zip application/x-zip-compressed
    Dev
    11/22/2006 2:37:38 PM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 
     Tuesday, November 21, 2006

    Vista and Office 2007 have just finished development and are being made available to corporate customers in advance of their January 30 release. But if you know where to look online, you can find both products already.

    In the case of Vista, the purported "crack" isn't really a crack to get around the activation process. According to the techie hobbyist site Ars Technica, the hackers replaced components in the final code with bits from from earlier betas of Vista.

    This allows the would-be pirate to use a product key that worked with the betas and two release candidates and skip the entire activation process.

    In the case of Office 2007, the Enterprise edition has leaked onto the Internet, and because it uses a volume license key, it does not require activation over the Internet.

    The free ride won't last long. Microsoft said it was aware of the hacks, and how they were done. "The unauthorized download relies on the use of pre-RTM activation keys that will be blocked using Microsoft's Software Protection Platform. Consequently, these downloads will be of limited use says Microsoft.

    Beyond the fact that the hacked software will be shut off, installing it is just crazy, claimed Greg DeMichillie, lead analyst with research firm Directions on Microsoft.

    "A whole lot of the versions of Windows XP that show up on download sites aren't just modified to bypass activation. They carry spyware. So you install them and they could immediately turn into zombies or botnets.

    He pointed out that it's possible even to install a rootkit despite Vista's vaunted PatchGuard kernel protection. The rootkit can be installed to the files on the installation, which are merely compressed and not installed yet.

    11/21/2006 8:55:15 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  | 

    The search giant announced that it is entering into a partnership with 176 newspapers in the U.S. to share content and advertising, The New York Times is reporting.

    Yahoo will index and tag content from seven major newspaper chains and make the news content from 38 states available on the web. Yahoo will also power local events listings, maps and search technology on the local newspapers' websites. The partnered newspapers will also use Yahoo's advertising platform to sell and host the targeted local ads on their websites. The ads will largely be powered by Yahoo Local.

    The newspapers will test the waters by posting their employment classified ads on HotJobs, Yahoo's classified ad site for job listings. That first part of the deal was reported by the Wall Street Journal on Saturday. (the article is behind the WSJ's paywall)

    Yahoo's partnership with the newspaper industry comes on the heels of Google's Novemeber 5 announcement that it was allowing AdWords advertisers to purchase printed advertisements in several large-market local newspapers like The New York Times and the Washington Post.

    11/21/2006 8:41:43 AM (Pacific Standard Time, UTC-08:00)  #    Disclaimer  |  Comments [0]  |