More on Spyware

I thought I had this aforementioned computer (see last post) all cleaned up of spyware. On the contrary. After another day of messing with it, still not clean. The proggy I discovered today is, HiJackThis. This handy little program lets you look at all the the stuff that is run when you logon. One interesting line that this program found was…

O4 – HKLM\..\RunOnce: [*****] C:\Windows\SYSTEM32\******.exe

Where ****** is some arbitrary name. Whenever you delete that item using HiJackThis, this line pops back in with a different name for the .exe. If you delete the .exe from C:\Windows\SYSTEM32, it just makes a new executable and redoes the line above to match. This piece of spyware must be relatively new, because macafee, spybot and ad-aware are not spotting the core program or process behind this.

This program is basically a dropper. It is a process that sits in the background and downloads new spyware and installs it. So you delete the spyware on the infected computer, come back 5 to 10 minutes later, and you have fresh new spyware installed. How handy!

What I need to do is find out what the name of this core program or process is called. I need to research on how to find out what programs are loaded beyond what HiJackThis is finding. Or find out if this program has found a way to attach to what is normally a friendly program. Oh what fun.

If anyone else has had this type of battle and can point me to a handy resource, I would greatly appreciate it.

Sunny Day and Fighting with Spyware

For those with short attention spans, here’s my day in bullet format…

  • Fought with spyware on work computers
  • Forecasted possible severe weather for area tomorrow
  • Left work early to enjoy sun and 70 degrees
  • Cruised around Grand Lake to find a possible house to move into
  • Kayaked a couple miles on the bay side of Park Point
  • Barefoot jogged a couple miles on the beach on the Lake Superior side of Park Point.

    That would be my day. Now to elaborate…

    Concerning the spyware/malware on the work computers. We had a heck of time trying to get this shit off. We tried ad-aware first, then Macafee. After using both, the savvy spyware would rejuvenate and reappear. So we decide to move on to Spybot. Here’s where it got interesting. The spyware set up some type of firewall so we couldn’t get to the Spybot home page… this struck be as funny for some reason. We did find a copy of Spybot on download.com, so we did get it eventually installed. Spybot version 1.3 did the trick. It was definitely more thorough in removing this stuff.

    Looks like an active day tomorrow, severe weather-wise. Fortunately for us, Iowa will probably steal most of northern Minnesota’s thunder (ha-ha get it). The most unstable air will be over Iowa, and there will be plenty of shear there. Later on in the evening, bow echoes will congeal and kick some fanny… mainly east of Iowa. Not good news if you are in the path.

    Yep, you heard right, it was 70 degrees and sunny today here in Duluth. We were parked right underneath the high, so hardly a breath of wind either. The only negative about this situation? Immense pressure! You MUST go outside NOW. Days like this are extremely rare around these parts so you have to take advantage. So that’s what I did.

    Went on a leisurely drive around Grand Lake, near Saginaw, MN. I would like to move off of Park Point and find some nice secluded lake front property. Some homes for sale looked inviting. This was the leading candidate.

    Went back to Park Point and did the Kayak thing behind my house. I only had a couple beers while I was out floating back there, but I definatlely felt them. Hauling the kayak back to the house was a bit more work compared to bringing it to the bayfront.

    So what do you do if you have a couple beers in you? You jog them off. First barefoot jog of the season… and it felt good…

  • Wrap-up

    I finally went out and measured the rain from last night…1.17 inches.

    Sun came out this evening, I put on the shades and went out for a 2 mile jog.

    The replacement front grill for my car was put into place this past afternoon, This concludes the repairs from my fender bender… in my driveway. I haven’t talked about that yet have I. About a month ago, my neighbor was trying to take a short cut to her back yard via my driveway. She ran into my car in this attempt. I wasn’t even in my car, I was down in my basement doing some spring cleaning. I have to drive through downtown Duluth to get anywhere, and this is how I get into an accident. Silly world.

    ———
    Hmmm, a web site outage. I wrote the above last evening around 9 pm central time. What has transpired since then? I did laundry, played some UT2004, then went to bed. You didn’t miss much. BobYates (morning talk show guy I listen to) seems to be have problems telling the difference between Glen Campbell and Earl Campbell this morning. Must of been a rough night.

    More on North Dakota

    Remember a few days back when I was posting about the Turtle “Mountains” over north-central North Dakota? I wasn’t the only one looking at them that day. Some other weather geekoid from the University of Wisconsin (Madison) was also looking at that part of the world. This visible image has the Turtle mountains smack dab in the middle of it. Now the quiz for you guys is, can you differentiate between the snow cover on the ground and the clouds floating over the snow cover. No you can’t. I said you can’t, now be quiet. This brings us to the 1.6 micrometer channel with color enhancement. Notice how oh so much easier it is to differentiate between snow cover and clouds. Coolies, eh!!

    By the way, in this picture, there was 6 inches of snow on the ground in northern North Dakota and 10 inches over parts of southern Manitoba. Not what you want in mid-May. Phooey.

    Rain

    Checked the rain guage, right around an inch of rain fell last night. Still drippy and yucky out. Only 42 degrees. I might just have to break down and cut the lawn for the first time after things dry up.

    Bob is trying to help a listener fix the hiss that she is getting from her radio. I say, reboot, then reinstall Steam and then reinstall Counter-Stike. Should work then.

    New drinking game… have a big fat swig of your favorite beverage whenever a national news cast says the word, “decapitated”. That seems to be the national media’s favorite shock word of the moment.

    Move complete

    I got all of my crap out of the Willernie House. Two hours of packing the car in Willernie this morning, a two plus hour drive up here to Duluth, then another couple of hours to unpack here at the Duluth house. I am now relaxing a bit, watching the Wolves/Kings playoff game. Wolves are playing lousy right now, but I think they have at least one more run before the game is over.

    Let’s see, it was 70 degrees and sunny down in Willernie with full green out. Now in Duluth it is 48 degrees, cool wind off of the lake, and it now has begun to drizzle. Duluth still has a gray panorama. It is days like these, I loathe Duluth.

    More fun

    The original plan last night was to go out and hit Ground Zero in Minneapolis and enjoy Bondage a-go-go night. One of the best atmospheres ever assembled. The music is mainly techno with a little bit of industrial and goth thrown in. They have multiple projectors displaying music videos or psychedelic displays. There are “go-go” dancers, both male and female, on mini-stages and cages. The leather and spanky set are upstairs where various fetishes are fulfilled. A large dance floor is available, filled with outcasts who enjoy dressing for holloween every night. I am sure there is a drug scene here, although since I’m not into this stuff, I have a tough time spotting these people. Ground Zero is a great people watching place, but that is also a complaint. There are people who just show up to gawk (I am one of them), which hurts the energy to an extent. Ground Zero is pricey with a $6 entry fee… and the drink and beer cost is in the $3-5 range. To learn more about Ground Zero, here is your google search

    So why didn’t I go? Well a rousing game of Risk diverted me, of course. The players included, a sister plus husband, a couple of nephews and a friend and his wife. Seven players, so we had to improvise a bit for this six player game… one player had to use buttons. Plus we had to change the starting count of armies to 18 instead of the 20 armies each in a 6 player game. During the game, we had more than one giggle fit, complete with spit takes. To top it all off, I won th match. I greatly appreciate them letting me win, the check is in the mail.

    In summary, I had a lot more fun, with people I know, for a lot cheaper price. Safe to say I made the correct decision.

    No More WLS Headquarters

    Today may be the last full day I spend at the Willernie Leisure Society Headquarters. Yesterday I started packing stuff up for moving out. Plus I moved (with help) the couch, dresser and the 25 year old microwave that was in here. Today the bed and frame will be donated to a friend… I’ll be sleeping on a small futon tonight. I’ll also be moving stuff to my sisters house for temporary storage.

    The potential buyer had this house inspected (as all house buyers should) and found some problems. There was a gas leak in the gas line coming into the house. Since it was a leak before reaching the house, the utility company fixed that for free. Then there was the electrical problems. To make a long story short, I had to replace the 60 amp service with 100 amp service. That I paid for… $1200. Ouch. The electrical inspector came out yesterday and said that the new service was installed correctly… but the old service needs some attention. I will have to cover up the old meter so water won’t get into the house.

    The electrical problem was the last thing on the buyer’s fix-it list. I pre-signed my papers for the closing yesterday. If everything goes as expected, I should be rid of the WLS headquarters before Memorial Day.

    Today’s post

    I am currently listening to the Bob Yates show (http://bobyates.com)… a morning radio talk show out of Stillwater, MN (or should I say “the new Stillwater”). He has a healthy following, but is not the most popular… which I guess is because he comes off too high brow for most folks. Bob and his “Shock Kick”, Kel Gradke have a good chemistry and the friendly barbs are constantly flowing between the two. Toward the end of his 3 hour show (between 6:00 and 9:00 am CT), Bob and Wally Langfellow (from Minnesota Score magazine http://www.minnesotascore.com) talk Minnesota sports. This is probably the most intelligent conversation concerning Minnesota sports around. Bob is trying to fire up a career as a playwright… his play “BIG BRENDA SHOCKS THE WORLD” has received some critical acclaim. Unfortunatly for me, up here in Duluth, MN, the only way to pic up Bob is via internet stream (http://bobyates.com/listen.php). Although the stream is usually of better quality than is received from the low wattage AM radio station.

    Next topic… lack of green color up here in Duluth. I am talking about the green foliage that is supposed to be on trees. The thunderstorm a couple days back finally kicked the trees in the fanny and we are just now starting to see some green stuff stick out of the branches. I am about to hop into a car and drive to the Twin Cities. The Minneapolis/St.Paul area has been greened out for almost a month now. I played my first round of golf over a month ago down there. It is no secret that I want a different environment. Green-ness and warmer temperatures do wonders for my mood.

    North Dakota Has Trees

    So there we are, looking at the visible satellite image over the upper midwest… admiring the latest snowfall that had occurred over the northern sections of North Dakota into southern Canada (in mid-bleeping May for cripes sake). Then WHAM!! There it was. A hole in the snow cover pattern. Huh. Looked up a topographical representation of the region and sure enough, a mesa called the Turtle Mountains was in this location. The trees on the mesa were darker than the surrounding snow covered terrain. Who’d a thunk it. To read more on this fascinating discovery, go here…

    http://www.ndsu.edu/nd_geology/nd_space/landsat3.htm