<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>BIT Consultants &#187; Tips</title>
	<atom:link href="http://www.bitconsultants.net/tag/tips/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.bitconsultants.net</link>
	<description></description>
	<lastBuildDate>Sun, 25 Jul 2010 21:54:45 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>Fighting Difficult Viruses</title>
		<link>http://www.bitconsultants.net/2009/fighting-difficult-viruses/</link>
		<comments>http://www.bitconsultants.net/2009/fighting-difficult-viruses/#comments</comments>
		<pubDate>Tue, 06 Oct 2009 20:18:00 +0000</pubDate>
		<dc:creator>Rob</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://www.fangledcontraption.com/?p=37</guid>
		<description><![CDATA[Tips and tricks for hunting down evasive pests.]]></description>
			<content:encoded><![CDATA[<p>Let&#8217;s face fact, most commercial AV publishers can&#8217;t get everything. They do a good job keeping known viruses off your system by scanning for the existence of certain files (not checking content), certain registry entries or running processes/services. So how do you get rid of a virus that your AV vendor doesn&#8217;t know about? Here are the tactics I use, with a high rate of success. Please not that the order is of no consequence, all of these tasks are fine to be performed atomically.</p>
<h2>Fix 1: Get the computer to boot:</h2>
<p style="padding-left: 30px;">Does the computer boot? If not, what messages (if any) are you getting? If you are getting error messages, Google them; most likely, you are not the first person to experience this problem. Careful where you click, though. Assuming you have eliminated the possibility of hardware failure (and that you have properly backed your important documents up): if the computer doesn&#8217;t boot, you could have a boot sector virus. To get rid of these, load the Windows CD and press &#8216;R&#8217; when prompted to enter the Recovery Console. Type these commands:</p>
<ul style="padding-left: 60px;">
<li>fixmbr</li>
<li>bootcfg /list
<ul>
<li>If no entries are listed, type bootcfg /rebuild</li>
<li>Enter the numerical identifier for your Windows installation (likely the number 1)</li>
<li>Type Y or Yes to add installation to boot list</li>
<li>Provide a load identifier (e.g. Windows XP)</li>
<li>Enter /fastdetect</li>
</ul>
</li>
</ul>
<h2>Fix 2: Finding the culprits:</h2>
<p style="padding-left: 30px;">If it&#8217;s possible, hook the infected hard drive up to a different machine and scan it using <a title="MalwareBytes" href="http://www.malwarebytes.org" target="_blank">MalwareBytes</a>, removing any infected objects it finds. Now, knowledge of an approximate time the virus was contracted is REALLY helpful here, though not necessary. If you can&#8217;t hook it up to another computer, boot the computer into safe mode (press F8 as the computer is booting) and choose Safe Mode (with Networking).</p>
<p style="padding-left: 30px;">Whether you have booted to this hard drive or are viewing it from a different computer, take the following actions:</p>
<p style="padding-left: 30px;">Open My Computer &gt; C:.  Go to Tools &gt; Folder Options &gt; View tab &gt; Check &#8220;Show hidden files and folders&#8221;; uncheck &#8220;Hide extensions for known file types&#8221;, &#8220;Hide protected operating system files&#8221; and &#8220;Use simple file sharing&#8221;. &gt; Change to detail view and sort by Date Modified, more than likely, all of the virus files are going to have the same date in this field. Now is the tedious process of looking (and deleting/renaming), be sure you aren&#8217;t deleting important system files by using Google. Here are the important places to look, though they can be anywhere:</p>
<ul>
<li>C:\</li>
<li>C:\WINDOWS\</li>
<li>C:\Recycler\S-1-{RANDOM}\</li>
<li>C:\WINDOWS\Tasks</li>
<li>C:\WINDOWS\system32\</li>
<li>C:\WINDOWS\system32\drivers\</li>
<li>C:\Program Files\{ANY RECENT SOFTWARE THAT IS NEW AN YOU DIDN&#8217;T CHOOSE TO INSTALL}</li>
<li>%TEMP% (Start &gt; Run &gt; %TEMP% &gt; OK)</li>
<li>%USERPROFILE%\Desktop (look for installer files)</li>
<li>&#8220;%USERPROFILE%\Local Settings\Temporary Internet Files\&#8221;</li>
</ul>
<p style="padding-left: 30px;">Open Windows Firewall through Start &gt; Control Panel &gt; Windows Firewall, click on the Exceptions tab and check for any programs that you didn&#8217;t specifically authorize, remove the exception if there are unknown entries.</p>
<h2>Fix 3: Stop the rogue processes from loading at startup</h2>
<p style="padding-left: 30px;"><a title="Autoruns" href="http://live.sysinternals.com/autoruns.exe" target="_blank">Download Autoruns from Sysinternals</a>. Run the program and select the Logon tab. Check for malicious software under the headings listed below, unchecking each malicious item:</p>
<ul>
<li> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</li>
<li>HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</li>
<li>C:\Documents and Settings\All Users\Start Menu\Programs\Startup</li>
<li>C:\Documents and Settings\username\Start Menu\Programs\Startup</li>
</ul>
<p style="padding-left: 30px;">Move to the Services tab and look for items where the Publisher is missing, these items are frequently (not always) suspect. Remove malicious services by unchecking them</p>
<p style="padding-left: 30px;">Select the &#8220;Image Hijacks&#8221; tab, the only item that should be present is &#8220;Your Image File Name Here without a path&#8221;. If anything else is present, uncheck it.</p>
<p style="padding-left: 30px;">Close Autoruns</p>
<h2>Cleanup</h2>
<p style="padding-left: 30px;">Download <a title="CCleaner" href="http://www.filehippo.com/download_ccleaner/" target="_blank">CCleaner</a>, install and run it with the default settings to remove all of your temporary files. If you don&#8217;t have a good Firewall and don&#8217;t have money to spend, download <a href="http://personalfirewall.comodo.com/download_firewall.html" target="_blank">Comodo</a> or <a href="http://www.zonealarm.com/security/en-us/zonealarm-pc-security-free-firewall.htm" target="_blank">ZoneAlarm</a>. Turn off System Restore by right-clicking My Computer and selecting Properties.  Select the System Restore tab and check the Turn off System Restore checkbox &gt; Select Apply (may take a moment or two). Once it is responding again, uncheck the box and it will create a new restore point (that doesn&#8217;t have the virus files).</p>
<div style="border:1px solid #993300; padding:5px; background-color:#FBE3E4;">
<h3><span style="color: #993300;">Disclaimer</span></h3>
<p><span style="color: #993300;">I cannot be held liable for you bricking your computer. It is your responsibility to take the necessary precautions when altering system files and folders. I make no guarantee about the fitness of these instructions, their application to your computer system and settings and accept no liability for any system errors, serious or not that result from following these directions. The riskiest items in this posting are:</span></p>
<ul>
<li><span style="color: #993300;">the fixmbr command could cause some problems (warning is given when command is run)</span></li>
<li><span style="color: #993300;">Deleting files in the WINDOWS, system32, drivers directories is extremely risky, check files if you are unsure<br />
</span></li>
<li><span style="color: #993300;">Using Autoruns can be risky; if you uncheck important system processes your computer may no longer boot.<br />
</span></li>
</ul>
<p><span style="color: #993300;">That being said, if you have problems, post in the comments section and I will try to help.</span></div>
]]></content:encoded>
			<wfw:commentRss>http://www.bitconsultants.net/2009/fighting-difficult-viruses/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Making Podcasts</title>
		<link>http://www.bitconsultants.net/2009/making-podcasts/</link>
		<comments>http://www.bitconsultants.net/2009/making-podcasts/#comments</comments>
		<pubDate>Mon, 05 Oct 2009 15:28:20 +0000</pubDate>
		<dc:creator>Rob</dc:creator>
				<category><![CDATA[Development]]></category>
		<category><![CDATA[podcast]]></category>
		<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://www.bitconsultants.net/?p=167</guid>
		<description><![CDATA[If you want to start making podcasts, it can be a bit difficult to understand how you go about the process. Making a podcast essentially requires three tasks (with various sub-tasks). The basic workflow is: Record the podcasts Create an XML file that describes the...]]></description>
			<content:encoded><![CDATA[<p>If you want to start making podcasts, it can be a bit difficult to understand how you go about the process. Making a podcast essentially requires three tasks (with various sub-tasks). The basic workflow is:</p>
<ol>
<li>Record the podcasts</li>
<li>Create an XML file that describes the content (author, file location, etc.)</li>
<li>Upload the audio and XML files to a web server</li>
</ol>
<p>The unlisted step 4 is share the link to your feed (XML file) with friends/colleagues/customers. That is really all there is to it. If you want iTunes to follow you, of course there is a little more work that goes into that.</p>
<p>If that seems straightforward, except for the XML part, I have generated a little tool to help you on your way. It won&#8217;t record the podcast for you or make you like the sound of your own voice, but it will generate the XML file you need.</p>
<p><a href="http://bitconsultants.net/podcasts/" target="_self">Podcast XML Generator</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.bitconsultants.net/2009/making-podcasts/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Force Quit iPhone Apps</title>
		<link>http://www.bitconsultants.net/2009/force-quit-iphone-apps/</link>
		<comments>http://www.bitconsultants.net/2009/force-quit-iphone-apps/#comments</comments>
		<pubDate>Sun, 01 Mar 2009 15:14:16 +0000</pubDate>
		<dc:creator>Rob</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[iphone]]></category>
		<category><![CDATA[Tips]]></category>

		<guid isPermaLink="false">http://www.bitconsultants.net/?p=151</guid>
		<description><![CDATA[Quick Tip If you have an iPhone application that isn&#8217;t responding or seems to be moving very slowly: Open/select the application Hold the Home button for 6 or 7 seconds until the application quits Restart the application This has fixed numerous mail errors I have...]]></description>
			<content:encoded><![CDATA[<h3>Quick Tip</h3>
<p>If you have an iPhone application that isn&#8217;t responding or seems to be moving very slowly:</p>
<ol>
<li>Open/select the application</li>
<li>Hold the Home button for 6 or 7 seconds until the application quits</li>
<li>Restart the application</li>
</ol>
<p>This has fixed numerous mail errors I have encountered.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.bitconsultants.net/2009/force-quit-iphone-apps/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
