A Computer Recovery Walkthrough With Free Trinity Rescue Kit

Popular guest writer Mark Schneider, walks you through a computer recovery operation using the Trinity Rescue Kit, which, as he puts it, “saved my bacon”.

Today, I was doing a little maintenance on my daughters Gateway laptop, uninstalling one anti-spyware program, and upgrading another to real-time protection. It seemed to go fine – I ran the Uninstall from Programs and Features in Vista, and enabled the full time protection in Malwarebytes, with the registration codes and rebooted.

When the computer shut down, I noticed it installing several updates. I didn’t think much of it at the time but when the machine restarted, the brown stuff hit the fan. I didn’t have any mouse! Even the Track pad was totally unresponsive. So, I plugged in a old USB trackball mouse, success!

I then clicked on the admin account I keep on the machine and went to type my password – nope, the keyboard didn’t work either. So I rebooted after plugging in my USB keyboard. Windows went through its usual routine and told me the keyboard had installed and was ready to use, except, it wasn’t. It wouldn’t work at all.

Basically, I was hosed! I couldn’t run the device manager from the limited account, or do a system restore. I had to get into the admin account, or I was stuck.

So I did what any red-blooded geek would do, I Googled “resetting a password in Vista”. I came up with usual Microsoft solution, you know the one where you use the password reset CD you made when you set up the computer, yep that one, the one no one ever makes!

Fortunately for me, I also found a reference to TRK or the Trinity Rescue Kit. TRK is a Linux based bootable CD, that can be used for resetting passwords, recovering files and a few other things relating to Windows calamities.

Publisher’s description: Trinity Rescue Kit or TRK is a free live Linux distribution that aims specifically at recovery and repair operations on Windows machines, but is equally usable for Linux recovery issues.

Once the CD booted normally, I typed in “winkey u admin” – this started TRK searching, and mounting all the files in the system. I choose “Enter” in the next dialog, and then typed an “*” confirmed this with a “y”, and this created a new administrator account with no password.

I was able to log into the Administrator account and then began the next phase of fixing the corrupted drivers. This took a little longer than I anticipated. I tried deleting the Track pad and keyboard in Device Manager , both had the little caution signs next to them indicating a damaged or corrupted driver; rebooted but this didn’t work.

I finally resolved the problem by using a restore point. Fortunately, you can get there with just a few clicks of the mouse. So I got lucky; the USB mouse worked, and the TRK worked after some trial and error.

Get the Trinity Rescue Kit here. I recommend it for your toolkit, it definitely saved my bacon.

Fast facts:

TRK is a complete command line based distribution, apart from a few tools like qtparted, links, partition image and midnight commander.

Full read/write and rpm support (since build 333)

Easily reset windows passwords (backup and restore option)

Four different virus scan products integrated in a single uniform command line with online update capability

Full ntfs write support thanks to ntfs-3g (all other drivers included as well)

Clone NTFS file systems over the network

Wide range of hardware support (kernel 2.6.39.3 and recent kudzu hwdata)

Easy script to find all local file systems

Self update capability to include and update all virus scanners

Full proxy server support

Run a samba fileserver (windows like file sharing)

Run an ssh server

Recovery and un-deletion of files with utilities and procedures

Recovery of lost partitions

Evacuation of dying disks

UTF-8 international character support

Powerful multicast disk cloning utility for any file system

Two rootkit detection utilities

Elaborate documentation

It is possible to boot TRK in three different ways:

As a bootable CD which you can burn yourself from a downloadable iso file.

From a USB stick/disk (optionally also a fixed disk), installable from Windows, or from the bootable TRK CD.

From network over PXE, which requires some modifications on your local network (version 3.2). Has the ability to act as a network boot server itself, without any modifications to your local network.

Trinity Rescue Kit is now in Version 3.4, and is better than ever before.

Getting started with TRK.

Download at: Developer’s site.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world. Why not pay a visit to Mark’s site today.

This article was originally posted here on March 11, 2010.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

A Lesson In Malware Removal Using Kaspersky Rescue Disk

This past Sunday, I posted an article on the benefits of regular scanning with a “live CD” – Stay Malware Free (Hopefully!) – Scan With A “Live CD” Regularly. Which, reminded me of an excellent article (previously posted here), by my good buddy and fellow blogger, Mark Schneider, on working with Kaspersky Rescue Disk to eradicate malware.

There are some great pointers here, and I encourage you to re-read this terrific article. It’s well worth a re-read.

 

You find your computer getting slower and slower to boot, and when it finally does boot it’s so slow everything runs at a crawl. So you try running the antivirus you have and just get a message that says the definitions are out of date and you can’t connect to the update server.

Or you may find an annoying pop-up coming up every time you boot telling you PC Antivirus has found 70,278 infections and for $49.99 they will remove them for you. Well my friend, you are hosed! Your machine is so badly infected that you have to try desperate measures.

At this point you can try pulling your hard drive out of the machine and putting it in another mounting it as a slave, and using your other machine to try to clean it.

Another way to get this thing up and running is to try some kind of bootable rescue disk to clean it. Bootable rescue disks are bootable CD’s/DVD’s that contain small operating systems, with some preinstalled tools contained for repairing your computer.

When you turn on your computer hit F10 or F12, select your CD/DVD drive and your computer boots into an operating system contained on that CD. There are a lot of great rescue disks out there, the problem is most are very complicated, and some take forever to boot.

I found one great exception to this though. Kaspersky Labs, creator of the very capable Kaspersky Antivirus line of products has built a great free bootable rescue CD that is simple to use.

Unlike many other bootable rescue disks it has one purpose, to clean your system. To create a Kaspersky Rescue Disk, download the ISO image from this link , then burn the image to a CD.

Depending on what operating system you are using you may need to download a CD burning program if you don’t already have one. If you are running Windows 7 it has a built in, burning program that’s simple to use and works great. If you are running XP or Vista, I like Image Burn, or CD BurnerXP – both do a great job of burning .ISO images, and are free.

Once you have your rescue CD built, start your infected machine pushing F12/F10 to get it to the boot selection screen. Boot to the CD Rom drive as I stated earlier and relax, although faster than most rescue disks it’s hardly fast.

Follow the prompts and when it boots into the Kaspersky Rescue system you first need to update the virus definitions. Once updated do a scan, and go read the newspaper or get some coffee, it takes a while.

Once it completes the scan go ahead and let it remove or quarantine all the files it has found. I’ve never had it delete anything that caused the machine it was fixing not to boot. But of course before you do anything like this, BACK UP YOUR DATA!!!!! But you already did that so proceed.

Do the scan, remove the junk and log off Kaspersky. Just turning off your computer with the power button won’t hurt anything when you are running a rescue CD.

The reason rescue CD’s are so effective is, you’re not trying to disinfect a computer with an infected OS. When you boot to the hard drive of an infected machine, you’re playing on the bad guy’s home turf. They control the machine and in many cases they’ve hidden the infected files so your antivirus can’t see them.

There are other rescue disks out there and many are very complicated and take a very long time. The Kaspersky Rescue Disk is the fastest and easiest I’ve found to clean an infected machine enough to allow me to boot back into Windows and complete the process by adding my favorite automated antimalware tools to keep the system clean going forward.

Note: Kaspersky Rescue Disk 10 can be run from a USB device.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

Why not pay a visit to Mark’s site today.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

New Hard Drive? – Clone Your Old Hard Drive with Free Easeus Disk Copy

A great tip from guest writer Mark Schneider on how to clone your hard drive using free Easeus Disk Copy.

Upgrading your hard drive can be a rewarding and simple procedure for the everyday computer user. Cloning your hard drive, or making a exact copy, is the easiest way to get your new hard drive up and running quickly.

It’s also a popular tool for many professional IT people to backup a computer setup to be instantly restored in case of a disaster.

There are a number of paid commercial programs that serve this purpose; Norton Ghost is very popular as is my favorite, Acronis True Image. Both do a great job and have a number of useful options besides the cloning function.

They are great programs but they cost money, and money is tight right now, so I decided to try out a few free cloning programs that do the job just as well – albeit, without the options the paid programs include.

The first program I tried successfully was Easeus Disk Copy. Easeus Disk Copy allows a user to replicate their hard drive on to an external hard drive; the only option besides the full copy option is to copy an individual partition – a useful feature that I didn’t test.

Easeus Disk Copy is simple to use. Just download the program and burn the ISO image to a CD. Then boot to the CD and follow a simple set of windows guiding you through the process. Once your target disks are selected you simply wait for the process to take place.

This is where Easeus falls short of the paid programs I’ve used. The entire operation took over 3 hours to clone a drive with about 140GBs of data to the new drive. Not a big deal for most situations but if you’re in a hurry, you’ll want a different program.

Another issue which was no big deal but could be for some people, was that out of the 3 drives I cloned, 2 required me to repair the Windows Boot Loader using an install disk. No big deal for me, but if you don’t have an install disk for your operating system, or don’t feel comfortable doing this, it could be a real hassle.

Overall, I think Easeus Disk Copy did a fine job; it’s free and relatively simple. Since hard drives have become so inexpensive, it seems silly to pay for software if you’re only using it on rare occasions. I give it a conditional “fully recommend” rating’ – the condition being, the user knows how to burn an ISO file, and is able to repair the boot loader if needed.

Fast facts:

Copy all of your hard drive: Creating a bootable CD/DVD, it allows you to copy entire disk in case of unknown/proprietary file systems.

Partition copy: Enables you to copy one partition to another partition you want.

Disk copy: Enables you to clone one disk to another sector by sector.

Sector by sector copy: Makes physical 1:1 copies (clones) of hard disks and partitions. This ensures 100% identity to the original.

Safe, simple and fast: It is a very fast and easy way to copy all or part of a hard drive to another hard drive with Disk Copy.

Supports inaccessible disk copy

Supports booting from CD/DVD

Friendly graphical user interface

Relay disk space for insufficient destination

Support hard disks up to 1 TB

Download at: Download.com

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level super user, to the blogging world.

Why not pay a visit to Mark’s site today.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Principles of Security: Keeping it Simple

Popular guest writer Mark Schneider looks at how to increase system security by focusing on core applications.

Computing on the Windows platform today can be very rewarding. The problem with Windows applications is, as Microsoft has made improvements in patching security holes in Windows, the Black Hat hackers have begun to focus on third party applications to exploit the Windows platform.

Recent highly publicized exploits on the Adobe Acrobat PDF reader, have been just the tip of the iceberg. According to Secunia, creators of PSI a security tool which scans your PC  for out of date software, half their users had 66 or more programs on their PC’s.

Once all the programs and required patches were tabulated, it totaled over “75 patch incidents annually”, per average PC. That averages out to a patch every 4.9 days.” (Source InfoWorld Security Central)

This state of affairs obviously puts the average user at risk. Most people do well just to keep their Windows OS patched, much less check more than once a week for patches to their other applications.

This leads to the crux of my point, keep it simple. Don’t download every application you see, or hear about. Pick a core of useful applications that allow you to use your computer in the way you need to, and stop!

Your computer is a serious tool that can be very useful, so treat it seriously. You can still have fun with your computer, but you don’t need 5 different media players –  choose one, and stick with it. If you find one you prefer uninstall the old one first.

Many people use old out of date programs because they don’t like the “feature creep” of newer applications. This is a mistake; keep what programs you have up to date. This is especially true with PDF readers, browsers, email clients, and media players. Keeping your flash player up to date is extremely important. Adobe Flash is a major exploit vector, and I frequently run with it disabled.

Trying new applications can be fun and rewarding but, the best way to try new applications is in a virtual machine. Using a program like Virtual Box from Oracle Systems, is a great way to safely try new applications without committing yourself to a new program, or loading your Hard Drive with a ton of unnecessary applications that need to be constantly updated.

Finally, run Secunia’s free PSI. It will help you keep your applications up to date, and add another layer of security to your computer.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Another Day in the Trenches: Killing XP Antivirus 2010

Popular guest writer Mark Schneider, walks you through a computer recovery operation, following an infection by a rogue security program, XP Antivirus.

I hate rogue antivirus programs. They seem to be getting more numerous and harder to get rid of all the time. Case in point: At work, I noticed a shared computer suddenly popped up a Window announcing it was doing a scan, and that I was infected with over 4,000 Trojans and other forms of malware.

Nice try I thought, so I used Control Alt Delete to start task manager, and I closed Internet Explorer and all running processes involved. Fortunately, it was a limited user account that was infected, and that turned out to be a important factor in removing it.

I immediately ran Malwarebytes from that user and found a number of infections including the rogue antivirus product I was afflicted with. These cretins that come up with this crap can’t even come up with something creative – we’ve seen XP Antivirus for a few years now; each year they just tack on a year to make it look current.

Sad thing is, I’m sure somewhere out there is someone who renews this crap every year. Imagine paying yearly to be infected – oh right, we already do that it’s called McAfee, but don’t get me started.

Well back to the task at hand: I rebooted the machine and logged into an administrator account, updated Malwarebytes and ran it again… and found more junk, actually the same junk. Malwarebytes found it, but could not kill it.

Next, I downloaded Superantispyware, a great application that I always run at home but it wasn’t on the work machine. The first thing I do now after I download a anti-malware application is rename the installer. I do this because I often find the malware knows how to prevent anti-malware from installing – these guys aren’t creative, but they’re getting smarter.

To rename a file, right click on the file and select rename and type anything.exe and install the program. Superantispyware did its thing and found a ton of additional files. I removed the infected files and rebooted again, and ran both my programs again. I still found junk!

I repeated the sequence two more times until nothing was found. I then ran a scan in all user accounts to confirm “the kill”. So far so good, until I went into the user account where the infection had started, now whenever I tried to launch any program from the desktop I’d get the “Choose what Program you want to use to Open this File” message. This means I had to fix file associations and a great site with XP file association fixes is here. I used the .exe file association fix and it worked great.

The last thing I did was to run Process Explorer, and Autoruns from Syinternals. These utilities give a great in-depth look at what is currently running and starting on your machine at boot-up. Finding nothing suspicious I deemed the computer clean, for now.

So a few lessons I learned on this one: Don’t use IE – this was caused by a flaw in Internet Explorer I believed it was just fixed this week. Second, running as a limited user is still far safer than running as an administrator, even though its trivial to elevate to administrator level, most malware seldom does, and this makes cleaning an infected PC much easier.

Next, running your cleanup tools multiple times and rebooting after each scan is the only way to give the anti-malware tools a chance against the bad guys.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Trinity Rescue Kit – Recovery From a Windows Calamity

Popular guest writer Mark Schneider, walks you through a computer recovery operation using the Trinity Rescue Kit, which, as he puts it, “saved my bacon”.

Today, I was doing a little maintenance on my daughters Gateway laptop, uninstalling one anti-spyware program, and upgrading another to real-time protection. It seemed to go fine – I ran the Uninstall from Programs and Features in Vista, and enabled the full time protection in Malwarebytes, with the registration codes and rebooted.

When the computer shut down, I noticed it installing several updates. I didn’t think much of it at the time but when the machine restarted, the brown stuff hit the fan. I didn’t have any mouse! Even the Track pad was totally unresponsive. So, I plugged in a old USB trackball mouse, success!

I then clicked on the admin account I keep on the machine and went to type my password – nope, the keyboard didn’t work either. So I rebooted after plugging in my USB keyboard. Windows went through its usual routine and told me the keyboard had installed and was ready to use, except, it wasn’t. It wouldn’t work at all.

Basically, I was hosed! I couldn’t run the device manager from the limited account, or do a system restore. I had to get into the admin account, or I was stuck.

So I did what any red-blooded geek would do, I Googled “resetting a password in Vista”. I came up with usual Microsoft solution, you know the one where you use the password reset CD you made when you set up the computer, yep that one, the one no one ever makes!

Fortunately for me, I also found a reference to TRK or the Trinity Rescue Kit. TRK is a Linux based bootable CD, that can be used for resetting passwords, recovering files and a few other things relating to Windows calamities.

Publisher’s description: Trinity Rescue Kit or TRK is a free live Linux distribution that aims specifically at recovery and repair operations on Windows machines, but is equally usable for Linux recovery issues.

Once the CD booted normally, I typed in “winkey u admin” – this started TRK searching, and mounting all the files in the system. I choose “Enter” in the next dialog, and then typed an “*” confirmed this with a “y”, and this created a new administrator account with no password.

I was able to log into the Administrator account and then began the next phase of fixing the corrupted drivers. This took a little longer than I anticipated. I tried deleting the Track pad and keyboard in Device Manager , both had the little caution signs next to them indicating a damaged or corrupted driver; rebooted but this didn’t work.

I finally resolved the problem by using a restore point. Fortunately, you can get there with just a few clicks of the mouse. So I got lucky; the USB mouse worked, and the TRK worked after some trial and error.

Get the Trinity Rescue Kit here. I recommend it for your toolkit, it definitely saved my bacon.

Fast facts:

TRK is a complete command line based distribution, apart from a few tools like qtparted, links, partition image and midnight commander.

Here ‘s a sum up of some of the most important features, new and old:

Full read/write and rpm support (since build 333)

Easily reset windows passwords (backup and restore option in 3.3)

Four different virus scan products integrated in a single uniform command line with online update capability (5 in version 3.3)

Full ntfs write support thanks to ntfs-3g (all other drivers included as well)

Clone NTFS file systems over the network

Wide range of hardware support (kernel 2.6.39.3 and recent kudzu hwdata)

Easy script to find all local file systems

Self update capability to include and update all virus scanners

Full proxy server support

Run a samba fileserver (windows like file sharing)

Run an ssh server

Recovery and un-deletion of files with utilities and procedures

Recovery of lost partitions

Evacuation of dying disks

UTF-8 international character support

Powerful multicast disk cloning utility for any file system

Two rootkit detection utilities (version 3.3)

Elaborate documentation

It is possible to boot TRK in three different ways:

As a bootable CD which you can burn yourself from a downloadable iso file.

From a USB stick/disk (optionally also a fixed disk), installable from Windows or from the bootable TRK CD.

From network over PXE, which requires some modifications on your local network (version 3.2). Version 3.3 has the ability to act as a network boot server itself, without any modifications to your local network.

Although version 3.3 is still beta, it is recommended that you download this version, as most features which were included in version 3.2 are still running just fine (and are more up-to-date) and the new stuff is presumed to be running fine too.

Download at: Developer’s site.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Kaspersky Rescue Disk – The Ultimate Malware Solution?

Guest writer Mark Schneider gives you some very important pointers on how to kill malware dead, with a great free tool – Kaspersky Rescue Disk.

You find your computer getting slower and slower to boot, and when it finally does boot it’s so slow everything runs at a crawl. So you try running the antivirus you have and just get a message that says the definitions are out of date and you can’t connect to the update server.

Or you may find an annoying pop-up coming up every time you boot telling you PC Antivirus has found 70,278 infections and for $49.99 they will remove them for you. Well my friend, you are hosed! Your machine is so badly infected that you have to try desperate measures.

At this point you can try pulling your hard drive out of the machine and putting it in another mounting it as a slave, and using your other machine to try to clean it.

Another way to get this thing up and running is to try some kind of bootable rescue disk to clean it. Bootable rescue disks are bootable CD’s/DVD’s that contain small operating systems, with some preinstalled tools contained for repairing your computer.

When you turn on your computer hit F10 or F12, select your CD/DVD drive and your computer boots into an operating system contained on that CD. There are a lot of great rescue disks out there, the problem is most are very complicated, and some take forever to boot.

I found one great exception to this though. Kaspersky Labs, creator of the very capable Kaspersky Antivirus line of products has built a great free bootable rescue CD that is simple to use.

Unlike many other bootable rescue disks it has one purpose, to clean your system. To create a Kaspersky Rescue Disk, download the ISO image from this link , then burn the image to a CD.

Depending on what operating system you are using you may need to download a CD burning program if you don’t already have one. If you are running Windows 7 it has a built in, burning program that’s simple to use and works great. If you are running XP or Vista, I like Image Burn, or CD BurnerXP – both do a great job of burning .ISO images, and are free.

Once you have your rescue CD built, start your infected machine pushing F12/F10 to get it to the boot selection screen. Boot to the CD Rom drive as I stated earlier and relax, although faster than most rescue disks it’s hardly fast.

Follow the prompts and when it boots into the Kaspersky Rescue system you first need to update the virus definitions. Once updated do a scan, and go read the newspaper or get some coffee, it takes a while.

Once it completes the scan go ahead and let it remove or quarantine all the files it has found. I’ve never had it delete anything that caused the machine it was fixing not to boot. But of course before you do anything like this, BACK UP YOUR DATA!!!!! But you already did that so proceed.

Do the scan, remove the junk and log off Kaspersky. Just turning off your computer with the power button won’t hurt anything when you are running a rescue CD.

The reason rescue CD’s are so effective is, you’re not trying to disinfect a computer with an infected OS. When you boot to the hard drive of an infected machine, you’re playing on the bad guy’s home turf. They control the machine and in many cases they’ve hidden the infected files so your antivirus can’t see them.

The rescue CD can scan your boot sector, and you hard drives from the outside looking in. The malware doesn’t have a chance to hide if it’s not running. It’s become the first step I now use when I’m dealing with an infected machine.

There are other rescue disks out there and many are very complicated and take a very long time. The Kaspersky Rescue Disk is the fastest and easiest I’ve found to clean an infected machine enough to allow me to boot back into Windows and complete the process by adding my favorite automated antimalware tools to keep the system clean going forward.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

Why not pay a visit to Mark’s site today.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Windows 7 – Security Essentials You Need to Know

Guest writer Mark Schneider gives you some important pointers on how to take advantage of Windows 7 security features.

Windows 7 is a big deal. Many people, in the tech industry, believe it will be the catalyst for the next tech boom in hardware sales. Could be – Windows 7 is a great OS.

Staying secure in Windows 7 however, still requires users to be careful. If you upgrade to Windows 7, one of the first things I recommend most users do is, go to UAC in “start search” and click on “Change User Account Control Settings”.

Once the UAC window appears, use the new slider interface to move your security settings all the way to the top to “Always Notify Me” – the most secure setting you can have. The reason is obvious: the UAC is there for a reason, to protect you. There’s no point in turning down the protection you already have built in to your computer.

To back up this point, I found a post from Sophos, a security software company, that found a random sample of 10 malware samples infected Windows 7 running UAC, at its default mode. It also ran the test on a machine running no security software.

Neowin, a popular Windows blog, however cried fowl, and ripped the methodology of the “study”. I admit, Sophos sells sell security software so their motives might be questionable. But I still think it’s prudent, and wise, to turn up your UAC.

So the next step after turning up UAC is to make sure you have an antivirus program. The free Microsoft Security Essentials is a fine, free program and I’m running it on several machines. I’d also get Malwarebytes Anti-Malware software, and top it off with SuperAntispyware another great antispyware program.

Microsoft Security Essentials

Malwarebytes’ Anti-Malware

SUPERAntiSpyware

Another common item on the security checklist – type “Folders” into “start search”, open “Folder Options” and select “View”. Uncheck “Hide Extensions for known File Types” – this way, if someone sends you a picture you normally see as a .jpg file but it is in fact, an executable file, then you will see the jpg.exe it really is.

Pictures don’t normally have executables in them, and for some unknown reason Microsoft continues to hide known extensions by default.

Security threats being what they are, a few quick techniques will help keep you safe, even with the latest, and greatest, from Microsoft.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

Why not pay a visit to Mark’s site today.

If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Online Login Security Tips

Don’t think much about your online passwords? Guest writer Mark Schneider gives you the lowdown on why you should.

Today, many of us live online – we bank, we shop, and we communicate with old friends via the internet. The problem with online life is; your identity is out there in so many places, and eventually, one of those sites will be compromised.

To protect ourselves, we come up with passwords that, supposedly, only we know. The problem is – people don’t take the time to use properly secure passwords because they are often too difficult to remember.

How many people use the word “password” for their password? It happens all the time. So, to combat this, many sites require passwords of minimum length. This is fine except if you are using a word out of the dictionary, which is fairly easy to crack.

So, to really get a secure password, you need to use a password with more than a few characters, and it needs to include letters, numbers, and if the site allows it, symbols to make a decently secure password.

Another problem then arises: how do you remember your password? Security expert Bruce Schneier, recommends people write down their passwords and post them by their computer. This may sound crazy, but his point is simple. It’s more important to have a secure password you’ll never remember, than one that’s easily discovered by hackers. The fact is, if someone has physical access to your computer all bets are off anyway.

My only problem with this idea is, many people need to access their secure information while they’re away from home, or office. Having your passwords written down while you’re on the road, is not a good idea. So you need to devise a way to create secure passwords that you can easily remember. Doing this isn’t as difficult as it sounds. Just devise a method that makes sense for you, and use it consistently.

One method I recommend is – take a line you remember from a song you like, then take the first letter of the line and then add numbers, or symbols to it that make sense to you.

For example, I use lines from old songs I remember and I add numbers of old addresses, birthdates, or a series of numbers I just picked at random, but can easily remember.

The important thing is, it should be easy to remember and totally random. The length of the password is also important – less than 8 characters is too short; 20 characters is considered totally secure.

Many people prefer to use a program to remember their passwords. A couple of very good programs I’ve used which are secure and easy to use are:

Roboform (Free).

and KeePass (Free).

While I don’t use them anymore, I think both offer a great service and should be considered by anyone looking for a simple way to manage passwords in a secure fashion.

Another and potentially more serious problem which I see everywhere online is, the vulnerability in resetting passwords. Several public figures have had their accounts hacked by the use of poor authentication protocols that websites use to reset passwords in case you forget, or lose it.

What happened to Sarah Palin, the Vice Presidential candidate in last year’s national election in the United States, is a great example. Her Yahoo mail account was hacked because her security question was easily guessed, and her password was then made available on Wikipedia.

This problem is perhaps the single largest login security hole you have to face. Typically websites ask questions such as your mother’s maiden name, or your first home town. This information can often be found in publically available locations.

A better protocol would be for sites to have the user set their own “secret question”. While this is better, you would still need to be careful not to use questions which can be guessed, or are known by others.

On a more delicate note, it’s important to realize that identity theft is committed most frequently by people that are known to the victim. It’s not a good feeling, but it’s statistically a fact, and shouldn’t be ignored.

So how do you get around this problem of authentication? Simple – you lie. If you have to use your mother’s maiden name, make up one you can remember. Use the name of someone else you may know, or use a color you hate. There’s no law that says your mom’s maiden name isn’t pink, or that you have to be truthful. Just make sure you remember the fake name you choose.

Logging into websites we use is easy to take for granted. The problem is, once your identity is compromised it can be a nightmare to fix all the issues that will arise.

Take the time to use good, secure passwords, and remember – the security questions you are asked are just as important as your passwords.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

Why not pay a visit to Mark’s site today.

If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Malware Removal Tips – Experience From the Trenches

Guest writer Mark Schneider gives you the best advice you’ll ever get on malware removal – “when it comes to malware removal, use a shotgun – not a rifle”.

Cleaning an infected computer is a challenge. Unfortunately, malware writers are talented, and that translates into real trouble if your machine gets infected.

Many computers ship with large all-in-one security suites. These all-in-one programs look good on a checklist comparison in PC Magazine, but I prefer to use a variety of free programs from different vendors, each using a slightly different method of cleaning a machine, which gives you the best chance of finding all the bad files.

Recently, I had to deal with a Lenovo Thinkpad my daughter had been using – the laptop is a spare machine I use only occasionally, and had just been given a clean install of Windows XP.

After my daughter had finished using it, I did a routine scan using Malwarebytes, a very good free anti-spyware program. The initial scan found 15 infections, including some Rootkits, which can be very difficult to remove. Malwarebytes told me I needed to reboot the computer to finish the removal. I complied and rescanned.

Same results, same Trojans, same Rootkits, so I scanned with Microsoft’s Security Essentials, a new free anti-virus Microsoft recently released. Security Essentials found nothing at all, so I tried a new (to me) website, virustotal.com.

Virustotal allows you to upload suspicious files to scan to determine if they are a threat or, possibly a false positive. I uploaded the file that was showing up the most frequently on the quick scans. Virustotal scans the file using over 40 different malware removal engines. Only one engine, McAfee Virus scan, found the file to be suspicious so I was beginning to think I might have a false positive. But, the fact that the file kept reappearing was very suspicious. Now I needed to get serious.

The next step was to run CCleaner a very good registry, and temporary file cleaner. CCleaner will make virus scans faster, and may delete files that are allowing a possible payload to reload when you restart the computer.

After using CCleaner, I installed Superantispyware Free, a program that I always install as one as my primary tools to combat spyware. The fact that this computer was a fresh rebuild was the only reason I hadn’t installed it yet.

Installing and running Superantispyware goes very fast – it’s a great program that is the favorite of many computer technicians. Super lived up to its reputation, and found a number of problems, including one Trojan with multiple registry entries.

Rebooting the machine after Superantispyware ran, finally yielded some results. Additional scans from Superantispyware, and Malwarebytes, came up clean.

My next test is to run HijackThis. HijackThis is a very powerful tool which must be handled with care. Installing HijackThis is simple; using it effectively is another story. The best method, for most people, is to run HijackThis and create a log file. Next, post this file to a web site where experts can parse your results and determine if you still have any suspicious files.

My preferred site is HijackThis.de – the site is primarily in German, but don’t let that deter you. They have a scanner which will scan your log file in real time and give you a good idea, right away, if HijackThis has found anything.

If you have run, and re-run your scanning tools, run a HijackThis, and everything comes up looking okay, you’re probably malware free. But for the next few reboots, you should continue to make sure your anti-malware programs are up to date, and keep rescanning periodically.

Most malware these days wants to hide in the background. You may be infected and never know your machine is stealing your passwords, and draining your bank account. So stay safe, keep your data backed up, and if you get infected, use as many tools as it takes to get secure again.

This is a guest post by Mark Schneider of the Techwalker Blog, who brings a background as a high level techie, to the blogging world.

Why not pay a visit to Mark’s site today.

If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.