Thursday, June 30, 2011

How to: Clone a VM for VirtualBox

 The following is the command for cloning a .vdi virtual hdd for VirtualBox

Mac OS/Linux:
Open the terminal
Type:

VBoxManage clonehd source.vdi target.vdi

Example:
Suppose you have a virtual machine with a hdd called: "virtualhdd.vdi"
"virtualhdd.vdi" is located on /Users
You will make a clone of this hdd called: "clone.vdi" on /Users
You will type:
VBoxManage clonehd /Users/virtualhdd.vdi /Users/clone.vdi

Alternatively you could do:
cd /Users
VBoxManage clonehd virtualhdd.vdi clone.vdi

For Windows the command is the same but you must navigate cmd into the directory that contains VBoxManage

How to Fix: .exe files won't open on my computer

Hello,

Exe files not opening properly is an issue that occurs commonly after malware removal. 

The cause of this problem commonly is an issue in the Windows Registry
First thing you need to do is get into regedit
You can usually still open it by running it as administrator
Once regedit is open navigate to:
HKEY_CLASSES_ROOT\exefile\shell\open\command
the value for (Default) should be (material inside of the quotes):  "     "%1" %*      "


Alternatively I have a simple script below that should correct the default value.  To create this right click on the desktop and go to new then click text document.  Open the text document and copy in the following (material inside of the quotes)
:
"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

"
then save the file as: fix.reg
Open the file and when it asks you if you want to merge the registry click yes

This should fix most issues with opening exe files. If this does not help you verify that your registry value is (material inside of the quotes) "   "%1" %*    " and or send me msg.  Sometimes if you try to fix this issue too early you need to go back and remove malware from the computer first

Mark

ABP + NoScript = Safer Browsing

Web browsing is the primary vector for malware infection.

By making your web browsing experience safer you can significantly reduce your overall risk of infection

One way you can do this is by using the Ad Block Plus and NoScript addons for Mozilla Firefox:

NoScript essentially works by blocking all scripts except those from whitelisted domains (ones you give the ok to)
-It will by default only allow scripts to run on very few websites and it is up to you to decide which ones you think are safe
->Admittedly this gets annoying especially when you first start but if you want an extra layer of protection it is worth it

Ad Block Plus works by creating a blacklist of advertisements on the web
-The danger with advertisements is that some vendors do not regulate content well and sometimes serve so called "malvertisements" which will attempt to infect your computer.  If you simply block advertisements then your risk of getting a malvertisement will go down.
->I have seen computers that have been infected by malvertisements served from a variety of ad networks on a range of websites. I believe there was actually a malvertisement on the New York Times main website a while back.
->The drawback of Ad Block Plus is that it might block advertisements that you are interested in viewing.  You can disable it on pages of your choice

So when looking at the two together:
-NoScript will minimize your risk significantly and only run scripts on websites of your choice
-Ad Block Plus serves as something of an extra layer of protection for websites you chose to run scripts on.  If such a website is in a position where it will infect you it is probably due to a malvertisement so Ad Block Plus would likely protect you in those cases.

**Note**
Running ABP and NoScript together is not guaranteed to make your computer impervious to browsing attacks.  Common sense is still your best tool and should not be neglected.

Wednesday, June 29, 2011

Trick for speeding up virus removal

Premise: Deleting files is faster than scanning them (especially multiple times)

You can speed up virus removal by running a program such as CCleaner before running any scanners. CCleaner removes a large number of useless and potentially infected files.  By decreasing the total number of files that your cleaning programs have to go through you will decrease the length of scans. The more scans that you plan to run the more time you will save if you choose this approach.

Make sure to check the recycle bin before running, some people like to leave surprisingly important stuff in there.

Mark