xtreem

Many people ask me what they should do when they get there computer infected by a virus.

I always say; reinstall your os.
But If you dont have the effort to do it; this is i would do.

Look for and terminate processes that you dont regonize or seem suspicious in the Task manager.

Look in your roaming directory after suspicious files:

%appdata%

Take a look in your windows registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce

Download and run:

Eset online virus scanner:
http://www.eset.com/us/online-scanner-popup/

after that

Malwarebytes Anti-Malware (Free)
https://www.malwarebytes.org/downloads/

Outlook 2013
32-bit Windows C:\Program Files\Microsoft Office\Office15
64-bit Windows C:\Program Files (x86)\Microsoft Office\Office15
64-bit Outlook C:\Program Files\Microsoft Office\Office15
Click-to-Run C:\Program Files\Microsoft Office 15\root\office15

Outlook 2010
32-bit Windows C:\Program Files\Microsoft Office\Office14
64-bit Windows C:\Program Files (x86)\Microsoft Office\Office14
64-bit Outlook C:\Program Files\Microsoft Office\Office14

Outlook 2007
32-bit Windows C:\Program Files\Microsoft Office\Office12
64-bit Windows C:\Program Files (x86)\Microsoft Office\Office12

Outlook 2003
32-bit Windows C:\Program Files\Common Files\System\MSMAPI\
64-bit Windows C:\Program Files (x86)\Common Files\System\MSMAPI\

1) Stop the “Windows Update” Service.
Run: services.msc
Stop Service: Windows Update

2) Erase the old windows update files.
Go to: C:\Windows\SoftwareDistribution\Download
Erase all the files in this directory.

3) Add a DWORD(32 bit) post to the windows registry.
Run: regedit
Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUPGRADE
If you dont have OSUPGRADE create it.
Add a DWORD(32 bit) post with the name: AllowOSUpgrade
Set the Value data: 1

4) Start the Windows Update Service again.
Run: services.msc
Start Service: Windows Update

1 l = 4,2 cups
1dl = 6 tablespoons
1 msk = 0,5 fl oz
1 tsk = 0,17 fl oz
1 g = 0,035 oz
1 kg = 2,2 lb
1 cm = 0,4 in
200°C = 392 F


fsutil file createnew C:\temp\10MB.dat 10485760
fsutil file createnew C:\temp\20MB.dat 20971520
fsutil file createnew C:\temp\50MB.dat 52428800
fsutil file createnew C:\temp\100MB.dat 104857600


SCP

scp -rp sourcedirectory user@dest:/path

-p Preserves modification times, access times, and modes from the original file.
-r Recursively copy entire directories.
(Note that scp follows symbolic links encountered in the tree traversal.)

RSYNC

rsync -ravz --delete sourcedirectory user@dest:/path

-r recurse into directories
-a archive mode
-z compress file data during the transfer

Include exclude variables

-F
–exclude=PATTERN exclude files matching PATTERN
–exclude-from=FILE read exclude patterns from FILE
–include=PATTERN don’t exclude files matching PATTERN
–include-from=FILE read include patterns from FILE

Installation

Start with installing bind9.

apt-get install bind9


Stop bind and prepare to chroot it.

/etc/init.d/bind9 stop


Edit /etc/default/bind9

# run resolvconf?
RESOLVCONF=no

# startup options for the server
OPTIONS="-u bind -t /var/lib/named"


Create the new directories under /var/lib.
Move the bind-files and creating symbolic-links to them.

mkdir -p /etc/bind/zones
mkdir -p /var/lib/named/etc
mkdir /var/lib/named/dev
mkdir -p /var/lib/named/var/cache/bind
mkdir -p /var/lib/named/var/run/bind/run
mv /etc/bind /var/lib/named/etc
ln -s /var/lib/named/etc/bind /etc/bind


Make null and random devices and set permissions

mknod /var/lib/named/dev/null c 1 3
mknod /var/lib/named/dev/random c 1 8
chmod 666 /var/lib/named/dev/null /var/lib/named/dev/random
chown -R bind:bind /var/lib/named/var/*
chown -R bind:bind /var/lib/named/etc/bind


Make bind able to report to syslog.
Create and edit /etc/rsyslog.d/bind-chroot.conf

$AddUnixListenSocket /var/lib/named/dev/log


Restart syslog

/etc/init.d/rsyslog restart


Start bind

/etc/init.d/bind9 start


Typical use:

backup: tar -clpzvf /dev/st0 /dir1 /dir2 /dir3
compare: tar -dlpzvf /dev/st0 /dir1 /dir2 /dir3
restore: tar -xlpzvf /dev/st0 /dir1 /dir2 /dir3

For multiple tapes just add the -M option:

tar -clpMzvf /dev/st0 /dir1 /dir2 /dir3
tar -dlpMzvf /dev/st0 /dir1 /dir2 /dir3
tar -xlpMzvf /dev/st0 /dir1 /dir2 /dir3

Keep getting mail and error logs thats say:

PHP Deprecated: Comments starting with ‘#’ are deprecated in /etc/php5/cli/conf.d/ming.ini on line 1 in Unknown on line 0

Solution:

Edit the file /etc/php5/apache2/conf.d/ming.ini
remove the first line: “#” so its only contains: “extension=ming.so” and nothing more.

## On the local machine
ssh-keygen -t rsa
# hit return three times

ssh-copy-id -i ~/.ssh/id_rsa.pub user@remote_host
# enter your password for user on remote_host