So, I got bit again by a radio station\u00a0not monitoring their web site and getting a trojan downloader.\u00a0\u00a0\u00a0 Windows Security essentials caught it and I’m pretty sure it didn’t do any damage, but I did a System Restore just in case.\u00a0\u00a0<\/p>\n
It’s only been in the MSE signature file for a couple weeks, and using other tools I have, it’s clear it wasn’t written by a script kiddie.\u00a0\u00a0\u00a0 I would guess with 99% certainty this is a “State Sponsored” trojan.<\/p>\n
Poking around, I think it may be using a clever technique to reinfect a computer even after a system restore.\u00a0\u00a0 Internet Explorer has a very dangerous option to “Recover Tabs if\u00a0IE crashes” – since a virus or trojan often causes a crash, the last thing you want to do is auto reload the pages in the browser.\u00a0\u00a0 I suspect it is trying to trick IE into autorecovering from a crash when no crash occurred.\u00a0\u00a0\u00a0 Not sure, and that’s not the point.<\/p>\n
So I kicked myself and said “OK, that’s IT.\u00a0 At least part of the problem is that I run Windows XP as the Administrator.\u00a0\u00a0 Forgetting that I went down this path once before, I decided to do it again and hit my head again.<\/p>\n
Windows XP out of the box has an administrator account called “Administrator” that has no password.\u00a0\u00a0\u00a0 I’ve been using XP ever since it came out (and 95 and 3.1 before that) – so everything that I have done for all that time is stored under the original Adminstrator account (with a password)\u00a0– pictures, bookmarks, favorites, etc…\u00a0<\/p>\n
So, I go in to create a “Limited” account\u00a0that won’t have the ability to automatically install software and make dangerous changes to the system.\u00a0\u00a0\u00a0 I really doubt that offers much protection – so much “stuff” critical\u00a0to Windows is stored in the registry, and I bet there are dozens of ways to compromise a system even as a Limited User.\u00a0\u00a0\u00a0<\/p>\n
I go to System Settings \/ Users and Add a User.\u00a0\u00a0 the first thing it announces is that this new user must be an administator account (But I already have one!).\u00a0\u00a0 Oh well, I guess I’ll have two.\u00a0\u00a0\u00a0\u00a0 So I create an administrator account and then my Limited Account.\u00a0\u00a0\u00a0 Logout so I can use the limited account – and the ACCOUNT THAT HAS EVERYTHING IN IT FOR THE LAST 3 YEARS IS GONE!<\/p>\n
Grrr….\u00a0 that’s when I remember that I did this before.\u00a0\u00a0\u00a0 The prior time – being a security conscious person, I didn’t want my adminstator account named Administrator, as it is stupid for an Operating System to use the same username for the Super user on every computer.\u00a0\u00a0 (Is your super user on Linux still named “root”?)\u00a0\u00a0 It’s much harder for a bad guy to break in as the Super User if they don’t know the username of your super user.<\/p>\n
The Out of the Box Admin user is intended as basically a placeholder until you create the real administrative user (which maybe 1% of XP\u00a0users even know about).\u00a0\u00a0 Once you create your “real” admin user, Windows hides the default Admin user and won’t let you login using it any more – except in Safe Mode).<\/p>\n
After poking around a bit, it turns out that is not 100% true – and is a HUGE security hole in Windows XP Professional.\u00a0\u00a0\u00a0 At the Welcome Screen, if you hold down Ctrl and Alt and press DEL twice, you are presented with an NT style network type login prompt.\u00a0\u00a0 You can type in any user name there, not just those Microsoft hasn’t hidden.\u00a0\u00a0\u00a0\u00a0 So if the\u00a0default Administator account was never assigned a password, just typing Adminstator\u00a0with no password lets you in – even if your real Administator account has a password.<\/p>\n
The reality is that anyone with bad motives who has physical access to your computer will not have trouble getting what they want from the computer – so in the big scheme of things, it is not a huge\u00a0hole.\u00a0\u00a0 Locks are there to keep out honest people.<\/p>\n
So now I’m just wondering if I copy or rename or move my Documents and settings from the Hidden Admin user to the visible Admin User….\u00a0 just how many days will I be cleaning up this mess….<\/p>\n
Did you hear that Apple Computers is now bigger in market cap than GM and has more cash than the federal government?\u00a0 I wonder why….<\/p>\n","protected":false},"excerpt":{"rendered":"
So, I got bit again by a radio station\u00a0not monitoring their web site and getting a trojan downloader.\u00a0\u00a0\u00a0 Windows Security essentials caught it and I’m pretty sure it didn’t do any damage, but I did a System Restore just in … Continue reading