Fun tracking down malware - svcchost.exe

I love being tech support. Found a little nasty called svcchost.exe (classic!) on a family windows computer. Run key in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
C:\Documents and Settings\username\Application Data\Microsoft\svcchost.exe

Beacons:

1 0.000000 10.1.1.9 10.1.1.1 DNS Standard query A xdemonx.selfip.org
2 0.000590 10.1.1.1 10.1.1.9 DNS Standard query response A 96.18.166.50
3 0.000895 10.1.1.9 96.18.166.50 TCP 1588 > 3085 [SYN] Seq=0 Win=16384 Len=0 MSS=1460

Reported to McAfee. They actually have some decent advice for finding runkeys:

On Windows XP systems, click START RUN, type MSCONFIG and hit ENTERClick the Startup tab.

A McAfee monkey in Bangalore produced a signature and sent back an extra.dat file in just a few minutes. Mission accomplished.

Advice on how to report an ubuntu bug

The Ubuntu wiki has a great page on how to report a bug. It includes details of how to install debugging symbol packages (I didn't know these existed, I always headed for the source and compiled a debug build), and detailed gdb instructions.

I also finally learnt a better way to find out which version you are running (usually I look at /etc/issue or /etc/apt/sources), but this:

lsb_release -rd

gives you the numerical release number. Sweet.

Restarting NFS after changes to /etc/exports

On ubuntu I was using

/etc/init.d/nfs-common restart

to restart NFS after making changes to /etc/exports. Unfortunately this doesn't work. Use "exportfs -a" to sync changes (clients don't need to re-mount either).

Zabbix monitoring tips

Random Tips

• The zabbix server comes with some great example graphs, copy these to your own templates and every host linked with the template will have them available to use as screens.
  
• You can disable an item/trigger inherited from a template for just a single host by disabling it in the hosts view (not the template).
  
• If you delete an item, triggers depending upon that item will automatically be deleted.
  
• The multi-value graphs you can create under the graphs tab are way better than the 'simple
  graph' type available in the screens menu.
  
• You can automatically add hosts discovered through automatic discovery to templates (and do many other things) using actions under the actions tab.
  

Errors

I got the following error from the zabbix agent daemon (zabbix_agentd):

Can't find shared memory for collector

Restarting didn't help, but deleting the shared memory objects did:

ipcs -ma          to list the objects
ipcrm             to delete the objects owned by the zabbix user

Restarting the zabbix daemon and killing off the defunct processes got me back into business.

Creating new server certificates with an existing CA

Creating new server certificates with an existing CA, using unencrypted server keys so you don't get prompted when apache starts:

openssl req -new -config openssl.cnf -nodes -keyout newkey.pem -out newreq.pem -days 1825
openssl ca -config openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem

Firefox XUL dialog box transparent by default

This took far too long to figure out. I was opening a dialog in XUL in my firefox plugin, but it was arriving with a transparent background, which made it render really weirdly. The solution is to put the following in your css for the dialog tag:

    background-color: menu !important;
    opacity: 1.0;

My guess is that the background is transparent so you can see images set by firefox themes/skins, but it is pretty annoying!

HOWTO Convert a windows vmware image to a linux qemu/kvm

This is a good HOWTO for converting windows vmware images to linux Kernel Virtual Machines (KVMs). Note that if you don't have a single monolithic vmdk disk file, you can just run qemu-img over each individual file, converting it to raw, then cat them together in order. I tried this and it worked a treat:

for i in $( ls *.vmdk ); do qemu-img convert -O raw $i ~/$i.dd; done
cat s001.vmdk.dd s002.vmdk.dd s003.vmdk.dd > monolithic_image.dd