Responding to Rootkit Question found on Linked IN

Just to start off, I'm going to mention that last week's picnic event with Simplex IT was a great turnout. Everyone was enthusiastic and the food was great. There appeared to be some new visitors in the crowd as well who have been seen around other events ranging from the Simplex-It Lunchinars, NEO IT Think Tank, Greater PC User's Group, Sam's WPF and C#/.NET groups, ISSA Northeast Ohio Chapter, Computers Helping Inspire People PC Refurbishment Program, and finally the Security 503 course sponsored by SANS organization.

Today's topic is going to answer a specific question that I have seen posted on Linked IN. For some reason, it would not post the answer that I was going to provide so I will explain it here. The question this person asked is if a user gets a rootkit virus that is unable to be removed by a program that detects rootkits and is designed to remove them fails to get all of the malicious files off of there, then what would be the next step? My next suggestion is to have the hard drive wiped with a special wiping drive utility that may even have Department of Defense standards for wiping the drives. Reformatting the hard drive with the current operating system like Microsoft may not be enough. The reason it may not be enough is because let's say this same person accidentally deleted some mandatory files from their system in the future and someone happened to find a file recovery utility program, some of these programs are powerful enough to restore files from several reformat of this drive for example: "Recover My Files".

From what I understand about rootkits, they are more difficult to detect because they like to hide in multiple areas on the operating system and go undetected by regular AV scanners that primarily scan for malicious file signatures of other virus type programs like Trojans, Malware, Worms, etc. What's imperative in the Microsoft environment is to get the systems with the latest up to date critical patches and keep virus signatures up to date for all other virus types. Programs that are designed to run on Windows Operating Systems have to set configuration parameters within the Windows Registry in order to run properly on the platform whether they are good or malicious programs.

Some I have heard say that they love the MAC operating system instead because they claim it is virus free. Well I hate to say this but that's not 100 percent true for they do have at least a handful list of MAC viruses. There are just not as many because most are written for the Microsoft environment. There are vulnerabilities in different Operating Systems. They may not get nearly as many reports as Microsoft because they are not the primary target systems. Hackers are looking for Operating Systems that have the most vulnerabilities in them in order to gain something from them. A majority of the reason is to get personal data off of multiple systems at once and there are some that just play.

Also, for those accessing the internet, someone within a Special Interest Group on home networking had given us an online utility program called "Shields Up" which is located on www.grc.com which is an online probing security tool which scans the ports on your home firewall to see if there are any vulnerabilities that you should be aware of. Software firewalls such as Zone Alarm and Trend Micro do have pretty strong security controls that can be turned on or off to at least provide some protection on your internet setting but always remember to keep your guard up when it comes to protecting your systems at home. Some ISP's often provide decent port blocking tools to help better secure your network. Most of these intruders like to get in through Microsoft's Internet Browser which often uses a reserved port that is always open.

Another tool to check if something is going on is the Event Viewer in Microsoft Operating Systems. Now I admit that the logs can be a little mysterious, however, going out to google and researching what these event logs are trying to tell you often helps. Sometimes just knowing the time and date that the log was created with a few general messages tells me that something or someone was trying to manipulate something with the system. Often I will ask around and for the most part do get an honest answer about them trying to change some settings on that day that just didn't work out the way they wanted them to. Of course you might not always get an honest answer but for the most part, when investigating logs, there is more evidence there to find out if something is not going right with the system. There are several services that maybe turned on by default that you may wish to turn off to deter an outsider from trying to connect to the user's machine.

Always keep in mind though to take precautions to protect your systems. Now within a Corporate Environment, a majority have some type of scanning tool that monitors the network for malicious activity. When something changes and it appears to be affecting let's say 20 systems in a row for that day, then it's best to investigate what it is that is causing the problem, if it's virus or malware related then find out exactly what the malicious activity is and where it is coming from prior to attempting to wipe and re image 25-30 hard drives that were affected by this problem. This also depends on how network monitoring is used. Some places take a more pro active approach than others. If one just re-formats the hard drive alone, don't be surprised if some malicious files resurrect from a powerful file recovery tool program later on. A wipe drive program will take the time to overwrite the hard drive between 4 to 5 times and then perform a check to make sure that all of the data is gone. For data that one wants to see again, be sure to backup data frequently to an external drive of some sort before things start to get bad.

So in summary, the answer to this person's question all depends on the situation. If it's in the Corporate Environment with multiple misbehaving systems then the first step is to investigate the environment. If it's just something on the home front where the user's system is not a Corporate owned laptop then wipe drive with something like Wipe Drive Pro and reload operating system.

3 Events Recap from Week of October 4th

Just wanted to give an overview of the Greater Cleveland PC User's Group Meeting this past Saturday. Once again and for the last time, Bob Coppege gave a presentation on Windows 7. The meeting had a really nice turnout. Nice to see some familiar faces there and some other ones that I have never met before as well. Bob provided answers to numerous questions that the audience had about this new presentation. He is currently the CIO for Simplex-IT Technologies company based out in Hudson that provides solutions in Microsoft Infrastructure to different businesses. He is also one of the former Presidents of the Greater Cleveland PC User's Group. Anyone interested in learning more about this group and the highlights of Bob's presentation can visit the following website: http://gcpcug.org.

Another interesting event that I had attended last Tuesday evening was the NEOSPIN event which is sponsored by the following 3 companies: PNC, Hyland Software, and OE Connections. This time, the event had taken place out in Richfield at the office of OE Connections. Vice President, John Cunningham had put on a nice presentation of the ITIL Release Management process by comparing and contrasting both the theoretical and the applied processes. Anyone who is interested in attending or joining this group can visit the following website: http://www.neospin.org.

The 3rd event attended is based out in Akron, known as JumpStartInc where different businesses held demos of their latest technologies from their Exposition booths prior to a presentation held by various leaders of this program. This is a program for entrepreneurs to gain valuable information for proceeding with their businesses. Everyone that I met had very creative ideas as to what will be the drive behind their business.

The Greater Cleveland PC User's Group

Before I begin covering the highlights of "The Greater Cleveland PC User's Group", I would like to mention that attending the fundraising event for "The American Diabetes Association" Step Out Walk last Saturday, October 3rd was a great event to attend. Many walkers formed in lines of different registration stands to turn in their donations for the last several months. After a nice breakfast of bananas, bagels, and coffee; a young group of ladies from a special dance group led the energetic walkers out of the start gates as everyone prepared for a 4 mile walk in the Downtown Cleveland area. Walkers were greeted with multiple rest stops and cheerful people happily motivating them to move forward to the finish line. After the walkers were happily received at the finish line, a luncheon followed sponsored by Mr. Hero with sub sandwhiches. Those who had raised a certain amount over 100 dollars received a t-shirt and multiple raffle tickets to participate in a drawing at the end of the event. Patti Clair and Eddie D'Amato extended their appreciation for all those involved with helping to not only raising funds that are needed to research this troubling disease, but also threw down a challenge. Yes, that means my online fund raising donation time has been extended until October 31st. Those of us who raise 100 dollars or more get to participate in yet another drawing. I can honestly say that I was pleased with my team, NASA Glenn Research Center for raising us much as they have despite the unstable economic conditions. I had set a goal for raising $500 dollars in the beginning and not only did we end up raising $1,719.00 so far, 2 additional people were able to walk with me that day. I also happened to notice that as a Corporate Team and for someone like myself who has not been on contract with them since the year 2004, somehow, I was able to find 7 people to join my team. I also noticed that for a Corporate Team, we are in the top 5 list out of the 10 Corporate companies that has raised the most funds. That's very impressive since the Team has been known to register at least 20 participants in the past. These individuals did not let the bad economic times prevent them from still moving forward to raising funds for a good cause. So if you want to know if I am a Team Player, point has already been proven multiple times.

Moving on, I would like to introduce what is known as "The Greater Cleveland PC User's Group". Founded in 1982, this group has been known as one of the top PC user's groups in the country. Meetings are held every 2nd Saturday of the month at Cleveland State University. The group started out with over 1,000 users and was often referred to as "The Best Kept Secret" in the Greater Cleveland area. Appears as if at this time with less than 200 members, it seems more like a best kept secret than it did back then. Although technology has changed and more valuable information becomes available online, nothing still beats having a network of people face to face. For one thing, not everything posted online is valid information, with this group, every information discussed has been known to be researched carefully if information is not always available at the present meeting.

Although social media has taken a great turn and is the latest in technology, still you never know who you are really dealing with until you get to meet them and work with them face to face. Sure you have the web cams now to participate in video conferences, however, these people can still be completely different in person. That's why there are good companies that use integrity and caution while making hiring decisions to ensure that they have hired the right candidate for the position that they are trying to fill. People still need to be able to not only network in person, but also be able to form genuine friendships as well. There are several Special Interest Groups that form throughout the Greater Cleveland area on a monthly basis that focus on a specific topic that form underneath The Greater Cleveland PC User's Group and throughout the weeks, I will take the time to discuss each one of them. Today, I am focusing on the General Meetings.

Currently, Bert Boyd is the President of the Greater Cleveland User's Group and Jim Evans, the Vice President. Each month, a specific computer related topic is presented in a friendly and upbeat way. These meetings are not just primarily for the IT Professionals, different business professionals have also been known to attend these meetings just to keep up to date with the latest technologies as places like "The Employment Connection" center have strongly encouraged those in transition to look into.

This coming Saturday, October 10th at Cleveland State University, Bob Coppedge will be the presenter as he focuses on the upcoming release of the latest from Microsoft. As some of you may already know, Microsoft is about to release Windows 7 Desktop and Windows Server 2008. Bob is a former President of the Greater Cleveland PC User's group and is currently the CEO of Simplex-IT Technologies based out of Hudson, Ohio. Feel free to join us next Saturday from 9:30AM to 12:00PM as Bob highlights the main points. Prior to his presentation, there will be a Q & A session for anyone with questions or concerns about their latest PC issues. After the presentation, there are several of us who get together to network and socialize at a restaurant nearby for about an hour. Each month, we have a different speaker come and speak about a different topic. Last month, Crystal Theis from "Virtual Buzz" presented a topic on "Twitter".

I joined this group based on the advice of a former colleague and current friend, Susan Becker, who happens to be very experienced with the latest in Autocad and has a strong background in Mechanical Engineering. Through networking with her, I met a gentleman by the name of Duane Hughes in 2000 who happened to be the President of the Lorain County PC User's Group at the time. Susan often mentioned that if I were to join a group like this one, how much more value I could add to my education that I had been receiving in a classroom environment. She is right, education in the classroom is valuable, however, why not meet with individuals that have the background experience within that particular industry that either you are considering getting into yourself or just want to learn more about if you happen to be the decision maker for the IT Infrastructure within your company or you just simply want to learn more about what's coming next.

In the year 2000, I joined this group and have written several articles about this group when the PC Chronicles were still being printed. Currently, these articles on past presentations maybe found online at the following url address location: http://gcpcug.org. Many have been known to attend these General Meetings for free just to find out what the group is all about. There is a yearly membership fee that is not only affordable but has also proved to be valuable. Also, those who attend the meeting for the first several times are given a chance to provide feedback on the topics that have been presented at these meetings.

Some of the other interest groups that are apart of the Greater Cleveland PC User's Group have been the following:

Sam Nasr's VB.NET/C# Special Interest Group that meets on a monthly basis.

SQL Server

Web SIG - lead by Stuart Smith ..... just to name a few here.

A note: It's often been encouraged in the past for members to step forward to create a Special Interest Group of their own like for example, Ken Rogers did in the past with his "home networking" group which was a very interactive discussion group that would often meet at different locations throughout the Greater Cleveland area.

Some special organizations that have been sponsored by "The Greater Cleveland PC User's Group" have included the following.

Dan Hanson's - Computer's Assisting People - where volunteers have come along to help refurbish PC systems that have been donated by local businesses throughout the local Cleveland area.

Hank Bitterman's - Computers Helping Inspire People program that is based in Beachwood at the Cuyahoga Board of Developmental Disabilities. This is a similar type of PC refurbishing program with a different approach.

Being a part of this group has helped to enhance my knowledge outside of the Corporate experience and classroom environment. This is a great place to build your network if you are considering a field in IT or just want to meet other business professionals. There are Special Interest Groups for the IT Professionals and those with special hobbies.

Just thought I would mention yet another great place to meet in the Greater Cleveland area since there were some whom I networked with in the past who still have not heard of this group.

JLG-Networking Event September 23rd

This is a completely different topic. I was planning on blogging about different events that I have attended througout the course of the week and I felt that this was the topic for the week. I'm going to try to blog about different networking groups that exist within the Greater Cleveland area and my focus this week is on a group called JLG-Event Management Solutions http://www.jlg-eventmanagementsolutions.com/.

Now this small business/entrepreneur is a networking group that started out during the month of May. The idea behind this group is to get people to attend these meetings to share some ideas if your interested in your own business venture. Actually, I've found the meetings that I have been able to attend so far very valuable in that some topics could even benefit those who are currently in transition right now as well as small to medium sized business owners.

Today, I'm going to focus on the highlights of the meeting that I attended in Valley View. Marilee MacAskill from Dale Carnegie Training did a wonderful presentation based on the following book "How to Win Friends and Influence People". Some of the things that she discussed from the book would pertain to anyone who handles customers or works in a team environment with different work type personalities often found in Corporate as well as small business environments.

The topic discussed was "Gaining Enthusiastic Cooperation From Others" and how to gain trust from others when promoting your business. I think that this would also apply to how individuals would sell themselves and their particular skillset. She will be presenting at another event next week within the Greater Cleveland area.

Here are some of the principals that were discussed at the meeting:

1. Follow the 3 c's. Don't criticize, condemn or complain

2. Give honest, sincere appreciation (for example, if someone decides to buy some product or service from, take the time to thank them for their business through some form of communication)

3. Arouse in the other person an eager want

4. The only way to get the best of an argument is to avoid one.

5. Show respect for the other person's opinion. Never say, "You're wrong" (In other words, let's say that a customer calls in and says that they still have not heard back from someone at your company and the record shows that they have been contacted, instead of arguing with them, you can politely let them know that the records show that someone had contacted that person's place at a specific time. This would allow the person to go back to the individual who is responsible for handling their messages to make sure that they did receive that message).

6. If you are wrong, admit it quickly and empathetically.

7. Begin in a friendly way whenever handling any situation.

8. Get the other person saying "yes, yes" immediately.

9. Let the other person do a great deal of the talking (practice good listening skills).

10. Let the other person believe the idea is his/hers.

11. Try honestly to see things from the other person's point of view. (For example, when promoting your business or yourself, don't go in with force and discuss things that might not be of value or interest to that potential client. Find out exactly what their needs are before explaining what you can do for them).

12. Be sympathetic with the other person's ideas and desires.

13. Appeal to the nobler motives.

14. Dramatize your ideas. (In other words, paint them a picture of how your products, services, or you can meet their needs). This puts you in the chair for them to make the decision to buy your services.

15. Throw down a challenge.

Obviously she went into more depth than this, however, I found these points to be very helpful as I look forward to writing about other events. Her message was to emphasize that we must strive to follow these guidelines in order to keep business relationships flowing smoothly.

Your question might be, what value might I get out of this group? The answer is, to gain valuable information and find other ways to improve business if things are not going as smoothly as they could. There were many more guidelines from the tiny booklets we received and I would encourage anyone to attend any of the next events that she will be making her presentation.

This particular group, JLG-Networking Event can be found on meetup.com.

Bob Coppedge's Event in Hudson, Ohio

Bob is the CIO of Simplex-IT, a Microsoft Small Business Specialist solutions company. He has been in many management and leadership roles throughout the Greater Cleveland Area. He was CEO of Patio Enclosures, served on the Board as President of the Greater Cleveland PC User's Group several times, has been involved with many different educational facilities including: Tri-C, American Logistics Group, and Devore Technologies.

For the past several months, I've enjoyed the presentations given by Bob Coppege on various topics. He started with his small business building located out in Hudson which consisted of approximately 6 attendees and leaped in size to 30 + so he needed to relocate the seminar to a different location. You may ask what all the hype is about? Well this is about Microsoft Windows 7 and yes it is something to get excited about.

Some of the features of Windows 7 that were mentioned were the following:

- seemless connections to the Corporate Network from a remote location without the hassle of using 3rd party VPN software to connect.

- the capability of controlling the use of Program Applications where you can control which users can launch specific applications

- the fixes that were applied to make up for the shortcomings of Windows Vista

- the volume control that controls the way the "are you sure you want to do this?" box keeps popping up just to perform any particular function. Yes, now there is a way to adjust that.

- more accurate recordings of error messages that may come up on the screen so that if someone calls into the Help Desk for a computer related problem, the system now has a recording feature to aid people.

Bob has mentioned that people are reluctant to research into Windows 7 because of all the negatives of Vista that burned many individuals. Now would be the perfect opportunity to learn more about Windows 7 and Windows Server 2008 R2. He has been scheduling these events for the past several months between the Hudson and Beachwood areas. With the economy being a little tight at this time, now would be the perfect opportunity to take advantage of the free seminars to find out more about these systems which are soon to be released. You can't beat this opportunity with free food to go along with it while the opportunity is still there. Also, it's a great way to meet with people, network, and see what opportunities may unfold for yourself.

When I first met Bob, he was attending some of the same Microsoft classes that I had been attending. We both were already involved with the Greater Cleveland PC User's Group and discovered that along the way. He has also been my instructor through Tri-C UTC Campus, he encouraged me to join on the Board for the Greater Cleveland PC User's Group, he has given me the opportunity of what I like to do best and that is write news articles about the group, and has returned on several occassions to give great presentations for the Greater Cleveland PC User's Group along with his own presentations for Simplex-IT.

If you would enjoy learning about these new Microsoft based systems in a fun and upbeat environment, then I encourage you to attend some upcoming events while the opportunity is still there!

Sincerely,

Doreen Skonier

An Olympic Gold Medal

Hi my name is Doreen and I am related to a young woman who just made her dreams come true. As a native to Cleveland, Ohio, it was just announced last week that she made it to the Women's U.S.A. Ice Hockey Team. She will be showcasing her talents as a forward in the Winter Olympics in February of 2010 up in Vancouver, Canada. I'm proud to say that she is my cousin and my goal here is to post a blog about her adventures to reaching this goal.

Also, I would like to post a separate blog about my background experience in PC technical support. If you have any frustrating or mysterious issues about your PC's that you would like to share, bring them to me and we will see what we can come up with to solve those mysteries. If you have any questions about this Twice Earned Gold Medal star for the Women's USA Hockey Team those questions are welcome as well.

I've been very supportive in the past with my customer base and will continue to go above and beyond the call of duty.