Your story makes my heart heavy, my prostate weak and my bladder full to burst

Friday, September 30, 2005

LOTR Shit

Tuesday, September 27, 2005

Midterms finally over (sort of)

Midterms are finally over!!! Spent the whole of the midterm break studying for these 4 stupid midterm tests. Argh! Finally it's over... actually not really... I still have one more test on the 12th of October but I heard that it's chicken feet so I'm not too worried abt it =P

Now I can finally start on this project that I have... THAT IS DUE TOMORROW MORNING!!! Busybusybusy...

So anyway, I've been tracking ossvc.exe. It turns out that ossvc.exe activates after you've been connected to the internet for a while (either it activates at random or according to a certain number of bits transferred... I can't say for sure). When it activates, it adds an entry into your Windows Registry startup.
It adds the entry under the name "MsUpdate" in order to fool you into thinking at it is a legitimate Microsoft file. You know that ossvc.exe is evil because if you Google it, you won't be able to find any information on it. Legitimate Windows files have webpages to document them.

After that, it runs all the programs listed in your Windows Registry startup list. This causes a major slowdown in your computer's processing speed.

Following that, it calls tftp.exe (a legitimate Windows file) to download sxd.exe onto your C:\ and runs it. I can't determine what this file does at the moment.

Somewhere along the way, it also uses tftp.exe to download a file and randomly renames it. This file runs and also adds itself to your Windows Registry startup. This randomly named file has the entry name "SPK3".

The effect of this randomly named file running is that it starts taking up your Mem Usage. This can be seen using Windows Task Manager (Crl-Alt-Del).

Somewhere along the line, entries are also added into the Windows Registry to register osscv.exe as a Windows Service. This just makes it more tedious to remove.

The thing about osscv.exe and the randomly named file is that they cannot be located with Window's find file function. Either these files are very well hidden or they are deleted right after they have been loaded into the memory. I still need to study it more to confirm.

Even after removing all traces of osscv.exe from the Windows Registry, the file still manages to find a way to run itself. So this leads me to suspect that there is another .exe file at work here. This file is running and when activated, downloads osscv.exe using tftp.exe. The next logical step in my investigation is to locate this mystery file. So far I have no leads however I suspect there might be a possiblity that it could have something to do with a possible web browser hijack... will update more on my investigation when I discover more.

Meanwhile, I have disabled tftp.exe to prevent osscv.exe from even starting up. This temporary measure seems to work well at the moment =) [Edited: No it doesn't =P Windows doesn't allow u to diable tftp.exe. Dohz.]

[Edited again: I have determined that the virus/worm/trojan watnot is activated by running Internet Explorer. Hence, I conclude that these are the result of a browser hijack. Quick solution: 1) Install Firefox. 2) Use Firefox to download antispyware from TrendMicro. 3) Use antispyware to clear the browser hijack. Situation seems stable at the moment.]

[Edited once more: Using Firefox also kenna =O]

14:57

Sunday, September 25, 2005

SPK3

I still haven't got back my laptop yet =( ARGH! Can you imagine the inconvenience!?

It seems though that there are many computers experiencing the same problem. I suspect that this is not a hardware problem but actually something caused by a virus/worm/trojan whatnot. The whirling/screaming sound could possibly be caused by increased harddisk activity due to some function of the virus. I can't confirm this at the moment but I suspect something of this nature.

Grrr.

Anyway, I'm temporarily using this other laptop for my work and my warning bells are ringing when this entry "SPK3" suddenly pops up in my Windows Registry "run at startup" files list. I checked Windows Task Manager and you can tell that the file that it references to takes up quite a bit of CPU time that its Mem Usage increases every second. The file doesn't allow me to "End Process" it either. The filename of this file is made up of random letters so it turns up with a different filename at different times. However, the MO of the files are all the same and they all have links to that "SPK3" so I'm assuming that they are of the same origin. Quite smart using random filenames... this ensures that people trying to find information regarding that file on the internet will have a tougher time determining if it is a virus or not.

I'm thinking that it's the same thing that killed my precious baby. I can't find any news about it yet so either I'm way off the mark or it's a new virus. Will try to look more into it.

Anyway, just to fill your time: Here's an addictive game thingie.

(I'm currently at stage:ascorbin but stopped bcos I have to study for my midterms =P Will continue playing later when I've got more time. It's really super addictive!)

[Edited: I think ossvc.exe is evil too.]

[Edited again: I finally found the mp3 version of Leftbank 2!!! Woo & Yay!]

15:42

Wednesday, September 21, 2005

Beat This!

It is official. BB03 is the Singapore Beatboxing Champion! Good job bro!

13:42

Monday, September 19, 2005

Still offline

My comp is still out. The new parts are probably coming at the end of the week. Argh... oh well, at least I get to concentrate more on studying then =P

Meanwhile, I'll just have to blog using pure willpower by willing words into existence. Not easy =(

Anyway, KUDOS TO MY BRO FOR GETTING INTO THE TOP 2!!! Finals tomorrow at the Black Eyed Peas Concert. HOOYAH! See u there!

In the meantime, check this out!!!

Metal Gear Solid 4 Tokyo Game Show 2005 Trailer!

Sweet.