Story on Keyloggers at SpywareInfo.Com! link is now gone — but it was a good article!

There are some serious concerns here. If you even THINK you’ve been jacked by a keylogger, Install a SOFTWARE FIREWALL IMMEDIATELY. Change the passwords on ALL your bank, email and other accounts from a DIFFERENT, KNOWN-CLEAN computer. Oh, and DON’T USE INTERNET EXPLORER.
]]>

NOTE: These instructions have been superseded with updated procedures for the nailfix installer and a new version of Ewido. Please post a HijackThis Log in the Malware Removal Assistance forum here or at any of the ASAP Member Sites.

The following are instructions to run the Nail/Aurora popups fix. This can be recognized by the following lines in HijackThis:

F2 – REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O23 – Service: System Startup Service (SvcProc) – Unknown owner – C:\WINDOWS\svcproc.exe

I ALWAYS recommend starting this fix by posting a HijackThis log at one of the forums listed in the Spyware Help Forums FIX LINK! section.

Please download, install, and update the free version of Ewido trojan scanner:

1. When installing, under “Additional Options” uncheck “Install background guard” and “Install scan via context menu”.
   
2. When you run ewido for the first time, you will get a warning “Database could not be found!”. Click OK. We will fix this in a moment.
   
3. From the main ewido screen, click on update in the left menu, then click the Start update button.
   
4. After the update finishes (the status bar at the bottom will display “Update successful”)
   
5. Exit Ewido. DO NOT scan yet.
   

Download CCleaner and install, but do not run it yet.

Please download the Nail/Aurora Spyware Fix from NoIdea.US.

Unzip it to the desktop but do NOT run yet.

Reboot into Safe Mode. To do this with Windows XP, you can follow these steps from Microsoft:

1. Restart your computer and start pressing the F8 key on your keyboard. On a computer that is configured for booting to multiple operating systems, you can press the F8 key when you the Boot Menu appears.
   
2. Select an option when the Windows Advanced Options menu appears, and then press ENTER.
   
3. When the Boot menu appears again, and the words “Safe Mode” appear in blue at the bottom, select the installation that you want to start, and then press ENTER.
   

Once in Safe Mode, please double-click on nailfix.cmd that you unzipped earlier. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Next, run Ewido again.

1. Click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run, so time to go get a drink and a snack….
   
2. If ewido finds anything, it will pop up a notification. You can select “clean” and check the boxes “Perform action with all infections” and “Create encrypted backup” before clicking on OK.
   
3. When the scan finishes, click on “Save Report”. This will create a text file. Make sure you know where to find this file again.
   

Then run HijackThis, click Scan, and place a checkmark by the following item:

F2 – REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Now, run CCleaner.

1. Uncheck “Cookies” under “Internet Explorer”.
   
2. if running Firefox: then click on the “Applications” tab and uncheck “Cookies” under “Firefox”.
   
3. Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.
   

Finally, restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.]]>

To configure Thunderbird for the domains hosted here:

Start Thunderbird. If you have never set up accounts in thew program before, you will start with the Account Wizard. If not, click on the Tools menu, then Account Settings.

Select Email account, then Next.

Enter your name and email address in the appropriate fields, then click Next.

Select IMAP, and type in the names of the incoming and outgoing mail servers. Click Next.

Enter your full email address as the Incoming User Name and click Next.

Enter a descriptive Account Name or take the default entry, and click Next.

Confirm that all the settings are correct, and click Finish.

Back at the Account Settings window, select Outgoing Server(SMTP) from the left menu, then check Use name and password and enter your full email address in the User Name field.

Select Server Settings (for the account you just created) from the left menu. Check Use secure connection (SSL) and set the Check for new messages settings to your preferences.

Finally, select Composition & Addressing from the left menu. Uncheck Compose message in HTML format, and set the quoting options to your perferences, then click OK to exit the Account Settings screen.

That’s it!
]]>

Updated 27 Feb 2005: Grrr…I got the two Shuttle boxes (SV24 and SV25), only to discover that both have blown motherboards and power supplies. I’m working on the means to get them in usable order, but it’s going to take some fundage that I don’t currently have….can anyone help?

---

UPDATED 12 FEB 2005: I know people are waiting on this document! Gomennasai…but I will hopefully be much closer after this weekend. I should be picking up two shuttle systems this weekend, one of which will be my new mail server. I will be using this to finalize all the steps I will take to make this document finally useful.

I have Amavisd-new, SpamAssassin,ClamAV and Maia Mailguard all running now. I still need to get Mailman list manager tested and Squirrelmail running on https, but I promise! it’s getting closer!

---

UPDATED 13 OCT 2004: getting closer! See the bottom for the newest info…

---

Wednesday, September 29 2004 @ 12:02 AM CDT
Just a little heads-up…I’m currently working on a test mail server, incorporating Fedora Core 1, Postfix, Dovecot Imap, fetchmail, amavisd, and Maia Mailguard, with full SSL and virtual domain/user support tied into a MySQL database.

---

Like the title says, it’s a work in progress, so I don’t have a whole lot to give you yet, but I do have some success:

1. Postfix is working to receive mail to users who only exist in the MySQL database.
   
2. Dovecot will authenticate users via SSL, logging into the database.
   
3. I can perform all IMAP functions with Dovecot and Mozilla Thunderbird as the client.
   
4. I had to build custom RPMS for Postfix and Dovecot to incorporate the features I wanted (and remove Postgres support from Dovecot…grrrr)
   

Still to come:

1. Installing and setting up Amavis, SpamAssassin, and ClamAV, and tying it into Maia Mailguard for per-user configuration.
   
2. Setting up Fetchmail to POP several external accounts.
   
3. Setting up name-based virtual hosting on Apache2.
   
4. Probably other issues as they come up.
   
5. Writing up coherent documentation on the process.
   

Doesn’t sound like much, really, but it’s been a big accomplishment for me so far, especially considering how badly certain applications (*cough*dovecot*cough*) are documented. To be fair, it is a fairly new app, and the userbase is not what it could be (many people sticking with Courier and Cyrus out of familiarity, I’m sure). I’m going to attempt to do my part by creating documentation on the process here, so others can benefit from my experimentation.

I’ll be writing up a static document for this site once everything is in place, so be watching for it!

---

UPDATE 13 OCT 2004: Process/Progress

Requirements:

• SMTP-AUTH
  
• IMAPS
  
• all auth to sqldb
  
• anti-spam
  
• antivirus
  
• web managable
  
• virtual domain hosting
  
• per-user config for antispam
  

Implementation:

• Fedora Core 1
  
• MySQL 3.23.58
  
• Postfix 2.1.5 w/ pcre, MySQL, sasl2, tls, vda support
  
• Dovecot 0.99.11 with MySQL support
  
• Maildir-formatted mailboxes
  

Done and Notes:

• OS – Fedora Core 1 and updates
  
• MySQL
  
• Postfix
  
  • set up SMTP via SASL/Pam for auth over TLS.
    
  • Requires Pam-mysql 0.5 module
    
  • User passwords in db must be in MySQL-Crypt format
    
  • Maildir mailbox format in /home/postbox/%domain/%name/
    
  
  
• Dovecot
  
  • configured to only offer IMAPS for encrypted comms
    
  • User passwords in DB must be in PLAIN-MD5 format
    
  
  
• PostfixAdmin
  
  • Web interface for virtual domains in Postfix
    
  • can set passwords in several formats. Set to md5crypt.
    
  • added new $CONF[‘postfix_smtp_pw’] set to mysql crypt for smtp-auth
    
  
  
• PHPMyAdmin
  
  • MySQL administrator for the web.
    
  • simplified testing password crypt methods.
    
  
  

ToDo:

• Amavis/SpamAssassin/ClamAV
  
• Maia Mailguard
  
• Fetchmail (for POPping external mailboxes)
  
• Squirrelmail webmail client
  

]]>

SpywareInfo.Com’s Support Forums! This means that they think I known enough to not endanger anyone when it comes to cleaning malware off computers. If you need assistance with your computer, you are more than welcome to visit SWI. The volunteer helpers there certainly do their best to help you.

I’ve also been accepted for membership in the Alliance of Security Analysis Professionals. “ASAP is made up of website/forum owners and administrators, forum staff, individuals, companies and various organizations who all provide security related support to computer end users.”]]>

Setting Up a Spam-Filtering Mail Gateway

For Microsoft Exchange

Using Fedora Core 1, Postfix 2.0.19,

Amavisd-New and Razor2