Sephem's Ubulwembu (web) Blog

I came across a problem at one of my clients today where remote desktop stopped working on a Windows 2003 Server. (Although this also affects Windows 2000 Server)

I have searched the internet for causes, and the most likely reason is due to an update that is installed.

Further investigation led to a solution in Microsoft KB555382.

Basically the ability for RDP-TCP to bind to all network adapters configured with this protocol.

So to resolve this problem, you can do the following. (As taken from the Microsoft article KB555382)

1. On the server, logon to the server locally (not using Remote Desktop/Terminal Client).
2. Click Start, Run, type “tscc.msc /s” (without quotation marks and click OK.
3. In the Terminal Services Configuration snap-in double-click Connections, then RDP-Tcp in the right pane.
4. Click the Network Adapter tab, select the correct network adapter and click OK.
5. Make sure that you can establish an RDP connection to the server.

I hope that this helps out others who come across this sudden stop in RDP connectivity.

If you’re confused about all the Conficker chatter everywhere, as an SME (Small & Medium Enterprise) owner or home user there are some simple steps you can take to be safe. Rest assured, if these instructions sound too complicated, we’re happy to help with these issues either on-site or remotely through the magic of the telephone and screen-sharing technology.

These four steps are important to take no matter what your situation is! Think of them like taking your immunizations before you travel to a developing nation. The Internet IS a developing nation!

Read more here

Careful what you search for and click on — at least if you’re using Google you benefit from its association with Badware.org.

Of course as I searched for “Conficker nmap” this just now, the first hit is:

You can read the rest here.

The time has come to be proactive against Conficker.c as it is due to become active on 1 April 2009. It would be far more beneficial for you to try and remove any trace of this nasty before it becomes active as one of its traits is to block access to any tools that could be used to remove it including blocking access to anti-virus updates.

Make sure that you run the free scans available from
BDtools.net
Sophos

For more information please read the following.
http://www.ubulwembu.com/2009/03/23/conficker-powerfull-or-powerless/
http://blogs.computerworld.com/the_conficker_worm_on_60_minutes
http://www.theregister.co.uk/2009/03/26/conficker_activation_analysis/
http://www.sophos.com/blogs/gc/g/2009/03/27/hype-april-fools-day-conficker-worm/

Although I like the services and easy of use that Squarespace provides, I have decided to move my blog to my own server that I already have, and use my domain that I have had for many years at www.ubulwembu.com.

Ubulwembu means web in Zulu and therefore the name of my new blog will become “Sephem’s Ubulwembu Blog”.

I will be using WordPress to provide my blogging system, of which I have not used for a while, and I am highly impressed with the latest version. It is extremely user friendly and easy to use.

Don’t worry, I will still be doing a writeup on what I think of Squarespace, but I do not feel and cannot afford at this time to spend on another hosting plan when I already own my own reseller hosting.

All old posts have been migrated to the new server so go ahead and take a look.

Conficker was first seen in October 2008, but has gone through a few variants called conficker.a conficker.b and now the one to be activated on 1 April 2009 called conficker.c

Is this new variant going to be a crisis in the world of computers, or is it just going to flop like a bad April fools joke?

The conficker worm spreads itself primarily through a buffer overflow vulnerability in the Server Service on Windows computers. The versions of windows that are affected are Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, and even Windows 7 Beta. The security bulletin can be read here.

Once it is activated, it does a few things, like disabling some services like Windows Defender, Windows security center and windows automatic update service.

It also connects to a server over the internet and gets some instructions that can gather information, install other malware amongst other things.

According to The New York Times,

An estimated 12 million or more machines have been infected. However, many have also been disinfected, so a precise census is difficult to obtain.

There is still little consensus as to whether conficker.c is going to be something or nothing, so we will just need to wait and see.

It is highly suggested to keep your windows up to date and to make sure that your anti-virus has the latest definitions.

Due to the fact that the new version of conficker has highly evolved means of removing most anti-virus software packages, being able to disable Microsoft’s Automatic update service, open ports on firewalls and to even block access to the update services of most security software it is highly advised to download some removal tools before the anticipated date of activation.

Here are a few links to some removal tools.

Microsoft® Windows® Malicious Software Removal Tool
Symantic W32.Downadup Removal Tool
Sophos Tool

For a more details report on Conficker, take a look at SRI Internationals Technical report at http://mtc.sri.com/Conficker/

One of my colleagues sent out an e-mail to bring to our attention this website he came across called Death Switch.

A deathswitch is an automated system that prompts you for your password on a regular schedule to make sure you are still alive. When you do not enter your password for some period of time, the system prompts you again several times. With no reply, the computer deduces you are dead or critically disabled, and your pre-scripted messages are automatically emailed to those named by you.

At first I was a bit sceptical if this was a very good idea. Would you entrust your most secret details with another company or person you do not know? Would you just keep all your passwords on someone else’s system? I know I would not.

Well after some careful research and investigation, I have come to the conclusion that this might not be such a bad system if used correctly with the right software and systems in place.

The scenes from the movies are not that far away when after you die, a video or an encrypted disc is sent to someone on the event of your death. In fact those times are here and have been for quite some time. It is not that difficult to get setup and running either.

Lets take a look at using an encrypted USB flash drive. All you need to do is use a piece of software called TrueCrypt which is free and Open-Source to create an encrypted file on a flash drive and then give the drive to the person you want to have the information in the event of your death. You can also create multiple flash drives, each with different files on. You could even create a video file with your last will and testament, or a message for your loved ones.

Once this is done, you can then sign up for Death Switch. (Note that with the free account, you can only setup one e-mail and you cannot upload any attachments.) Then what you can do is setup the e-mail or emails (if you have a premium account) to send out the messages with just the password to the corresponding flash drive.

Then your family, loved ones or anyone else you have give an encrypted flash drive to will be able to open it and read its contents.

Click here to see an example of the Death Switch prompt and an example of an e-mail that could be sent out.

So not as unsecure as I thought at first if you do it correctly that is.

Well time has come for me to hop onto the blogging and social networking bandwagon. Therefore I have decided to use Squarespace as a trial for my first blog.

Now comes the real test of whether I can actually keep a blog going. Ever since I was young I have tried to keep a journal or a diary of some sort. I would go out and buy it and then after a few days forget that I even had it. I guess that the trick would be to make sure that you have some kind of a reminder that just pesters you till you have added an entry on whatever is felt to be the best time between posts.

It does not stop there I guess as what is a blog without some mention somewhere else to get readers to your blog? This is where I like the term Twitter gives it, “Tweeting”. So if thats the case, I guess I will be singing like a bird.

I would also like to have all your comments out there whether good or bad as this I beleave is the only way to make sure that what I am blogging about is making an impact on what others think and feel, and for me to know if I need to change something or not.

I will also be testing some other systems to see what would be the best way to get a blog and website up and running. As time goes by I will defiantly be posting my thoughts on each of these systems so that others in the same situation can have a bit of information to go on to get there own blogs up and running as well.