Spyware

Two nasties I've had to deal with in the last few months, both of which installed registry hooks into the Windows startup and Explorer launch so that they required Windows to load dlls which then locked them as system files, and they would sit there watching the registry to make sure that they re-added any registry entry you deleted, so you couldn't turn them off or remove them.

The only way to get around them in the end was to boot off an XP install CD or some other boot image that can write to NTFS file systems and remove the offending files from C:\Windows\System32 - generally the newest files in that directory.
(From time to time there are a number of files of exactly the same size and different time stamps = the spyware making clones of itself)

The two I've removed (off two different machines) were WinFixer and SysProtect.
Nasty little buggers.

Must-have toolbox for dealing with nasties:

AdAware Anti-Spyware
SpyBot S&D Anti-Spyware
ewido anti-spyware Anti-Spyware
AVG Free Free Anti-Virus
Sysinternals Process Explorer Kill bad processes.
Sysinternals Autoruns Clean out start-up entries for bad processes.
RegSeeker Clean your registry afterwards.

If you need a boot CD:

Trinity Rescue Kit (85MB)

Paragon NTFS for Linux NTFS for Linux trial version (includes a self-burning .exe - only 26.3MB to download)

NTFS driver for DOS (could work from boot floppy if you have a floppy drive. (Haven't tested this)

How do I read the Volume ID of a CDROM under Linux?

If you want to read a CDROM Volume ID under Linux (as set by 'mkisofs -V volID') (which Solaris & Windows can read, and Windows displays as the disk label) you can do:


# dd if=/dev/cdrom bs=1 skip=32808 count=32


Or do:


# dd if=/dev/cdrom bs=8 skip=4101 count=4


Getting Skype installed properly...

I got the up-to-date Skype package working, so I don't need to use the "Static binary tar.bz2 with Qt 3.2 compiled in" one...

I downloaded the latest version (currently skype_1.2.0.18-1_i386.deb) from here: http://www.skype.com/products/skype/linux/

If you try and install this you get:


# dpkg -i skype_1.2.0.18-1_i386.deb
dpkg - warning: downgrading skype from 1.2.0.18-2jgh to 1.2.0.18-1.
(Reading database ... 52930 files and directories currently installed.)
Preparing to replace skype 1.2.0.18-2jgh (using skype_1.2.0.18-1_i386.deb) ...
Unpacking replacement skype ...
dpkg: dependency problems prevent configuration of skype:
skype depends on libqt3c102-mt (>= 3:3.3.3.2); however:
Package libqt3c102-mt is not installed.
dpkg: error processing skype (--install):
dependency problems - leaving unconfigured
Errors were encountered while processing:
skype


Which you can get around by doing:

dpkg --force-depends -i skype_1.2.0.18-1_i386.deb

but that's not nice.

This can be fixed by correcting the DEBIAN/control in the .deb file.
One way to do this is: download the .deb package, move it into a new directory
& cd into that directory, then do this:


mkdir skype
dpkg-deb --extract skype_1.2.0.18-1_i386.deb skype
dpkg-deb --control skype_1.2.0.18-1_i386.deb skype/DEBIAN


Now use your favorite editor to edit the Depends line:


vi skype/DEBIAN/control


I changed:

Version: 1.2.0.18-1

to:

Version: 1.2.0.18-2sg


and more importantly changed:

Depends: ... libqt3c102-mt ...

to:

Depends: ... libqt3-mt ...


I also added a menu entry like this:


cd skype
vi usr/share/menu/skype

add this to the file:

?package(skype):needs="X11" section="Apps/Net" title="Skype" command="/usr/bin/skype" icon="/usr/share/icons/skype.png"


Then you need to rebuild the DEBIAN/md5sums file so it knows about the menu file:
# find etc usr -type f -exec md5sum {} \; > DEBIAN/md5sums.new
# diff DEBIAN/md5sums DEBIAN/md5sums.new
36a37
> 6033460bf835d754b25451943db3e92f usr/share/menu/skype
# mv DEBIAN/md5sums.new DEBIAN/md5sums


Then cd back up a directory and rebuild the package:


cd ..
dpkg --build skype
mv skype.deb skype_1.2.0.18-2sg_i386.deb


That's it. Now you can install it:


dpkg -i skype_1.2.0.18-2sg_i386.deb


I found the basic of these instructions here: http://forum.skype.com/viewtopic.php?t=44138 and added a bit to it...

Soundcard again...

Ages ago I recall finding that the ALSA drivers didn't work on the Tosh, so I was running OSS, but then when I upgraded to 2.6.15-1-686 they stopped... whether that was just because I didn't know to run alsaconf I don't know - but it *did* work fine on the Vaio.

debian-faq-wiki::UseSoundCard
had everything I needed to get ALSA going this time.

ALSA vs OSS

ALSA rocks! - now my Gaim has sound too I can hear when people login or out or send me messages... and my console beeps work :o)

Best of all... I can now use that *gorgeous* AlsaPlayer again... which lets you speed up and slow down and even reverse tracks!!! - crazy :o) great thing to have access to if you're getting bored with listening to your music collection!

Gaim spell check

It seems there are quite a few dependencies to get this working, and the gaim package doesn't actually recommend the bits you need, so I had a look at the Vaio and a few looks with apt-cache search and ended up getting it working...

I *think* this is pretty much what you need:


gaim (shock, horror!)
aspell
aspell-en
dictionaries-common
libgtkspell0


Installing XML::Simple

http://www.cpanforum.com/threads/1473


cpan> install XML::Simple
Running install for module XML::Simple
Running make for G/GR/GRANTM/XML-Simple-2.14.tar.gz
Is already unwrapped into directory /root/.cpan/build/XML-Simple-2.14
Has already been processed within this session
Running make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0,
'blib/lib', 'blib/arch')" t/*.t
# Package Version
# perl 5.8.7
# XML::Simple 2.14
# Storable 2.13
# XML::Parser Not Installed
# XML::SAX 0.13
# XML::NamespaceSupport 1.09
# XML::SAX::PurePerl 0.90 (default parser)
t/0_Config........ok
t/1_XMLin.........ok 1/122Unable to recognise encoding of this document at /usr/
local/share/perl/5.8.7/XML/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
t/1_XMLin.........NOK 32
# Failed test 'no warning issued (as expected)'
# in t/1_XMLin.t at line 380.
# got: 'Unable to recognise encoding of this document at /usr/local/sha
re/perl/5.8.7/XML/SAX/PurePerl/EncodingDetect.pm line 96.
# '
# expected: ''
t/1_XMLin.........ok 33/122Unable to recognise encoding of this document at /usr
/local/share/perl/5.8.7/XML/SAX/PurePerl/EncodingDetect.pm line 96.
t/1_XMLin.........NOK 38
# Failed test 'CDATA section parsed correctly'
# in t/1_XMLin.t at line 426.
# Structures begin differing at:
# $got->{cdata} = 'Hello, world!>'
# $expected->{cdata} = 'Hello, world!'
t/1_XMLin.........NOK 39
# Failed test 'CDATA section containing markup characters parsed correctly'
# in t/1_XMLin.t at line 432.
# Structures begin differing at:
# $got->{x} = 'one>two>'
# $expected->{x} = 'onetwo'
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96, line 1.
t/1_XMLin.........NOK 122
# Failed test 'successfully read an SRT config file'
# in t/1_XMLin.t at line 1443.
# Structures begin differing at:
# $got->{pubpath}{test1}{title} = 'web_source -> web_target1'
# $expected->{pubpath}{test1}{title} = 'web_source -> web_target1'
# Looks like you failed 4 tests of 122.
t/1_XMLin.........dubious
Test returned status 4 (wstat 1024, 0x400)
DIED. FAILED tests 32, 38-39, 122
Failed 4/122 tests, 96.72% okay
t/2_XMLout........NOK 47
# Failed test 'generated document with escaping'
# in t/2_XMLout.t at line 302.
# Structures begin differing at:
# $got->{c} = '&C&'
# $expected->{c} = '&C&'
t/2_XMLout........ok 99/196Unable to recognise encoding of this document at /usr
/local/share/perl/5.8.7/XML/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
t/2_XMLout........ok 196/196# Looks like you failed 1 test of 196.
t/2_XMLout........dubious
Test returned status 1 (wstat 256, 0x100)
DIED. FAILED test 47
Failed 1/196 tests, 99.49% okay (less 1 skipped test: 194 okay, 98.98%)
t/3_Storable......ok
t/4_MemShare......ok
t/5_MemCopy.......ok
t/6_ObjIntf.......ok
t/7_SaxStuff......ok
t/8_Namespaces....ok
t/9_Strict........ok 2/38Unable to recognise encoding of this document at /usr/l
ocal/share/perl/5.8.7/XML/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
Unable to recognise encoding of this document at /usr/local/share/perl/5.8.7/XML
/SAX/PurePerl/EncodingDetect.pm line 96.
t/9_Strict........ok
t/A_XMLParser.....skipped
all skipped: no XML::Parser
Failed Test Stat Wstat Total Fail Failed List of Failed
-------------------------------------------------------------------------------
t/1_XMLin.t 4 1024 122 4 3.28% 32 38-39 122
t/2_XMLout.t 1 256 196 1 0.51% 47
1 test and 1 subtest skipped.
Failed 2/11 test scripts, 81.82% okay. 5/454 subtests failed, 98.90% okay.
make: *** [test_dynamic] Error 255
/usr/bin/make test -- NOT OK
Running make install
make test had returned bad status, won't install without force



tcpdump syntax


/usr/sbin/tcpdump -A -s 65535 -i eth0 -l host $ME and host $IT


NFS errors...


# umount /var/cache/apt/archives
Cannot MOUNTPROG RPC: RPC: Port mapper failure - RPC: Unable to receive
umount: /var/cache/apt/archives: device is busy


and


# mount /var/cache/apt/archives
mount: RPC: Remote system error - Connection refused


Hmmm... the NFS daemon was not running on server.

I did this on the server:


/etc/init.d/portmap start
/etc/init.d/nfs-kernerl-server start


After I had done this I got:


# umount /var/cache/apt/archives
Cannot MOUNTPROG RPC: RPC: Program not registered


and


# mount /var/cache/apt/archives
mount: RPC: Program not registered


I had to add an entry to /etc/hosts.allow on the server like this:


ssh sshd : ALL@ALL : ALLOW
ALL : 127.0.0.1 LOCAL : ALLOW
portmap : 192.168.254.0/255.255.255.0 : allow


then...


# umount /var/cache/apt/archives
umount: /var/cache/apt/archives: not mounted


YAY! got it!


# mount -v /var/cache/apt/archives
mount: uaine:/var/cache/apt/archives failed, reason given by server: Permission denied


Whoops! I had the wrong directory on the server in the /etc/fstab on the client machine...


# vi /etc/fstab
# mount -v /var/cache/apt/archives
uaine:/mnt/hda1/var/cache/apt/archives on /var/cache/apt/archives type nfs (rw,addr=192.168.254.6)



# mount
...
uaine:/mnt/hda1/var/cache/apt/archives on /var/cache/apt/archives type nfs (rw,addr=192.168.254.6)


All sorted :o)

Files with spaces in their names...

If you want to process the output of find and some files have spaces in their names, you don't need to use double quotes...

find has the -print0 switch and xargs has the -0 (or --null) switch.


find . -type f -print0 | xargs -0 ls -l


Debian public key expired...


Reading package lists... Done
W: GPG error: http://ftp.uk.debian.org testing Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 010908312D230C5F
W: You may want to run apt-get update to correct these problems


and something like this:


10 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.
Need to get 0B/14.7MB of archives.
After unpacking 557kB of additional disk space will be used.
Do you want to continue [Y/n]?
WARNING: The following packages cannot be authenticated!
  apt apt-utils libgimp2.0 gimp-svg gimp gimp-data
Install these packages without verification [y/N]?
E: Some packages could not be authenticated


This page explains it:

http://secure-testing-master.debian.net/

And this year (2006) while the link on the secure-testing page is still out of date, you can fix it with this:


gpg --keyserver subkeys.pgp.net --recv-keys 084750FC01A6D388A643D869010908312D230C5F
gpg --export 084750FC01A6D388A643D869010908312D230C5F | sudo apt-key add -


(thanks to #debian irc channel on freenode.net)

NB1: This will only work this year (2006) - because next year's key signiture will be different.

NB2: This has the side effect of adding the public key to root's keyring which you can see with:


gpg --list-keys


which gives:


pub   1024D/2D230C5F 2006-01-03 [expires: 2007-02-07]
uid                  Debian Archive Automatic Signing Key (2006)


You may want to remove it from there once you've imported it into apt, you can do this with:


gpg --delete-key 2D230C5F