[16:42:41] <el-bee> ToAruShiroiNeko: nevmerind i thought you were looking at processes. I usually use netstat for network connections [16:43:05] <el-bee> ToAruShiroiNeko: WireShark is probably what you’re looking for though in network activity. [16:47:43] <ToAruShiroiNeko> Stryyker that was something I was looking for, a blue screen viewer 
[16:47:48] <ToAruShiroiNeko> el-bee ya I used it before [16:47:55] <ToAruShiroiNeko> too much info for my limited brain capacity :p [16:49:07] <laos9> how the hell do you burn cd’s in windows 7… there is no damn “write to cd” option anywhere?! [16:49:23] <padi999> Is anyone in here fit in excel and open for a short question? Please pm, if you have the time, thank you very much) [16:49:50] <Stryyker> laos9: Normally you right click a file and burn to disc. [16:50:15] <laos9> it opeens with windows explroer [16:52:26] <Stryyker> Do you have a context option burn to disc? [16:52:38] <ToAruShiroiNeko> Stryyker how do you use this software [16:52:40] <enthdegree> Hello, all. [16:52:43] <ToAruShiroiNeko> I get the bluescreen report [16:52:55] <enthdegree> My thinkpad just came in the mail but it’s loaded up with cruft [16:53:08] <enthdegree> is there any tool that will take care of uninstalling it all for me [16:53:21] <Stryyker> ToAruShiroiNeko: report? I don’t know about that but bluescreen viewer allows you to open minidump files and it will analyse it. [16:53:23] <ToAruShiroiNeko> I have an old desktop too which bsod’s [16:53:37] <melik> hey guys i’m not entirely good at bat scripting [16:53:38] <ToAruShiroiNeko> Stryyker yes I am trying to trouble shoot a different problem now [16:53:55] <melik> how can i continue a line of code on the next line [16:54:03] <laos9> Stryyker: no [16:54:13] <laos9> it does not say that anywaree [16:56:40] <RevTorA> Hey guys… does HijackThis show running processes only? [16:57:06] <RevTorA> Or am I misinterpreting its use [16:58:55] <PZt> RevTorA the log does [16:59:02] <Some_Person> Does anybody here know if it’s possible to add ATSC channels to Windows Media Center with 3-digit subchannels? The add thing only lets me type in one digit [16:59:16] <PZt> melik what exactly are you trying to do? [16:59:47] <PZt> someguy123 can you please stop with the magic rat stuff [17:00:12] <Stryyker> laos9: What file extension does it have? Have you disabled the built in burning? [17:00:56] <laos9> …no [17:01:00] <laos9> exe [17:01:28] <laos9> I just want to put it on a cd because fuken 7 keeps saying I dont have permission to open it so I am opening it on my xp [17:01:56] <RevTorA> Are you not an administrator? [17:02:42] <Stryyker> laos9: Can you copy it to another area of your hard drive? [17:03:05] <someguy123> PZt, he’s trying to point out holes in XP SP2… then i say that windows 7 still has gaping holes that allow RATs like cybergate/spy-net [17:03:18] <sekyourbox> anyone here know how to script checking for the existance of a machine certificate? I can do it for a user cert [17:03:22] <el-bee> someguy123: why not run XP SP3? [17:03:29] <laos9> Its on my desktop [17:03:58] <someguy123> el-bee, i run windows 7 64-bit. [17:03:59] <someguy123> kthx. [17:04:04] <sekyourbox> someguy123: RAT is just software. you still need to exploit holes to install that software [17:04:37] <PZt> someguy123 who is? [17:05:00] <sekyourbox> someguy123: its not magic [17:06:50] <el-bee> what does RAT stand for? [17:07:01] <someguy123> el-bee, remote administration tool [17:07:11] <someguy123> PZt, i was saying how I ran XP sp3 for 6 years [17:07:13] <someguy123> without reinstalling [17:07:16] <someguy123> with no issues [17:07:31] <el-bee> sekyourbox: what do you use as your primary OS? [17:08:20] <PZt> someguy123 yeah i do not disgree with any of that the whole magic undetectable rat stuff is fud [17:08:34] <sekyourbox> el-bee: why? [17:09:05] <someguy123> PZt, windows doesn’t even believe it’s there [17:09:18] <sekyourbox> I use a bunch of differne’t OS’s for many differnt things. Right now I’m non windows 7 ultimate x64 [17:09:38] <el-bee> sekyourbox: wondering what version of Windows you prefer? [17:09:49] <someguy123> PZt, and even if you manage to locate it, deleting it causes it to just respawn somewhere else. [17:09:55] <PZt> someguy123 um sorry to tell you that it is detectable and removable it is not magic [17:10:06] <sekyourbox> It depends on the hardware. The computer I’m using right now gets the best performance on windows 7. [17:10:40] <sekyourbox> Also depends on what I’m using the computer for [17:10:53] <sekyourbox> ..or server [17:11:14] <sekyourbox> linux is way better for automation and many network functions [17:11:32] <el-bee> sekyourbox: yea, i just meant as your primary day to day desktop/laptop personal machine. Sure I support Windows XP SP3 all day long, and Vista SP2, and Win7 SP1…as well as SBS, and *nix machines<Kevin`> rootkits may not be complately undetectable, but they are damn annoying to find. it’s better to just use a known-clean system [17:12:12] <someguy123> Kevin`, yeah it’s a rootkit that’s capable of re-rooting itself [17:12:13] <someguy123> upon deletion [17:12:25] <PZt> Kevin` agreed but his theory is that a few apps in the rat family are [17:12:35] <mota> That just means you didn;t fully delete it, someguy123 [17:12:51] <someguy123> mota, no, it runs within several processes [17:13:04] <Kevin`> and you didn’t delete those processes [17:13:07] <PZt> it cannot run by magic [17:13:16] <PZt> it injects itself using a location [17:13:25] <Kevin`> realistically you have to remove it when windows isn’t running though [17:13:28] <someguy123> kevin yeah by deleting csrss.exe and winlogon.exe [17:13:32] <someguy123> that’d be easy now wouldn’t it [17:13:32] <Kevin`> otherwise it can intercept your actions [17:13:33] <someguy123> =_= [17:13:40] <PZt> sigh [17:13:45] <Stryyker> someguy123: Which again means you didn’t fully delete it. IF you fully delete it then it can’t run. [17:13:48] <mota> sigh. no. by replacing them with known good copies [17:14:32] <mota> But kevin is right. if malware has had that level of access to a system, the right thing to do is nuke + reinstall from trusted sources [17:14:32] <Stryyker> someguy123: Most of the issues come from users having some kind of interaction to enable the problem in the first place. [17:14:52] <laos9> whats a good burning software I can use [17:15:03] <someguy123> Stryyker, problem is that it could easily be binded to a completely legitamite piece of software [17:15:04] <sekyourbox> there are many places to hide a rootkit. Doesn’t need to be stored in the hard drive [17:15:05] <someguy123> like firefox [17:15:07] <PZt> laos9 imgburn [17:15:12] <melik> PZt, [17:15:22] <someguy123> a user could nicely download what’s apparantly firefox with a “valid digital signature” [17:15:27] <someguy123> oh look they’re infected. [17:15:34] <mota> someguy123: yes. that’s why you need to get your software from trusted sources [17:15:46] <melik> http://ompldr.org/vYmo1dw/pasta [17:15:52] <melik> PZt, ^ it doesn’t work that way [17:15:56] <someguy123> mota, the average user wouldn’t do that though [17:16:03] <melik> in bash we usually append a “&” [17:16:06] <Stryyker> They wouldn’t? [17:16:11] <Kevin`> mota: do you remember that neat application that injected rootkits into http streams and re-signed them with a valid certificate? [17:16:13] <someguy123> the fact something is aqllowed by windows to inject itself into vital system processes is pretty bad… [17:16:17] <Stryyker> Most people I know get Firefox from the Mozilla site. [17:16:26] <mota> someguy123: so maybe you should spend more time educating average users, and less time being the trumpeter of doom [17:16:28] <Stryyker> someguy123: How else would you install a driver? [17:16:35] <sekyourbox> there is flash memory on video cards, on the mother board, and on the hard drive that could hold a rootkit [17:16:40] <Stryyker> someguy123: People can do the same on any major OS. [17:16:56] <mota> Kevin`: eh. he made that note about sigs just as I pressed the enter key [17:17:14] <PZt> melik why echo and why find [17:17:18] <Maarten> Just get your software from the PROPER source, and you will be fine. [17:17:23] <Kevin`> not that most malware companies would bother getting a certificate [17:17:38] <Kevin`> it’s a useless cost and liability when the user will just press ok anyway [17:18:23] <melik> PZt, i don’t use Windows. [17:18:36] <melik> i don’t know anything about it [17:18:46] <Kevin`> sekyourbox: there’s also magnetic memory on the hard drive that can hold it far easier than messing with undocumented firmware. doing it to a video card would be easier though [17:18:53] <PZt> someguy123 the main idea is please stop the fud [17:19:18] <someguy123> sekyourbox, but then again, you could easily brick the motherboard [17:19:20] <someguy123> or the video card [17:19:23] <someguy123> by attempting that [17:19:30] <PZt> melik get rid of echo and use findstr [17:19:56] <mota> melik: put parens around your DO clause (starting at the first SET and ending after the last %%d) [17:20:28] <sekyourbox> http://www.theregister.co.uk/2008/01/11/malware_digital_devices/ [17:20:31] <PZt> below the %%d [17:20:37] <mota> like so: http://pastebin.com/BgtdYzmJ [17:20:49] <mota> the final paren can be on a newline, or not [17:21:06] <sekyourbox> I’d do new line [17:21:17] <PZt> ah i always did new line [17:21:18] <someguy123> In another incident, a Windows computer virus snuck onto the hard drives of a limited number of Apple’s iPods during manufacturing in 2006. [17:21:19] <someguy123> >ipod [17:21:23] <someguy123> >hard drive [17:21:26] <someguy123> what am i reading… [17:21:31] <sekyourbox> I dont think that space is going to work after delims [17:21:35] <PZt> maybe from perl i picked that up [17:21:36] <Kevin`> sekyourbox: that’s pretty common. the computer running windows xp sp0 that programs the devices gets infected, and the device is a usb-storage emulator so it happily accepts the virus. easy to clean<sekyourbox> I think you need delims= ,” or some workaround [17:23:20] <mota> space is already a natural delimiter [17:23:30] <PZt> delims should be fine [17:23:40] <PZt> the echo is what is the first issue [17:24:31] <PZt> well the tokens maybe off as well but i do not have a mirror hear to double check them [17:27:10] <sekyourbox> rule of thumb find /i is the safe way to go [17:27:40] <Rdogg112> Guys… Why haven’t I gotten an update for Windows 98 for ages now? [17:27:52] <sekyourbox> also I like to make all my for statements on a single line, but that is just me [17:27:57] <oeuvre> lol [17:28:02] <Rdogg112> I bought this Windows 98 expecting lifetime updates but you twats apparantly don’t support it anymore, Why not? [17:28:12] <Rdogg112> This is OUTRAGEOUS! [17:28:21] <oeuvre> Rdogg112: cause it’s not worth supporting. [17:28:33] <oeuvre> There’s probably at most 2% of all computers that still use it [17:28:35] <Rdogg112> oeuvre, LET ME SPEAK TO YOUR SUPERVISOR NOW! [17:28:37] <oeuvre> Less than, actually. [17:28:45] <oeuvre> troll. [17:28:48] <Rdogg112> I SAID NOW [17:28:57] <Rdogg112> GET YOUR SUPERVISOR ON THE LINE(WELL INTERNET) [17:29:03] <wanderingi> ive a 16gb usb pen thats only showing up as 8mb. anyone any ideas as to why this would be happening? [17:29:03] <PZt> Rdogg112 please stop [17:29:05] <someguy123> oeuvre, actually i downgrade all windows 7 computers i get in here to windows 98 [17:29:14] <someguy123> and they never complain again. [17:29:16] <Rdogg112> PLEASE STOP WHAT? [17:29:18] <Stryyker> Rdogg112: Please read http://www.freenode-windows.org/channel-guidelines [17:29:25] <Rdogg112> freenode.org? [17:29:26] <PZt> wanderingi tried in more than one computer? [17:29:26] <Rdogg112> WHAT [17:29:27] <oeuvre> please no all caps [17:29:28] <Rdogg112> this is MICROSOFT [17:29:30] <Rdogg112> not FREENODE [17:29:33] <Rdogg112> whats GOING ON? [17:29:39] <wanderingi> PZt tried in loads of computers [17:29:39] <oeuvre> .. [17:29:45] <sekyourbox> Rdogg112: !kickban [17:29:50] <wanderingi> tried formatting and windows disk management and no joy [17:29:54] <PZt> Rdogg112 this is freenode [17:29:58] <Rdogg112> How? [17:30:03] <PZt> Rdogg112 feel free to meail or call ms [17:30:05] <Rdogg112> this is ##microsoft [17:30:10] <Rdogg112> from talktomicrosoft.org [17:30:15] <PZt> Rdogg112 we are not affiliated with ms [17:30:21] <Rdogg112> uhh.. [17:30:25] <Rdogg112> then im sorry to inform [17:30:32] <Rdogg112> im going to have to tell them you’re using their name [17:30:38] <Rdogg112> without their permition [17:30:43] <PZt> Rdogg112 feel free [17:31:01] <Rdogg112> alright [17:31:08] <sekyourbox> this has nothing to do with microsoft. It is about home design. [17:31:17] <PZt> wanderingi the stick is dead msot likely [17:31:38] <wanderingi> 
i only have it a few months [17:31:39] <Stryyker> Rdogg112: Please read http://freenode.net/policy.shtml#topicalchannels [17:31:52] <Rdogg112> !report Microsoft.HQ “##Windows(FOUND ON TALKTOMICROSOFT.ORG) is apparantly using your name and is not even affliated with you..” 2192 190m [17:31:55] <sekyourbox> so what kind of frame is going on the window in the new peterson model home [17:31:57] <PZt> wanderingi try rma it most give you a year or two [17:32:23] <someguy123> sekyourbox, maybe that new 7 windows technology [17:32:23] <oeuvre> Rdogg112: might as well report #apple as well [17:32:27] <someguy123> maybe 8. [17:32:48] <someguy123> 8 windows includes really good vacuum double glazing [17:32:49] <wanderingi> PZt: ok thanks. i must check out the date i bought it [17:32:50] <sekyourbox> the IEframe? [17:32:58] <Rdogg112> oeuvre, I’m sorry to hear that Steven Hawking , founder of IBM has died.. [17:33:09] <sekyourbox> whasn’t he a nazi? [17:33:36] <Stryyker> Oh please. [17:33:56] <Rdogg112> I heard he was a friend of Bill Gates, the guy who invented that weird device… the iTouch…? [17:34:18] <Stryyker> Rdogg112: Please read the PM from me. [17:34:21] <sekyourbox> I could have sworn he was actually a nazi [17:34:32] <Rdogg112> Stryyker, What PM? how do i check them? [17:34:35] <someguy123> sekyourbox, no he was a jew [17:34:40] <PZt> sekyourbox stop feeding [17:34:46] <someguy123> hitler tried to gas him but failed and left him paralyzed [17:34:53] <someguy123> :3 [17:34:56] <Stryyker> someguy123: Drop it. [17:35:43] <Rdogg112> Stryyker, how do i check PM’s? [17:35:51] <someguy123> Stryyker, but i don’t want to break the window… [17:35:54] <Rdogg112> im using IRSSI, IS there an option for that? [17:36:06] <Stryyker> You should see a message from me [17:36:20] <someguy123> Rdogg112, command-alt-f4 [17:36:21] <Rdogg112> where? i can only see the text from this [17:37:01] <Rdogg112> someguy123, your keyboard must be now, mine doesnt have command or the f4 key, this keyboard is from 1985 [17:37:17] <someguy123> Rdogg112, connect it to itunes [17:37:21] <Rdogg112> new* [17:37:22] <someguy123> Press and hold the Home button and the Sleep/Wake button at the same time. [17:37:32] <someguy123> now what does itunes say Rdogg112? [17:37:39] <Rdogg112> Some_Person, im sorry to inform you that i use Mosaic not iTunes.. [17:37:41] <Stryyker> someguy123: Please read the the message from me [17:37:48] <Rdogg112> iTunes is a bad web browser.. [17:37:49] <someguy123> it should come up with
Dec 022011