Category Archives: Field Reports

Cleanup reports of startupware from the real world.

FOSE Opening Keynote: David Girouard

Written by Jerry Stern

Google sent the Vice President in charge of their Google Enterprise division for the first keynote address and slide show of the FOSE conference at the DC Convention Center. According to David Girouard, the future is in the clouds. Well, cloud computing. Yes, this speech was given on April Fool’s Day, also known as the 4th anniversary of the launch of GMail, but what he was promoting was the migration of documents onto the ‘cloud’ (storage on the Internet) and positioning Google as a SAAS vendor.

Those of you who attended the Software Industry Conference during the years it was in Florida around ten years ago will remember that SAAS, or Software as a Service, was really big back then, but it resulted in very little. Now, bandwidth and connectivity for business users is good enough and fast enough that SAAS may be practical for specific applications.

Putting documents into the cloud is already what Google is living on. All their documents, spreadsheets, slide shows, etc, are hosted live on the Google Apps site (www.google.com/a). Nothing is stored on workstations, and their technology now includes sharing of documents between collaborators, with tracking of edits and changes.

Girouard reports that lots of business notebooks are lost worldwide, usually with business data. He had one stolen from a parked car the day before a big meeting. The next morning, he stopped by the Google IT department, picked up a new notebook, switching to a Mac while he as there, logged in to Apps, and was up and running immediately, with less than half an hour lost.

This isn’t just Google eating their own brand of dog food. Girouard showed an impressive list of Fortune 500 companies that are using Google’s GMail with Postini spam filtering for 100% of their email storage. It’s all online, manageable and controllable by corporate management.

Grinding your Personal Information– Your Tax Dollars at Work

I’m back from my annual one-day jaunt down to Washington DC for the computer show formerly known as the Federal Office Systems Exposition. Now, it’s just FOSE, pronounced ‘fah-cee.’ You can get a good feel for what’s happening in the government computer markets based on what’s showing in the DC Convention Center.

This year, the main hall of the Convention Center was busy, but only at about 2/3 capacity. This show has never filled the new convention center–the old one was retired a few years back and two blocks south, and that one was always full. But this is a bigger building, and the show is smaller than it used to be. Actually, the show floor covers two city blocks, below ground, and if you go up to the registration area or up another floor to the keynote and conference rooms, it’s clear that it’s really two buildings. There’s even a DC Metro train stop at one end of the building, shared with Mt. Vernon Square.

For the last two years, the dominant items on the show floor have been removable storage devices with security features, and eGovernment systems for converting agencies with actual people into web sites with actual forms and automation. That’s progress in the US capital, maybe.

This year, regulations have changed regarding the destruction of personal data. And the US military is being more careful too. So, the item that wasn’t visible in previous years, that was everywhere this year, is demolition of computer hardware, shown by at least seven companies. First, there was a degaussing machine (OK, three different machines), that rotate a hard drive through a massive magnetic field. I fed in a hard drive, but there was no visible change–their demo didn’t actually show that the drive had lost all formatting, including servo tracks.

Degaussing isn’t visible enough for government use, apparently. They want to look at a device and SEE that it’s not readable. In the dark, apparently.

That means there was a vendor that sells a machine (with a hidden sound-muffled hydraulic compressor) that folds hard drives in half, the long way–it’s a clean 90 degree bend. Another had a hard drive destroyer that pushes a 2″ blunt cone down into the center of the drive until it becomes visible on the far side, shattering the platters. Again, it’s pneumatic, using a compressor.

There was another machine that folded drives, but electric or hand-crank operated for field use in a battlefield. There was a truck-mount hard drive shredder that reduces the drives to 1″ or smaller chunks–that one wasn’t on the show floor–it’s driven to clients for mass destruction of drives. And another portable device snipped the drives in half with a hydraulic claw.

Not to be outdone, another vendor had samples of what comes out of their computer shredder. Yes, the entire computer. But wait, there’s more… one supplier to the US government is actually doing it right–they shred the entire computer, grind it into fine dust, sort it both magnetically and by density into its component bits of metal alloys, plastic, gold, all the good stuff, and recycle it. They showed off clear containers of the various sorted powders.

So, your next appliance may contain 5% recycled US military computer parts and data. Guaranteed unreadable by the current level of technology.

Elsewhere at the show, there were the usual vendors, a mixture of the software companies you know, and the government specialists that build their offices around the edges of DC–locally, they’re called ‘Beltway Bandits.’

Last year, Google had a shared area in a small booth, showing off their hardware search technology that they install on client sites for searches of private networks–it’s called a ‘search appliance.’ This year, they had one of the largest areas on the floor, with seating for seminars in groups of around 50 people, and they gave introductory lessons on buying adwords, and showed what Google Earth could do for the military, and demonstrating the new real-time Google Earth weather alerts.

More tomorrow…

ContraVirus cleanup

Had a call from a client this week, describing a “Microsoft logo down by the clock with a virus alert.” It wasn’t, but that was the message. This is on a recent vintage Dell box, XP Home, fully-patched, with antivirus and antispyware packages from one of the major companies. A yellow warning flag announced that “the system will now download and install more efficient antimalware program.” The bad English grammar was a bigger clue to the customer than anything else that this wasn’t normal.

Well, the yellow box was followed by a silent install of ContraVirus 2.0, which launched and started an apparent “scan” which resulted in “finding” 27 infections. I had the customer do an online spyware scan, which found and removed the problem, but it came back within a minute or two. Also had him uninstall ContraVirus from the add/remove list. That worked, too, but the flag came back, reinstalled, rescanned, and found the same infections each time, even though the system had been fully scanned by two other programs between the two CV “scans.”

OK, in the car, down the road… I had already looked up ContraVirus online–the reports describe it as either rogue antispyware, or being installed as a drive-by download by an affiliate. RogueRemover, from MalwareBytes.com, was said to take it out, so I took that with me, along with my usual software tools.


Screen capture, ContraVirus 2.0
Here’s what the screen looked like when I arrived.

Took a look… Yes, it’s really easy to remove this, or so it appears; it heals. Ewido.net’s online scan takes it out, or RogueRemover, or add/remove programs, but it won’t stay gone; it reinstalls in less than 4 minutes, immediately if an Internet Explorer window is opened; there’s a browser helper object involved.

HijackThis reported this:
O2 – BHO: IEExtension Class – {DBE5BEE8-F032-11DB-826A-C4BB56D89593}
– C:\Program Files\ContraVirus\secieaddin.dll
O3 – Toolbar: Ad-Protect Toolbar – {EA038DDD-0FE0-41f5-BA60-FC3660529E71}
– C:\Program Files\ContraVirus\ToolBand.dll

But this one appears to be the self-repair program:
O4 – HKLM\..\Run: [Windows Updater Servc]
C:\WINDOWS\system32\xpuupdate.exe

It was this xpuupdate.exe that RogueRemover and all the other cleanups missed. I ran a drive search for ‘xpuupdate’–there was also a reference in the prefetch folder. I moved the files off c:, ran one more cleanup immediately with RogueRemover and this time, the cleanup stayed cleaned.

Back to the computer owner: He recognized that the yellow popup box looked like a Microsoft message, and also thought the system tray icon was from Microsoft, but also knew that advertising message puffery and bad English isn’t quite what to expect in a legit warning message.