|
Experts are warning that hackers have yet to activate the payload of the Conficker virus.
The worm is spreading through low security networks, memory sticks, and PCs without current security updates.
The malicious program - also known as Downadup or Kido - was first discovered in October 2008.
Although the spread of the worm appears to be levelling off, there are fears someone could easily take control of any and all of the 9.5m infected PCs.
Speaking to the BBC, F-Secure's chief research officer, Mikko Hypponen, said there was still a real risk to users.
"Total infections appear to be peaking. That said, a full count is hard, because we also don't know how many machines are being cleaned. But we estimate there are still more than 9m infected PCs world wide.
"It is scary thinking about how much control they [a hacker] could have over all these computers. They would have access to millions of machines with full administrator rights.
"But they haven't done that yet, maybe they're scared. That's good news. But there is also the scenario that someone else figures out how to activate this worm. That is a worrying prospect."
Experts say users should have up-to-date anti-virus software and install Microsoft's MS08-067 patch. The patch is known as KB958644.
 |
 Even having the Windows patch won't keep you safe
|
Speaking to the BBC, Graham Cluley, senior technology consultant with anti-virus firm Sophos, said the outbreak was of a scale they had not seen for some time.
"Microsoft did a good job of updating people's home computers, but the virus continues to infect business who have ignored the patch update.
"A shortage of IT staff during the holiday break didn't help and rolling out a patch over a large number of computers isn't easy.
"What's more, if your users are using weak passwords - 12345, QWERTY, etc - then the virus can crack them in short order," he added.
"But as the virus can be spread with USB memory sticks, even having the Windows patch won't keep you safe. You need anti-virus software for that."
Method
According to Microsoft, the worm works by searching for a Windows executable file called "services.exe" and then becomes part of that code.
It then copies itself into the Windows system folder as a random file of a type known as a "dll". It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.
Once the worm is up and running, it creates an HTTP server, resets a machine's System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker's web site.
Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down.
But Conficker does things differently.
|
Right now, we're seeing hundreds of thousands of [infected] unique IP addresses
|
Anti-virus firm F-Secure says that the worm uses a complicated algorithm to generate hundreds of different domain names every day, such as mphtfrxs.net, imctaef.cc, and hcweu.org. Only one of these will actually be the site used to download the hackers' files. On the face of it, tracing this one site is almost impossible.
Variant
Speaking to the BBC, Kaspersky Lab's security analyst Eddy Willems said that a new strain of the worm was complicating matters.
"There was a new variant released less than two weeks ago and that's the one causing most of the problems," said Mr Willems
"The replication methods are quite good. It's using multiple mechanisms, including USB sticks, so if someone got an infection from one company and then takes his USB stick to another firm, it could infect that network too. It also downloads lots of content and creating new variants though this mechanism.
"Of course, the real problem is that people haven't patched their software," he added.
Microsoft says that the malware has infected computers in many different parts of the world, with machines in China, Brazil, Russia, and India having the highest number of victims.
Source:news.bbc.co.uk/2/hi/technology/7832652.stm
Today I was required to implement detecting the idle time or user inactivity in windows form. Here it is how it works
The theme behind is the usage of MessageFiler that will be intercepting calls (Keyboard / Mouse activities) and usage of System.Windows.Forms.Timer
Step 1.
Create MessageFilter class as
using System;
using System.Windows.Forms;
public class MessageFilter : IMessageFilter
{
//Following are the Windows API hex values. You can find more at http://faisalmb.com/blog/post/2009/01/Values-of-Windows-API.aspx
// Here we are only interested in only Keyboard and Mouse activities
private int WM_LBUTTONDOWN = 0x0201;
private int WM_KEYDOWN = 0x0100;
private int WM_RBUTTONDOWN = 0x0204;
private int WM_MBUTTONDOWN = 0x0207;
private int WM_MOUSEWHEEL = 0x020A;
private int WM_MOUSEMOVE = 0x0200;
public bool PreFilterMessage(ref Message m)
{
if (m.Msg == WM_MOUSEMOVE || m.Msg == WM_KEYDOWN || m.Msg == WM_LBUTTONDOWN || m.Msg == WM_MOUSEWHEEL || m.Msg == WM_RBUTTONDOWN || m.Msg == WM_MBUTTONDOWN)
{
//Reset the timer of form1
Form1.timerIdle.Stop();
Form1.timerIdle.Start();
}
return false;
}
}
Step 2:
In the form where you actually want to implement what to do if user is inactive for particular period, like redirecting to Login page, performing Session / objects cleanup, hiding or locking touchy form etc etc, put following peace of code,
a) Declare static timer as
//Reason for taking this timer as static becasue we need to reset timer in MessageFilter class.
//If don't want to use static then you can implement your own logic. The theme is to reset the timer in MessageFilter on any Keyboard or Mouse activity
internal static Timer timerIdle;
b) Put following initializing code after InitializeComponent or on Form_Load. Note to set Interval of timer to your requirement. Here it is set for 5 minutes.
timerIdle = new System.Windows.Forms.Timer();
timerIdle.Enabled = true;
timerIdle.Interval = 50000; // Idle time period. Here after 5 minutes perform task in timerIdle_Tick
timerIdle.Tick += new EventHandler(timerIdle_Tick);
c) Put following inside your form
private void timerIdle_Tick(object sender, EventArgs e)
{
//Here perform your action by first validating that idle task is not already running.
// If you want to redirect user to login page, then first check weather login page is already displayed or not
// if not then show loign page. Same logic for other task or Implement your own.
// Remember after every five minutes or period you defined above this timerIdle_Tick will be called
//so first check weather idle task is already running or not. If not then perform
//if (Login.Visible == false)
//{
//PerformNecessoryActions();
//ShowLoginForm();
//}
}
Step 3.
So far we have created MessageFilter class (On keyboard or mouse activity it will reset the timer of form). In form we have declared and initialize timer. On timer_Tick event we have implement the task which we need to do when user become inactive for particular period of time. Now in last step, Add our MessageFilter class in Application to intercept calls as
static void Main(string[] args)
{
Application.AddMessageFilter(new MessageFilter());
Application.Run(new Form1());
}
Hope it helps.
WM_NULL = 0x0000,
WM_CREATE = 0x0001,
WM_DESTROY = 0x0002,
WM_MOVE = 0x0003,
WM_SIZE = 0x0005,
WM_ACTIVATE = 0x0006,
WM_SETFOCUS = 0x0007,
WM_KILLFOCUS = 0x0008,
WM_ENABLE = 0x000A,
WM_SETREDRAW = 0x000B,
WM_SETTEXT = 0x000C,
WM_GETTEXT = 0x000D,
WM_GETTEXTLENGTH = 0x000E,
WM_PAINT = 0x000F,
WM_CLOSE = 0x0010,
WM_QUERYENDSESSION = 0x0011,
WM_QUIT = 0x0012,
WM_QUERYOPEN = 0x0013,
WM_ERASEBKGND = 0x0014,
WM_SYSCOLORCHANGE = 0x0015,
WM_ENDSESSION = 0x0016,
WM_SHOWWINDOW = 0x0018,
WM_CTLCOLOR = 0x0019,
WM_WININICHANGE = 0x001A,
WM_SETTINGCHANGE = 0x001A,
WM_DEVMODECHANGE = 0x001B,
WM_ACTIVATEAPP = 0x001C,
WM_FONTCHANGE = 0x001D,
WM_TIMECHANGE = 0x001E,
WM_CANCELMODE = 0x001F,
WM_SETCURSOR = 0x0020,
WM_MOUSEACTIVATE = 0x0021,
WM_CHILDACTIVATE = 0x0022,
WM_QUEUESYNC = 0x0023,
WM_GETMINMAXINFO = 0x0024,
WM_PAINTICON = 0x0026,
WM_ICONERASEBKGND = 0x0027,
WM_NEXTDLGCTL = 0x0028,
WM_SPOOLERSTATUS = 0x002A,
WM_DRAWITEM = 0x002B,
WM_MEASUREITEM = 0x002C,
WM_DELETEITEM = 0x002D,
WM_VKEYTOITEM = 0x002E,
WM_CHARTOITEM = 0x002F,
WM_SETFONT = 0x0030,
WM_GETFONT = 0x0031,
WM_SETHOTKEY = 0x0032,
WM_GETHOTKEY = 0x0033,
WM_QUERYDRAGICON = 0x0037,
WM_COMPAREITEM = 0x0039,
WM_GETOBJECT = 0x003D,
WM_COMPACTING = 0x0041,
WM_COMMNOTIFY = 0x0044 ,
WM_WINDOWPOSCHANGING = 0x0046,
WM_WINDOWPOSCHANGED = 0x0047,
WM_POWER = 0x0048,
WM_COPYDATA = 0x004A,
WM_CANCELJOURNAL = 0x004B,
WM_NOTIFY = 0x004E,
WM_INPUTLANGCHANGEREQUEST = 0x0050,
WM_INPUTLANGCHANGE = 0x0051,
WM_TCARD = 0x0052,
WM_HELP = 0x0053,
WM_USERCHANGED = 0x0054,
WM_NOTIFYFORMAT = 0x0055,
WM_CONTEXTMENU = 0x007B,
WM_STYLECHANGING = 0x007C,
WM_STYLECHANGED = 0x007D,
WM_DISPLAYCHANGE = 0x007E,
WM_GETICON = 0x007F,
WM_SETICON = 0x0080,
WM_NCCREATE = 0x0081,
WM_NCDESTROY = 0x0082,
WM_NCCALCSIZE = 0x0083,
WM_NCHITTEST = 0x0084,
WM_NCPAINT = 0x0085,
WM_NCACTIVATE = 0x0086,
WM_GETDLGCODE = 0x0087,
WM_SYNCPAINT = 0x0088,
WM_NCMOUSEMOVE = 0x00A0,
WM_NCLBUTTONDOWN = 0x00A1,
WM_NCLBUTTONUP = 0x00A2,
WM_NCLBUTTONDBLCLK = 0x00A3,
WM_NCRBUTTONDOWN = 0x00A4,
WM_NCRBUTTONUP = 0x00A5,
WM_NCRBUTTONDBLCLK = 0x00A6,
WM_NCMBUTTONDOWN = 0x00A7,
WM_NCMBUTTONUP = 0x00A8,
WM_NCMBUTTONDBLCLK = 0x00A9,
WM_KEYDOWN = 0x0100,
WM_KEYUP = 0x0101,
WM_CHAR = 0x0102,
WM_DEADCHAR = 0x0103,
WM_SYSKEYDOWN = 0x0104,
WM_SYSKEYUP = 0x0105,
WM_SYSCHAR = 0x0106,
WM_SYSDEADCHAR = 0x0107,
WM_KEYLAST = 0x0108,
WM_IME_STARTCOMPOSITION = 0x010D,
WM_IME_ENDCOMPOSITION = 0x010E,
WM_IME_COMPOSITION = 0x010F,
WM_IME_KEYLAST = 0x010F,
WM_INITDIALOG = 0x0110,
WM_COMMAND = 0x0111,
WM_SYSCOMMAND = 0x0112,
WM_TIMER = 0x0113,
WM_HSCROLL = 0x0114,
WM_VSCROLL = 0x0115,
WM_INITMENU = 0x0116,
WM_INITMENUPOPUP = 0x0117,
WM_MENUSELECT = 0x011F,
WM_MENUCHAR = 0x0120,
WM_ENTERIDLE = 0x0121,
WM_MENURBUTTONUP = 0x0122,
WM_MENUDRAG = 0x0123,
WM_MENUGETOBJECT = 0x0124,
WM_UNINITMENUPOPUP = 0x0125,
WM_MENUCOMMAND = 0x0126,
WM_CTLCOLORMSGBOX = 0x0132,
WM_CTLCOLOREDIT = 0x0133,
WM_CTLCOLORLISTBOX = 0x0134,
WM_CTLCOLORBTN = 0x0135,
WM_CTLCOLORDLG = 0x0136,
WM_CTLCOLORSCROLLBAR = 0x0137,
WM_CTLCOLORSTATIC = 0x0138,
WM_MOUSEMOVE = 0x0200,
WM_LBUTTONDOWN = 0x0201,
WM_LBUTTONUP = 0x0202,
WM_LBUTTONDBLCLK = 0x0203,
WM_RBUTTONDOWN = 0x0204,
WM_RBUTTONUP = 0x0205,
WM_RBUTTONDBLCLK = 0x0206,
WM_MBUTTONDOWN = 0x0207,
WM_MBUTTONUP = 0x0208,
WM_MBUTTONDBLCLK = 0x0209,
WM_MOUSEWHEEL = 0x020A,
WM_PARENTNOTIFY = 0x0210,
WM_ENTERMENULOOP = 0x0211,
WM_EXITMENULOOP = 0x0212,
WM_NEXTMENU = 0x0213,
WM_SIZING = 0x0214,
WM_CAPTURECHANGED = 0x0215,
WM_MOVING = 0x0216,
WM_DEVICECHANGE = 0x0219,
WM_MDICREATE = 0x0220,
WM_MDIDESTROY = 0x0221,
WM_MDIACTIVATE = 0x0222,
WM_MDIRESTORE = 0x0223,
WM_MDINEXT = 0x0224,
WM_MDIMAXIMIZE = 0x0225,
WM_MDITILE = 0x0226,
WM_MDICASCADE = 0x0227,
WM_MDIICONARRANGE = 0x0228,
WM_MDIGETACTIVE = 0x0229,
WM_MDISETMENU = 0x0230,
WM_ENTERSIZEMOVE = 0x0231,
WM_EXITSIZEMOVE = 0x0232,
WM_DROPFILES = 0x0233,
WM_MDIREFRESHMENU = 0x0234,
WM_IME_SETCONTEXT = 0x0281,
WM_IME_NOTIFY = 0x0282,
WM_IME_CONTROL = 0x0283,
WM_IME_COMPOSITIONFULL = 0x0284,
WM_IME_SELECT = 0x0285,
WM_IME_CHAR = 0x0286,
WM_IME_REQUEST = 0x0288,
WM_IME_KEYDOWN = 0x0290,
WM_IME_KEYUP = 0x0291,
WM_MOUSEHOVER = 0x02A1,
WM_MOUSELEAVE = 0x02A3,
WM_CUT = 0x0300,
WM_COPY = 0x0301,
WM_PASTE = 0x0302,
WM_CLEAR = 0x0303,
WM_UNDO = 0x0304,
WM_RENDERFORMAT = 0x0305,
WM_RENDERALLFORMATS = 0x0306,
WM_DESTROYCLIPBOARD = 0x0307,
WM_DRAWCLIPBOARD = 0x0308,
WM_PAINTCLIPBOARD = 0x0309,
WM_VSCROLLCLIPBOARD = 0x030A,
WM_SIZECLIPBOARD = 0x030B,
WM_ASKCBFORMATNAME = 0x030C,
WM_CHANGECBCHAIN = 0x030D,
WM_HSCROLLCLIPBOARD = 0x030E,
WM_QUERYNEWPALETTE = 0x030F,
WM_PALETTEISCHANGING = 0x0310,
WM_PALETTECHANGED = 0x0311,
WM_HOTKEY = 0x0312,
WM_PRINT = 0x0317,
WM_PRINTCLIENT = 0x0318,
WM_HANDHELDFIRST = 0x0358,
WM_HANDHELDLAST = 0x035F,
WM_AFXFIRST = 0x0360,
WM_AFXLAST = 0x037F,
WM_PENWINFIRST = 0x0380,
WM_PENWINLAST = 0x038F,
WM_APP = 0x8000,
WM_USER = 0x0400,
WM_REFLECT = WM_USER + 0x1c00
Just a thought,
Jis mulk ki valuable and hardworking youth ko abondan kia jaye us mulk ka Allah hi hafiz hay....
Clips of Geo English Memories... yaadain yaad ati hain...
In first sight you will not see PasswordChar property in ToolStripTextBox.
If you want Password char in ToolStripTextBox and To allow ToolStripTextBox to act as Password textbox like * do following
ToolStripTextBox1.TextBox.PasswordChar = '*';
===========================
Usually ToolStripTextBox.Focus() doesn't focus to ToolStripTextBox when opening form or on form load.
To set focus on ToolStripTextBox when opening form or form load, do following
In FOrm1_Activated event
private void Form1_Activated(object sender, EventArgs e)
{
ToolStripTextBox1.Focus();
}
Or
on Form1_Load event
this.ActiveControl = ToolStripTextBox1.Control;
In windows form, if you don't want user to close the form by pressing Alt+F4 or Cross (x) button accidently and without saving existing form status, you may need to capture the form close event.
In the FormClosing event of form, FormClosingEventArg has a property called CloseReason. This is very usefull because if you want the Form to stop closing if the closing reason was CloseReason.UserClosing or some thing else.
You can do e.Cancel = true to prevent form being closed, then do something in your code and finally close the form programatically.
e.g.
private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
e.Cancel = true;
//Check the status of form, Save form status if required or other logic
this.Close();
}
In windows form, if you have richtextbox or multiline textbox then usually enter key use to enter a new line.
But if AcceptButton property of Form is set for some action/button press, then pressing enter key in richtextbox or multiline textbox doesn't enter a new line rather AcceptButton calls.
To supress this set the property AcceptsTab to true in richtexbox. In case of multiline textbox / control set AcceptsReturn and AcceptTab property to true.
Tonight in windows form, using C# language I required to use key combination like we use Ctrl+S to save form, CTRL+F to find etc.
In windows form, its quite easy. Just enable KeyPreview property to true. This property makes the form get the key events before the controls, so you can set the KeyPress event on the form.
Form1.KeyPreview = true;
After that, set the form event for the keypress/key down
this.KeyDown += new KeyEventHandler(this.Form1_KeyDown);
Now shortcut part comes here, follow like this
private void Form1_KeyDown(object sender, KeyEventArgs e)
{
if (Control.ModifierKeys == Keys.Control && e.KeyCode == Keys.S)
{
//SaveData();
}
else if (Control.ModifierKeys == Keys.Control && e.KeyCode == Keys.F)
{
//Find();
}
}
Hope it helps some one.
Washington: People throws shoes at White House against the war policies of Bush and asks for accoutablity of Bush actions.
Source : jang.com.pk/jang/jan2009-daily/20-01-2009/update.htm#01
War on Gaza Annie Lennox Shaken To The Core Sky News
Annie Lennox (born 25 December 1954) is a Scottish musician, vocalist and Academy Award-winning songwriter
|
|