kichik.net

Our good old friend, NSIS Media, comes back for a second ride. As you know, the first ride is always free. It’s good for business. Nothing like a good promotion to draw new customers. But when you come over for a second ride, it won’t be cheap.

Right after I finished writing the last post, I was greeted with a nice pop-up suggesting I should get a green card. I was quite surprised I was infected with NSIS Media, because I only opened the installers on a Virtual PC. After a little meditation, mainly to cool myself, but also to dig in my memories, I recalled I opened one of the installers to take a screenshot. Foolishly, I assumed it’d only install this malware along with the program itself. How deep was my mistake to think they’d actually be that nice. The malware installed itself even before the first wizard page showed up. All doubt was removed. This software is pure evil.

I’ve taken several routes to bring this internet atrocity to an end. So far, the most fruitful route was based on a friend’s advice. I contacted Software Freedom Law Center to get their help sending a cease and desist letter to NSIS Media. In the process, I found out a lot interesting facts about NSIS Media. Like Openwares, they are located in Vanuatu, a Melanesian island which is, of course, outside of the USA. This means a cease and desist won’t affect them and so further research is required. This also raises the intresting question of NSIS Media’s owner. Both companies are based in Vanuatu and are hosted with aplus.net. As clearly stated in Openwares’ RSS and many other places, Openwares is owned by Opensoft Corporation which is making the web more interesting since 2001. It won’t be too far fetched to assume NSIS Media is also a part of this corporation, if not at least its best partner.

This corporate deserves a lot of credit. It has ripped off many open source programs and has plauged the web with Cydoor and NSIS Media malwares. A very paritial list follows.

• Openwares - distributing malware infected packages on download.com.
• Turbo Torrent - G3 Torrent rip off containing NSIS Media, but claiming to be adware free.
• Foxie - CCleaner rip off, Firefox look alike designed to fool people into thinking it’s the new Firefox everyone is talking about. There have also been reports of it packing NSIS Media, but I cannot confirm that. They claim to be based in Israel, however they are hosted on aplus.net, are linked from every Opensoft website and have Opensoft listed in their license as a contractor.
  

  U.S. Government Information Use, duplication, or disclosure by the U.S. Government of the computer and software documentation in this package shall be subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.277-7013 (Oct 1988) and FAR 52.227-19 (Jun 1987). The Contractor is Opensoft Corporation, Vanuatu.

• MP3 Shield - another Opensoft venture which is currently offline. Probably packed with NSIS Media as well and most probably a rip off.
• Startup Mechanic - calims to protect your PC but installs NSIS Media.

Now that we’ve gotten to know them, lets dig in and see how NSIS Media works. As I’ve previously said, NSIS Media “enhanced” installations include two DLL files installed into the system folder. The names vary, but the goal is always the same. The first, written using MSVC, leeches on just about every process in the system and loads the second. It is also responsible of installation and removal, according to strings that show up in it. The weird thing about this file is its PDB path which is always under c:\Cydoor_shell_project. Cydoor are reportedly out of this evil business, so I don’t quite know what to make of this. All DLL files have timestamps dating back to 2001, so it might be an old Cydoor DLL used to wrap NSIS Media. On the other hand, Opensoft claims to have established on 2001, but I doubt they still use the same DLL files.

The second DLL is far more interesting. It’s built using VB6 and contains an HTML page with the title Advertisment (typo in source) as resource. But there are no references to the C:\Program Files\Common Files\NSIS directory, nsis.jar, HKLM\Software\NSIS\Media or NSIS Media at all. The third DLL, miraculously installed into Common Files\NSIS along with an uninstaller contains no code. It only contains a resource named IID_NSIS which holds an unknown GUID. The uninstaller, as you might have guessed, doesn’t do much. It creates a new value called OptOut in HKLM\Software\NSIS\Media, unregisters the third DLL and finally deletes it along with the uninstaller. It also deletes a shell hook, according to the GUID found in the clsid value under its registry key.

So where does all the evil come from? I started digging in the second DLL, the VB6 DLL, looking for a URL. I found one string that raised my suspicion - @CDOQSAO:=ARB:ACPF:FQE@:QCE@=DSCBFR@. It was stored in Unicode and used in what seemed to be a key function in the code. However, it was not a URL. Notice how the colors repeat themselves and how many characters are in each block they separate. It’s a GUID. The distance between a colon and a hyphen is 13. Subtract 13 from each character and you get 367BDF4B-04E5-46C9-9D83-D68307F659E3. One Google search later and you see you’ve hit the jackpot. That GUID belongs to NSIS Media.

So I have a GUID, but what’s that good for? Lets try decoding the entire file and see if more shows up. That struck oil. In the decoded files, I found URLs, advertisement categories, registry paths, file paths, HTML and even JavaScript. There was also a list what seems to be potential hostile programs including Ewido, Grisoft, NOD32, Norman, Symantec, Panda and even Cydoor. Another list contained wildcards matching common advertisement servers like DoubleClick, probably so their ads can be replaced with NSIS Media ads.

But the most interesting list was the URL list. One URL in particular had most to tell. Its response contained my country code and another URL for a file located on msserv.net, another one of Opensoft’s websites. The name of the website and the content it tries to serve suggests it tries to make users believe it’s non other than Windows Update. Windows Update’s URL, by the way, is also listed in the second DLL. But it’s the file that’s hosted on msserv.com that I enjoyed the most. http://www.msserv.net/src/b3.bin is an installer, better described as an updater, containing two new NSIS Media DLL files. The two DLL files seem to share the same common pattern of the regular NSIS Media DLL files, but appear to be of a newer version, at least by examining the file sizes. Going to the original URL again, you get another installer name. I quickly saw the pattern is [ab][1-9].bin and downloaded them all.

Following is the complete list of NSIS Media’s new version DLL files along with their MD5 sum, for your malware removal needs. They are also available for download, but be careful with those.

04022272675cc56f1e68faa3fa2558b8 avtmskii.dll
0ff0930bb2ff743b212210471c725bc8 odbvgie.dll
15e63b822a0efede397ba9e7c8dbd02f usrwsh.dll
179164804cee71d62cd0f60d8f31735b kbdtdu2.dll
21e5ab0214714983584031e78c763aae wkcajax.dll
2c7b28b24cf717d8204b89a51a43c52d ftsash.dll
2dd9d642eb71eb541f51950c6ae0e5f5 nvritf.dll
2de5a9a086d0878abbd5259fe4f31787 rsvuaac.dll
2e3a6d1f71317faa094f2e7b427bb202 coltea.dll
2e7024c9f3dc91862e1b719d74e9f78f wshpwd32.dll
362b234f82ab4847ea14fcfe0bc07b33 nmmvti.dll
4322dbd9a120b0b6531a6d2c25bcbed3 mtxme2k.dll
5007f06b93defe72ff41c035cbaadc4a kbdrpo.dll
523a7424f94db5be34b33aecd2db32c5 nvredd.dll
59ecae29bdcccae85e8aff5718e55f2f dmubsi.dll
5aa56093a1e568c11a38264be0f4db7a wmiv3p.dll
5b850d909455d3062422f199c44445f2 mspksp2.dll
5fcbef5a137ee8ce3f5f615cb2e2d743 msjmme.dll
661f98df2ed0d7ba9997322248f01f46 ir4axb.dll
854b515f539f125fe4c9f4cdb01277f0 usrflx32.dll
8b4169f654be67be6f874a721c3919da avwmdm.dll
a27e788246ebb3fb59173594d314fd33 dsaoms.dll
a59bc64fb9f97934d20bccdbf346bce4 mswbst.dll
a8a1bb4bf6a67df2a2a24791b0605703 dspvfx.dll
a94db9a1ed0cfe9d807bec7407bef85a cfgsle.dll
aecc2a0fc2e9efa22f979f93ad3b5820 ieaean.dll
b1bbd68d3472ae8bb242f7fa6de00f76 ncxpri.dll
bd9cd45321c46cb7565553a1869ba19a wpdccmo.dll
c2e811707d1898d00a897802bea144ee atmkmsa.dll
c57b55771515280a8e93fabfea00928d adsusv32.dll
cac34a21c3957f118cff2fc4f43b555d lochsh32.dll
da4987053dc52f7ee9b1e70c62f7daa0 actsdr.dll
db69afb5e34af7aba15c2984bd582a31 mfctsa.dll
dd6ec5013c437ac0e86d17ab66e37854 audes2e.dll
e4b4747e461d39695722d07154dbdbb2 swpxa52u.dll
f3ee10c331a81188385e47e851ae3079 minsv32.dll

So what have we learned today?

1. NSIS Media and Opensoft are pure evil.
2. Cydoor might still be up to no good.
3. kichik still doesn’t make 1000$ a day

I’ve been providing support online for a few years, mainly for my projects. Someone asks a nice challenging question, you dig in a little, possibly find a bug and fix it, give the user his answer get a nice little thank you and you’re on your way to the next question. Sadly, that ideal is far from being the reality for most questions. Most of the time questions repeat themselves, lack any challenge, lack too much information or asked in an irritable manner. Inspired by the effective bug reporting and smart questions guides, I decided to write my own version. Initially, I wanted to go with the ten commandments, but I didn’t quite see how I could fit “honor your father and mother” in. So, without further ado, I hereby present the seven deadly sins of questioning.

Lust

Moms are smart, that’s a known fact. However, they’re not always right. Especially on so called facts that contain the notorious pair of words “most important”. Breakfast is not the most important meal of day as it’s usually aimed at herbivores and you are not the most important person in the world. Nothing you ask is urgent unless other lives are at stake. There’s nothing to get passionate about. Nothing will happen if you don’t get your answer right away. Armageddon will continue lingering and your mom will still be there for you with her “most important” slogans. So chill. “Urgent” questions and vivid descriptions of how amazing your question is will not get you an answer faster.

Gluttony

Ideally, when stumbling upon an issue, you look around a bit before asking a question. You seek the solution, try to find out what’s wrong, collect as many details as you can until two or more click and you find the solution. Nothing clicks? Time to ask someone else? Don’t skimp on the details, add as many as you can. Gathering them all and then keeping them to yourself doesn’t help anybody and most certainly doesn’t help you. At the very least, describe a method of reproduction of the issue. Even the most talented support champion can’t help you with an issue that can’t be seen or described in words. Even Don Quixote had his windmills to fight.

Greed

Knowledge is power, everybody knows that. It’s only reasonable to keep it to yourself, to keep your prestigious stand. So, if after asking a question, you find the answer yourself, why bother sharing? In fact, why not ask a lot of questions and then come back later to say you solved them all by yourself? Instant self-proclaimed hotshot. Power overwhelming. Guru.

So why ask in the first place? Why be a burden? If you’re going to frustrate people by answering yourself before they get a chance or even while they’re trying to politely answer your question, at least share your findings. Even if all it took was that little search you were too lazy to do, share it so your question will rise up from its cyberspace waste status. You may even get a better solution from a true guru, or the average curious John Doe who simply knows better on your specific issue. If you don’t share, why would anyone want to share with you? P2P networks has a lot to teach us in this case.

Sloth

Time is money. Asking for something that can be easily obtained, like questions from a FAQ or searchable questions wastes your time while waiting for the answer and the other side’s time while searching for you. Search engines have been invented for a reason, FAQ pages were not written in vein and documentation files may rot, but shouldn’t be abandoned.

Even if the search comes out empty, there are other ways. Show a bit of self competence, try solving the problem yourself. Isolate the problem, test on different platforms, observe differences that cause the problem to appear, broaden your search and guess a little. You can’t expect the other side to do all the work for you. At the very least, your tests will help the other side finding the solution faster. Lazy questions inspire lazy answers.

The most annoying type of sloth is the ever so lazy request of “do it for me”. Some ask it right out, occasionally attaching a job half done, a very lacking description of things that don’t work, usually with a very descriptive “not working” text. Some simply refuse to understand the solution until it comes in the form of a full fledged example. Then, seeing as their laziness has paid off, they’ll move on to the next issue and once again stumble upon a great obstacle they can’t possibly overcome without yet another example.

Wrath

Raging and screaming won’t help you get your answer faster. It’ll only get the other side angry and unwilling while wasting your time on being calmed down. Frustrated? Upset? Furious? Leave the computer. Go meditate or something… Come back after you’ve found nirvana and everything will look better. You might even find the problem on yourself, now that you have more blood running into your brain instead of your fists.

Envy

Been waiting a while? Someone got an answer before you? Forget about the green monster. Go get some tea, sit back and relax. Posting your question in more places where “others got an answer” will only get others annoyed and confused. Which post is the newest? Where do I want to answer? Do I even want to answer and encourage this guy to post his question a zillion times and litter my beautiful piece of heaven? You should spend your time on trying to get more details for your problem instead of getting upset and confusing others.

Pride

Until proven otherwise, you don’t know best. If the computer, application or programmer’s fault is in your axiom list, you’re doomed. You’ll never find your answer by assuming it’s not your fault. Even if the problem you’re seeing is caused by a bug, you’ve triggered this bug somehow. Assuming the fault lies solely outside your reach will only get you frustrated and get you farther from redemption.

Have a little modesty, just as you’d except the other side to have. Pride is an epidemic. It rapidly infects all parties and consumes all hope of a solution, sending your time right down the drain. Declaring you know best right of the start, stating exactly what’s a right and what’s wrong, will force the other side into a defense from which you’ll have a hard time getting your answer.

Still think you know it all? Found the bug that no one else found? Do you really think such a huge bug would go unnoticed by so many people? If you are so certain, you must have a lot of information to back your claim. Post that information or face the immanent failure of finding a solution.

Imagine you had an application that gets over 1,000 downloads a day. Imagine that this application’s soul purpose is to create other applications. Imagine those applications are distributed by you users, some bigger some smaller. Imagine those derived applications get downloaded over 1,000,000 times a day. Feeling good yet?

Now imagine someone would offer you 0.001$ for each user that opens one of those derived applications. That’s over 1,000$ a day. 30,000$ a month. 360,000$ a year. Perfect, ain’t that right? You’re sitting on your porch, a beer in your hand, music in the background and the skies are raining green bills. Does it get any better?

Sounds too good to be true? How about we dig in a little? Say, mister money pants… What exactly do I have to do for this money? “Nothing really”, he responds. “All you have to do is include our little library in every derived application your application creates”, he adds. Move a little uncomfortably in your chair and he’ll satisfy you, “it just gives the user nice and unobtrusive advertisements specifically targeted at him”. Sold yet? I sure am!

So you decide to wrap it up. But you still feel a little bit uncomfortable with it. Maybe because you don’t want people to know you’re making money of your free software, or maybe because you still don’t trust this guy too much. What do you do? You move his library a bit further. Assuming your application is called XYZ, you pack money pants’ library into XYZ Media which will be silently installed by your application’s derived applications. No one will know it’s you now. It’s ingenious!

Best deal ever? Right? You dig? Well? No? Why? Come on… You with me or what? Of course not. Why would I ever want to do something like that?

1. My software is not only free, it’s open-source and is freely hosted on SourceForge. It costs me nothing but time. I’ve got no bills to cover.
2. I’ve got a job, I don’t need an additional income. I’ve also had my share of incomes from the free software, without the need for deals like that.
3. It’s completely evil. Besides forfeiting my ever-elusive seat in heaven, it’d also send my software right down the drain. Even if I remove XYZ Media later, no one will ever want to use it again. 1,000 downloads a day? Try one closed project.

As you’ve probably already guessed, I’m talking about NSIS and NSIS Media. NSIS Media is an extremely annoying adware package, or so reports say. It installs itself on both Internet Explorer and Firefox. On Firefox, it installs an extension with a file named NSIS.jar. These browser extensions pop-up advertisements titled “NSIS Media Advertisement” for the user at what appears to be random times. It shows an uninstaller in the Add/Remove control panel, but as long as the carrier program is installed, it’ll just come back.

According to reports online, it comes with eMule++ and every download from Openwares. The eMule++ installer and each installer I have downloaded from Openwares install two DLLs to the Windows directory. DLL names include wmidext.dll winsdrv.dll, msxmlu.dll and even nvrssid.dll pretending to be shell extension of nVidia. As you can see, it doesn’t really smell too good. But as can be seen in the picture below, it does ask the user for permission, at least with the original eMule++ installer.

In Openwares installers, on the other hand, there is no such page. So what is this Openwares? It’s a company that would, at least according to their front page, freely repackage your installer with NSIS, publish it on their website and on CNet’s Download.com. The latter seems to be most fertile ground for their deployment.

So is it evil or not? The eMule++ installer page might suggest it’s not. So does NSIS Media’s website, especially the uninstall page. But do they enforce this installer page on all of their partners? It doesn’t seem like they care too much for Openwares’ installers which seem to be pretty wide spread. Add the weird DLL naming and the very peculiar company name choice; and one thing you won’t get is positive credit. More specimens, outside of Openwares, or a direct contact at NSIS Media are required to determine the true nature of the beast.

But we’re not here to discuss the business affairs of this advertisement company. We have gathered here today to discuss my righteousness. Some people actually think I’m responsible for this mess. Probably some just Google up “NSIS” and find my e-mail address as the first result. But some people actually believe I’m behind this abomination. I got everything from polite requests for removal instructions to death threats. My favorites follow.

“As you can see, I am an IBM employee. Somehow the NSIS Media Trojan Horse has invaded my system. Please promptly send me instructions on how to remove it so that I don’t have to report this issue to IBM Legal.”

“CUT THE CRAP (read: spy-ware) !!!” (this one is actually longer, I trimmed it a bit…)

Some even plot a NSIS-Firefox grand conspiracy in their heads.

“Why there is no info on the Firefox / NSIS spyware scandal? Some malicious code installs into Firefox browsers and Thunderbird mail clients via JAR files by abusing a yet unpatched NSIS security hole and the bombards the user with many pop-up windows and downloads further spyware. The Net is up in arms about it, especially in Europe, where Firefox has 20% share in browsing. Firefox developers accuse NSIS developers of indifference and lazyness in fixing.”

All of the above and many more like those, got the appropriate response in the lines of “NSIS is not NSIS Media, go away”. Poor saps, fooled three times in a row. The first time, they’ve downloaded their application of choice from a bad source. Next, they miss the warning signs in the installer or all of those privacy statements. And finally, when reality pops-up in their faces, they miss the word “media” and blame yours truly.

So what have we learned today?

1. NSIS Media is in no way related to NSIS.
2. Download only from trusted sources and read carefully what the installer tells you.
3. kichik doesn’t make 1000$ a day

Pah! I just got this cool Quake flag from a friend. It ownz!

Bet that won’t help my rails, since I’ll be looking at it all the time. Still have to figure out where to hang it… Probably not too close to the screen

Click on the image on the left for a bigger version.

I went to see Fearless today. It’s nice, nothing too special. I can’t say I had a great time though. There’s just something about movie theaters that repeals me lately.

The video quality sucks. I keep seeing crackles, brown spots used to prevent ripping and black lines — early 90’s TV style. The sound quality isn’t that amazing as well. Not as rarely as I’d hope, it seems as if the non-existent computer playing the movie is passing its quota of CPU power. The surround speakers set also seems to go unused too many times. Should I even mention prices?

But I can live with all that for the big screen, the uninterrupted volume and the comfy seats. You pay for the experience just like with anything else. You pay, others pay, you get together and enjoy the goods. But some people reckon it’s not enough to keep the joy to themselves. They must share it with their friends. Loudly. Since when did it become a norm to talk in movie theaters?! Why do I have to find myself a new seat just so I can enjoy the movie quietly? Even after several undeserved polite requests, the noise just keeps on coming from every direction.

And they say piracy is the number one reason for diminishing profits…

On the way home today, I passed through several crosswalks. It was late, I was hungry, the bus was already waiting in the station and I missed every green light by a few seconds. Four good enough reasons for good old jaywalking, but I decided to be a good boy and wait. But it was worth it. When standing in the long line for the bus, with a recently acquired sandwich in my hand, I looked back and saw two cops come out of a rented car (illegally) parked right next to the last crosswalk I passed and start talking to two guys who failed the color test.

What’s the big deal with nuclear weapons? What’s with everybody wanting them lately? What’s wrong with plain old explosives? Far be it from me to understand the costs of either choice, but it does seem somewhat fair to assume that they are cheaper to produce and maintain. The warheads might be lighter due less mechanism requirements. So the rockets can go further or simpler rockets can be used. But even if the same rockets are needed, it’s still less research and development because more information is available, more professionals are in the neighborhood and it’s much easier to get around the airports in your handbag because everybody’s focus is on the nuclear weapons. Even more, “conventional” weapons (what’s with that distinction anyway?) are safer to keep around as there’s no radiation so there’s no need for as much shielding. If it’s cheaper and faster to produce, there’s an option to produce much more warheads. This allows spreading the attack wider and makes it harder on defense as it’ll need many more defensive missiles / rockets / guns / shelters / whatever. The fact is, I can never know which one is more efficient because I don’t have all the details.

That’s the problem with all of those “secret” stuff. You can never get the details you need to make your own calculations. You always have to trust the politicians that say they have the facts. But you can’t even be sure they have the facts. In fact, opposing politicians always claim to their thesis is correct according to the facts. Some even claim to the same facts but derive different conclusions, which they conveniently call facts.

I am not sure I want all the facts of nuclear weapons freely available, but sometimes, even with simpler stuff, the secrecy overextends. Sometimes it seems like freedom of information only concerns keeping information already freely available as it is. I remember trying to figure out how come a local tax-funded television channel keeps buying new big-shot series no other channel has, right as their season ends in the USA. I had to use connections to get a “don’t worry, the prices are suitable” accompanied with a reasonable explanation why a tax-funded channel should have such series. I was kindly reminded our country is semi-socialistic and that even people who can’t or won’t pay for cable should get quality television. But we’re also semi-democratic, so why can’t I can get a copy of the budget? Though I have to be honest - I probably didn’t try hard enough.

Tyler from Microsoft has contacted me about my Vista bug report. He said he’ll open an internal bug report for it, but can’t promise it’d be fixed before RTM. In the mean time, newer versions of NSIS will include the manifest so no problems should come up with them.

While working on a new NSIS header file to properly handle Windows versions, I thought of something really cool. The LogicLib is a cool library dselkirk and eccles wrote a long time ago. It allows you to avoid using labels, Goto, StrCmp, IntCmp, relative jumps and other cool beans. Instead, you get a bunch of macros wrapped in defines that make your life so much easier.

${If} $0 == "good"
DetailPrint "it's not evil"
${EndIf}

It struck me while I was thinking of the interface I want to use for the new version checking stuff, I originally started with a function taking an argument. However, functions and header files don’t work too well together. A warning is spewed, if the function isn’t used. The code was also meant to be short, as there isn’t too much to do. So, combine those two together and of course you get macros. But what will the macro get? Labels to jump to? What if the user passes relative jumps? What if the user wants to skip a label definition and just jump to the next line? Why can’t it be like LogicLib? Because these checks don’t fit into LogicLib.nsh? So what? Why can’t I define more tests for LogicLib? Who said I can’t? I can.

And it turns out adding more tests to LogicLib is quite easy as well. Just define a macro with a name prefixed with an underscore and give it four parameters. Two operands and jump labels for true and false. The LogicLib will handle creating the labels and all that is left for this little macro is the actual test.

!macro _= _a _b _t _f
IntCmp `${_a}` `${_b}` `${_t}` `${_f}` `${_f}`
!macroend

The end result is quite cool. Instead of yet another new interface for another functionality, there are just a few new operators for LogicLib.

${If} ${AtLeastWin2000}
DetailPrint "2000 or better. Fun!"
${EndIf}

The new code is available on CVS for your eager browsing. Crave code. Craving is good.

Stargate is off for “fall break”. Seasons of 4400, The Shield and House have all ended. Nothing to watch on TV anymore. Well, except for the news, but that show has been airing reruns for so long it’s a arguably laughable. Now and then they find something semi-new, like the latest Thai coup. But overall, it’s almost always the same episodes over and over again.

If already on the subject, does the completion of “Carter & McKay’s intergalactical bridge” mean SG-1 will finally see some digital stargates? And is it just me or 4400 is becoming more and more X-men’ish with each passing episode? Too bad for Kenny Johnson, I think he really liked the first episode…

Well, more time for rest & recreation or beer & beach I guess… Too bad summer is on the brink of destruction almost over.