Viral NetScheduleJobAdd

Something unrecognized started showing Internet Explorer based popups… Obviously it is of a viral source, there is an executable with arbitrary eight character name created in %WINDIR%\system32 which also uses NetScheduleJobAdd to add a number of delayed start job to launch Internet Explorer and navigate to free lotto, diversity visa and other advertised websites. Google search on NetScheduleJobAdd, however, did not give any matching description for a known virus, trojan or malware. Fresh AdAware is also not yet aware…

Update 1: Similar symptoms described here in German.

Update 2: I started Process Monitor to record creation of a new file in %WINDIR%\system32 to find out where it comes from on next re-spawning of the popup. It took some time to wait and here it goes. There was again an IE popup and new AT/Scheduled Task entries. A new process %WINDIR%\dnQS28v6.exe was started. The image was created by another process gC5AHp1a.exe from user’s Temp which was already terminated and the file was deleted to the moment. Still logs are here.

The process gC5AHp1a.exe was created by… Mozilla Firefox 3! None of the DLLs loaded into Firefox process look suspicious.

Update 3: Firefox 3.0.1 available, fixed security issues.

How To: Implement DirectShow Filter using DirectX Media Object DMO (Part 2: Video Processing)

Previously on the topic:

We have the DMO filter project compilable and registered with the system and it is right time to start putting code in that allows connecting the filter to other DirectShow filters, such as video capture or video file source on the input and video renderer on the output.

IMediaObject implementation includes the following groups of functions:

  • object capabilities:
    STDMETHOD(GetStreamCount)(DWORD* pnInputStreamCount, DWORD* pnOutputStreamCount)
    STDMETHOD(GetInputStreamInfo)(DWORD nInputStreamIndex, DWORD* pnFlags)
    STDMETHOD(GetOutputStreamInfo)(DWORD nOutputStreamIndex, DWORD* pnFlags)
    STDMETHOD(GetInputType)(DWORD nInputStreamIndex, DWORD nTypeIndex, DMO_MEDIA_TYPE* pMediaType)
    STDMETHOD(GetOutputType)(DWORD nOutputStreamIndex, DWORD nTypeIndex, DMO_MEDIA_TYPE* pMediaType)
  • current media types:
    STDMETHOD(SetInputType)(DWORD nInputStreamIndex, const DMO_MEDIA_TYPE* pMediaType, DWORD nFlags)
    STDMETHOD(SetOutputType)(DWORD nOutputStreamIndex, const DMO_MEDIA_TYPE* pMediaType, DWORD nFlags)
    STDMETHOD(GetInputCurrentType)(DWORD nInputStreamIndex, DMO_MEDIA_TYPE* pMediaType)
    STDMETHOD(GetOutputCurrentType)(DWORD nOutputStreamIndex, DMO_MEDIA_TYPE* pMediaType)
    STDMETHOD(GetInputSizeInfo)(DWORD nInputStreamIndex, DWORD* pnBufferSize, DWORD* pnMaximalLookAheadBufferSize, DWORD* pnAlignment)
    STDMETHOD(GetOutputSizeInfo)(DWORD nOutputStreamIndex, DWORD* pnBufferSize, DWORD* pnAlignment)
  • streaming:
    STDMETHOD(GetInputMaxLatency)(DWORD nInputStreamIndex, REFERENCE_TIME* pnMaximalLatency)
    STDMETHOD(SetInputMaxLatency)(DWORD nInputStreamIndex, REFERENCE_TIME nMaximalLatency)
    STDMETHOD(Flush)()
    STDMETHOD(Discontinuity)(DWORD nInputStreamIndex)
    STDMETHOD(AllocateStreamingResources)()
  • data processing:
    STDMETHOD(GetInputStatus)(DWORD nInputStreamIndex, DWORD* pnFlags)
    STDMETHOD(Lock)(LONG bLock)
    STDMETHOD(ProcessInput)(DWORD nInputStreamIndex, IMediaBuffer* pMediaBuffer, DWORD nFlags, REFERENCE_TIME nTime, REFERENCE_TIME nLength)
    STDMETHOD(ProcessOutput)(DWORD nFlags, DWORD nOutputBufferCount, DMO_OUTPUT_DATA_BUFFER* pOutputBuffers, DWORD* pnStatus)

Continue reading →

Firefox search plugin for Longman Dictionary Online

Longman Dictionary, my favorite one, offers online dictionary service through its website Longman Dictionary Online http://pewebdic2.cw.idm.fr/.

I did not notice any intent to offer integration tools, instead they only made available pronouncation .wav files for words starting with two letters, but luckily it is still quite easy to integrate Firefox with the website through a search plugin (if installed manually, it should be copied into %user%\Application Data\Mozilla\Firefox\Profiles\%profile%\searchplugins).

How To: Implement DirectShow Filter using DirectX Media Object DMO (Part 1: Starting the Project)

This post is starting a step by step tutorial on writing a simple DirectShow filter using a simplified DirectX Media Objects (DMO) API. From the very scratch, the goal is to make a DirectShow/DMO video processing filter which implements video brightness and contrast correction.

DirectX Media Objects are COM-based components. To implement a COM object we will use Visual Studio .NET 2008 and Active Template Library (ATL).

We are starting creating a no thrills ATL DLL project following by adding a no thrills ATL Simple Object Class:

ATL DLL Project

Continue reading →

More about APIs

Just recently there was a problem discovered in considered to be stable DirectShow component (the problem itself is not fatal – access violation while being used in improbable scenario – and thus it may appear it is even ignored), another “pleasant” thing came up with an API from another vendor.

The camera vendor is recognized in the industry and even considered to be among leaders, kind of “cheap for superior quality”. Their SDK/API has always been offered to reach several goals: the first was to cover product line with unified access method; the second was to embed implementation of a not so much popular TFTP protocol used for this type of hardware (rivals use more popular protocols: HTTP, RTSP). These not include regular things like to documented access to variety of features, availability for Win32 and Linux etc.

API documentation has always been not very much accurate as if it was given insufficient attention but luckily it was quite simple to figure things out. Another warning thing was that native software worked directly, without SDK: it was not very good for independent software vendors like us because there was a suspicion that SDK was something complimentary and was undertested. Fortunately however, the vendor decided to change this and their mainstream software started using the same SDK redistributables available for independent vendors also.

The first incident was recently when the vendor changed SDK implementation without changing published API and without giving any notice in documentation on one of the features. It did not break compilation or anything in our software, however it started working differently in production environment. We started receiving complaints and since we did not find any documentation changes, contacted the vendor’s support for comments and found out that implementation has been changed…

Now we got a new issue. As mentioned before, SDK’s advantage was to cover product line being constantly extended. New hardware from the product line appears to be quite sophisticated – a camera with multiple sensors. I believe this was not the thing foreseen when original SDK was designed so there was a kind of solution to workaround indexed access to individual sensor parameters in the API. However it appeared now that new products don’t support some of the older product features and SDK instead of returning a kind of “unsupported” error code to the requests, instead it messes other values. So it appeared that unified access to the product line was broken…

Everything was finally sorted out but in total it took a lot of time to. First of all, the problem due to its nature spread to production from where the dealer started receiving complaints from his client. The dealer in his turn forwarded the issue to us where we had problems investigating it because this particular piece of hardware is a kind of rare and expensive. When we gather sufficient data to think of the case as an SDK bug we forwarded the issue to the vendor.

Obviously the vendor responded with ridiculous suggestions assuming us to be complete lamers. Still we were in position to help our client and resolve the case, so spent some time to gather additional information to prove the supposition of an SDK bug. It took quite some time at our expense while finally we could work out a workaround for the problem and soon after receive a confirmation for a bug… Can we expect it to be fixed with next SDK update? “We will do this some time later”.

Why things happen this way? OK we are a small ISV with our own problems getting things work as expected. The vendor, however, is a high technology leader, well known and recognized throughout the industry, a subject of a completely different scale. Expensive hardware ans software is involved and we are still getting ridiculous problems at the output.

Freakonomics

Freakonomics: A Rogue Economist Explores the Hidden Side of Everything – the book was advertised a number of times by blog buddies, so I wanted to take a look. Torrents offered a scanned 26 megabyte heavy PDF, which is available, but of rather poor quality (low JPEG compression levels used).

A quick search using Google on “staring into a funhouse mirror” brought an OCR’ed copy to the top.

The book looks nice (from the start, I am not even close to the half), maybe just a bit like soap opera.

FFDShow is getting more annoying

Surprisingly fast I got new problems having ffdshow installed as a part of K-Lite Codec Pack. No wonder though because let us take a look at registration information:

Display Name: @device:sw:{083863F1-70DE-11D0-BD40-00A0C911CE86}\{0F40E1E5-4F79-4988-B1A9-CC98794E6B55}
CLSID: {0F40E1E5-4F79-4988-B1A9-CC98794E6B55}
Friendly Name: ffdshow Audio Decoder
Path: C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax
Merit: 0x3fffffff

Nice merit, ain’t it? What is merit anyway? Let us check at MSDN:

MERIT_PREFERRED = 0x800000,
MERIT_NORMAL = 0x600000,

MERIT_HW_COMPRESSOR = 0x100050

The highest defined value is 0x00800000, while ffdshow is registered with 0x3FFFFFFF, that is on top of everything. No doubt the developers read Guidelines for Registering Filters and decided to get rid of the rest of installed software as unnecessary crap.

Anyway back to the problem: I had an A-law wave file (WAVE_FORMAT_ALAW) to play and make sure its data is valid and quite unexpectedly there was a silence while playing. A quick check confirmed that the sustem has CCITT A-law codec installed, however GraphEdit shown ffdshow Audio Decoder intercepting decoding. Obviously it spoiled the thing!

Finally I decided it was a right time to take an advantage of IAMGraphBuilderCallback interface to detect and reject the bastard.

Continue reading →