This afternoon I did a session titled “SEC404 – Look@me and Pay” with speaker Jakub Kaminski.

For those who don’t understand the rating systems applied to sessions:

• Level 100 – Sales Fluff
• Level 200 – Information / Minor Tech / Technical Sales Fluff
• Level 300 – Medium Technical
• Level 400 – Make your brain ache with overload technical.

With a SEC404, I thought beauty, just what I need, something to make my brain ache and walk out with some cold  hard information.

Just like my previous post, this was nothing more than a Level 200 Session about the different types of Malware / Fake Antivirus software that is available on the internet and really not one iota of technical info.

One core principal of this session that was missed was Microsoft Best Practice of Running Users with Least User Access – ie. Don’t give user Local Admin rights on their PC!!!

So, why is this a problem, the client has current up to date Antivirus…WRONG!

These new streams of Malware are so unbelievably sneaky that they stay ahead of the patch cycles of the AV Vendors and have many variants of the same virus out in the wild.

Pictured Above – Screenshots of fake antivirus Malware.

These malware streams spread through email with Attachments and Links to .exe files, Rogue or Hijacked Websites and ActiveX Controls, P2P and Chat such as MSN and Skype.

If a user were to be running as Admin, these applications will launch, execute and voila, one successfully infected PC.

Now, if the user were running with LUA, the application would launch, prompt for elevation privileges and all being well the user cannot continue (if they don’t have the Local Admin or Domain Admin Password to elevate.)

So with one small step, you can very easily avoid an infection.

The next thing to look at with these streams of viruses is the removal. They imbed themselves in such a way that even with booting to Safe Mode and theoretically “removing the files”, actually, the root of the virus or payload is actually sitting there waiting for the signal to re-spawn.

So, you’ve “removed” it, you boot up, log on not being on the network – everything looks good. Now lets plug the Ethernet cable back in and see what happens…

Congratulations – the payload has just phoned home, downloaded the same virus or a new one and successfully re-spawned.

So, how do I remove it?

In my business we have a simple policy. Infected machine = flatten and rebuild.

It is just not worth the risk of putting a potentially infected machine back in to a clean environment and having the rest of the environment at risk.

So, back the the start of this post… When a Level 400 session isn’t…

As a Tech.Ed delegate, It’s vitally important that you give feedback. Not just 5 for everything because it’s easy, rank thing correctly and leave proper feedback that’s relevant.

“Session was advertised as level 400 but lacked in depth technical content.”

This info gets back to the right people and yes, it does actually get read and makes for a better Tech.Ed moving forward.

Tech.Greg

This is a great way to make sure your voice is heard about the sessions that you attended and do something for a good cause at the same time.

To fill out your feedback just log in to CommNet (australia.msteched.com) and in the Session Builder to the right of the session is a Green Icon.

Remember, it’s your feedback that makes for a better Tech.Ed so be honest with your feedback. If you really liked something, say so, and if you thought something was complete and utter sh1t, then, by all means let them know too.

Tech.Greg

For my part – as I said during the session this is the start of a full days training that I’ll be offering later this year (Oct/November) as I know all too well that we need to know how to take SBS beyond the wizards safely.  The session was recorded by Microsoft and will be available on teched website soon.  I’ll post here once it is up.

Many thanks again for all that came along and please feel free to give me feedback on what you need in a session like this.

For those that missed out on picking up a community card (I was surprised how quickly they went – the URL you need is www.sbsfaq.com/helpme this gives you access to all the free community resources out there focused on SBS and the SMB IT Professionals space

Click here to download MDT now. (http://go.microsoft.com/fwlink/?LinkId=159061)

As you prepare to deploy Windows® 7 and Windows Server® 2008 R2, get a jump start with Microsoft® Deployment Toolkit (MDT) 2010. Leverage this Solution Accelerator to achieve efficient, cost-effective deployment of Windows 7 and Windows Server 2008 R2.

MDT is the recommended process and toolset to automate desktop and server deployment. MDT provides you with the following benefits:

• Unified tools and processes required for desktop and server deployment in a common deployment console and collection of guidance.
• Reduced deployment time and standardized desktop and server images, along with improved security and ongoing configuration management.
• Fully automated Zero Touch Installation deployments by leveraging System Center Configuration Manager 2007 Service Pack 2 Release Candidate and Windows deployment tools. For those without a System Center Configuration Manager 2007 infrastructure, MDT leverages Windows deployment tools for Lite Touch Installation deployments.

MDT 2010 includes new features such as flexible driver management, optimized user interface workflow, and Windows PowerShell^TM command line interface to help simplify deployment and make your job easier. Deploy faster and more easily with MDT 2010.

New in MDT 2010

Improvements in MDT 2010 allow you to:

• Access deployment shares from anywhere on the network and replicate files and settings across organizational boundaries or sites.
• Organize and manage drivers, operating systems, applications, packages, and task sequences with an improved UI.
• Automate UI functionality using the new Windows PowerShell command line interface.

Next steps

• Download Microsoft Deployment Toolkit 2010. (http://go.microsoft.com/fwlink/?LinkId=159061)
• Learn more about MDT by visiting the MDT site on TechNet. (www.microsoft.com/mdt)
• Get the latest news by visiting Microsoft Deployment Toolkit Team blog. (http://blogs.technet.com/msdeployment/default.aspx )
• Provide us with feedback at satfdbk@microsoft.com.

From the Twitter feed…

Business business business blah blah blah nothing about community at the keynote of teched…. Not impressed < #auteched

Noting the warm glowing warming glow of many Netbooks, handsets & iPhones in the audience…

Massive screen at #auteched. Impressed!

#auteched Keynote – Next Speaker Please!

Colin Timm content good, jokes bad. Moral = sales guys are not comedians. > *Nods*

0833 – Welcome Paul Lamb from HP
Plugs the Netbook, Talk about GFC

From the Twitter Feed…

I wonder if this #auteched #keynote was done with Apple Keynote…

0837 – Shifting the balance – 30% Innovation, 70% Maintenance
0840 – Looking at the pillars of capability – Technology, Manageability, Organisation, Governance

From the Twitter feed…

#auteched wheres the wow?

#auteched is not really a business / pre-sales audience, *yawn*

Interesting comparing this to last years keynot 08 cloud computing, 09 a business focus #auteched

0842 – Thanks to Paul @ HP and HP for sponsoring the Event.

0843  - I’m a PC takes to the stage… A whole new branding! … Q to the audience.. Are you going to be proud to be a Windows 7 PC??? We are back baby!

0844 – Welcome Alistair Speirs and Lee Hickin (Office Productivity Specialists)

Demo Time… Microsoft Online Services (and the username is wrong! )

Lee speaks about the migration from physical in to the cloud. Migrate from Exchange, Competition Product or even Online Free Email Services (Gmail, Hotmail, Yahoo)

0851 – Alistair speaks about Office 2010 – Send an electric shock to a developer…. :S

• New ignore function for Reply All…
• Meeting requests show a preview in the request.
• “Visual Voicemail” in your inbox.
• Powerpoint 2010… make it rock?? (Ed note… will it be better than Keynote??)
• More image editing capabilities.
• More compatible… cross platform compatibility

0857 – Thanks Alistair and Lee

Next up… the developers – Welcome Sarah Ford … “I have waited my entire life to say these words… Hello Australia”

• Codeplex – now hosting over 11,000 projects.
• 382 tips written online about Visual Studio 2008
• Can move code pages out on to their own screens (dual screens )
• VisualStudioGaller.com – Image Gallery Plugin for VS
• #autechedsession // Hello #auteched Keynote from Visual Studio
• Sketchflow – have a look

Final words… Australia You Rock!

0908 – Sarah Vaughan & Nick Hode (Childhood Photos…. Arrgggghh)

Classroom photo time But First… A small disclaimer from the legal department….Leave, Hold Notebook Over Face or assume the brace position. – The lights come up and the photos begin! (Music Lady Gaga – Paparazzi)

0913 – Australia generated more internet traffic downloading Windows 7 than the Obama speech!

0914 – Windows 7 Demo (and a stool for Sarah to stand on….)

• Show Desktop tool
• Federated Search – Emails, Files, etc etc
• Open Search Standard – XML Connectors for Federated Search
• Look out for the Windows 7 champions (Bright Orange T-Shirts!)
• BitLocker to go – Secure your USB Key!
• Problem Step Recorder (record what’s on your screen and email it to your IT Department)

0923 – Welcome to the Stage Jorke Odolphi.

• Jorke shows forklift video (available on TechedBackstage.net)
• Speaks about the deployment process

Thanks Jorke!

0926 – Sarah shows Touch and Multi-Touch – Very Cool!

Thanks Sarah!

0930 – Colin takes the stage to wrap up.

I keep hearing little voices in my head … or chirps??

So, what does this mean….. well here’s how Steve explains it….

Do you follow? Oh well, maybe you had to be there to understand it.

As always another engaging session from Steve, with lots of questions, lots of answers and plenty of twisted sick American humour!

Look Nothing Up My Sleeve!

Steve will be presenting a Security Chat in Parkside Ballroom A at 3.45pm today (after Afternoon Tea) and all being well (my battery not being flat) I’ll do some live blogging from in the session.

Tech.Greg