SysAdminGear

Android is a software stack for mobile devices that includes an operating system, middleware and key applications. This early look at the Android SDK provides the tools and APIs necessary to begin developing applications on the Android platform using the Java programming language.

Android Features:
- Application framework enabling reuse and replacement of components
- Dalvik virtual machine optimized for mobile devices
- Integrated browser based on the open source WebKit engine
- Optimized graphics powered by a custom 2D graphics library; 3D graphics based on the OpenGL ES 1.0 specification (hardware acceleration optional)
- SQLite for structured data storage
- Media support for common audio, video, and still image formats (MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, GIF)
- GSM Telephony (hardware dependent)
- Bluetooth, EDGE, 3G, and WiFi (hardware dependent)
- Camera, GPS, compass, and accelerometer (hardware dependent)
- Rich development environment including a device emulator, tools for debugging, memory and performance profiling, and a plugin for the Eclipse IDE

Source: http://code.google.com/android/what-is-android.html

Android Presentation Video #1


Android Presentation Video #2


Google Android Explained


"Google's open platform could benefit the wireless industry, but the 3G issue may slow adoption. Also, while more than 30 industry heavyweights are partnering with Google, Apple will not be participating." ( http://www.youtube.com/watch?v=lWJ9xW4Wm-k )

Download Free Removal Tool for the next Worms / Backdoors / Virus:
- Free Removal Tool For: Backdoor.Win32.Afcore.l-ad
- Free Removal Tool For: Backdoor.Win32.Agent.ac
- Free Removal Tool For: Backdoor.Win32.Allaple.a
- Free Removal Tool For: Backdoor.Win32.Small.d
- Free Removal Tool For: Email-Worm.Win32.Avron.a-e
- Free Removal Tool For: Email-Worm.Win32.Bagle.a-j,n-r,z
- Free Removal Tool For: Email-Worm.Win32.Bagle.at,au
- Free Removal Tool For: Email-Worm.Win32.Bagle.cx-dw
- Free Removal Tool For: Email-Worm.Win32.Blebla.b
- Free Removal Tool For: Email-Worm.Win32.Bridex.a
- Free Removal Tool For: Email-Worm.Win32.Brontok.n
- Free Removal Tool For: Email-Worm.Win32.Dumaru.a-m
- Free Removal Tool For: Email-Worm.Win32.Fizzer
- Free Removal Tool For: Email-Worm.Win32.Goner
- Free Removal Tool For: Email-Worm.Win32.Klez.a,e,f,g,h
- Free Removal Tool For: Email-Worm.Win32.Lentin.a-p
- Free Removal Tool For: Email-Worm.Win32.LovGate.a-l
- Free Removal Tool For: Email-Worm.Win32.Magold.a-e
- Free Removal Tool For: Email-Worm.Win32.Mydoom.a-b,e
- Free Removal Tool For: Email-Worm.Win32.Navidad.a
- Free Removal Tool For: Email-Worm.Win32.NetSky.b-d
- Free Removal Tool For: Email-Worm.Win32.Nimda.a
- Free Removal Tool For: Email-Worm.Win32.Sircam.a
- Free Removal Tool For: Email-Worm.Win32.Sober.a,c
- Free Removal Tool For: Email-Worm.Win32.Sobig.f
- Free Removal Tool For: Email-Worm.Win32.Swen
- Free Removal Tool For: Email-Worm.Win32.Tanatos.a,b
- Free Removal Tool For: Email-Worm.Win32.Torvil.d
- Free Removal Tool For: Email-Worm.Win32.Winevar
- Free Removal Tool For: Email-Worm.Win32.Zafi.b
- Free Removal Tool For: IM-Worm.Win32.Sohanad.as
- Free Removal Tool For: Net-Worm.Win32.Lovesan
- Free Removal Tool For: Net-Worm.Win32.Opasoft.a-h
- Free Removal Tool For: Net-Worm.Win32.Opasoft.a-p
- Free Removal Tool For: Net-Worm.Win32.Rovud.a-c
- Free Removal Tool For: Net-Worm.Win32.Sasser.a-d,f
- Free Removal Tool For: Net-Worm.Win32.Welchia
- Free Removal Tool For: P2P-Worm.Win32.Malas.b
- Free Removal Tool For: Trojan-Downloader.Win32.Agent.a-j
- Free Removal Tool For: Trojan-Downloader.Win32.Losabel.ap
- Free Removal Tool For: Trojan-Downloader.Win32.Todon.an
- Free Removal Tool For: Trojan.Win32.Agent.aec
- Free Removal Tool For: Trojan.Win32.KillAV.nj
- Free Removal Tool For: Trojan.Win32.Krotten
- Free Removal Tool For: Trojan.Win32.SilentLog.a-b
- Free Removal Tool For: Trojan.Win32.StartPage.fw
- Free Removal Tool For: Virus.Win32.AutoRun.acw
- Free Removal Tool For: Virus.Win32.FunLove
- Free Removal Tool For: Virus.Win32.Implinker.a
- Free Removal Tool For: Virus.Win32.VB.he
- Free Removal Tool For: Virus.Win32.Win32.Elkern.c
- Free Removal Tool For: Worm.Win32.AutoRun.cby
- Free Removal Tool For: Worm.Win32.AutoRun.czz
- Free Removal Tool For: Worm.Win32.AutoRun.daa
- Free Removal Tool For: Worm.Win32.AutoRun.dfx
- Free Removal Tool For: Worm.Win32.AutoRun.dhq
- Free Removal Tool For: Worm.Win32.AutoRun.hr
- Free Removal Tool For: Worm.Win32.VB.jn
- Free Removal Tool For: not-a-virus:AdWare.Win32.Visiter
- Free Removal Tool For: not-a-virus:RiskTool.Win32.XCP.a-b

Download Win32/Zafi.B / W32.Erkez.B Removal Tool

Win32/Zafi.B / W32.Erkez.B Critical Worm Information

Win32/Zafi.B is a worm spreading via e-mail and P2P networks. The worm is attached in the attachment of the e-mail message. Upon activation Win32/Zafi.B copies itself into the %system% directory with a random name and the extension .exe. In the same directory it creates the new file with a random name and extension .dll. The worm uses this file as a store for collected e-mail addresses used for further spreading.

The worm changes the following system Registries to ensure starting on the following system start up:

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftWindows\CurrentVersion\Run
It creates a new key named _Hazafibb.

The worm also creates the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\_Hazafibb

Win32/Zafi.B / W32.Erkez.B searches the hard disk for folders named "share" and "upload" and copies itself into them using one of the following names:
Total Commander 7.0 full_install.exe
winamp 7.0 full_install.exe

It also terminates all the process that containing "firewall" and "virus" in the name and blocks starting of the following utilities: Regedit, Msconfig and Task

Related to the post "Download ebtalbes filtering tool" you can also read this excellent tutorial "Configuring a Transparent Proxy/Webcache in a Bridge using Squid and ebtables".

Read the full article

Download ebtables

From ebtalbes, website:
The ebtables program is a filtering tool for a bridging firewall. The filtering is focussed on the Link Layer Ethernet frame fields. Apart from filtering, it also gives the ability to alter the Ethernet MAC addresses and implement a brouter.
This website is also a reference for the Linux bridge-nf code, which gives Linux the functionality of a bridging IP/IPv6/ARP firewall, by letting iptables/ip6tables/arptables 'see' the bridged IPv4/IPv6/ARP packets. Both ebtables and bridge-nf are a part of the standard 2.6 kernel. A patch for the 2.4 stable kernel is maintained here, because enough people keep bugging me when Marcelo releases yet another 2.4 kernel.

What is ebtables
The ebtables utility enables basic Ethernet frame filtering on a Linux bridge, logging, MAC NAT and brouting. It only provides basic IP filtering, the full-fledged IP filtering on a Linux bridge is done with iptables. The so-called bridge-nf code makes iptables see the bridged IP packets and enables transparent IP NAT. The firewalling tools iptables and ebtables can be used together and are complementary. ebtables tries to provide the bridge firewalling that iptables cannot provide, namely the filtering of non-IP traffic.

What ebtables do?
- Ethernet protocol filtering.
- MAC address filtering.
- Simple IP header filtering.
- ARP header filtering.
- 802.1Q VLAN filtering.
- In/Out interface filtering (logical and physical device).
- MAC address nat.
- Logging.
- Frame counters.
- Ability to add, delete and insert rules; flush chains; zero counters.
- Brouter facility.
- Ability to atomically load a complete table, containing the rules you made, into the kernel. See the man page and the examples section.
- Support for user defined chains.
- Support for marking frames and matching marked frames.
- {Ip,Ip6,Arp}tables can filter bridged IPv4/IPv6/ARP packets, even when encapsulated in an 802.1Q VLAN header.
- All filtering, logging and NAT features of the 3 tools can therefore be used on bridged frames.
- Combined with ebtables, the bridge-nf code therefore makes Linux a very powerful transparent firewall.
- This enables, f.e., the creation of a transparent masquerading machine (i.e. all local hosts think they are directly connected to the Internet).
- Letting {ip,ip6,arp}tables see bridged traffic can be disabled using the appropriate proc entries, located in /proc/sys/net/bridge/. Also, letting the aforementioned firewall tools see 802.1Q VLAN encapsulated packets can be disabled with such a proc entry.

Basic ebtables filtering configuration

First, boot the system with the first Linux CD, when you see boot prompt, type linux rescue to switch to rescue mode. Here, you will be asked if similar steps should be followed, which need to be followed in the installation.

At the prompt, type the next command:
# chmod /mnt/sysImage
# locate grub.conf
# nano /path/to/grub.conf (Edit the grub.conf file and remove the passwd line from the file)

When GRUB loads up, select the Red Hat Linux entry on the GRUB menu and then press "e" to edit the boot configuration.

Locate a line like this:

kernel /boot/vmlinuz-x.x.xx-x.xxx root=LABEL=/hdc

- type the number '1' at the end.

Doing so boots the computer into run level 1- single user mode you will automatically be logged in as root.

Type 'passwd' at the prompt, now you can enter a new password here.

HOW TO RESET ROOT PASSWORD

- While Booting (on Redhat ) press "e" in GRUB and you will find 3 lines of code.
- On 2nd line press "e"again and type "1" in the end (then "ENTER")
- Then press "b" and it will boot you into shell.
- Type "passwd" and change your root password.

You can backup a single cPanel account trough ssh using pkgacct cPanel script located at /scripts folder on your server. This tip is helpful for WebHosting companies that uses cPanel as Hosting control Panel

- Login to your cPanel server as root.

To backup a sigle account use the next commands:
# cd /scripts
# ./pkgacct username
These commands will crate a file named "cpmove-username.tar.gz" on /home directory. And this is the file you need to restore on this server latter or on other server.

How to restore cPanel sigle account on other server

You just need to upload "cpmove-username.tar.gz" to the server you want to restore it or you can do it in the first server if you want. To upload you can use ftp, rsync or scp.

Restoring cpmove-username.tar.gz:

- "cpmove-username.tar.gz" should be on /home directory

Run the next command:
# /scripts/restorepkg username

It will restore homedir, dbs, mail, all the old cPanel account.

Assigning an ip address to a site in Plesk is simple and easy

Log in to your server as root (http://IP:8443), then follow the next steps:

- First you should assign the ip address to a client account.
"Server" -> "Ip Addresses"

- Then you need to assign the ip address to a site.
- "Hosting" -> "Setup"

-Finaly and only if you want it you can make the site default domain for the ip.
"Sever" -> "IP Addresses"

You see popups in your website and don't know how they start to appear. If you have a hosting account you should investigate your code and .htaccess file. Some type of black hackers own hosting accounts and put code on .htaccess file to get money from the traffic.

If you have a code on .htaccess file like this:

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://xxx.xxx.xxx.xx/in.html?s=hg [R,L]
Errordocument 404 http://xx.xxx.xxx.xx/in.html?s=hg_err

Your account should be hacked and you need to change access password, scan the computers where do you access from and contact yous hosting provider sysadmin.

Hope this post help you if you get in trouble.

As you know, if you manage a dedicated server you only should provide ssh access to people you trust, so is recomended to disable shell access on all cPanel accounts. The problem is that when you create a resseller acount the owner of this account can give shell access. How to stop it?

Go to Feature Limits for resellers in Resellers
=> Reseller Center,
=> Under "Privileges" always disable "Allow Creation of Packages with Shell Access"
=> Enable "Never allow creation of accounts with shell access"
=> Under Root Access disable "All Features".

It will increase your server security level.

After it, goto "Account Functions" => "Manage Shell Access"
=> "Disable Shell Access for all users" (except you login)

SysVinit is a package that contains a group of processes that control the very basic functions of your system. It includes the init program, the first program started by the Linux kernel when the system boots. Init then controls the startup, running and shutdown of all other programs.

Sometimes you just login in into a box using ssh and need to check the OS version.

If this box runs CentOS you can use this command to determine what is the CentOS version:

[root@box ~]# cat /etc/*release*
CentOS release 4.3 (Final)

How to use RPM Commands

This is a post cointain some basic rpm commands to manage RPM packages.

1. Install a RPM package - you can use the command:
# rpm -ivh somepackage.arc.rpm

2. Uninstall a RPM package - you can use the command:
# rpm -e packagename
# rpm -e horde (e.g.)

3. Upgrade a RPM package - you can use the command:
# rpm -Uvh somepackage.arc.rpm
Note: When this command is used, RPM will uninstall the old version of package and install the new version.

4. Query a RPM package - you can use the command:
# rpm -q packagename
E.g.:
[root@box ~]# rpm -q glib
glib-1.2.10-15
Note: rpm -q command will print the package name, version, and release number of installed package. You can use this command to verify that a package is or is not installed on your system.

5. Package information - you can use the command:
# rpm -qi package
E.g.:
[root@box ~]# rpm -qi glib
Name : glib Relocations: (not relocatable)
Version : 1.2.10 Vendor: CentOS
Release : 15 Build Date: Tue Feb 22 05:32:17 2005
Install Date: Tue Mar 28 01:14:49 2006 Build Host: guru.build.karan.org
Group : System Environment/Libraries Source RPM: glib-1.2.10-15.src.rpm
Size : 321141 License: LGPL
Signature : DSA/SHA1, Sat Feb 26 20:42:07 2005, Key ID a53d0bab443e1821
Packager : Karanbir Singh
URL : http://www.gtk.org
Summary : A library of handy utility functions.
Description :
GLib is a handy library of utility functions. This C library is
designed to solve some portability problems and provide other useful
functionality which most programs require.

GLib is used by GDK, GTK+ and many applications. You should install
th glib package because many of your applications will depend on this
library.

As you can see, this command display package information, including name, version, and description of the installed program.

6. List files in package - you can use the command:
# rpm -ql package
E.g.:
[root@box ~]# rpm -ql glib
/usr/lib/libglib-1.2.so.0
/usr/lib/libglib-1.2.so.0.0.10
/usr/lib/libgmodule-1.2.so.0
/usr/lib/libgmodule-1.2.so.0.0.10
/usr/lib/libgthread-1.2.so.0
/usr/lib/libgthread-1.2.so.0.0.10
/usr/share/doc/glib-1.2.10
/usr/share/doc/glib-1.2.10/AUTHORS
/usr/share/doc/glib-1.2.10/COPYING
/usr/share/doc/glib-1.2.10/ChangeLog
/usr/share/doc/glib-1.2.10/NEWS
/usr/share/doc/glib-1.2.10/README
Note that this command will list all files in a installed RPM package. So it only works when the package is already installed on your system.

7. Check a RPM signature package - you use the command:
# rpm --checksig package
Note: This command will check the PGP signature of specified package to ensure its integrity and origin, it is secure to verify that ;)

Yum fails "GLib-CRITICAL"

[root@box ~]# yum check-update
Repository atomic is listed more than once in the configuration
Repository plesk is listed more than once in the configuration
Setting up repositories
update 100% |=========================| 951 B 00:00
base 100% |=========================| 1.1 kB 00:00
atomic 100% |=========================| 951 B 00:00
addons 100% |=========================| 951 B 00:00
extras 100% |=========================| 1.1 kB 00:00
Reading repository metadata in from local files

(process:7349): GLib-CRITICAL **: file gtimer.c: line 106 (g_timer_stop): assertion `timer != NULL' failed

(process:7349): GLib-CRITICAL **: file gtimer.c: line 88 (g_timer_destroy): assertion `timer != NULL' failed
Traceback (most recent call last):
File "/usr/bin/yum", line 29, in ?
yummain.main(sys.argv[1:])
File "/usr/share/yum-cli/yummain.py", line 97, in main
result, resultmsgs = do()
File "/usr/share/yum-cli/cli.py", line 534, in doCommands
ypl = self.returnPkgLists()
File "/usr/share/yum-cli/cli.py", line 1176, in returnPkgLists
ypl = self.doPackageLists(pkgnarrow=pkgnarrow)
File "__init__.py", line 904, in doPackageLists
File "/usr/share/yum-cli/cli.py", line 75, in doRepoSetup
self.doSackSetup(thisrepo=thisrepo)
File "__init__.py", line 260, in doSackSetup
File "repos.py", line 277, in populateSack
File "/usr/lib/python2.3/site-packages/sqlitecachec.py", line 40, in getPrimary
self.repoid))
TypeError: Can not create index on requires table: near "NOT": syntax error


Possible Solution "GLib-CRITICAL":

First try it:
# rpm -Uvh http://www.mirrorservice.org/sites/mirror.centos.org/4.6/os/i386/CentOS/RPMS/sqlite-3.3.6-2.i386.rpm http://www.mirrorservice.org/sites/mirror.centos.org/4.6/os/i386/CentOS/RPMS/sqlite-devel-3.3.6-2.i386.rpm

It should fix the problem, it worked on CentOS. If didnt, go to http://mirror.centos.org/centos/

And install or re-install the next packets:
- glib
- yum
- sqlite
- python-sqlite
- python-elementtree
- python-urlgrabber

Remember to use:
# rpm -Uvh somerpm.rpm

mrtstub.exe - mrtstub process information

mrtstub.exe is a process that belongs to malware category thta can download other malicious processes and cause unwanted behavior on your computer. You should run a tool like spybot to disable and remove mrtstub.exe, it is most likely an adware or spyware.

Linux partition possibility

A normal linux installation requires at least two partitions. It usually improves performance to more partitions.

Disk be divided into 4 partitions.
About 33% to linux bootable

About 33% to Windows bootable
Windows requires residency on the first primary partition

128M to swap
Note that a filesystem optimized for memory caching improves performance, that partition must have a filesystem supported by the operating system that will use it.

About 33% to data
This partition should be used by either or both OS if is compartible, it will be used for data, and can have any filesystem. The Windows bootable partition must be one of the filesystems supported by Windows, the linux bootable partition must be one of the filesystems supported by linux.

Problem: svchost.exe file take up 100% of cpu resources (when Internet is turned on)

One possible cause of high loads from svchost is the DNS Client service. On some cases, it can cause high CPU loads. So, if you are facing this problem and dont need Windows DNS Client service you can disable it.

How to stop/disable the DNS Client
Type "services.msc" on the run box, find "DNS Client" and on the proprieties, chance it to "Disabled". If you are running a firewall, you can also disable Windows Firewall to, if you are using other there is no reason to keep both because can provoke conflicts.

After it, everything should back normal.

If you need to change all cpanel account themes, you can use this command as root:

# replace RS=oldtheme RS=newtheme -- /var/cpanel/users/*

This will change all the cpanel users theme, if you need to change only one account,

# cd /var/cpanel/users/
# nano user_account

and replace rhe "RS=" line