Friday, October 5, 2012


Moving a Wordpress Site from One Host to Another


  1. Install Wordpress on the new host.
  2. Using an FTP client, copy down all of the Wordpress files from the original host.
  3. Back up the Wordpress database using the database utility provided by the host.
  4. Using the FTP client, copy all of the Wordpress files (except wp-config.php) to the desired directory on the new host. DO NOT OVERWRITE THE EXISTING WP-CONFIG.PHP FILE AS IT CONTAINS REFERENCES TO THE NEW WORDPRESS DATABASE.
  5. Using the database utility provided by the new host import the original Wordpress database.
  6. Download the Wordpress search and replace tool (http://interconnectit.com/124/search-and-replace-for-wordpress-databases/) and copy the file to the root of your Wordpress installation.
  7. Using a browser, go to www.yourdomain.com/ (where "yourdomain" is your domain name and the path to the Wordpress installation) and "" is the name of the search and replace file. This utility is used to replace references to your old domain name in the database tables.
  8. Follow the instruction to replace references of your old domain name with the new one. When you are done, delete the search and replace tool. If you do not delete it, and someone should come across it, they could use it to do anything to your database.

Your Wordpress site should now be working.

Wednesday, September 19, 2012

How I Removed the Fake FBI MoneyPak Scam Malware from Windows XP

For those unfamiliar, the FBI MoneyPak scam is a ransomware infection that has been making the rounds recently. The malware locks the infected computer and displays a message, purportedly from the FBI, stating that you are guilty of illegal downloads and could be fined or jailed for the infraction. The message goes on to say that you need to pay money via MoneyPak to get your computer unlocked. It should go without saying that this message is a fraud and you should not pay any money.

As the malware prevents you from accessing Windows, the average computer user will not be able to remove the infection. We recommend that you take the computer to your local computer repair shop for remediation.

As there are a couple of variants of this infection, and different computer setups can provide special challenges to removal, here is the story of how I was able to remove the infection from a computer in our shop:

This malware presented itself as a white screen with the words "page is loading. please wait this may take up to 30 seconds." There was no way to get around this screen to run anti-malware software.

Complicating matters was the fact that I only had a domain login, not a local administrator login. This prevented me from accessing Safe Mode with Command Prompt. If I had been able to get to the command prompt, I may have been able to start the Explorer process and/or access the registry without removing the hard drive. As it was, I had to jump through a few hoops to remove the infection.

If you should find yourself in a similar situation, here's what I did to fix the problem:

  • I removed the infected hard drive from the computer and connected it to another computer using a USB adapter.
  • Using regedit on the main computer, I loaded the HKLM hive from the infected hard drive and navigated to \Software\Microsoft\Windows\CurrentVersion\Run. I found a reference to a program whose name was a collection of random numbers/letters and deleted it.
  • I unloaded that hive and loaded the hive for the current user account (for the login I had). I navigated to Software\Microsoft\Windows\CurrentVersion\Run and deleted another entry referencing a program whose name was a collection of random numbers/letters.
  • I then navigated to  Software\Microsoft\Windows\CurrentVersion\Policies\System and deleted the value "DisableTaskMgr."
  • I then navigated to Software\Microsoft\Windows\CurrentVersion\Policies\Explorer and deleted the value "NoDesktop."
  • After unloading the hive, I navigated the file system, checking the Startup folder, %SystemRoot%\temp and the \Application Data folder and deleted programs whose names were a random collection of numbers/letters.
  • I then reinstalled the hard drive and was able to run ComboFix to remove the remanants of the infection.

Tuesday, March 27, 2012

The difference between Memory and Storage

Many computer users are confused by the difference between memory, provided by your computer's RAM, and storage, provided by your computer's hard drive. I know because a week doesn't go by when someone comes into our shop and tells us they're "running out of memory" when they really mean their hard drive is almost full.

While both the computer's memory and hard drive can contribute to overall performance, I thought it was important that everyone understand the difference between these components.

The RAM in your computer is used to store information the computer needs to retrieve quickly: primarily information about the programs you are currently running and the files you are currently working with. If there isn't enough room in memory, the computer will temporarily store this data on the hard drive, where it takes much longer for it to access. That is why increasing the amount of RAM in your computer can often have an immediate impact on how your computer performs. The more memory you have, the more information your computer can store for quick retrieval and the less it has to temporarily store on the hard drive.

Another big difference is that information stored in memory is lost after the computer has been turned off. That is why we save our files to the hard drive.

The hard drive is used to store data that does not need to be retrieved quickly and must be maintained even after the computer has been shut down. That is why we save files to the hard drive. Over time, though, the hard drive can get too full. When this happens, it can have a dramatic impact on how the computer performs. As a rule, it's generally a good idea to always have at least 15% free space on your hard drive.

To see how much RAM you have in your Windows computer:

Windows 7/Vista/XP

  1. Click on the Start button
  2. Right-click on Computer (or My Computer for Windows XP)
  3. Click on Properties

To see how much free space you have on your Windows hard drive:

Windows 7/Vista

  1. Click on the Start button
  2. Click on Computer

Windows XP

  1. Click on the Start button
  2. Click on My Computer
  3. Right-click on the C drive
  4. Click on Properties