1. Browse to C:\Documents and Settings\ u s e r n a m e \Application Data\Macromedia\Flash Player\#SharedObjects\GVP00001
2. Delete all the files and folders in this folder
3. Browse to C:\Documents and Settings\ … \Application Data\Macromedia\Flash Player \ macromedia.com \ support \ flashplayer \ sys
4. Delete all the files and folders in the directory
5. Restart Firefox

Youtube has slowly started to create better quality versions of many videos, adding links that say, “Watch this video in higher quality.” See this High Quality example and compare it to Youtube’s Normal Quality.

Comparison of Normal Youtube vs Youtube High Quality

-	Normal Youtube	High Quality Youtube
Screen Res.	320 x 240	480 x 360
Bitrate	≅ 200 kbps	≅ 900 kbps
Audio	22KHz 64 kbps Mono ABR	44.1KHz 96 kbps Mono CBR
Frame Rate	30	30
Video Codec	Flash Sorenson	Flash Sorenson
Audio Codec	Mp3	Mp3

Getting iPod compatible mp4s!

Adding &fmt=6 to the end of any youtube video’s url will give you Youtube’s new high quality setting. Changing the number from 6 to something else yields different formats though it’s not obvious which numbers work. Format 18 generates an mp4 using h264 with AAC stereo, which is compatible with video iPods. This is way better than using a service like vixy.net, which transcodes the crappy quality youtube vid into an mp4. Using fmt=18, you get a video transcoded from the original clip the user uploaded. The bitrate is lower on the mp4 version, but since the resolution is smaller it compensates. The h.264 codec has better looking videos at lower bitrates anyway. We finally see stereo on youtube with the mp4 version! It has a widescreen 16/9 aspect ratio rather than 4/3.

Correction:

Previously I thought the mp4 screen resolution was 480 x 270, but it’s also 480x360. It could be that both formats have the possibility to be 480x270 if their aspect ratio is close to 16/9 width/height. The mp4 version may add an additional small audio gain and a small sharpening effect.

-	fmt 18 / MP4	fmt 6 / HQ FLV
Screen Res.	480 x 360	480 x 360
Bitrate	≅ 512 kbps	≅ 900 kbps
Audio	44.1KHz 128 kbps Stereo	44.1KHz 96 kbps Mono CBR
Frame Rate	24	30
Video Codec	h.264	Flash Sorenson
Audio Codec	AAC	Mp3

Downloading the MP4 and High Quality Videos

Video downloaders like keepvid still work. Enter the url, click download, now grab the link and add &fmt=6 or &fmt=18 (for mp4) to the end. The good people at lifehacker created an easy to use firefox extension that will put a download link under each vid. You can also get the download url if you follow my wireshark tutorial but the process is pretty tedious.

You can do it manually too, but it’s annoying. Go to any video on youtube, right click then click view source. Click ctrl+F, which will open a searchbox and type &t=. Next copy the value after the t= but before any “&” characters. Grab that and the video_id and your set. The vid id is the v=something part of the url. Just copy the variables into the url below.

www.youtube.com/get_video?video_id=&t=&fmt=18

Example
Vid URL: http://www.youtube.com/watch?v=pVYp2sgA9M0
Output: right click - save as

You may want to pass it to a download manager like wget. If you load it in the browser it will display a bunch of gibberish while it loads the entire video’s ASCII representation into your browser.

Howto Get Videos to Play HQ by Default

This option has not been implemented on many accounts but the howto is already present in the youtube help pages. You need a youtube account to be able to do this.

1. Go to your Account page.
2. Under “Manage My Videos” click the “HQ Video Playback Setting” link.
3. Select the playback setting that makes sense for you.
4. Click the “Save” button.

Criteria for a Video to Become HQ

The exact settings aren’t know yet for the video to become high quality. We could assume that the exact minimum settings are the same as encoded format listed above, however youtube has changed their “best format to upload high quality” help page to set the video resolution to 640 x 480. Maybe high quality will support different formats and aspect ratios in the future. It’s best to upload as high quality as possible. The new multi video uploader makes it easy on a unreliable connection. Even if your upload times out or you get disconnected it will restart the uploading process exactly where it left off.

Embed High Quality Youtube Clips

Update

This code works fine to embed the mp4 version. The magic query string var is “&ap=%2526fmt%3D18″ specifying format 18. Just replace (VIDEO EMBED URL) with the video ID. Note that there’s a huge disadvantage in that there is no seeking. The fmt=6 embed version is less reliable.

<object width="480″ height="397″><param name="movie” value="(VIDEO EMBED URL)&ap=%2526fmt%3D18″></param><param name="wmode” value="window"></param><embed src="(VIDEO EMBED URL)&ap=%2526fmt%3D18″ type="application/x-shockwave-flash” wmode="window” width="480″ height="397″></embed></object>

Ignore Below

Currently there is no official way to embed the High Quality videos on your website / myspace / blogs. It’s possible, but a big hassle, and it’s impossible to turn off autoplay. Here’s an example you can embed if you want to see it for yourself.

Remove the line breaks for best results

<object width="425″ height="355″><embed autoplay="false” quality="high” src="http://www.youtube.com/player2.swf” flashvars="vq=2
&sourceid=r
&video_id=pVYp2sgA9M0
&l=239
&sk=5E_4xTZlkQqZYuyEXwBRzQU
&fmt_map=18/512000/9/0/115
&t=OEgsToPDskItDX5Cg05utBXEP1wh76mc
&hl=en
&plid=AARIM8FsSohHKlMVAAAAIIAoQAA
&playnext=0″ type="application/x-shockwave-flash” wmode="transparent” width="425″ height="355″></embed></object>

It only works with youtube’s in-site player, player2.swf, rather than the player youtube has for embeds. The problem is youtube’s in-site player does not have a variable to turn autoplay on or off and if you try embedding it to your site flash issues a warning that the script is trying to contact a remote server (youtube.com). Player2.swf seems to have an internal “ap” variable hidden in the actionscript but it seems to just break the vid no matter what options I set. The key flashvar for high quality is “fmt_map=6/0/7/0/0″ and “fmt_map=18/512000/9/0/115″ for mp4s. When enabled, the flv file comes from cache.googlevideo.com/videoplayback?itag=6, without the fmt_map var it comes from cache.googlevideo.com/get_video, with normal quality.

To embed a high quality video you need to go to the video’s page on youtube, view source, and grab the flashvar data. The most important vars are video_id, t, and sk. Just use the above embed code as a template and replace those values. As for the rest: L defines how long the video is in seconds, hl is the home language, plid tries to find any associated playlists, playnext plays the next item on the playlist if there is one.

Making your youtube videos High Quality

Youtube will be automatically creating high quality versions of many videos for those that meet the guidelines. The video quality is bad on youtube, partly because youtube encodes to such a small screen resolution with a low bitrate, but mainly because people post really low quality videos.

The crappy resolution youtube is actually what got it so popular. Google video had originally allowed 640 x 480 with a great bitrate, but they failed miserably to compete against youtube (so they later bought em out). It made online video making / viewing possible even on crappy connections. Take the time to resize your vid and sharpen it a bit before uploading. A little noise reduction and color correction can’t hurt either. Use virtualdub and avisynth. They’re free. Use xvid or x264 and lame acm for the audio. Divx is fine if you can get the pro version. See doom9 for tons of guides on video creation / editing / improvement.

Youtube High Quality Hack

There is also a hack using total video converter where if you make an flv with certain settings you can upload a video of super high quality and have youtube keep the screen resolution and bitrate.

Youtube High Quality Hack Settings Howto

Select what you want to encode into an flv in total video converter with these settings.

Sample Rate: 44100 Hz
audio bit rate: 320.000 kbit/s
Audio codec: mp3
Custom video bit rate: any
Resolution: any

Cons

It messes up the time on the video. A 30 second video can read as 9 minutes. The way it tells how long the video is seems very random but it constantly says the video is much longer than it really is. Having the resolution or bitrate too high causes it to not stream well and get stuck.

1. Mac/Linux users: Click Edit > Preferences. Windows users: Tools > Options
2. Go to the Content Tab
3. To the right of “Enable Javascript,” hit “Advanced…”
4. Uncheck “Move or resize existing windows”

bind9 google apps zone template (See related posts)
Change 1.2.3.4 for your accelerator’s ip and mydomain.net for your domain name

$TTL 86400
@ IN SOA ns1.mydomain.net. hostmaster.mydomain.net. (
2007052701 ; serial
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum

IN NS ns1.mydomain.net.
IN NS ns1.everydns.net.
IN NS ns2.everydns.net.
IN NS ns3.everydns.net.
IN NS ns4.everydns.net.

@ IN TXT “v=spf1 ip4:1.2.3.4 include:gmail.com~all include:mydomain.joyent.net~all ~all”

@ IN MX 1 aspmx.l.google.com.
@ IN MX 3 alt1.aspmx.l.google.com.
@ IN MX 3 alt2.aspmx.l.google.com.
@ IN MX 5 aspmx2.googlemail.com.
@ IN MX 5 aspmx3.googlemail.com.
@ IN MX 5 aspmx4.googlemail.com.
@ IN MX 5 aspmx5.googlemail.com.

_xmpp-server._tcp IN SRV 5 0 5269 xmpp-server.l.google.com.
_xmpp-server._tcp IN SRV 20 0 5269 xmpp-server1.l.google.com.
_xmpp-server._tcp IN SRV 20 0 5269 xmpp-server2.l.google.com.
_xmpp-server._tcp IN SRV 20 0 5269 xmpp-server3.l.google.com.
_xmpp-server._tcp IN SRV 20 0 5269 xmpp-server4.l.google.com.

_jabber._tcp IN SRV 5 0 5269 xmpp-server.l.google.com.
_jabber._tcp IN SRV 20 0 5269 xmpp-server1.l.google.com.
_jabber._tcp IN SRV 20 0 5269 xmpp-server2.l.google.com.
_jabber._tcp IN SRV 20 0 5269 xmpp-server3.l.google.com.
_jabber._tcp IN SRV 20 0 5269 xmpp-server4.l.google.com.

@ IN A 1.2.3.4
www IN CNAME @
mail IN CNAME ghs.google.com.
start IN CNAME ghs.google.com.
calendar IN CNAME ghs.google.com.

It wasn’t really my intent to go back and revisit all these security post lists. That’s just how it seems to have turned out. That’s OK. Software gets developed and updated. Lists grow. New and better versions get released….

So this time, I’m re-visiting my original anti-rootkit post: Windows Rootkit Detectors

To summarize: “…a rootkit is executable code that attempts to evade detection of running processes, files or system data. There are many ways it can do this, but the end result is that they are very hard to find and can make an infected system look clean and safe even to traditional anti-virus and anti-malware software.” More here: Wikipedia : Rootkit

At the time of my original post, there were just a handful of anti-rootkit tools available to the public. I just offered five.

Now most all major anti-virus/security software vendors have issued anti-rootkit solutions, though some are still in a beta release form.

The Threat

How seriously concerned should the average user be? Well…if you are practicing “safe-surfing” by staying away from “risky” websites, keeping your operating system patched, scanning all files downloaded and sent in email with an up-to-date anti-virus program, you should be mostly ok. I say mostly because it is still possible for a system to become compromised with a rootkit, even if you are playing by the rules.

Certain individuals would like nothing else than to get a home-broadband user’s system infected with a rootkit. Not so much to steal your personal information–though that’s always a potential target–but to install trojan services that would allow them to leverage the system for attacks on other larger systems, spam-mail-bot rental services, or even hosting of their hidden/illegal files on the system. Any of these events could seriously make a home or corporate user’s system a great big pile of steaming cow-dung for the user and those impacted by those services. Bummer!

SANS-ISC recent reported that Europe has been pounded lately by emails which include variants of a virus/trojan loader file: European Storm Video E-Mail. While bad, it doesn’t sound too serious…but!

heiseSecurity in Germany expands the story with more details, much more disconcerting: “Storm worm” sloshes through the internet. What the trojan seems to be doing is download additional files from the internet, and “…according to GDATA, one action it takes is to install the rootkit Win32.agent.dh.” Depending on the anti-virus company, different names may be used.

Over at the Anti Rootkit blog: New Storm-Worm Rootkit creating Botnets Steo does some more research on just how this rootkit does its deed. Interesting.

Rootkit writers aren’t happy about the attention. Just this week, they have worked to get the GMER anti-rootkit mirrors shut down under a massive DDOS attack. As soon as new mirrors for the files went up, they also were attacked. More information: GMER Anti Rootkit & People Power, and Martijnc’s blog post: DDoS attack

The battle for pc security rages on.

The Response

There are a number of ways to look for a rootkit on your system.

The first is to download and run several of these rootkit detection tools on your live system. These rootkit detection tools are specially programmed to check for hidden files and masked running or injected processes. It’s a cat and mouse game, and some tools and methods are more effective than others. Just as hard as the security programmers work to prevent and detect these rootkits, the developers on the other side are working to make them more difficult to be detected.

A second technique is to download and run several of these rootkit detection tools onto a USB drive. Then using a bootable “LiveCD” like BartPE or Linux, run the appropriate rootkit detection tools on the “dead” system’s drive(s). This may be a much more effective approach. Since the infected system isn’t being booted, the drives just contain “static” data files that shouldn’t be executed. They could be, but that’s the point…to not run or launch any files on the potentially compromised system. That way they can be detected and removed while “dormant". Using a Linux “LiveCD” to scan a Windows system disk is even more safe as the likelihood of cross-contamination is almost non-existent.

If a rootkit is found you have two options: 1) Use one of the detection/removal tools to–hopefully!–remove it. Or, 2) recover your critical data files to another drive/media location, then do a full wipe of the infected system, and reinstall it fresh.

Speaking as a half-way competent computer geek, I personally would feel more comfortable going with option two, because otherwise I would always have a shadow of doubt of the system’s integrity. Nor would I have have the patience to pick through a manual removal process if the tools failed to remove it.

Rootkit Detector Tool List

InformationWeek posted an excellent article recently titled Review: Six Rootkit Detectors Protect Your System. I was familiar with some of them, and had come across a few more on my own that didn’t make the author’s cut. But that got me observing the increase in the number to tools now at our disposal. With some more careful searching, I’ve ended up collecting quite a list. Almost all are offered as freeware or trialware.

I have only used a handful of these tools and only keep a few with me on my USB system administrator’s stick. So far, I haven’t found a rootkit on my systems (here or at work) so I can’t speak of their effectiveness in removal. Also, because of the nature of how these tools work and where they look, it is quite possible that removal of a real rootkit or a listed file in error (that wasn’t actually malicious) can cause your Windows system to fail, not boot, or BSOD to the point you will be recovering files off the dead OS drive and then reinstalling your system.

You’ve been warned!.

• F-Secure BlackLight - Restrictive wizard interface, but easy to use for the uninitiated.
• IceSword 1.20 - Developed in China but nicely translated into English. Busy interface but updated often. Has some advanced tools like the ability to “reboot and monitor” during the boot process.
• RKDetector 2.0 - Two tools in one; 1) scans for hidden files on drives, 2) scans for hidden processes and hooks. Takes a bit of work to run the scans, and can’t do a global system scan with both.
• Trend Micro RootkitBuster 1.6 - Runs scans in five system areas and exports a nice log file. You can then opt to remove the detected items.
• RootkitRevealer 1.71 - From the Sysinternal’s team. Easy to use, but does often turn up documented false-positives. Just identifies suspicious processes…you are on your own to delete them with other methods and applications. Better for system checking and monitoring, rather than protection and removal in-of-itself.
• Rootkit Unhooker 3.0A - Russian software team project. Does a self-test to make sure it hasn’t been compromised; that’s a good feature. Provides lots of details and the ability to do focused scans or a global element scan. Also provides multiple methods to address/remove the located processes and files.
• McAfee Rootkit Detective Beta - “McAfee Rootkit Detective Beta is a program designed and developed by McAfee Avert Labs to proactively detect and clean rootkits that are running on the system.” Nice interface.
• Sophos Anti-Rootkit - “Sophos Anti-Rootkit provides an extra layer of detection, by safely and reliably detecting and removing any rootkit that might already have secreted itself onto your system.” Note: Registration required for download from the vendor’s site. The utility itself is free.
• Gmer - The tool that’s got everyone in a fuss! Scans for hidden processes, services, files, registry keys, drivers, and hooks. Also allows some system function monitoring. Highly regarded by the antirootkit professionals. More screenshots (while the site is up).
• Advanced Rootkit Detector for Windows (rkdetector) - This command-line based scanner was one of the very first rootkit detectors I became familiar with. I don’t think it has been updated since it’s original release (back in 2004). The website is in Spanish, but the application worked just fine for me. I can’t say it now can handle the newest rootkit methods of attacks, but just for posterity I’m offering it here.

More follow as discovered on Antirootkit.com’s incredible website. They’ve done a bang-up job of finding and detailing all these. Please check out their site for more information as well as some screenshots, reviews and evaluation ratings. These guys (and gals?) are doing great work and deserve full credit for locating these wide selections of tools.

Note: Some products here are beta products and may not be available or will work past a certain date. Others are trialware/crippleware. In these cases I have chosen to still include them so you can keep an eye on possible future development or releases.

• Gromozon, Rustock, Haxdor related removal tools - Specialized and targeted rootkit removal tool list via Antirootkit.com
• Aries Sony Rootkit Remover - Tool to remove the Sony/BMG DRM CD protection software.
• Archon Scanner - More of a process, injection, hooking scanner. But has other specialties as well. - current version was beta and has expired…developer’s promise new one sometime.
• AVG AntiRootkit - Beta product. Doesn’t seem to be offered anywhere but from Antirootkit.com.
• Avira Rootkit Detection - Beta product disabled after 1-4-07. See Antirootkit.com’s page for file.
• DarkSpy - Chinese developed tool. Supports process, kernel mode, file, registry scan (disabled in test version) and hidden port detection. Screenshot via Antirootkit.com.
• Helios - Alpha level program right now. Behavior-based, not signature based detection. Interesting interface and approach. Worth looking at, but remember it is alpha/beta level… Developers offer videos as well of their tool in action.
• HiddenFinder - trialware - Shows hidden processes and drivers on a system and then allows for killing of the desired process.
• HookExplorer - Tiny little application. Displays import address table (IAT) hijacks and “detour style hooks.” Lots of information in the tiny display!
• OS X Rootkit Hunter - Mac OS X 10.4 product. I don’t support Apple systems, but there you are. Screenshot page by developer. (I didn’t think Mac’s got sick like this!)
• chkrootkit - Linux rootkit scanner
• Panda Anti-Rootkit - beta software. Looks at hidden drivers, processes, modules, files, registry items, hooks. Not a lot of user options…scan, clean, and view results.
• Process Master - trialware - API comparison tool.
• RootKit Hook Analyzer - Reports on any system hooks and modules and displays findings.
• Rootkit Hunter - Linux rootkit scanner.
• RootKitShark - trialware - Command-line scanner. Unmasks located files and prevents from boot-execution. Then can be manually removed by user or using other security tools.
• WinShark - trialware - GUI based version that incorporates RootKitShark (above) among other features. Allows process and user monitoring of systems. (Intrusion Detection System). Detection enabled in trial version, but rootkit elimination feature only in the fully-licensed version.
• RootKit Uncover - beta - Appears to be a hidden process and file scanner. See Antirootkit.com’s page for overview. Bitdefender doesn’t have any information on their site for it.
• SEEM - Multi-purpose system reporting tool that has an interesting interface. Includes a rootkit scanner as part of it’s features. Website (translated from French) has quite a bit of good information on rootkits and as they apply to their program. Download page (kinda hard to find in French). Get the English version unless you know French.
• System Virginity Verifier - Tool developed by Joanna Rutkowska to validate system integrity by checking important Windows System components targeted by hidden malware. She also provides links to some related PowerPoint presentations.
• Unhackme - trialware - limited to 10 runs until license purchased and entered - In standard, “Roaming” and “Professional” editions. University of Minnesota’s Safe Computing page documents rootkit removal tutorial with Unhackme.
• Zeppoo - Linux rootkit scanner. Screenshot page. Blog page.

Additional Resources

• Antirootkit.com - Anti Rootkit Software, News, Articles and Forums
• Anti Rootkit Blog - Blog page for Antirootkit.com
• InvisibleThings.org - Website of security guru and brilliant mind Joanna Rutkowska. Presented “Blue Pill” concept. Lots of neat tools and detailed rootkit related information on her website.
• Episode #9 of Security Now - Rootkit discussion between Leo Laporte and Steve Gibson. Good foundational information.
• Behavioral Analysis of Rootkit Malware - Basic article from an ISC-SANS handler (with pictures!).
• Rootkits: Subverting the Windows Kernel (Addison-Wesley Software Security Series) (Paperback) - Amazon.com
• Rootkits, Spyware/Adware, Keyloggers and Backdoors: Detection and Neutralization (Paperback) - Amazon.com
• Rootkits for Dummies (For Dummies (Computer/Tech)) (Paperback) - Amazon.com
• Oddysee Rootkit Test - Very nice, well documented and illustrated post on how a rootkit shows up on various security scanners.

See you in the skies…

NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface. By running NirCmd with simple command-line option, you can write and delete values and keys in the Registry, write values into INI file, dial to your internet account or connect to a VPN network, restart windows or shut down the computer, create shortcut to a file, change the created/modified date of a file, change your display settings, turn off your monitor, open the door of your CD-ROM drive, and more…

Executing NirCmd commands on remote computers
Starting from version 1.40, you can execute all NirCmd commands in remote computers. However, you should be aware of the following restrictions and problems:

* This option is only available for Windows NT, Windows 2000 and Windows XP. You cannot use it on Windows 9x machines.
* You must log on to the remote machine as administrator.
* The Schedule service in the remote machine must be started. (By default, the Schedule service is automatically started in all NT/2000/XP machines, so you don’t have to worry too much about this)
* Due to some limitations of the Schedule service, you have to wait up to 60 seconds until the command is actually executed in the remote machine.
* The command in the remote machine is executed under ‘SYSTEM’ account, and thus some commands may not work in the same way as you execute them locally.

There are 2 commands for executing NirCmd in remote machines:

* remote - for executing command on a single remote computer.
* multiremote - for executing command on multiple remote computers.

General Purpose Settings - up to 6 minutes

A simple way to ensure that the quality is there is to export to MPEG-4 with:

* H.264 video at 2000Kbits/sec (2Mbits/sec or 250KBytes/sec)
* 320x240 video size (deinterlaced or simply use one field)
* Mono audio with AAC at 64 Kbit/sec (or 128 Kbit/sec for stereo)
* Recommended Sample Rate and
* Best Encoding Quality.
* In the Video Options Main Profile should be checked on and Best Quality (Multi-pass) is advised for best quality.