Rick's World

I find it really ironic that a lot of the referer spam I get is linked to my blog articles against referer spam! heh.

I seem to be getting quite a bit referer spam lately. Not as much as the flood I used to get when I had the referers posted on the front page, though. I'm curious why they are interested in me again all of a sudden when I'm not showing their links.

These spammers are becoming downright criminal in their actions. Here's a few new ones I've noticed in my logs:

1. Our friend cyber-search.biz, who's been feeding this 33.WMF file for the last few weeks is now feeding a different WMF file, named 'cyber.WMF'. Whether or not this is the same file with a different name, I don't know. I am still suspicious that this WMF file is an exploit of the Windows WMF processing bug. I see this cyber-search.biz site feeding these WMF files all over the place.
2. It looks like some spammers are taking advantage of some badly written web sites to disguise the URL of their sites. I'm seeing entries in the log file where it's what looks like a legitimate site that is using HTML frames. Their frame page is written to take a parameter that passes in the URL of the web site to display in the frame. The spammers are then using this parameter to essentially wrap their URL inside a frameset from the legitimate site. This leads your browser to display the URL of the legit site, but show the content of the spammer site. Plus, if you attempt to block the site, you end up blocking the legit site and not the spammer site.
3. The spammers are heavily targeting teens as a way of compromising the teen's computers. I see many links from site with the word 'teen' in the domain name. The names have harmless sounding domains like 'teensspace.com' (which sounds suspiciously similar to the very popular teen site 'myspace.com'), 'teen-search.info', etc. Many of these sites link to that infamous 33.WMF file that cyber-search.biz has been feeding. A teen clicks on these sites, loads that 33.WMF file, and ends up unknowningly compromising their computer for the spammer/criminal's use.
4. The spammers are now using false 'search engine' sites to redirect people toward this 33.WMF file. I see MANY 'refering searches' in my logs as coming from these bogus sites. This is just a different way of the bloggers trying to force their way into your site so you can display their links for the unsuspecting to click on.

Wow, I've never banned an entire country from my site before!

I just modified my site to ban the entire country of Russia. Why? Because this seems to be the source of most of the referer spam I'm getting. It's unfortunate that I need to resort to this large of a ban, but I must keep the spam under control.

I got a few minutes to play with the latest build of Windows Vista last night. I've only just installed it, so keep in mind these are just first impressions. They may change.

The installation is now graphical from the very beginning. A nice change. The installation is also nicely minimal. You pretty much just set it to install and then let it do it's thing. You don't need to click so many boxes anymore. It does a lot of this stuff automatically. I like this newer, simpler install. The only thing I would change is the progress bar on the bottom. The install takes a long time. It often seems as if it's not doing anything. For a while there I thought it got stuck. The installation needs a bit more 'confort UI' to ensure you that it is actually doing something. Maybe a 'time left to complete' or something that counts down...

The Control Panel is completely rearranged. I actually kind of like this arrangement. It seems to make more logical sense than previous versions of Windows.

The UI is interesting. I like most of the changes they have done. They finally got rid of the word "Start" from the menu button in the lower left corner... I always thought that was a really stupid design. I like this change. They made the taskbar default to a shaded black color... I'm not sure about this one. The minimize, maximize and close buttons in the upper right hand corner of a window look different. I'm not sure I like this look. I like how the buttons kind of light up when you hover over them though. Many of the windows now kind of 'expand' out when you open them. They don't just pop onto the screen. This is an interesting effect that I kind of like. I haven't played with the UI too much yet, but it does look like they've enhanced the 'snazzy' effects quite a bit. I'm not sure it's up to the Mac level of snazzy effects, but it's an improvement.

I haven't been able to try out Internet Explorer yet. Apparently it didn't detect my motherboard's network card properly and install the drivers. I'm going to have to try to do that manually.

It is buggy though. It seems to have some trouble with going into and out of Sleep mode. When I put it to sleep, it went to sleep very rapidly (nice!). But when I brought it back from sleep mode, it seemed to lose the mouse. I was forced to use the keyboard from that point on. Once I got back from sleep mode, I actually tried to shut it down and it seemed to get stuck in the middle of shutdown.

All in all, my first impression is that this new Windows looks promising. I'll have to play with it some more to see how stable it is and how well things work.

My friend Dave, has a blog over on MSN Spaces, which is a Microsoft owned site. I read his blog regularly and have subscribed to the RSS feed for it. I read his blog and subscribe to the RSS feed through Firefox, a NON-Microsoft browser. Now in the past, Microsoft has always had a serious case of 'tunnel-vision' when it comes to web sites. They seem to design their websites intentionally to only work in Internet Explorer, thier web browser. This fact has often caused Microsoft owned web sites to either only partially work or to not work at all in non-Microsoft browsers.

The RSS feed from MSN Spaces frequently fails to work in Firefox with some kind of XML parser error. Every other RSS feed that I use in Firefox works perfectly though. This leads me to believe that the problem lies with MSN Spaces and not with Firefox itself. Recently, however, it seems like Microsoft has been making an effort to improve their Firefox compatibility. The MSN Spaces RSS feed seems to work more often than it used to and several of their newer sites are much more capable in Firefox.

Recently, Microsoft rolled out some 'improvements' to the MSN Spaces site. I don't use it much so I never really tried any of these improvements. I just found a major problem though. While the RSS feeds work now, you can't post comments in Firefox! This is a big hole! Microsoft, fix this right away! This is unacceptable!

I got an iPod video a few days ago. I've been trying to figure out how to copy DVDs to the iPod Video so I have something to watch on that trip to Paris, that I'm taking. This morning, I figured it out and successfully copied a DVD to the iPod. Here's how to do it. Note that these instructions are for Windows. I haven't quite figured out how to do this on the Mac yet. Once I do, I'll post a follow-up blog with those instructions.

Download the following two programs:

1. DVD Shrink. You can find this by doing a Google search. You will need this program to copy the movie off of the DVD and onto your hard drive, breaking the copy protection in the process.
2. Videora iPod Converter. This freeware program will give you a one-click way of converting the video from the DVD into iPod format.

Now follow these steps to setup DVD Shrink. You only need to to this once.

1. Install DVD Shrink.
2. Run DVD Shrink.
3. Click on the Edit menu, and choose Preferences.
4. Click on the "Output Files" tab.
5. Make sure the option that says "Split VOB files into 1GB size chunks (recommended)" is NOT checked.
6. Click the 'Ok' button to save these changes.

Now follow these steps to setup Videora iPod Converter. You only need to do this once.

1. Install Videora iPod Converter
2. Run Videora
3. Click on Setup and set the directory you want to output the finished movie files to.

Now for the actual copying.

1. Run DVD Shrink
2. Insert the DVD you want to copy.
3. Click on the 'Open Disc' button in the toolbar. Then click 'ok' on the dialog box that comes next.
4. DVD Shrink will spend 1-2 minutes analyzing your DVD disk. Once it is done, it will display the contents of the DVD.
5. Click on the 'Backup!' button on the toolbar.
6. In the 'Target Device' tab, under 'Select backup target', choose 'Hard Disk Folder'.
7. Under 'Select target folder for DVD output files', select a directory to extract the DVD contents to on your hard drive. Note that you must make sure to enter a DIFFERENT directory here for each DVD you extract. If you don't do this, you could end up overwriting the contents of a previously extracted DVD.
8. Click the 'OK' button.
9. DVD shrink will then spend the next 30-60 minutes extracting the contents of the DVD to your hard drive. Just keep an eye on it and come back when it's done.
10. Once DVD Shrink says it is done, you can close DVD Shrink.
11. Open Windows Explorer and browse to the directory where you just extracted the DVD to.
12. Underneath that directory where you just extracted the DVD files, browse to the 'VIDEO_TS' directory.
13. Look through all the files with a VOB extension. The largest file with a VOB extension should be the movie. This file will likely be several GB is size.
14. Rename this large VOB file so that the filename is of the format NameOfMovie.VOB
15. Run Videora iPod Converter.
16. Click on Convert
17. Click on the 'One-Click Transcode' button.
18. Browse to the directory where you have that large VOB file, and select that file. You can select several VOB files at once here if you want and it will convert all of them in a batch.
19. Click the 'Open' button. Videora will then spend a while converting the video to iPod format.
20. When Videora is done, go to your output directory, and copy the new MP4 file for the movie into your iTunes directory.
21. Import the video into your iTunes library.
22. Copy the video to your iPod, using iTunes.

Done! You can now go to the 'Movies' section of the Video menu on the iPod and watch the movie. Enjoy!

Last night I decided to take the plunge and try Windows XP 64 bit edition. I installed it (several times) on my Athlon 64 PC at home. I've always avoided it before because I felt that I really didn't need a 64 bit OS. I really don't do much complicated stuff on my home PC these days. I mostly just play around with it. What changed my mind? Simple. My PC has been acting very odd lately - weird noises from the sound card, MSN Messenger refusing to EVER log in, even though it works on the Mac, etc. I figured it was time to give the computer a 'cleaning' by reinstalling. Since I was going to go through the hassle of reinstalling Windows anyway, I figured I might as well put my 64 bit CPU to good use and try Windows XP 64 bit edition again. So far it's been a bit of a bumpy ride. Norton SystemWorks 2006 (the NEWEST version that just came out a few weeks ago) refuses to install and AVG Antivirus (a free virus scanner) refuses to install as well. Firefox and Nero installed perfectly though. I'll be sure to comment on my experiences with this. Lets see how long I can survive this.

See the link for this blog entry for a good article on Emacs.

Emacs is one of the 'big two' text editors in Unix. The other is VI. I personally prefer Emacs.

Sed is a Unix command line tool for doing string substitutions in text files. It is VERY handy when searching for referer spam in your access logs. The article for this blog goes into great detail on how to use it.

I'll write a detailed blog on how to locate referer spam in the future...

Yesterday, I wrote about how it appears that the referer spammers are all using a program called Wget to download my website and hence place their links on my site. I just got finished searching my entire access logs for the last month for this Wget program. It was there for almost 50% of the links on my site (likely the 49% I saw yesterday). I am in the process of banning these IPs now. Below is a complete list of the IPs that sent me spam last month. If you run a blog like I do, I suggest you ban these IPs from your site, as I did: