Various information on antivirus related products

New USB security tool, BeamGun..

USB SecurityBeamGun – So what is it all about, and do I need it?

Well, to answer the latter first – “maybe”,  if you could ever see yourself inserting a USB key you found somewhere, or if other people have access to your computer….

Background;

All modern computers have USB ports, you can attach all sorts of wonderful devices to USB ports – like mouse and keyboards, well imagine if someone made a device that looked like a USB key, however it actually emulated a keyboard – when you would plug this into your USB port it would tell your computer “Hey, I am totally a USB keyboard, honestly..”, and your computer would say “Hey that is cool, go ahead and be my second keyboard…”. So far so good, however, now this totally honest “keyboard” would start typing commands and your computer not knowing any better would think that it was you typing. So, long story short – any device looking like a USB key that is inserted into your computer has a chance to be an evil “Rubber Ducky USB” (that is the name under which many of these are actually sold), so someone either hands you a USB device and convince you to insert it (hey can you look at the report I just made) – or distracts you for a second and insert the USB device to your computer – BOOM and you are owned – in benign cases it just adds some practical joke (like switch your desktop background etc), but if evil it steals passwords etc. and it is very likely your Antivirus will not pick it up as it will look like commands issued from the local keyboard.

Sadly “no”, this is not Sci-Fi nor expensive, the script kiddie version of USB keys like this cost around 50$ but if you have real coding skills you can do it for 1-3$ 🙁

Ok, so anyone inserting a foreign USB device to your machine could be “hacking you”, or if you find an abandoned/lost USB key and insert it you may cause yourself to be hacked/compromised.

The tool;

https://github.com/JLospinoso/beamgun

2017-01-25 22_49_04-Greenshot

BeamGun to the rescue – BeamGun is actually rather nifty, it will monitor your computer – and the moment a new “keyboard” (or something emulating a keyboard) is inserted, it will lock your computer and block the device, it will also show anything this device was trying to do in a popup window.

Mind you, it is an early version and seem a bit rough around the edges, but if you are in the “risk” group this may be a tool you would want to install.  But it works (yes I tested it, however it is difficult to show screenshots as the software does a great job of protecting your computer while it display its warning).

Want to see more about these “Rubber Ducky USB” devices, take a look at this video;
https://youtu.be/4kX90HzA0FM
Something similar is also shown in the popular tv-show “Mr Robot”

Want to aspire as an evil hacker (or totally own your friends), buy your own “USB Rubber Ducky” here (yes its actually that simple);
https://hakshop.com/products/usb-rubber-ducky-deluxe

 

Links;

https://youtu.be/4kX90HzA0FM

https://github.com/JLospinoso/beamgun

https://hakshop.com/products/usb-rubber-ducky-deluxe

 

 

Free security for Aunt Mathilda or other family members

securityAs many of you may have experienced the Internet is not just filled with wonderful “things” and cute kittens, its equally filled with malware as well.  Just over the past 6 months, I in my professional capacity, have experienced Cryptolocker like malware more than 5 times, in the professional scene this was mainly a nuisance as we could “just” revert to backups – however in many private homes this could often mean “pay up” or loose your family photos etc. – seeing that many home users do not have a good backup strategy.

Sure antivirus may detect and protect against many of these things, however why rely solely on that – why not add an extra and free layer of protection to the internet of your friends/family and kids?  A protection that is not only free but also auto-updating thus maintenance free.

It is actually REALLY simple, all you do is to configure your DNS to use the DNS servers of Norton (and yes, it is totally free for home use).  Instructions for configuration is on their site https://connectsafe.norton.com/configurePC.html – on the top right you can even select the level of protection – three levels are available, may I suggest level 3 for Aunt Mathilda.

“Advanced” use

if you administer your own network and or router (or that of family and friends), then you can setup the DHCP to hand out these Norton DNS addresses and protect each and every device in the network (even that Internet of things ;-))..

Word of caution..

If you configure this setting manually (like shown below) and have a laptop you carry with you, then you MAY run into problems at schools/workplaces – in my company we ONLY allow our own DNS servers access to the internet and subsequently if you set your own DNS addresses these requests are blocked in the firewall.  This is not a problem for Aunt Mathilda or the toddlers using the home desktop computer, but keep it in mind if using laptops – the VERY best solution is to setup your DHCP to hand out the Norton DNS addresses..

2015-07-23 14_23_46-Internet Protocol Version 4 (TCP_IPv4) Properties

How good is it?

That is a difficult question to answer, as you get no statistics it would be pure guesswork – but seeing it is free and MIGHT protect you and your loved ones, why not just go with it.

Alternatives

This sounds really cool, but are there no alternatives?
Well sure there are alternatives, not sure if they are better but to mention a few;

https://www.comodo.com/secure-dns/ – Equally free, but give you adds for non-existing domains.

https://www.opendns.com/enterprise-security/threat-enforcement/packages/ – OpenDNS is a great and old player in this field, you can customize things and it even works in corporate environments – however it’s not free, you will need the “Umbrella Prosumer uses” license which is a bit hard to find on their site, however it will give you 3 devices for 20US$.

http://www.securly.com/parent-signup   – This one I just read about, it sounds cool though even though the purpose seem more parental control than security – by using Google accounts you keep track of your loved ones internet use and you get to see cool graphs etc.  But this one is equally not free.

Cleaning up after ransomware (Cryptolocker etc.).

2015-06-10 15_59_50-cryptolocker - Google Search - Internet ExplorerAfter experiencing Ransomware a few times during the past months in our corporate setup I decided to scribble down some cleanup notes and things you can do to combat this.

This guide is seen from the point of a sysadmins and thus not from an enduser, however some tricks may apply even so (depending on various factors). In addition, this guide focuses on the cleanup of the server and not the client computer, which in my opinion always should be reinstalled after an incident like this.

This guide also assume that you have Shadowcopy enabled on your server; if not then you will need to go for a restore from backup (this however also loosely covered in the guide).  See the good thing about Shadowcopy is, that as the server is not infected nor is the servers shadowcopy – you thus have quick access to non-corrupted data from here quite easily and quickly.  Client wise things are different as most ransomeware clears the shadowcopy locally to ensure against easy cleanup locally, I heard that this may fail if the user is not a local administrator on his/her pc, so you may still have a straw to cling to if this is the case for recovering the local data easily.

Background.

First, let me sum up what this ransomware is all about.

Ransomware is a special type of malware, opposed to a regular virus it is not as much aimed at spreading but more focuses on its area of business (to extort users to pay to regain access to their data).  Ransomware is often spread via phishing mails, you may receive a mail stating that you have a package at the post office (just one example) and that you need to download and open the linked file to get the details.  Once you download and run the file from the phishing mail, it will execute the ransomware software, which will run in the background encrypting your files without you noticing it (to begin with).

It is very hard protecting against malware like this, as the makers of this type of malware keep changing the software to avoid detection.  Furthermore, antivirus is only of limited help as it cannot restore files that has been encrypted.

Ransomware usually starts by encrypting local files first and then move on to server shares.

Ransomware is actually not a new thing; it has existed since the MS-dos days in some form or other. I recall a very old virus that infected your boot sector, and upon the trigger event (could be a date or a number of boots) it would delete your fat table and bring up a slot machine, if you won the game you would get your FAT table back if not everything was lost.  Same but different.

How to get your data back after it being encrypted?  Well best bet is backups, hopefully you have either backups on some USB disk or in the cloud, if not you are likely in serious problems.  You can also choose to pay the ransom and have your data de-crypted, the price for this is usually around 100€ or 100$ depending, and from what I have heard it should work quite well and reliable to get your data back this way – some of the ransomware vendors should even have kind of customer support to assist you if you have problems – but supporting organized crime hardly seem like a good idea in the long run.

Anyhow, let us move on to the “fun” part, how to clean-up a file server after a visit from a client infected with ransomware.

So you have been struck by Ransomware (Cryptolocker, Cryptowall, Cryptodefence etc etc etc), “congratulations” and welcome to the club 🙁

Let us go through some steps to get things back on the road.

Important tip;

If you are using Shadowcopy on your server, DO NOT START CLEANUP BEFORE DATA HAS BEEN RESTORED – you may just waste storage space from your shadowcopy pool and thus be able to restore less data.

 

Step 1 – Stop the disaster from escalating.

You need to figure out which user is infected and stop this users pc from encrypting more files on your servers, if you are not fast to react your server will quickly look like this (the white is the infected files, it’s a mess).

Step 1.1 – how to identify the user

There are obviously different tactics for this, but two obvious once are;

1) look at an encrypted file and determine the owner – now to my surprise this did not work on the last server I looked at, here all the files for some reason was set to be owned by the local administrator group.

2) Look at the home folder for your users – most ransomware drop files on how to decrypt your data and these may serve as tell tail signs of “infection”.

2015-06-10 15_33_47-mRemoteNG - confCons.xml2015-06-10 15_29_46-mRemoteNG - confCons.xml

Thus, the user with all the “decrypt” files in his homedrive will be the user you are after.  Simply search the user’s folder for files with the word “decrypt” in it. The ransomware normally also targets the users local drives first, thus you may catch a lucky break if you like us have redirected the “My Documents” folder to the users home directory on the server, in our cases this meant that the infected users had tons of these files on his home share.

Step 1.2 – Shutdown the user’s computer

Shutdown the user’s computer and change the password of the user (as the user has malware on his/her computer his/her passwords (all of them) are likely now compromised.

 

Step 2 – Assess the damage

You now need to look at the server to determine how much data have been encrypted. How to determine the “infection” rate, well that depends – different ransomware uses different tactics, however at least for now they seem to share these tactics.

1) The ransomware will encrypt files, then add some extension to the file to show that it is encrypted (the extension may vary, but could be .encrypted or .iufasee or something totally different/random – but still the same for all encrypted files).

2) After encrypting a complete folder ransomware will often add 2-4 files that pertain to how to decrypt data, these files could be named “HELP_DECRYPT.TXT” / “HELP_DECRYPT.BMP” / “HOW_DECRYPT.TXT” / “!Decrypt-All-Files-iufasee.bmp” or anything like that.

2015-06-10 15_29_46-mRemoteNG - confCons.xml

NOTE: the ransomware is quite clever as not to change the creationdata/last modified date as this makes it hard to just look for files changed in the past 24h – however, as I mentioned in step two then the ransomware often creates “how to decrypt” files/pictures/links in the folders and these may be used to spot the “infection”.

My suggestion is;

  1. Try to determine the file extension using the tips above.
  2. Use Windirstat to get an idea of the scope of the incident (you can see an example below) http://windirstat.info/
  3. See screenshoot (the white is the encrypted/infected data).

cryptolocker

 

Step 3 – Restoring data (the non-encrypted files)

See we had a special challenge with restoring data as we use online backup, and the restore hence will take a LONG time seeing that the data need to come from the WAN restoring gigabytes of data would take a LONG time, so we had to get creative to make the cleanup as fast as possible.

You first need to determine the time for the last backup/shadowcopy snapshot before the “infection” occurred.

If you have shadow copy, then go back through the snapshots to find the time where files had their original extension. You may get best results if you look at the infected users home folder, this is likely the first folder to be “infected” (you can also look at the creation date/time of the “how to decrypt” files which may give you a lead).

2015-06-10 15_29_46-mRemoteNG - confCons.xml

If you have local backup it is quite easy I guess, just restore more or less all data (with the do not overwrite newer/changed versions option set) and then proceed to delete the encrypted data and the “help files” (the once on how to decrypt) – see section below on how to cleanup.

If however you cannot easily restore data from backup (like e.g. if you use “online backup” like we did), then move to shadowcopy (which you hopefully have enabled on the server).

You could of cause restore one file/folder at the time from shadowcopy, this will take forever especially if users have worked on the folder structure meanwhile. So why not make it fast and easy by using robocopy (yes it is actually possible to use Robocopy, we found a cool way to do this).

Restoring non encrypted data via ShadowCopy and Robocopy.

  • Determine the “last good” shadowcopy, the one just before files started to be encrypted.

 

    1. On the server list the shadowcopy snapshots using the dos command, you do this to get the “identifier” which we will need in a moment.Start an administrative command prompt and issue the command;
      vssadmin list shadows
      (you may need to change drive to the drive you want to see)This will give you a long list of available snapshots, see screenshot.
      2015-06-10 15_00_00-mRemoteNG - confCons.xmlLook for the creation time and find the block just before the incident occurred.

      In this block “Contents of shadow copy set ID {…….}” look for the line “Shadow Copy Volume”, copy this line to a notepad starting with \\

      In this example;
      2015-06-10 14_56_13-mRemoteNG - confCons.xml

      \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy107
      NOTE: the number at the end will be different for you.

      IMPORTANT! Now add a “\” to the line in notepad: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy107\

      Finally add a prefix of “mklink /d c:\restore ” to the line in notepad.
      So the final line should look like this;
      2015-06-10 15_12_14-mRemoteNG - confCons.xml

      mklink /d c:\restore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy107\
      (note: the c:\restore is a folder/name YOU choose, it can basically be anything you choose, the name must NOT exist before you run the command)Now run this command from the administrative command prompt.
      2015-06-10 15_09_35-mRemoteNG - confCons.xml

      It should give you a feedback much like;
      symbolic link created for c:\restore <<===>> \\?\GLOBALROOT\Device\HarddiskVolum eShadowCopy107\

      2015-06-10 15_13_13-mRemoteNG - confCons.xml

      Now if you write;
      dir c:\restore
      you will have a historic view of how the disk looked at the time of the shadowcopy snapshot, you could get the same via properties “previous version”… but this is much neater as you can access and script it.

  • Now we have the snapshot mounted we can run a robocopy job restoring any data that is not more recent or changed.In this example the command would be something like;ROBOCOPY C:\restore D:\ *.* /XC /XO /E /LOG:d:\restore.log
    2015-06-10 15_18_12-mRemoteNG - confCons.xmlYou will need to suit it to your environment.

    Things to make a note of are the /XC /XO command switches which ensures that we do not overwrite files modified after the “infection”. As the encrypted “infected” files have a different extinction this is not a problem.

    After the restore you can review the restore.log file to see if anything went wrong and see how much data was restored.

    Note, you MAY run into the problem that not everything was in shadowcopy in which case you have to revert to backups, in the incidents we have had “only” 10-20 gb of data was “infected” and our shadowcopy could easily accommodate this.

 

 

Step 4 – CleanUp

Final step is to clean up the encrypted files and the decrypt instructions.

Also remove the “directory link” to the shadowcopy snapshot if you used that (see previous section), you can just use “RD <directory name>”.

2015-06-10 15_13_13-mRemoteNG - confCons.xml

I used SearchMyFiles from http://www.nirsoft.net/ as it is easy and very customizable to use to find files, I suggest you take not more than 10.000 files at the time as deleting many files takes quite some time.

2015-06-10 16_41_29-2015-06-10 10_41_17-mRemoteNG - confCons.xml.png - Windows Photo Viewer

 

Mitigation strategy

  • On fileservers, try to limit access as much as possible – if nothing more than look at making data read-only wherever possible as this alone will protect you greatly.
  • FSRM – File Server Resources Monitor, set this up to detect and trigger alarms on new files where the word decrypt is part of the name – decrypt as part of a filename is uncommon enough to give only limited false alarms – I will create a separate article on the configuration of this later.
  • Supporters / super users – instruct them to react FAST to tell tail signs of ransomware, the faster you manage to stop the “infection” the less to clean up.

 

Tools that may be useful;

Decrypt Cryptolocker (this most likely will not work, but give it a go anyhow just in case).
https://www.decryptcryptolocker.com/

Windirstat                                     http://windirstat.info/
SearchMyFiles                              http://www.nirsoft.net/

Read more about Cryptolocker; http://en.wikipedia.org/wiki/CryptoLocker

Thanks to:

Torben Slaikjer for finding that link on how to mount shadowcopy snapshot as a directory, this made the job vastly easier.

Forefront Endpoint Protection – fustrations

2013-06-28_14h08_52I just updated our “Microsoft Forefront Endpoint Protection” client software, this in turn caused several of my scripts to stop working 🙁

Digging led to the discovery that the PATH has changed :-/ omg why change that…

Namely I ran two commands weekly on all our servers;

"C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe" -SignatureUpdate -MMPC"
"C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe" -scan -scantype 2"

The first foreces Forefront to update it’s definitions straight from the Internet repository, and the second forces a full scan.

but the “Antimalware” part of Forefront (or at least MpCmdRun.exe) seem to have moved from;

C:\Program Files\Microsoft Security Client\Antimalware” to “”C:\Program Files\Microsoft Security Client

But why 🙁  – anyhow, if you update your Forefront Endpoint Protection be sure to check any manual scripts you have running.

 

Downloading the updates manually;

You can still download the update file manually (80mb aprox), it’s the same file as for Endpoint Protection –  get them here;
http://www.microsoft.com/security/portal/definitions/howtomse.aspx
or try this undocumented one (direct download link); http://go.microsoft.com/fwlink/?LinkID=121721

 

 

WordPress Security -> Wordfence

WordFence

You are likely familiar with WordPress, if not well – interesting 😉  anyhow, you may also have heard about the recent attacks on wordpress blogs by a worm like virus/malware?  Attacks on WordPress installations is not something new, it has always been there as it’s such a popular platform however time has revealed some not so smart features with wordpress security, one thing is that you can try to log in as many times as you like without any action being taken – hence there is nothing to stop a brute force attack on your wordpress installation’s login!?

Well Wordfence to the rescue, a simple plugin you install on your wordpress installation that all of a sudden offers you a ton of cool security features, I will just mention a few here – for the complete listing visit their website..

Features;

  • Login limiter – limit how many incorrect passwords/usernames are accepted
  • Site and theme scanner – scan your wordpress blog for changes
  • Block unwanted IP’s from accessing your site
  • Manage crawlers (search engine index bots)
  • and many many many more cool features

You can define what the reaction to different attacks, eg. block IP/Lock account for xx min/throttle traffic.

Wordfence1

Now a thing like that must cost a fortune you say!?  well no, there is a TOTALLY FREE version with basic functionality (enough for most I would say) and the deluxe version which cost a bit.

Now after adding this you should also add Two Factor Authentication, eg using “WordPress Google Authenticator Plugin” – http://wordpress.org/extend/plugins/google-authenticator/screenshots/ Or one of the other TwoFactor authentication solutions out there.

So, what are you waiting for 🙂 protect your WordPress blog now 🙂

How to install Malwarebytes and remove malware/virus easy

Here is a short video guide to removing malware using Malwarebytes.org’s free scanner.

English language version;

Danish language version;

For more details on how to remove malware and viruses then look here;

http://www.kanmandet.dk/?page_id=1222

Microsoft rootkit and malware scanner (Beta)

Recently I mentioned the Microsoft Security Scanner (http://www.kanmandet.dk/?p=2011) a portable/standalone scanner for your pc, well it seem Microsoft is stepping up their Anti Malware/Rootkit effords – link to their new beta project;  http://connect.microsoft.com/systemsweeper

The link is to a beta project from Microsoft introducing a bootable ISO that will help getting rid of rootkits and what now (Rootkits which logically are notorious difficult to detect and remote from within the OS installation).

It’s still in Beta, but looks interesting indeed.

32 bit version; http://go.microsoft.com/fwlink/?LinkId=215854

64 bit version; http://go.microsoft.com/fwlink/?LinkId=215855

Microsoft site; http://connect.microsoft.com/systemsweeper

It is also worth noticing that the latest version of Microsoft DART “ERD commander” (the old Winternal/Sysinternal utility to boot, modify and fix Windows installations) now also contain a malware scanning and removal utility (Standalone System Sweeper) – this is however sadly only available to Microsoft corporate license holders.

Microsoft Security Scanner

Microsoft has released a no-nonsense simple to use, free and downloadable tool – Microsoft Security Scanner – to check and cleanup virus infections (or suspected infections).

This tool is not intended as an antivirus, it is intended as a cleanup utility for infected computers or as a tool you can download and do a double-check to confirm you are not infected (say your installed antivirus is unable to detect a certain virus/malware, then you can double check using Microsoft Security Scanner).

You can download it free from here (note the download only works for 10 days, then you have to re-download an updated version, this is to ensure the virus detection patterns are always fully up to date);
http://www.microsoft.com/security/scanner/en-us/default.aspx

A good thing to also do is to run Microsoft Malicious Software Removal Tool from time to time – this is done automatically as part of  Windows Update, however this is only the ‘fast/quick’ scan – by starting the MRT.EXE manually you can do a FULL scan.  The Malicious Software Removal Tool is installed on all windows machines and updated/maintained via Windows Updates.

to run it;

Btw; McAfee has  a similar yet not so comprehensive utility called Stinger (also free download);
http://www.mcafee.com/us/downloads/free-tools/stinger.aspx

Untangle – a cool open source TMG for your lan

In these days Internet security is more important than ever, would it not be neat if you could run all your Internet traffic through a big filter to filter out all those nasty viruses, malware and privacy concerns!?   Well, if you happen to have an old PC lying around or as I have a server running MS-Hyper-V then you actually can fairly simple (and free)..

Ok, you may have heard about such solutions as; Smoothwall, monowall and others like them?  These are basically routers/firewalls, and could with a PC (and two nics) replace your broadband router, they contain complex firewall capabilities and maybe even VPN connect possibility.  All very cool and quite easy to setup and use..

Untangle go a step further than this, to the basic router capability is added firewall, vpn, antivirus scanning, privacy filter, ad filter, spam filter, captive page and much much more.  The best part is that most of this is free, you can download a bunch of apps and install these (this is point and click, so no linux knowledge is required).

So how does it work, is it a proxy or is it a gateway or what?  Well once installed you set the LAN nic IP as the default gateway and viola all traffic is now filtered against malware, virus, spam, privacy concerns and what not..

I setup my Untangle box as a Hyper-V machine on my Windows 2008R2 server, gave it 640mb ram and two cpu’s and a 120gb hard drive (of which it is now using aprox 6-7gb).

Once installed you configure everything via the web-interface (not on the box itself if you use Hyper-V, but on you own pc);

So a few notes on installing the app as a hyper-v virtual server;

  • Obvious disadvantages, you will never be able to install the Hyper-V additions into the Linux box, thus no mouse ever which leaves the user interface on the installed box useless.
  • I had to run the installation 4-5 times before I succeded, dont know why it failed but it was as if the installer just stalled during the installation, thus I suggest you take a snapshot once you manage to install the basic system (now you can always revert to here).

Ok, let me just give you the quick tour of installing the thing, it is not a complete guide
(so no screenshots and some obvious steps may be omitted, but if you know a bit of Hyper-v’ing it should not be too hard);

1. Download the Untangled install cd from; http://www.untangle.com/Downloads/Download-ISO

2. Create a new Hyper-V machine (I suggest 640mb ram, 2 cpu’s), replace the NIC with two legacy NIC’s (required to work), an IDE drive – I used a dynamic drive of 120gb but I think performance may be better if you set a static drive of perhaps 20gb, mount the downloaded ISO as the CD rom. Tweaks; you can stick to one legacy NIC if you do not plan to use the box as a firewall (eg. if you have a HW firewall in your ISP router etc), some things will not work with only one nic but most will.

3. Start the system and select the Text based installer (as you have no mouse in hyper-v), I seemed to have better luck with the advanced installer..  You should set static IP’s so decide on two IP’s before getting started.

4. Once the installation is complete switch to your browser and connect to the IP you set as the LAN side during install

5. Take a snapshot of your of your Hyper-V machine.

6. Now download the “open source pack”, on the left of the interface.

7. Configure the different modules, I suggest you disable/turn off the firewall, anti spam, PG, intrusion prevention features (unless you plan on using the device as your main router) as this will speed up performance.

8. Now set the LAN NIC IP as your default gateway on your pc (or on your DHCP server)

You can even set up a captive page, this will require people to have a password in order to access the Internet quite cool – sadly it does not support limiting bandwidth, download ratios etc. but well it’s still cool.

Don’t worry if your first or second install fails, as mentioned I had to do multiple installs before it succeeded, but now it runs fairly smooth.  I have experienced that the web-interface was unavailable (network still worked, but I could not reach the interface), but after a reboot everything was back online.

Read more here; www.untangle.com  –  http://wiki.untangle.com/index.php/Untangle_Server_User’s_Guide

Trinity rescue Kit – Malware cleanup disk

I just learned of a new antivirus/malware cleanup CD/iso, with support for NTFS and more.

Trinity Rescue Kit can be obtained from here;
http://trinityhome.org/Home/index.php?wpid=1&front_id=12 or http://trinityhome.org/

It sounds like a cool CD with numerous cleanup utilities, definitely worth a visit.  I for one is going to download a copy and check it out.