But i wanted to check out the GIT support available in Zend Studio 9. And hit a problem pretty quickly. But i will describe that below. First i will create a local clone of my git project.

$ git clone ssh://[somehost]/~/git/project.git

To test if everything is working i do a test commit. If that succeeds if push it out to the remote master.

$ cd project.git
$ touch TEST
$ git commit
$ git push origin master

So that works fine. Now time to see how Zen Studio handles this. To create a project i use the Create from Git option. And select the local checkout i just created. This will read the whole repository configuration. And you are basically done from here. But as i mentioned earlier, i had some difficulties getting things running smoothly. I discovered that when it was time to push changes to the master repository.

When i used the Push to Upstream option. I was greeted by a login panel that seemed to have selected the correct SSH key and user to perform the login. But when i typed the password, it just kept asking for the password. Again and again. Hmm. That sucks! The password was correct. I tried with a newly created key. No luck either. The last thing i tried was updating to a nightly build of Egit found here. But this offered no solution either.

After reading a couple of complaints i found this bug report for the EGit eclipse plugin. The thread contains a solution for the login issue i was having. Gotta love Google!

Apparently the problem has to do with the encryption algorithm used to create the SSH keys. In this case the EGit plugin (which uses Jsch to do the SSH communication) was having problems with AES encrypted keys. And to solve the problem the Jsch library should be replaced with a newer version to make things work again.

So lets download this JSch library and update it manually. The library (JSch v 0.1.46) can be found here.

$ cd ZendStudio9
$ find . -name ‘*jsch*’ -type f

Found it plugins/com.jcraft.jsch_0.1.41.v201101211617.jar. So let’s try to update that.

$ cp plugins/com.jcraft.jsch_0.1.41.v201101211617.jar plugins/com.jcraft.jsch_0.1.41.v201101211617.jar.backup
$ wget http://sourceforge.net/projects/jsch/files/jsch.jar/0.1.46/jsch-0.1.46.jar/download
$ mv jsch-0.1.46.jar plugins/com.jcraft.jsch_0.1.41.v201101211617.jar

After restarting ZS everything worked fine again. Another problem solved! Thanks to the guys who posted in the EGit bug thread. Some good community Karma here! Time for other things. Hope it helps!

I picked up the phone. And the guy (Amoria Bond) on the other end immediately started his sales pitch. O shit another one of those nasty recruiters. So after listening to him for a few seconds i quickly interrupted him. Told him i was not interested in a new job at all. And that he was a jerk and extremely unprofessional for calling me at the office. Completely unaware (or maybe intentionally?) what impact this might have if for instance my manager picks up the phone. Besides it’s just plain rude.

Now don’t get me wrong. It’s not a rant for nothing. I don’t hate recruiters. And have worked with some professional ones in the past. I’ve always enjoyed communicating with linda-lotte while she was still working for Recruit4it. And the guys at Starapple are OK as well. But this guy today really pissed me off with his aggressive unmannered approach. It’s a shame i didn’t catch his name while i was in rant mode. But please don’t ever call me again.

Update:

It seems to be some form of new tactic to call developers in the office where they work. This happened a couple of times more after this post. So this is for the next recruiter that calls me in the office. I’ll personally come over and kick your ass!!

With the email came a small excerpt of a IRC channel log. I recognized the node. So SSH’ed into that specific node. And used netstat to check for any strange connections. A connection on port 20 to the C&C node of the botnet. Thats not good.

$ netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 xxx.xxx.xxx.xx:20 69.162.80.62:20 ESTABLISHED

In the email from NCSC it was mentioned to look for files called wp-rss3.php. But a search for this file did not return any hits. Hmmm. And i still had no idea which site it concerned. Since a couple were running on this particular node. The only thing certain. It’s WordPress related. So i started searching for recent WordPress compromises. And found a lot of hits on Google for the timThumb and wps3slider plugins. But checking the log files for these plugins revealed nothing. And for some weird reason i just cleaned up the log partition a couple of days before. So not much luck there.

Some more Googling told me to do a search on the WordPress installs for the PHP function base64_decode(). O well. Lets give it a try. Some suspicious files did show up instantly.

$ find . -type f -exec grep -l ‘base64_decode’ {} \;
./uploads/2010/06/wp-rss4.php (source)
./uploads/2011/05/alienee.php (source)
./plugins/wps3slider/temp/34e3a3a74f6e2d0f236bdd3ba70c0c03.php (source)
./plugins/wps3slider/temp/cf2cdb3ad3249b9692de07290f16f287.php (encoded) (decoded)
./plugins/wps3slider/temp/771b821c974131c67e34c83d8d2db725.php (encoded) (decoded)
./plugins/wps3slider/temp/2b3753ea4769084f2e571737b695b03a.php (encoded) (decoded)
./plugins/wps3slider/temp/7228f168d9692eafeafc54dbc3a1ab49.php (encoded) (decoded)
./plugins/wps3slider/uploads/1.php (source)
/var/tmp/dc.pl (encoded) (decoded)

Interesting. A quick look at the files showed that most of them were obfuscated. But not all. Two of the files were IRC bots written in PHP. At this moment i couldn’t resist but crack a little smile. But its also a reminder of how fragile the web really is. I quickly moved the files out of the way. And rebooted the machine. When it came back online i monitored all connections for a while. But the connection to the C&C node was not restored. So i informed NCSC. And went back to bed!

The WordPress admin should have kept the sites up to date. Lesson learned i hope! of course i could not resist to come back to it later. And so i did. I started by searching the Apache log files for wp-rss4.php. And found a couple of instances where this file was directly called. From a total of 4 different IP addresses.

69.162.80.62

This is the IP address of the C&C server.

186.241.16.25
201.8.237.18
201.8.226.109

These IP addresses are all originating from Brasil. No further information is available at this moment. After that i started poking around the trojans / IRC bots found earlier. And as mentioned earlier. There were two bots installed on the server, One was running. The other wasn’t. This is configuration snippet from both bots.

The first bot. And the one i was informed about.

var $config = array("server"=>"antesedepois.servegame.com",^M
                     "port"=>20,^M
                     "pass"=>"depois",^M
                     "prefix"=>"depois",^M
                     "maxrand"=>8,^M
                     "chan"=>"#depoiswp",^M
                     "key"=>"",^M
                     "modes"=>"+iB-x",^M
                     "password"=>"depois",^M
                     "trigger"=>".",^M
                     "hostauth"=>"*" // * for any hostname^M

And the second one

var $config = array("server"=>"58.225.75.155",
                     "port"=>9999,
                     "pass"=>"",
                     "prefix"=>"animal",
                     "maxrand"=>8,
                     "chan"=>"#animal",
                     "key"=>"",
                     "modes"=>"+iB-x",
                     "password"=>"oishi",
                     "trigger"=>".",
                     "hostauth"=>"*!*@The.Black.Cat" // * for any hostname
                     );

Notice the ^M characters at the end. Seems like somebody is using windows. So now we have login details for two C&C servers. Why not take a look.

$ ircii
/server antesedepois.servegame.com:20

Some standard IRC stuff

*** Connecting to port 20 of server antesedepois.servegame.com
*** Welcome to the Internet Relay Chat Network, root (from IRCPRIVATE)
*** /etc/irc/script/local V0.5 for Debian finished. Welcome to ircII.
*** If you have not already done so, please read the new user information with /HELP NEWUSER
*** Your host is IRCPRIVATE, running version 1.2.1546
*** This server was created jan 27 2012 at 06: 29:02 HodB (Serial # 00-00-00)
*** channel modes available abdefghijklmnopqrstuvwxyzACEFIKLMOPT
*** IRCX
*** There are 6 users and 362 invisible on 1 servers
*** 7 channels have been formed
*** This server has 368 clients and 0 servers connected
*** Current local users: 368 Max: 989
*** Current global users: 368 Max: 989
*** MOTD Not Present

So let’s check the channels on this thing

/list

*** Channel Users Topic
*** #depoiswp 360 Entrou = Ban :)
*** #grmteam 6
*** #depoisSca 4 Entrou = Ban :)
*** #depoisSca 4 Entrou = Ban :)
*** #depoisVul 6 Entrou = Ban :)
*** #rfi 3
*** #sql 1

I entered all of the channels and waited for a while. But no activity took place. The only really interested channel is #depoiswp. This is the channel where all the bots connect. At the time i logged in there were about 360 of them available. I immediately recognized the log excerpt send to me by the NCSC.

*** Topic for #depoiswp: Entrou = Ban :)
*** #depoiswp SYSTEM 1327945185
(#depoiswp/#depoiswp) Entrou = Ban :)
*** [A]depois88802849 (~depois48170648@68.233.238.XX) has joined channel #depoiswp
*** #depoiswp 1327653297
*** [A]depois13436992 (~depois92951214@212.227.114.XX) has joined channel #depoiswp
*** [A]depois18833547 (~depois69088341@184.154.130.XX) has joined channel #depoiswp
*** [A]depois80116634 (~depois13242297@213.251.189.XXX) has joined channel #depoiswp
*** [A]depois31855907 (~depois23946193@82.85.28.XXX) has joined channel #depoiswp
*** [A]depois25458508 (~depois64120008@87.106.214.XX) has joined channel #depoiswp
*** [A]depois17803105 (~depois55004207@74.208.16.XX) has joined channel #depoiswp
*** [A]depois96800217 (~depois89042073@174.121.216.XXX) has joined channel #depoiswp
*** [A]depois17108432 (~depois51961332@209.68.1.XXX) has joined channel #depoiswp
*** [A]depois95432403 (~depois13925479@209.68.1.XXX) has joined channel #depoiswp
*** [A]depois96515275 (~depois10767943@195.74.38.XXX) has joined channel #depoiswp
*** [A]depois73596561 (~depois90562179@69.89.31.XXX) has joined channel #depoiswp
*** [A]depois85357227 (~depois31697723@64.191.115.XX) has joined channel #depoiswp
*** [A]depois07993697 (~depois40240585@79.96.128.XX) has joined channel #depoiswp
*** [A]depois97441253 (~depois19633359@193.189.74.XX) has joined channel #depoiswp
*** [A]depois76843389 (~depois55419325@176.9.34.XXX) has joined channel #depoiswp
*** [I]depois16679788 (~depois28004829@213.171.218.XXX) has joined channel #depoiswp
*** [A]depois88178285 (~depois05296405@74.220.215.XXX) has joined channel #depoiswp

<[A]depois16231776> [Attack Finalizado!]: 1749605 MB enviados / Pacotes enviados: 14580 MB/s
<[I]depois60130568> [Attack Finalizado!]: 75 MB enviados / Pacotes enviados: 1 MB/s
<[I]depois48664304> [Attack Finalizado!]: 75 MB enviados / Pacotes enviados: 1 MB/s
<[I]depois65415449> [Attack Finalizado!]: 75 MB enviados / Pacotes enviados: 1 MB/s
<[I]depois11325010> [Attack Finalizado!]: 75 MB enviados / Pacotes enviados: 1 MB/s
*** [A]depois40994506 (~depois72760562@79.98.28.XX) has joined channel #depoiswp
<[A]depois07568398> [Attack Finalizado!]: 2187317 MB enviados / Pacotes enviados: 18228 MB/s
<[A]depois55402758> [Attack Finalizado!]: 11425 MB enviados / Pacotes enviados: 95 MB/s
*** [A]depois03383512 (~depois52457929@74.220.215.XX) has joined channel #depoiswp
<[A]depois37064023> [Attack Finalizado!]: 1264043 MB enviados / Pacotes enviados: 10534 MB/s
<[A]depois69234369> [Attack Finalizado!]: 2205504 MB enviados / Pacotes enviados: 18379 MB/s
*** [A]depois74911768 (~depois04730096@74.220.215.XX) has joined channel #depoiswp
*** Signoff: [A]depois31575043 (Connection reset by peer)
<[I]depois17710498> [Attack Finalizado!]: 81 MB enviados / Pacotes enviados: 1 MB/s
<[I]depois28464134> [Attack Finalizado!]: 81 MB enviados / Pacotes enviados: 1 MB/s

Thats fine and all. I disconnected shortly after that. I really have no reason to be poking around there now do i ;) Besides who want to interfere with an ongoing investigation. So poking around the files a bit more didnot reveal all that information.Except for the fact that besides a IRC bot a backdoor was also installed in the form of a perl script dc.pl installed in /var/tmp. So who knows. The server might be rooted at this point.

I spend some more time on decoding the bot and trojan contents. And posted them on pastebin if you are interested. The server is going to be decommissioned soon. So i am not going to pay much more attention to it.

1.php and b2dabd0e2c42b55fabf741bcac29f857.php

Web Shell by boff

2b3753ea4769084f2e571737b695b03a.php

This file was base64 encoded but once decoded reveled to be a simple script by v0pCr3w and nob0dyCr3w to run system commands on the server. Also included was a simple upload form.

34e3a3a74f6e2d0f236bdd3ba70c0c03.php

c99 injector v1

771b821c974131c67e34c83d8d2db725.php

This script was rot13 and base64 encoded and was trying to cleanup after the hacker. And install a second back door.

7228f168d9692eafeafc54dbc3a1ab49.php and cce0a37ffc138a8908da05977639bed1.php

Again rot13 and base64 encoded.But this script contained something that looks like a control panel. The page title was ‘Hacked by Sherif #oishi @ ALLnet’

alienee.php

Still working on this one

cf2cdb3ad3249b9692de07290f16f287.php and ded3244749701c4eb5a29b959ad56736.php

These files contained a second bot that was connecting to a whole different server. Probably exploited by another crew?

dc.pl

This Perl backdoor was created by one of the IRC bot scripts. And was hiding in /var/tmp after creation.

And some links i found useful while working on this issue.

http://eromang.zataz.com/2012/01/08/gangbang-mytijn-org-malware-spreader-down/

http://www.madirish.net/content/hookworm-stealth-php-backdoor
http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/

I decided to give Ubuntu another try. After downloading and burning a fresh image. I did a clean install. And this time the result was a lot better then the first time. Maybe i just had a bad disk.

Unity still caused me issues. Mainly because i am running a dual monitor setup. And i wan to use a TwinView setup. This just does not seem to work at the moment. So i install GNOME Shell. And that seems to work a lot smoother with two screens. Even my sound issues have been resolved magically. Maybe i should stick with Ubuntu a bit longer.

This weekend i decided to finally try to upgrade Ubuntu to the latest version (11.10). And since the upgrade process was not working out for me. I had no other choice but to do a clean install. No problem. It was time for a clean install anyway.

After fighting my way through a pile of bad rewritable DVDs i finally managed to write to disc that didn’t halt in the middle of the install process. And finished the install quite quickly. No problem there.

The Lightgdm greeting instead of the old GDM interface was nice. I logged in. And then it hit me. O shit they hooked Ubuntu up with the Unity interface. The last time i upgraded Ubuntu that was the first thing i disabled. But my second screen wasn’t activated. So i decided to install the Nvidia drivers first. And then did a reboot.

After the system came back up. The desktop environment didn’t load anymore. And if i waited long enough the whole system would crawl to a halt. Damn! At this point i was getting sleepy. And didn’t want to spend the whole night poking around the system trying to fix this. So a bit of Google magic later i found this. Some issues related to the current Nvidia driver. So i upgraded to the 285.05 version

$ sudo bash
$ add-apt-repository ppa:ubuntu-x-swat/x-updates
$ apt-get update && apt-get upgrade
$ reboot

And after a reboot the desktop was fine again. Nice!

World of Warcraft

After that i installed wine and copied back the old files i already had installed previously. But World of Warcraft didn’t want to start anymore. And although i planned not to play for a while. This got me poking around. And of course couldn’t find a solution. So i downloaded a new game client from battle.net. And started a fresh install. But when the launcher came up. It crashed just like before. Tried it a couple more times. When i noticed it was crashing starting the download. SO i started poking around in the download settings. And disabled peer-to peer. And voila! It started working for me again.

Options > Downloader Preferences
(uncheck ¨Enable peer-to-peer Transfer¨)

Lets remove Unity!

Although i kind alike the Unity interface. It wasn’t running smoothly. And i was having some serious CPU load issues. So i decided to remove it once again. This time. It wasn’t as easy though. I followed the steps in this post. Only to come to the realization that its Gnome 3 i´m dealing with and not Gnome2. O well lets give it a try.

So after messing with the themes a bit. I got the normal look back. Now the only thing annoying left is the bottom bar. That has to go. And preferably moved to the second screen. This was surprisingly easy for a change. Start up DConfig Editor from the Applications menu. And navigate to.

org > gnome > gnome-panel > layout > toplevels

(then change)

monitor : 1
orientation : top

And fix the freaking keyboard

Sound still makes a crackling noise!

But at least i have a desktop that looks reasonably the same as my old and trusted Gnome2 one did.

So Chris Shiflett’s idea is for people to create a blog post called Ideas of March that:

• Lists some reasons why you like blogs (Read below)
• pledge to blog more the rest of the month (Working on it)
• share your thoughts on twitter with the #ideasofmarch hashtag (Done!)

I like blogs because ..
they offer me a platform where i can express my self without any limitations. And because more people tend to have this need to express them self. It leads to a great flow of valuable and creative information. Combine that with the ability to interact with a user base. And you have a great platform for having discussions. No need for rushed answers. You can just sit down and reflect your thoughts in a comment and start a discussion with the author. In short i offers freedom.

And ..
It’s also a great exercise platform. I myself are not native English speaker. So by blogging in English i tend to improve my own English language knowledge. Plus way more people speak English then Dutch. The second reasons is to improve once writing skills. Not that i have aspirations to become a write one day. but it never hurts to improve your skills.

Besides that it’s a great way to harvest your own thoughts over a period of time. And always have them at your disposal.

So if you read this. Write the Ideas of March post your self. And pledge to do more blogging this month. Some people who have already taken the time to express the thoughts on this initiative can be found below.

http://www.eschrade.com/page/ideas-of-march/
http://allinthehead.com/354
http://jontangerine.com/log/2011/03/ides-of-march
http://www.davidrhoden.com/eecore/index.php/weblog/ideas_of_march/
http://www.cvwdesign.com/txp/article/450/ideas-of-march
http://jeremycook.ca/2011/03/16/ideas-of-march/

I might as well write a post about the move to the Amazon Cloud late last year. Ever since this website went up in 2008. It has been running on one of my own servers. And this has done the job well for two years. Some people would say if it ain’t broke don’t try to fix it. But i like to try out new things. And running a server isn’t cheap. So if i can find a more affordable way of hosting this site i may be interested enough to move. So where do i move this site too. Some other hosting provider? Let’s try something different and host it from the cloud. I didn’t really want to go over the whole hassle of finding a suitable hosting provider. And i was doing some small project with Amazon Web-services. So my choice was made quite easy. Let’s try the wide array of options Amazon’s Web-services have to offer.

No way i was going to pay a fortune to set something up. So after some reading and some googling of course. I came to the Free Usage Tier page. This basically is a way to get familiar with the AWS system. And it offer quite a nice set of features to use. One year of free usage as long as you don’t go over the limit set for this microsystem.. Read more about the terms here . Some of the highlights are:

So that looks like a pretty nice offer from Amazon. Of course you don’t have to expect some multi core system waiting for you. But maybe it will do. I was interested enough to give it try. After logging in the place to start is the ec2 control panel. The first thing i did was create a new instance running Debian.

Make sure the right region is set in the region box. I logged in after creating my first image and couldn’t find it anywhere. Because the default region was not the one i used. From the dashboard i can just click the launch instance button and it gives me a list of different images to use as a virtual instance. There is plenty of flavour to choose from. I picked a community Debian instance.

The next screen is important because it sets the instance type to use. The Micro (t1.micro) is what i am looking for this time.

The rest of the install is quite self explanatory. At the end somewhere download the private key that will be used for setting up an SSH connection to the instance.

The next thing i did was setup a EBS storage volume for .. well .. storage. I made the choice for the EBS volume simply because it scales well. From the ec2 dashboard go to EBS instance and then create instance. Simply select the size and / or load it up with an image.

That pretty much does it. For the ec2 dashboard. The only thing left to do here is setup an elastic IP address so the instance is reachable from the outside world. This is basically assigning a ipv4 address to the instance. Click the elastic IP link and then allocate new address.

If all is well i should be able to login by SSH.

$ ssh -i [key name].pem ec2-user@[ip address].eu-west-1.compute.amazonaws.com
$ sudo bash

That’s it. I configured the instance using Zend Server and didn’t even bother to setup an RDS storage engine. I just installed MySQL. And used that for the site. Last but not least. Open port 80 on the firewall. This is easily done from the EC2 dashboard. I also opened up ports 10081 – 10083 bound to my home IP address so i can control Zend Server.

I was quite impressed with the AWS interface and the possibilities. But the cost is pretty high. The first month was nearly free. But while traffic keeps growing the cost keeps rising. This ended up me paying more for a single instance a month then for a complete server on which i can run multiple sites. So while extremely easy to use, flexible and just plain cool to work with. It’s not for this site. I thank Amazon for the available possibilities. And the Support i had today. But i am moving back to my own server as we speak.

Michael send me the end result. And everybody seemed happy with it. After that life resumed and i have been incredibly busy every since. So i kinda forgot about the whole thing. Till Vijay mailed me today (ty! Vijay). VMWare put the recording on their website. And a customer mailing has been transmitted over the wire. Cool stuff!

2011-02-07 VMware-Zend VOC Podcast

File > Export > General > Preferences

File > Import > General > Preferences

Bart’s zenburn theme:

Most developers i know don’t seem to care much about the colour of their screen and the font they use. But considering the fact that i spend an insanely amount of time behind a screen. It would be nice if this environment i am in all day put the least amount of constrained on my eyes as possible. So i choose to take time and configure this for optimal viewing pleasure. This starts with the font. For years i have been using the Envy Code font by Damien Guard inside my IDE. This all started i think with a post by Jeff Atwood It’s a great font that is extremely easy to read even for terminals. Although still in beta. I advice people to use it when possible.

The second thing i configure are the colour schemes my IDE uses. The standard colour always has a white background. White makes sure things are clear. But staring at a white screen for more then 6 hours always resulted in headaches for me. So the darker the better. And with a dark background you are forced to change the rest as well.

Changing the font is first

General > Appearance > Colors and Fonts
Font : Envy Code R Bold (11 pt)

Second up are some general text editor colours

General > Editors > Text Editors
Line number foreground : #787878 (120, 120, 120)
Current line highlight : #35353D (53, 53, 61)
Background color : #25252D (37, 37, 45)

And finally the PHP syntax coloring

PHP > Editor > Syntax Coloring
Decprecated : #000 (0, 0, 0)
Fields : #FFFFFF (255, 255, 255)
Heredoc : #008282 (0, 130, 130)
Keyword : #DE5727 (222, 87, 39)
Multi-line comment : #557F5F (85, 127, 95)
Normal : #FFF (255, 255, 255)
Number : #FFCECE (255, 206, 206)
PHP tags : #DE5727 (222, 87, 39)
PHP Doc : #FEC601 (254, 198, 1)
PHPDoc Comment : #FEC601 (254, 198, 1)
single line comment : #FEC601 (254, 198, 1)
static fields : #FFFFFF (255, 255, 255)
static methods : #FFFFFF (255, 255, 255)
String : #B3C0C8 (179, 192, 200)
Task Tags : #FEC601 (254, 198, 1)
Variable : #0B91B7 (11, 145, 183)

The result can be viewed below

There are much more configuration options to do but for now this is what i came up with. Setting up the theme is a since in ZS. But one thing bothered me. The function / property name highlighting when you select an element inside the IDE. Was a very light colour. And this made it impossible to read the contents of the selection.

So after searching for a while and setting every possible setting in the configuration tabs. I finally figured out how the set the colour for these two actions. This is done from the Annotations setting in the Text editors panel under the general tab. The two options to change are PHP elements read / write occurrences.

For now i settled with a dark colour. But maybe i will change this in the future since it is not very readable

That’s it for now. This of course only sets up the PHP environment. The syntax colours for XML, HTML, CSS and Javascript still have to be changed. But i will leave it at this.

Over the past years i have been a happy user of Compiz and the emerald theme manager. So these were two things i wanted to keep. Well that’s not going to happen. After playing around with xorg.conf for a couple of hours i just couldn’t manage to get the configuration i was looking for.

1. Single X Screen on the left
2. Two twinview screens on the right.

I managed to get Compiz to work with the 3 monitor setup. But this resulted in either having one large desktop extending the two 22 inch monitors. Or 3 screen using Compiz but with no possibility of sharing data between the screens. That just sucked. I have to admit this is one thing that just works better on Windows.

So the next was Xinerama. This meant switching Xinerama to “1″ in the config and restart X. Voila! Everything works. Well not everything. I have no Compiz effects and no emerald themes. So it’s slightly more ugly looking but it functions perfectly. So i will be keeping this config for now. Until i can either figure out how to get 3 monitors working using Compiz. Or get some effects / cool themes working while using Xinerama.