blog.johndwhite.net~InfoDump » IT jargon, musings, and life in general...

tag at the top of your page~InfoDump IT jargon, musings, and life in general… Home About Me Build Specs Contact Me » Twitter RSS Categories Applications General IT Linux Scripting Windows Recent Posts Weekend of Virus Removal! Configuring SNMP on Windows Hosts Nagios v3Centreon v2 Guide MS SQL Server Express 2008 Remote Connections BareTail for Windows Archives December 2012 September 2012 August 2012 Latest Tweets johndwhite0388 Kind of scary that I can pull out notes for a colleague on DB Normalization from my degree in under a minute while at work #tooorganized - posted on 10/05/2013 14:41:24 I just unlocked the Acquire Kittehs! badge on @codecademy ! http://t.co/a2m3H97Ifx via @codecademy - posted on 26/04/2013 11:17:27 I just unlocked the How to use APIs with Python badge on @codecademy ! http://t.co/a2m3H97Ifx via @codecademy - posted on 26/04/2013 10:47:10 I just unlocked the File Input/Output badge on @codecademy ! http://t.co/a2m3H97Ifx via @codecademy - posted on 25/04/2013 17:27:25 Dec 17 Weekend of Virus Removal! by John on December 17, 2012 at 6:00 AM Posted In: Applications , IT , Windows I don’t deal with user”-type issues at my current job, so my exposure to these sorts of things has been drastically reduced to the occasional friend or family member. This past weekend was one such experience, and an experience it was! I had to deal with a particularly nasty bunch of viruses/rootkits/malware, and while I’m no stranger to the routine removal of such things, I actually had to look up some new tools to help me out with this one. I’ll go through my newly expanded list of utilities below, in the order of use. The Operating System! First and foremost, before you start downloading and installing the first 10 hits on google for whatever problem you are having, make use of the tools already at your disposal. While you may not be able to solve all your problems without additional tools, at least taking a look around the OS will give you some hints on where to focus your efforts. Here is a list of things I usually do before doing anything else: Check currently running services and processes using Task Manager More often than not, the problem you are diagnosing is a slow” computer. Check how much memory/CPU is being used and by what to see if the answer is already right in front of you. The culprit may be an unfamiliar process that is most likely malware, but it could just as easily be a malfunctioning legitimate process. It could also be death by a thousand paper cuts – meaning you have way too many things running at once, perhaps due to necessary startup programs. Check Windows Event Logs This seems like common sense, but no one seems to start here. The logs are useful, and should almost always give you some kind of idea what the problem is, or at least what part of the system is being affected. Update your system Now, this step isn’t very likely to fix anything, but it will certainly help keep problems at bay in the future. An up to date system is much less likely to become infected or suffer from performance bugs. It may even reveal problems or infections by virtue of NOT running properly for you (ie. Windows Update errors). msconfig msconfig is a program that is available on any Windows OS, and can be used to modify startup services, programs, and scripts, specify special boot parameters, and launch some system tools. For example, instead of fighting with your BIOS and bootloader trying to get into the Windows boot selection screen manually by pressing F8 at just the right time, you can just tell Windows to use safe boot next time you restart. Some of you might prefer using 3rd party tools to control most of the behaviour in msconfig (I do as well), but knowing how to use this tool will mean you can make these changes even in cases you do not have access to your favourite utility. TDSSKiller This is a new one for me as of my adventure this weekend. Normally, once taking a quick look at the system, I am able to clear up most of the issues and then take care of any malware via MalwareBytes and AV. In this case, the infection was keeping me from being able to run these even in safe mode. TDSSKiller is a utility from Kapersky designed to remove rootkits. Simply run the executable, and let it do its thing. It will automatically remove any results, and with any luck return control of your system to you. I ran this in safe mode, and then in regular Windows. Combofix Another new one to me. Unfortunately in my case, TDSSKiller removed only part of the infection – I was still unable to run my usual anti-malware tools. Combofix is also an executable, which scans for known malware and attempts to clean anything it finds. Once finished, it also produces a very informative log that tells you what was scanned, what was found, and how it was dealt with. This tool removed the remaining infections that were keeping me from launching certain applications. Malwarebytes This is usually the bread and butter of my computer clean up tools. It seems to find infections that no other software does for me, and removes it with ease. Once TDSSKiller and Combofix removed the more vile of infections, I was able to run Malwarebytes and clean up the remaining offenders. Microsoft Security Essentials (MSE) It always seems a bit funny to me that I recommend a Microsoft product for PC security/AV over all others, but my own experiences as well as others documented on the web have shown MSE to superior to most (and sometimes all, depending on the tests) other free AV. Add in that definition updates come down integrated through Windows Updates, it is a free product (no trials), and designed by the guys in Redmond for their very own operating systems, and you get a pretty awesome AV client. And only seeking to prove itself further with me, after all of the above tools (MWB included), Security Essentials actually found and cleaned up a couple additional infected files after completing a full scan. Clean up So after all was said and done, and this laptop from hell was behaving again, I had one last issue that I was pretty much expecting to find from the beginning. An earlier attempt to install the most recent Windows Updates tipped me off, but I figured I would wait until everything was clean to try again, and sure enough a number of critical security updates refused to install. Turns out one of the plethora of unsavoury pieces of software I had just removed, had also had its way with the Update service in an attempt to keep some vulnerabilities open. The errors I was receiving was Windows Update Error 800B0100, which according to Microsoft means that a file needed by the update service is either corrupted or missing. First things first, I attempted to use the System Update Readiness Tool from Microsoft to attempt to install the update manually. This worked for one of missing updates, but not the other. After a bit of digging through Microsoft’s self service sites, I came across an automatic troubleshooter here . This tool took about 10 minutes to repair Windows Update components, re-register some security DLLs, and correct a database issue. After this, Windows Update completed without complaint. Next step: teach the in-law responsible not to install more spyware! Links TDSSKiller – http://support.kaspersky.com/5350 ComboFix – http://www.combofix.org/ Malwarebytes – http://www.malwarebytes.org/ Microsoft Security Essentials – http://windows.microsoft.com/en-US/windows/security-essentials-download System Update Readiness Tool – http://support.microsoft.com/kb/947821 Windows Update Error 800B0100 – Automatic troubleshooter └ Tags: guide , IT , malware , Security , tips , virus , weekend , Windows Comment Dec 16 Configuring SNMP on Windows Hosts by John on December 16, 2012 at 2:09 PM Posted In: IT , Windows The SNMP service is not enabled by default in Windows, so it must be manually added. The following sections will explain how to do this in both Windows Server 2003,...