More or less what we are doing is renaming ntdetect.com to ntdetect.bak. When the computer reboots it will loop until you rename the file back by boot disk like bart pe.

[ad]

This can also be used in a batch file:

Could be useful for trying to recover stolen computers, data from soon to be fired employees (not giving them the chance to delete things). Or recovering a computer to investigation. You can also use it as an excuse to go visit that cute new secretary…

[ad]

[ad]

Here is the same thing in a batch file with mapping a share:

[ad]

Essentially this will uninstall the trend client from the computer with no user interaction required. Though the silent switch is employed there is still a progress window that I can’t seem to suppress.

[ad]

This can be used as a login script by importing the registry key and then running the uninstaller.  Save the below as trend.reg:

And run this batch file at login, change the red to match your paths:

When run on login the Trend Product will be automatically removed thus preparing the computer for a Trend reinstall, or a new anti-virus install.
[ad]

[ad]

Example Event:

Symptoms: Every third of a second or so there was an event id 333 error logged in the application event log on the server. This would start after the server has been up for a few hours to days and will stop for a period after the server was rebooted. The error occurred so often I was reaching 30,000 instances of the error in 24 hours. About 36 hours after the event started occurring no one was able to login active directory, and to get the server back up it required a manual hard reboot.

Things I found on the internet: This error is often caused by lack of resources on the server. Either there is not enough addressable memory, your disk speed it too low, or something is functioning very sub optimally. Everything I found on the internet pointed to checking these:

 
[ad]

• /3GB  /PAE   and /USERVA switches in the boot ini.  It it worth evaluating if you have these set up right.  More often than not they are not needed at all.  This post on /3gb and /PAE andthis article on /userva

• Check performance. Use process explorer to see if there is something creating a excessive number of threads, or handles.  Use it to monitor tasks and make sure no process is being greedy with CPU time or memory usage.
• Disable Hot add Memory.  This has been useful to me on terminal servers before, though it did not fix my issue I have found a significant number of posts where it did.  Check out this article.
• Out of date firmware and drivers.  This especially goes for RAID controllers and hard disks.  This can often times be really hard to upgrade without breaking the data on your disks.  If you are using a RAID controller with 6 year old firmware, chances are that it is not preforming optimally on your 2 TB RAID 5 configuration.  I would start by upgrading in this path: 1. RAID controller driver     2. Motherboard BIOS    3. Motherboard chipset drivers   4. RAID controller firmware    5.  Hard disk firmware.  Be very careful to check with the vendors before changing firmware on your disks or controller that it is not data destructive.
• Update SQL.  If you are running SQL make sure you have all the updates, and that your memory usage in SQL is not set higher than 1/2 of your total available memory unless it is a detected SQL server.  
• Disk Quotas.  Turn them off, i really don’t think anyone uses them anyways.  If you do make sure you don’t have any service running under a account that is subject to disk quotas.  for example if you have a 500 mb disk quota for all users, and your print spooler is running under a service account.  If a few people print big things, its not going to work and you will get 333 errors among other errors.
• Page File.  Your page file should be 1.5 times your total system RAM.  On a server with 1 gb of RAM you would set this to 1.5 gb, do not allow for system managed pagefile.
• Ntbackup.exe.  This can cause strange system hangs if you are having a issue with VSS, are running SQL, or exchange, or any other application that is very did write intensive.  I found several posts that pointed to nightly systemstate backups as the culprit.  You can disable this temporarily for troubleshooting.  
• Old Antivirus.  Make sure you have the latest scan engine on your antivirus.  There were some examples of people that updated their antivirus and the issue was resolved like magic. 
• Virus/spyware.  This goes with out saying in most cases, but make sure there is nothing sketchy running on your server.

My solution:  For me the the solution was pagefile and disk quota.  The page file was system managed and moved to a disk off the primary partition.  This disk had disk quota limitations on it.  When things got intense and the server wanted more disk space for the page file quota management would slap its hand and make it put it back.  This was decreasing my performance and using causing a ton of errors.  I was effectively able to use 1.5gb of my pagefile on a server that was running exchange and SQL.  I turned off disk Quotas and change the pagefile to a set size, since doing this I have had no issues at all.
[ad]

So I used this with mklnk.exe to make a shortcut on the users desktop, with a lock icon.  Below is the batch file I used.  G: is a network share containing mklnk.exe.

What this does it it passes the arguments user32.dll,LockWorkStation to the rundll32.exe, and the result is a shortcut on the all user desktop called “lock” that uses shell icon 47 (a cute lock graphic).

To use this with kaseya you have to upload mklnk.exe to the kserver, and then import the following script.  Be sure to change the red to match the location you have uploaded mklnk.exe.

[ad]

Symptoms of the virus are expected to include and have been confirmed to include:

• Services disabling on their own. Namely windows defender, BITS, windows firewall, and some third party antivirus services such as live update.
• Massive increase in network traffic.  Up to a 10-15% increase in total network traffic is expected on infected networks. This is due to attacks on shares and accounts, as well as spreading of the virus and payload.
• Account lockouts reset.  If the virus is on a DC it will dictionary attack the admin account and admin shares, if the account locks out, it will automatically reset the lockout.
• Lastly some or all AV websites, security websites, and windows update sites are inaccessible.  they reply to ping and answer to telnet on port 80, but they are not accessible to any browser.  This appears to be done through a virtual proxy system.

Microsoft has teamed up with ICANN, AOL, Symantec and other big names in computer security and network technologies to attempt to curtail the infestation of the virus.  A $250,000 reward is available for anyone that can provide information leading to the arrest of the coder.  
[ad]
Microsoft released a patch MS08-067 on october 15th 2008, that fixes this exploit however, it is estimated that about 30% of computers do not have this patch installed.  This patch is available from Microsoft HERE.  The patch is available for windows 2000 sp4 – windows server 2008 with the exception of windows xp service pack 1 (service pack one has reached its end of support).  Windows 7 has the patch integrated in it already.  Many antivirus makers are releasing removal tools for the virus already.  Microsoft has a removal tool available HERE.  And bit defender has a network/domain removal tool HERE.

What you can do to limit and prevent conflicker spread as a network administrator.

• Follow best practice passwords.  Require password that include special characters and are at least 6 characters long.  This makes brute forcing the password very difficult.  
• Turn off all unnecessary network shares.  Any computer on the network that has a opened share is a vulnerability. Check this out to discover shares.
• Turn off auto run.  You don’t need it in most cases.  Turn it off, it allows for the potential execution of code.
• Update antivirus.  Make sure you have the last definitions and scan engine.  Note that sometimes the scan engine is not an auto update and may require manual processing.  Also make sure that all of your computers are showing in the antivirus console.  If not you might have a potential issue.  Look into it ASAP before it becomes a problem.  
• Windows update.  Update everything.  Every computer should have every critical rated patch, always.  Check out my past post on autopatcher, and check this out for a alternative way to investigate the security of your network.
• Be a bouncer.  Do not allow people to bring in home computers, set up wireless, connect external harddrives and other strange stuff to the network.   They are not on the domain, not subject to group policy, and they might not have AV or patches.  This is a huge vulnerability that often goes unnoticed, but it allows for another way to accidently introduce an infection into a network.

April 1st will be interesting at the least.  I have taken a ton of percautions so I can just sit back and watch the news all day while my network stands strong.

[ad]

http://www.autopatcher.com/

[ad]

1. Windows Update:  Works on small networks, though it might not be the best option on any network with more than a few computers.  

2. Network Install:  The file is available from Microsoft here.  Then all you have to do is install it, or script it.   I used this script to accomplish this at a few of my locations.  Note that you can run it over the network, but I like to copy it locally, just incase there is a network failure or i need to rerun it later for some reason.

3. Kaseya with cURLing:  This will create a ton of bandwidth usage if you push this to more than a few computers on the same network, as every computer will be downloading it to their local disk.  So I don’t recommend this to a really large network, and it is also best done at night just so you don’t get any complaints of slowness.  Also note that you are going to have to have curl on your kserver to make this work.  Check out this post for a quick explination of cURL or just download it here    The script will check to see if the computer is running SP3 already, if it is it will stop, if not it will download it and run an unattended install followed by a reboot.  

[ad]

If you would like to use this with Kaseya all you have to do is copy the above script name and name it password.vbs. Change the variables to meet your needs and then upload it to the server.  Then just import the script below and change the path of the password.vbs to match the path of your file.

This script pulls the computer name from the computer so it is completely portable.  This can also be used to reset any local accounts not just admin accounts and can be pushed through active directory or another script management application like Kaseya or n-able.  Remember that wscript.exe is what handles .vbs in windows, so be sure to point the script to the right location (usually c:windowssystem32wscript32.exe).  Just change the above accountname to match the account you wish to reset and insert the password you wish to set it to.

[ad]