Life as a Dealership SysAdmin

Windows XP restore Virus/Malware Start menu shortcuts

anigan — Thu, 09 Jun 2011 12:13:45 +0000

Recently we have been getting a few copy’s of the “Windows XP Restore” virus going around. This one is a nasty bit of kit. It changes all your files on C:\ to hidden and throws in a bunch of popup crap. I have been using malwarebytes anti-malware to get rid of the bugger but this virus leaves a parting gift of a hours worth of cleanup for the user profile. So far my process has been to rename the users profile folder under c:\documents and settings. I just rename the user folder to user.old. Then I log in as the user which creates a new profile. I then migrate the data back over manually.

Another pain in the ass with this virus is start menu shortcuts. Even after un-hiding the “All Users” start menu and the profile start menu all the shortcuts were still missing, So I went on the hunt and found that the virus moves them to C:\Documents and Settings\user\Local Settings\Temp\smtmp\1. It also seems to have moved quick launch to C:\Documents and Settings\user\Local Settings\Temp\smtmp\2.

NOTE: Recover these files before you run your AV software as they have started removing the files as part of the virus.

Hope this little bit of info helps!

Updating Outlook with a PRF

anigan — Thu, 14 Apr 2011 15:38:18 +0000

We use a pop based E-mail service so do not have a global address list in Outlook. I recently set up Active Directory as a LDAP based address book and wanted to send the setup to all of my existing clients through login script. I read many articles on how to create a prf, but when I went to import it with outlook.exe /importprf , it kept creating a profile called “Outlook Default Profile” instead of updating the current profile. The problem in the end was that I was typing Outlook.exe /importprf update.prf instead of outlook.exe /importprf c:\update.prf. The importprf command switch requires the full path of the file to work, otherwise it creates a blank profile.

Hope this Helps!

Adventures in PS3 repair

anigan — Mon, 11 Apr 2011 12:27:36 +0000

Cut from ribbon cable

So Ricky’s fat PS3 Black Betty bit the bullet last week, dreaded YLOD. Now as a good network administrator he had a fairly recent backup of his system so he wouldn’t have lost too much if we couldn’t get the system working again. But as techies we had to try and revive his trusted companion.

With a bit of googleing Ricky found a tutorial on how to re-flow the processors and IC’s on a PS3 motherboard (http://playstationlifestyle.net/forums/showthread.php?t=2376). So we got together the necessary supplies and went to town on Black Betty (PS3′s name). Disassembly was no problem at all, much like a laptop. The only concern we had was that the tutorial used a variable heat gun set at 350C, and all we had was a Mastercraft heat gun with a 250C and 450C heat setting. We decided on the 450C and went at it.

After I did the re flow Ricky pasted the processors and we began to reassemble it. Once she was all back together we plugged her in and, DUM DUM DUM, No Power! Now the question was did we burn up the board with the 450C heat setting? or was it something else? With this we went into troubleshooting mode!

We started by tearing Betty back down to her motherboard and carefully put her back together making sure all the ribbon cables and connections were in place. Still no go. To aid our thinking we took a break and made a Tim’s run. Sitting in the parking lot I whipped out My android phone and got back to googling. Not many forum’s described our situation exactly, but some hinted towards the small ribbon cable that goes from the motherboard to the power button board.

When we got back to the ER (Ricky’s basement) we cracked Betty back open again and inspected the ribbon cable. Sure thing there were tiny cracks in the leads that fit in the connectors. We could buy a replacement from ebay, but that would put operation “restore to new PS3″ schedule way off track.

I then noticed that the cracks were about half way down the lead and the connector actually didn’t take the full lead in. With nothing to loose I found a pair of scissors and cut off the lead at the point of the cracks. I then put the cable back in place to no avail. Not one to give up too easily I started backing the cable back in the connector and BINGO! We have Power! Seems the connector’s pins are mid way in the connector (now that I think of it that’s where the break was so it makes sense.

With that we called it a night and decided to start operation “restore to new PS3″ the next day. With the PS3 backup taking 4 hours we figured the restore would be close to the same. So around 2PM we took the larger drive from the old PS3 and put it in the slim and started the restore on the slim PS3.

Now Ricky is a nice fella and had not only his PS3 backups on his drive, but also a roommates as well. Problem was his roommate had a slim PS3, and no matter which backup we selected, it seems if there is a slim backup on the drive that is what it will restore. The only option we had now was to restore the PS3 backup on Black Betty with the 160gb drive from the slim in it and use the network transfer option on the PS3 to get the data over. it was about 3pm when we started the restore to Betty… and it was about 3am when it finished.

In the end the network transfer worked and the new PS3 is working well. What an Adventure!

Silent Installs

anigan — Mon, 20 Dec 2010 13:20:23 +0000

Recently when doing an upgrade from Windows XP to 7 in our shop, I had to install “viewer” software required by GM. Now GM tried to make it as easy as possible by creating a script on their website that checks for the software and if it isn’t installed will display links for the download and a message along the lines of “your computer needs this, please download it”. It even has a neat Java based downloader (they must be proud of that). Sadly, the neat downloader doesn’t run the installer after you download it. Now I have nothing against car techs but they are the same as any user, “after clicking on the link and the progress bar is gone its installed, right?”

Now using an image based install, generally I would have added this viewer software to the image before sending it out to the PCs, but of course this particular software didn’t like being installed then ghosted AT ALL. This left me with walking around to each of the PC’s to install the 3 software packages manually or script it. Now any respecting SysAdmin would have chosen for the scripting option and that is exactly what I did.

So first off I created a security group in our “application install” OU and added the user accounts for the technicians. Next was to create the group policy that would run the install scripts at logon. Now to the scripts!

The first of the “viewer” installs was an msi. so I opened up run and typed in “msiexec /?” to get the command line listing for msi installs. After a quick review I wrote the following script

REM Map G Drive for Installs
net use g: \\domain.name\netlogon\gm_viewers

REM Install Metaweb
if exist “C:\Program Files\Ematek\MetaWeb\MetaWebU.ocx” goto end
xcopy /E /C /Y /I g:\metaweb.msi c:\metaweb.msi
msiexec /i “c:\metaweb.msi” /quiet /passive /norestart

REM Remove G drive
net use g: /d /y

:end
net use g: /d /y

So to break down the script. First thing I did was map the install drive to an unused letter. Next was the “if exist” line of code to check if the program was already installed. If it was the script goes to the :end marker and disconnects the network drive. If it is not there it will run the msiexec /i script with the /quiet /passive /norestart switches. If you want a description of these switches just run msiexec /? in run or command line.
The second installer came down as a self extracting zip file, so I uncompressed the files and it was also a MSI, just a quick change to the first script and I was 2/3 on my way to finishing.

The third installer was to be a bit more problematic. There was no MSI install, but instead a InstallSheild installer. I tried a /s and /silent switch with setup.exe to no avail. So off to Google I went and found a few articles about silent installing InstallSheild software. Seems that /s was the right switch, but the software required an answer file. Luckily there was a handy /r switch that will create an answer file when you run the program. The answer file is stored in c:\windows\setup.iss. All I had to do was copy the setup.iss file to the installation directory and run my script with the /s switch. Below is the script.

REM Map G Drive for Installs
net use g: \\domain.name\netlogon\gm_viewers

REM Install Tiff Viewer
if exist “C:\Program Files\GM\TIFF Viewer Plugin\NPIMGVIE.dll” goto end
xcopy /E /C /Y /I g:\tiffview c:\tiffview
c:\tiffview\setup.exe /s

REM Remove G drive
net use g: /d /y

:end
net use g: /d /y

Websense Troubleshooting

anigan — Fri, 30 Jul 2010 15:57:52 +0000

We have a new AD at our dealership!!! YAY! With a new AD comes new features and better integration. With that, I have started migrating our Websense Enterprise content filter from IP based authentication to AD user/group authentication. During this change I learned a neat little trick that should help most when troubleshooting Websense problems.

Log onto the client PC and go to a restricted site.
Click on the “More information” link which should change the “Your organization’s Internet use policy restricts access to this web page at this time.” part at the top of the page to a white space.
Right click on that white space and click on “view source”.
At the bottom of the source code it will tell you the active policy and the method its being blocked by

Backwards ass way to get this info, but now you know!

Adobe Installer VS. IE

anigan — Tue, 29 Jun 2010 16:01:37 +0000

A little while back I got called out to one of our branch sites on an issue concerning Adobe Flash. Every time the installer tried to run it would kick IE 8 back to compatibility view and then pop up with a memory exception error. I tried just about all the fixes I found online, from registry edits to patches. In the end it was a very simple fix. under the advanced tab in internet settings there is an option to “turn off memory protection”. A quick restart of IE and no more Adobe installer problems! Figured I would post this here as I had to sift through pages of Google results before I found something describing this fix. Hopefully you find this post quicker and it helps out a bit!

Server 2008 Printer Queue Status Offline

anigan — Thu, 03 Jun 2010 14:34:08 +0000

So I recently had a problem at work with a xerox printer on a different subnet that kept going to the status “offline” in Windows Server 2008 Print Management. Seems the cause of this error is the print driver using SNMP to communicate with the printer and not getting a response. Here is a quick and easy fix to get your printer back up and running

1) Right click on your printer and click properties
2) Go to the Ports Tab
3) Click on “Configure Port…”
4) Un-check “SNMP Status Enabled”

Then just click OK until you re back to the printer management window and VOILA! Your printer can now print again!

VB Developing kids!

anigan — Fri, 07 Aug 2009 22:22:08 +0000

I recently had to go to one of our contract workers houses to upgrade their PC. This particular Contractor had a little 9 year old who is quite the computer wiz. He has already programed his first web browser in VB. Puts me in mind when I did the same at his age. When I asked where he had learned to program VB, the little scamp started telling me all about Microsoft’s VB Developer network Kids Corner… Wait… What? There is a VB developers network Kids Corner? Talk about starting them young Bill! Kinda puts a new meaning to script kiddie.

Not only does this kids corner teach you how to program VB, but also C++… Kids shouldn’t learn C++ That’s just wrong!

Anyways, if you have or know any aspiring little coders make sure to point them in this direction http://msdn.microsoft.com/en-us/beginner/bb308754.aspx

Windows Home Server, Painless Backups for all!

anigan — Thu, 06 Aug 2009 18:08:27 +0000

So my Freenas NAS has been a pain in the ass lately. It has this neat little habit of forgetting it has hard drives attached to it. This is the second time this has happened, so I decided to branch out and try new server OS’s. I have read a little bit about Windows Home server and heard the claims that “It just works”. With this in mind, I decided to give it a chance. The install was neat to say the least. At first it installed windows 2003 server, then converted it to SBS and finally logo-ed it as WHS. This process took 5 reboots, and looked like one hell of a batch file by MS. The one thing I didn’t like was that it didn’t ask for an admin password until it was finished installing. I was away form the house during the end of the install process and couldn’t log in to RDP on the server until I had an admin password set. That aside the install was pretty painless.

Setting up the WHS client on the rest of the PCs was equally as painless. Once installed from either a CD or the handy dandy network share under \\server\software I could remotely manage all the WHS functions and as well have remote access to my PCs (through a activex based RDP client). This client also facilitates automated network backups, but I was going to set this up later… or so I thought!

Since the old NAS used UFS for a file system, I have to use UFS explorer to mount the disk in windows and copy the data to the WHS. This is taking some time so I opted to leave my PC on overnight to finish copying. When I got up this morning I checked the status of the drives to see how much data has been copied. WHS has this neat little graph which displays different chunks for data, system, backups and so on. What did I see but a blue chunk full of 26gigs of backup. I never even touched the setups and WHS took care of my backups over night. How cool is that! Now that’s what I call painless backups! I recommend it for anyone that is looking for a nas solution.

Windows Home Server Host Headers

anigan — Wed, 05 Aug 2009 18:07:09 +0000

Recently my FreeNas file server has been giving me some problems. So I decided to try out that copy of Windows home server I had lying around. In my never ending consolidation of servers I also decided to move my other blog to WHS. As you can see b the link I am using a host header to forward my one static IP to the right website on IIS. This setup worked fine until I wanted to access my WHS from the same adamchurchill.ca domain. When I set a host header for my WHS it wouldn’t forward. From what I can gather from forums it seems to have something to do with SSL. So here’s where I cheated to get it work. I set up my new header on my dns provider (zoneedit.com) and left the host header on WHS blank. Where I had all my other headers set (www, blog, etc) I could let WHS become the default domain. Seems to be working so far!