CoNetrix

Blog

There has been a recent increase in “greeting-card spam” that tries to compromise users by getting them to visit malicious websites. The subject line most often states, “You've received a postcard from a family member!” Within the message body, users are given options on how to retrieve their “postcard”. Links in the message direct users to malicious websites where their browsers may be attacked, or they may be prompted to download and execute malicious software. Attacks are directed at both Microsoft Internet Explorer and Mozilla Firefox browsers.

Users should be very cautious when following links in e-mail messages. Links to foreign domains (e.g. http://someaddress.hk in Hong Kong) or directly to IP addresses (e.g. http://123.123.123.123) should almost always be avoided.

Also, it is important to keep operating systems and software up-to-date with the latest security patches, as well as keep antivirus software virus definitions current. [more]

For more information about this attack, please refer to the following article:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9025898

For information and guidance on protecting your organization from these types of attacks, please contact contact us.

IT Security Alerts, SPAM,
 

In Active Directory Users and Computers there is an Email Addresses tab that lists email addresses for the user.  One of these (for each protocol) is selected as the Primary.  The primary address will be the one that a user's outgoing email appears to come from.  But there is also a General tab where one can enter an email address for the user. This also causes that user's outgoing email to appear to come from that address.  Normally, changing one also changes the other.  But if you are running Active Directory Users and Computers from a machine that does not have the Exchange Server tools installed, the Email Addresses tab is not there and changing the email address on the General tab will not change the primary.  Actually, anything can be entered in that field on the General tab, even invalid domains.  So it is recommend to always make user account changes on the Exchange server, or at least on a system that has the Exchange server tools installed.  And use the Email Addresses tab to change user's email addresses.

Some email servers perform some verification on the sender's email address and may reject it if the domain is invalid.  Nothing can send a bounce message either because the email address does not work, so the sender will not know the email was not delivered.

Networking, Windows 2003 Server, Active Directory,
 

When upgrading VMware Workstation from a previous version (in this case, version 4) to version 6, snapshots can prevent the virtual machines created under the old version from being upgraded to version 6.  There are two solutions: [more]

  1. Prior to installing version 6, remove all snapshots from the virtual machines.  Also, it is a good idea to make sure all the virtual machines have been shut down gracefully and there are not any .lck files associated with them.
  2. If you have already upgraded to version 6 and still have snapshots, you may get an error message when attempting to upgrade the virtual machine that says something along the lines of, “this virtual machine cannot be upgraded because it has a legacy snapshot.”  When you go to remove the snapshot, the option is grayed-out.  It fix this issue without reverting the old version of Workstation, do the following steps:
    1. For the virtual machine you want to upgrade (vmware1, as an example), rename the file vmware1.vmx.sav to something else.
    2. Open the file vmware1.vmx in WordPad and delete these lines:
      1. undopoints.seqNum = "0"
      2. ide0:0.mode = "undoable"
      3. undopoint.restoreFromCheckpoint = "FALSE"
      4. undopoint.checkpointedOnline = "FALSE"
      5. ide0:0.redo = ".\VM1- XP Pro.vmdk.REDO_a05076”
    3. Save and close vmware1.vmx
    4. Open the virtual machine in Workstation 6 and choose the menu item “VM -> Upgrade or Change Version” to update the version.
Networking, VMware,
 

If you ever get this error : "Run-time error `339`; Component `MSCOMCT2.OCX or one of its dependencies not correctly registered: a file is missing or invalid."
This error is indicating that your workstation installation is missing a file that should have been installed when the OS was installed.
 
To fix the problem, simply download MSCOMCT2.OCX or copy it from another machine.
 
You then need to put it into the correct directory on the problem machine. It should look something like this:
 
%WINDIR%\SYSTEM32\REGSVR32.EXE %WINDIR%\SYSTEM32\mscomct2.ocx
 
You then need to register the file by typing in the following command:
 
C:\WINNT\SYSTEM32\REGSVR32.EXE
C:\WINNT\SYSTEM32\MSCOMCT2.OCX (on Windows 2000)

C:\WINDOWS\SYSTEM32\REGSVR32.EXE C:\WINDOWS\SYSTEM32\MSCOMCT2.OCX (on Windows XP)

Networking, Windows 2000, Error, Windows XP,
 

As of yesterday (May 28, 2007) it appears more than 1,400 executives (from various companies) had been infected by an e-mail attack that dresses itself up as a complaint filed with the Better Business Bureau.

The phishing attack uses details apparently culled from public sources to tailor the e-mail message with a company's name, the name of a senior executive and the executive's e-mail address in an attempt to convince the person to open a malicious attachment.

As with all such attacks, it is wise to never open unsolicited attachments. Up-to-date antivirus software and Intrusion Detection/Prevention systems also provide layers of protection from such attacks. [more]

For more information about this attack, please refer to the following article:
http://www.securityfocus.com/brief/511

For help protecting your business against these types of attacks, please contact us.

IT Security Alerts, Phishing,
 

We used to run bemcmd91.exe with a long list of parameters to export and import Backup Exec jobs and settings.  With version 10, there is now a gui, BEUtility.exe. Read http://seer.support.veritas.com/docs/274778.htm.  This document says "BEUtility will not copy media sets that are not currently assigned to a job". I assumed this means that it will copy media sets that were assigned to a job, but it does not. It also says it will copy the alert configuration, but it does not. You need to go through all the settings and check them.

Networking, Backup, Backup Exec,
 

One of out customers was not able to get to the Internet.  I was able to connect to the router, but could not ping the ISA server.  Shortly, I could get on the server, but when going through the start menu, it stopped responding and I finally got disconnected. I could no longer ping it from the router. Then in a little while it came back. I was able stay connected long enough to look at the event log and found messages that said "Remote Access Connection Manager failed to start because it could not create buffers. Restart the computer. Access is denied." I researched this and found http://support.microsoft.com/kb/842696 and http://support.veritas.com/docs/285593 which both say the tape drivers need to be updated. I downloaded the driver installation file from Veritas (Symantec) and put it on a CD and went on site.  The internal LAN was working fine. I got on the server and found that I could not ping the router. I installed the Veritas (Symantec) device drivers and rebooted and that seems to have corrected it. The version of the HP tape driver was "5.1.23.0" before and now it is "5.1."
Networking, Symantec, Windows Server,
 

When using Backup Exec 10.x, you may experience problems backing up SQL Server 2000 or MSDE databases if the file path contains double backslashes in the file path.

The error within Backup Exec is:  [more]

Final error: 0xe0008492 - Database Query Failure. See the job log for details.
Final error category: Resource Errors

To fix the issue, you must detach and reattach each database that contains the double backslash in the file path. The issue is caused by including a trailing slash in the “New Database Default Location” when declaring a file location.

If you do include a trailing slash (which will be included by default if you use the browse button) and try to create new databases using T-SQL (i.e. CREATE DATABASE …), your file paths will end up with the double backslash notation. Creating databases with the Enterprise Manager GUI does not produce the double backslash no matter if the “New Database Default Location” includes a trailing backslash or not. So, make sure the trailing backslashes are removed from the file path.

Networking, Backup, MSDE, SQL Server, Backup Exec, backup,
 

We have struggled with CRC errors on routers with 2 frame relay circuits connected to a dual channel T1 card.  The CRC errors seemed to only occur on the newly added secondary port on the card, and the connectivity would act intermittently.  In working with Cisco, I have learned that both ports’ default clock is set to ‘line’ which gets the clocking from the ISP.  When both ports are set at ‘line’, they both battle to keep up with the clocking.  To fix this problem, set one of the T1 controller’s clock source to ‘internal’.  This tells the port to get clocking from the other port configured as ‘line’.

Networking, Cisco, Router,
 

After completing a P2V migration of a server, I was having a problem bringing the server into the cluster using the NLB manager.  I traced it down by manually adding the cluster IP address to the new virtual NIC, and receiving an error message stating cluster IP was already assigned to an HP network adapter.  Since this was running as a Virtual Machine, there clearly was not a HP NIC installed, and it did not appear in device manager.  I found http://support.microsoft.com/kb/315539, which describes a procedure for showing hidden devices.  After doing this, the HP NIC appeared and I was able to remove it.

Networking, VMware,