CoNetrix

Blog

I was attempting to remove malware from an infected PC and was unable to install Malwarebytes. I have found that sometimes infections will prevent Malwarebytes from being installed. I did a quick search based on the Malware I suspected of being installed and discovered a new feature in Malwarebytes called Chameleon.  In order for this to work, you will need a second PC which is not infected and a USB flash drive or blank CD and CD burner or some other means to transfer files from one computer to the other.  Here are the instructions for using the Chameleon feature: [more]

  1. From your clean computer, download and install Malwarebytes Anti-Malware
  2. Once installed, open the folder where the program was installed (usually C:\Program Files\Malwarebytes' Anti-Malware or C:\Program Files (x86)\Malwarebytes' Anti-Malware)
  3. Once there, right-click on the Chameleon folder and choose Copy
  4. Close the Malwarebytes' Anti-Malware folder
  5. Right-click on your USB flash drive or blank CD and choose Paste and proceed to burn the CD if using a blank CD or remove your flash drive if using a flash drive
  6. Now, insert your USB flash drive or CD which should now contain the Chameleon folder into the infected PC
  7. Open the USB flash drive or CD and copy/paste the Chameleon folder from the drive to the desktop of your infected PC.  Make certain that your infected PC is connected to the internet and then open the Chameleon folder which now resides on the desktop of your infected computer and double-click on the Chameleon help file chameleon.chm.  If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose).
  8. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
  9. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
  10. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
  11. Upon completion of the scan, if anything has been detected, click on Show Result
  12. Have Malwarebytes Anti-Malware remove any threats that are detected and click 'Yes' if prompted to reboot your computer to allow the removal process to complete
  13. After your computer restarts, open Malwarebytes Anti-Malware and perform one last Quick scan to verify that there are no remaining threats
Security and Compliance, malware,
 

It is great to have an abundance of screen real estate via our wide screen monitors. But, if you have several Microsoft docs or spreadsheets open it is possible to get them confused and end up editing the wrong file.

I was wishing I could change the windows color to distinguish between open files, but came up with a good alternative (at least for Microsoft files).  It is possible to change the page color on Word or Excel files. Just go to the Page Layout ribbon and select Page Color. You will get a drop down of standard colors you can select to change the background colors of your open files. This allows you to color code any open files so it is easy to recognize different versions.

When you are finished, it is easy to go back and select No Color to return to a normal white background.

Office, Word,
 

I was running out of disk space on the C: drive of my laptop recently. I used WinDirStat to look for some files that could be removed to free up space.  It was immediately apparent that most of my free space had been taken up by a couple of virtual machine images I had been working on. However, I also noticed a large chunk of space being taken up by the Windows 7 hibernation file (hiberfil.sys). 

The hiberfil.sys file is used to dump the contents of RAM when the laptop goes into hibernation, so it has to be almost the same size as the amount of RAM in the laptop (I guess some compression takes place). As we add more and more RAM to our laptops, more and more disk space will be eaten up by hiberfil.sys. For example, a laptop with 8 GB of RAM may have a hibefil.sys file taking up about 6 GB on the hard drive. Since I don’t use hibernation on my laptop (just sleep and shutdown), I searched for a way to get rid of the file without making Windows angry. The answer is pretty simple. You just open a command prompt with administrator privileges and run “powercfg –h off”. Windows hibernation is now disabled. Your hiberfil.sys file will be gone and the “Hibernation” option will be removed from the Start menu (see screenshot below). [more]

General, Windows 7,
 

I had trouble in renaming a mapped drive. Windows Explorer allowed me to right click on the drive and select rename. However, I discovered while I could delete letters from the name, I couldn’t enter any letters. So, I was left with an accidental abbreviation for the drive name.

I decided I would remove the misnamed drive and redo the mapping. I was surprised to see when I re-mapped the drive and typed in my preferred drive name, it reverted back to the accidental abbreviation.

I searched for a solution and learned about registry entries for Windows Explorer called MountPoints2. I found the accidental abbreviation in the “LabelFromReg” key. Editing the key to the correct name fixed my problem. As an aside, my research also indicated using this registry key will solve some issues which had existed in XP regarding the length of the mapped drive names.

Networking, Windows 7,
 

When working with a Jack Henry application that required the use of a ‘localhost’ reference, it was discovered that the loopback (127.0.0.1) address in the HOSTS file seems to be commented out by default in newer OS’s (Windows 2008 R2, Windows 7).  The solution in this case was to just uncomment the entry in the HOSTS file.

MS TECH RESPONSE: At some point in the future, as the world transitions from IPV4 to IPV6, IPV4 will be eventually be disabled/uninstalled by companies that want to simplify network management in their environments.
With Windows Vista, when IPv4 was uninstalled and IPv6 was enabled, a DNS query for an A (IPv4) address resulted in the IPv4 loopback (which came from the hosts file). This of course caused problems when IPv4 was not installed. The fix was to move the always present IPv4 and IPv6 loopback entries from the host into the DNS resolver, where they could be independently disabled."

Networking, Jack Henry, DNS,
 

Since switching to our Lync phones, I have wanted to use my Jawbone Bluetooth headset with the soft phone on my computer. The soft phone could be very useful when onsite with a customer where I may not have a cell phone signal, but can connect to the customer’s Internet. My headset would connect to the built in Bluetooth radio in my laptop, but would not show up in Lync. I had a USB Bluetooth adapter and decided to install it and see if I could then use my headset with Lync. Using the USB Bluetooth radio, I can connect my headset and use it with Lync. It appears that Lync only allows devices connected to a USB or mic/speaker port to be used with the soft phone. Here are the steps I used to connect my Jawbone Icon to my laptop and use it as my mic/speaker for Lync. [more]

  1. Install USB Bluetooth radio (ASUS USB-BT21 – purchased on Amazon for about $10)
    • Install drivers as necessary (may get a yellow warning sign until after step 3
  2. Open Device Manager > Bluetooth Radios > Disable any onboard Bluetooth radios
  3. Reboot PC to activate USB Bluetooth Adapter
  4. Pair Bluetooth headset to USB Bluetooth Adapter
  5. Go to Audio Device Settings
  6. Change the Speaker and Microphone to use the Headset
  7. Test calls several feet away from your computer so you can ensure the voice is not being picked up by the laptop’s onboard microphone
  8. Now each time you connect/power on your Bluetooth headset, you will see in the bottom left corner of Lync and it should be called Custom Device
    • The volume on the headset is controlled by the speaker volume on the computer. The volume will probably need to be turned up pretty high.
General, Lync,
 

One of our users was having trouble opening an e-mail attachment that was sent from one of our software applications.  It looked like some kind of permission problem.  When he tried to preview it, it would just say the file cannot be previewed because of an error in the PDF Preview Handler.  If he tried to open it, it would say that it could not save the attachment.  He was previously able to open them without receiving the error.  I found that when you open Outlook attachments, it usually saves them in a randomly named folder under this path:

%userprofile%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook

This location can be changed with a registry edit.  Since that Temporary Internet Files folder is a special folder, you cannot drill down to this; you must paste or type it into explorer (or your favorite command prompt).

I'm sure you've seen how Windows will create a file with a number in parentheses if a file by that name already exists?  The problem in Grant’s case is that the attachments being e-mailed to him were all named Attachment.pdf, so they were being named Attachment.pdf(1), Attachment.pdf(2), etc.  It seems like the limit was 199 of these renamed files on Grant’s machine.  I have not been able to determine how this limit is determined, and it does not seem to be the same everywhere.  Cleaning out that folder solved his issue (at least until he gets the 200th e-mail again).

General, Outlook, Windows 7,
 

The Polycom CX600 phones currently deployed in the office are all running a special OS of the Lync Phone Edition. As will all Microsoft Products, updates are periodically released to the software to enable new functionality or fix buggy or security issues. The Lync server provides an easy way to deploy the updates out to all systems, but usually you would want to deploy it to a test device first to make sure that everything will install and function as intended. Lync also provides the ability to create a test device that can be used for updates.

  1. Open the Lync Server Control Panel
  2. Clients -> Test Device
  3. New Test Device
  4. Enter some descriptive name for the device and then type the phone’s MAC address or Serial number in the "Unique identifier" field.
  5. Wait.
  6. A lot.

Any updates that you have installed (regardless of the approval status) will now be automatically installed on your test device. Once you’ve determined the test device functions as intended, you can approve the updates for everyone. According to many sources, the update check-in happens within a minute or two after the phone goes idle and installation within 10 minutes after that. From our (impatient) testing, however, this didn’t appear to be the case. Granted, your mileage may vary and we may just be very impatient people.

Networking, Lync, Polycom,
 

I was troubleshooting something on my phone a while back and through the process, I had realized that I should flush the DNS cache on my phone. The problem was, however, I had no idea how to go about doing that. Of course, I could just reboot the phone and be done with it, but that took time and if I had to do it multiple times, it quickly became impractical. Instead, I stumbled upon a much simpler solution: put the phone in airplane mode. This completely disables all network connectivity until you drop out of airplane mode again and has the natural side effect of flushing the DNS cache of the phone.

General, Apple, iPhone, DNS,
 

After working with SecurID to migrate to a new server (which requires a complete new server, fresh install of the software, access to the original seeds, backup and restore of the current database, etc.), we finally got the RADIUS server responsive, but I still could not get it working with the Cisco routers.  One particularly aggravating issue that held me up for a while is that the router not only allows for the configuration of multiple RADIUS servers, but it allows multiple entries for the same server.  Thus, if you initially use the wrong port numbers, and you re-enter the line with the correct port numbers, the line with the incorrect information will remain active and your RADIUS tests will continue to fail.

Lesson learned:  Sometimes you have to read through your configuration again, to make sure everything is the way you “know” it is.

Networking, Security and Compliance, Cisco, RADIUS,