www.fusspils.net

  • Increase font size
  • Default font size
  • Decrease font size

Conficker lives

E-mail Print PDF

So it seems something big was brewing with Conficker, they just didn’t want to do what everyone expected and unleash it on April 1st when all eyes were on them.Smart move really, they kept quiet and waited a week or so after before dropping some fairly serious and complex payloads (encrypted rootkits).

It seems like they are going for the old ransom tactic and duping users into buying dodgy anti-virus software.


An updated version of the Conficker worm is installing malware that attempts to lure people into buying rogue anti-virus software. Security researchers also say the worm is downloading malware tied to the notorious Waledac botnet. Conficker’s latest move may be tied to a scheme to lure users into downloading fake anti-virus software. Security researchers monitoring the Conficker worm’s activities say the malware has been observed downloading a file detected by Kaspersky Lab as FraudTool.Win32.SpywareProtect2009.s.

“Once it’s run, you see the app interface, which naturally asks if you want to remove the threats it’s ‘detected,’” wrote Aleks Gostev on Kaspersky Lab’s Analyst’s Diary blog. “Of course, this service comes at a price—$49.95.”

 

Continue/credits to :- http://www.darknet.org.uk/2009/04/conficker-finally-awakes-dumps-payload/

 

 

The operation failed because of a protection agent failure. (ID 998 Details: An existing connection was forcibly closed by the remote host (0x80072746))

E-mail Print PDF

Received this error on a new DPM installation when trying to backup long term protection to a Dell tape system.  Update tape drivers!!  The drivers that were available on Windows update were enough to fix this problem.

 

Backing up Exchange with DPM

E-mail Print PDF

I recently had a nightmare getting the Microsoft DPM 2007 server to back up my workplaces exchange server.  Some of the errors are listed below.  After searching many forums and google smashing for days I finally managed to get DPM talking to the exchange store.
To start with I had to perform a manual installation of the DPM agent, all attempts for the auto install via the DPM admin console failed over and over.  This also applied to many other servers that I tried with DPM, in my experience it seems to have a 50/50 chance of working.

Manual Install of DPM Agent (from Technet)

On the computer on which you want to install the protection agent, we recommend that you map a network drive to the DPM server. For example, from the command prompt type net use Z: \\DPM1\c$.

On the protected computer, from the command prompt, change the directory (CD) to z:\Program Files\Microsoft DPM\DPM\Agents\RA\2.0.5820.0\i386 (if you have a 64-bit computer, use AM64), and then type DpmAgentInstaller.exe . For example: DPMAgentInstaller.exe DPM1.Fully.qualified.domain

OR

On a 64-bit computer, type DPMAgentInstaller_amd64.exe .

Note 
If you use the DPM server name in the command line, DPM installs the protection agent and configures the security permissions for the DPM server.
 
You can perform a non-interactive installation by specifying a /q parameter after the DpmAgentInstaller.exe command. For example, type DpmAgentInstaller.exe /q .

Restart the protected server.

Note 
The following step is not required if you specified the DPM server in Step 1.
 
To complete the protection agent configuration for the appropriate DPM server and firewall settings, from the command prompt, type :\Program Files\Microsoft Data Protection Manager\bin\ SetDpmServer.exe – dpmServerName . For example:
     SetDpmServer.exe –dpmServerName DPM01
Where DPM01 is the actual DPM server name.

On the DPM server, from the DPM Management Shell prompt, type Attach-ProductionServer.ps1 .

The password parameter is not required and we recommend that you do not provide it. DPM will prompt you for a password, which will not appear on the screen. However, you can provide the password if you want to use the script to install a protection agent on a large number of servers.


This worked on all servers for me where the auto deployment method failed.

Random notes and idea´s to try when you have problems backing up Exchange store´s using DPM

Exchange must have the latest service pack and all patches/rollup´s installed

LCR (Local Continuous Replication) MUST be disabled on the exchange store in 2007 including the Public folers!!  A mistake that I made at first was to leave this running on our public folders!  The exchange store didn´t even show up the the DPM admin console until LCR was diabled on the Exchange server

CCR (cluster continuous replication) must be disabled in clustered environments

With regards to any type of shadow copy errors run vssadmin list writers run on exchange server and make sure that the exchange writer is reported as being stable with no errors

Circular logging must be disabled -

    Start the Exchange Management Console.

In the console tree, expand Server Configuration, and then click Mailbox.

In the work pane, right-click the storage group for which you want to enable or disable circular logging, and then click Properties. The Properties dialog box appears.

Select or clear the Enable circular logging check box.

Click OK.

To make your changes to the circular logging settings effective, restart the Microsoft Exchange Information Store service, or dismount and then mount all of the databases in the storage group.

Right click on the storage group in the "protection" section of DPM 2007 administrator console and select "perform consistency check"

Also try clicking the link to perform consistency check and create new point (dont remember the exact wording as the error has now gone from our server) which is found under the monitoring tab of the  DPM admin console.  This check is NOT the same as the previous mentioned normal consistancy check which is found under the protection tab!!

 

Here are a few of the errors that I encountered along the way in no particular order....

 

The operation failed because an error occurred while enumerating the data source for Microsoft Exchange Writer\f10173b9-05bb-492a-852d-4d4ba2bf9467

Check to see that the data source specified in the error message is online and accessible.

ID: 921 Details: Internal error code: 0x80990A9C Under the monitoring Tab....

DPM could not start a recovery, consistency check, or initial replica creation job for Storage group First Storage Group on *********** for the following reason: (ID 3170)

The operation failed for Storage group first storage group on ***** because the data source is not acailable (ID 30169 Details: Unknown error (0x80042308)(0x80042308)

 

Lied in previous article about DPM

E-mail Print PDF

You CAN have LCR enabled with DPM sp1 and Exchange 2007, just a simple registry change and a service restart is all that is needed.

 You need to add the EnableVssWriter key as a DWORD with a value of 0 (NULL) to the Registry in HKLM/Software/Microsoft/Exchange/Replay/Parameters

After setting this key you need to restart the Exchange Replication Service to activate that setting, thats it!

 


Page 8 of 8