Tech Blog

Network Ransomware Infection Best Practices

After several clients have faced this issue, it time to write out some best practices for how to immediately deal with an infection from one of the Cryptolocker / Cryptowall network ransomware infection variants. These usually infect a single workstation on the network, encrypt all local files, encrypt all network file shares and leave an instruction file on how to pay for the decrypt key in every folder. A good backup of the network file servers is key for this network ransomware infection not to do devastating damage to a company.

Steps for cleaning up after the network ransomware infection:

1. Login to file server and find one of the instruction files (usually HELP_DECRYPT.txt or decrypt_instruction.html) on the affected network share.
2. Right click on the file, chose Properties and click on the Details tab. The Owner listed is most likely the username for the person using the only infected computer on the network.
3. Isolate this machine from the network, deep virus clean or wipe / reload the operating system to get rid of the infection.
4. It is also good to run basic virus scanning on all workstation and servers on the network to determine if further infection has happened. Clean as needed.
5. It is good to know all the infected files on the file server, so here is a Powershell script to do so (change the instruction file as needed):

get-childitem [local path of file share] -include HELP_DECRYPT.* -recurse | select fullname >> C:\TEMP\InfectedFiles.txt

6. Send a copy of an encrypted file and of one of the instruction files to your Antivirus vendor because obviously they missed something.
7. Next comes the cleaning of the instruction files, so more Powershell to automate this (change the instruction file as needed):

get-childitem [local path of file share] -include HELP_DECRYPT.* -recurse | foreach ($) {remove-item $.fullname}

8. Use backup software to restore affected file shares to an alternate location.
9. Copy / replace files into their original location from the alternate location.
10. Test to make sure that users are able to get back into their files.

If your company has been infected with a network ransomware infection or would like to be proactive about protecting your important company files from disaster, then contact us for assistance.

Event ID 1000 Faulting Application spoolsv.exe

Had a users who had their printers disappearing and even after reboot or Print Spooler Service restart the printers would vanish after only a few seconds. After much research found this article from Chicago Tech that explains in detail how to troubleshoot this Faulting Application spoolsv issue. Here are the three steps that fixed the issue for this domain user:

Step 1: Clear the print caches to fix Faulting Application spoolsv

1. Open “Computer” and browse to the folder “c:\windows\system32\spool\printers” and delete all the files in the folder.
2. Do the same to clear the content in the folder “c:\windows\system32\spool\drivers\w32x86”

If the above step doesn’t work, please perform the next one.

Step 2: Reset the printer spooler to fix Faulting Application spoolsv

1. Open command prompt as administrator
2. Type “Net stop RPCSS” (without quotation marks) and press Enter.
3. Type “sc config spooler depend= RPCSS” (without quotation marks and note the spacing) and press Enter.
4. Type “Net start RPCSS” (without quotation marks) and press Enter.
5. Type “Net start SPOOLER” (without quotation marks) and press Enter.
6. Delete the printer and reboot the computer to allow Group Policy to re-install printer.

If the issue persists, please go on to Step 3 since the issue can be caused
by some corrupted printer drivers on the computer.

Step 3: Remove Printer Drivers to fix Faulting Application spoolsv

1. open RegEdit as administrator
2. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print, click Registry->Export Registry File on the menu, and export the current key to a REG file for backup. (Note: You may double click on the REG file in Windows Explorer to restore the original settings)
3. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environment\Windows NT x86\Drivers, remove both the Version-2 and Version-3 keys if they exist.
4. Remove all sub keys under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers. (Do not remove the Printers key.)
5. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environment\Windows NT x86\PrintProcessors, delete any processor that is not the following:

winprint

6. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers, delete any provider that is not one of the following:

Internet Print Provider
LanMan Print Services

7. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Monitors, delete any monitor that is not one of the following:

BJ Language Monitor
Local Port
PJL Language Monitor
Standard TCP/IP Port
USB Monitor
Windows NT Fax Monitor
AppleTalk Printing Devices
LPR Port

8. Exit the registry editor.\

9. Remove all files from the following directories if they exist:

C:\Windows\system32\spool\drivers\w32x86\2
C:\Windows\system32\spool\drivers\w32x86\3

10. Reboot to let Group Policy install the printer drivers again. This will take extra time for this one reboot.
If your company is uses Group Policy to deploy printers or just needs help troubleshooting network printer issues, then contact us for assistance.

Office 365 Email Distribution Group

Had a client that was using Office 365 Directory Synchronization (DirSync) to manage their users / groups in Office 365 via the local Active Directory which meant that there was not end-user manageability of those groups. A user asked to have a new email distribution list created that they could manage, so performed the following to make that happen:

Create an Office 365 Email Distribution Group

1. Open Active Directory Users and Computers.
2. Navigate to where in the hierarchy that the Distribution Group will be created.
3. Right click on the Organizational Unit where it is to be created and choose New then Group.
4. Give the Group a name and leave the default Group scope of Global and change Group type to Distribution then click OK button.
5. Double click on the new group to open it. Type in the email address to use then click on the Attribute Editor tab.
6. Scroll down and double click on the proxyAddresses item. Add the email in the format SMTP:[username@domain.com] then click on the Add button and OK button.
7. Click on the Managed By tab and click on the Change button to search for the user who will be the group administrator.
8. Click OK button then run a manual DirSync to send the changes to the cloud.
9. Open the group administrators Outlook.
10. Click on the Address Book button.
11. In the Address Book drop down list choose the Global Address Book (this may take some time to download the update).
12. Find the newly created Distribution Group and double click to open then click on the Modify Members button to add users.
If your company is using Office 365 and needs end users to manage their Office 365 Email Distribution Group, then contact us for assistance.

Exchange User Calendar Adding Permissions

Had a request to allow all users access to the new hires Exchange user calendar and some researched determined that this was not a job for the Exchange Managememt Console GUI. Instead it required a bit of PowerShell scripting to get the job done. It is best to run Get-MailboxDatabase before editing the script to retrieve the [Database Name] and [Username]. Here is the final product for accomplishing this task:

Add Exchange User Calendar Permissions via Powershell

$mailboxes = Get-Mailbox -Database “[Database Name]”
$AccessRights = “Reviewer”
$newusername = “[Username]”

foreach ($mailbox in $mailboxes) {

$calendar = (($mailbox.SamAccountName)+ “:\” + (Get-MailboxFolderStatistics -Identity $mailbox.SamAccountName -FolderScope Calendar | Select-Object -First 1).Name)

Write-Host “Updating calendar permission for $mailbox…” -ForegroundColor Yellow

add-MailboxFolderPermission -User $newusername -AccessRights $AccessRights -Identity $calendar

}

If your company is using on-premise Microsoft Exchange User Calendar or needs any help migrating to Office 365, then contact us for assistance.

ShadowCopy Quickly Saves Your Bacon

In my opinion this feature is simply a must for all servers and stand alone workstations – ShadowCopy otherwise known as previous versions. As per Microsoft:

Previous versions are automatically saved as part of a restore point. If system protection is turned on, Windows automatically creates previous versions of files and folders that have been modified since the last restore point was made. Typically, restore points are made once a day. If your disk is partitioned or if you have more than one hard disk on your computer, you need to turn on system protection for the other partitions or disks.

To enable and configure ShadowCopy of Shared Folders:

1. Go to Administrative Tools and then click Computer Management .
2. In the console tree, right-click Shared Folders, click All Tasks, and then click Configure Shadow Copies.
3. In Select a volume, click the volume that you want to enable Shadow Copies of Shared Folders for, and then click Enable.
4. You will see an alert that Windows will create a shadow copy now with the current settings and that the settings might not be appropriate for servers with high I/O loads. Click Yes if you want to continue or No if you want to select a different volume or settings.
5. To make changes to the default schedule and storage area, click Settings.
If your company has important files shared on a network and would like to prepare in advance of a disaster to protect them, then contact us for assistance.

Sage 50 Data File Database Corruption Detected

This was a strange one for a client that uses Sage 50 Accounting and was trying to print a W-2 for an employee who “lost” theirs in the mail. Whenever they tried to create this the Aatrix form software crashed stating Sage 50 Data File Database Corruption Detected. (More precisely “Codebase Error #: -200 or Codebase Error #: 83805″ File is not a data file database corruption detected in Dat.bdf” when processing Aatrix tax forms.) The troubleshooting for this went on for some time until this Sage Support article was found. The first option worked like a charm.

Fixing Sage 50 Data File Database Corruption Detected

Section I: Replace Histories folder

1. Locate a valid backup taken prior to the last processing of the tax forms.
2. Rename the backup file to add .zip to the extension.
3. Rename the Histories folder in your individual company to Old-Histories
4. Open the newly renamed .zip file and copy the Histories directory to the individual company folder.
5. Start the tax form selector and process your forms.

If your company is using Sage 50 Accounting or has experienced any sort of database corruption issues, then contact us for assistance.

Group Policy Deployed Printer Preferences

This was an interesting find for me as I had not thought of changing Group Policy deployed printer preferences for a printer that was deployed via Group Policy. A client wanted to have the default for their multi-function printer to be set to black & white printing. As this is a printer deployed via Group Policy, changing the preferences in Devices & Printers did not do the trick. Instead it took the following:

Making changes to Group Policy deployed printer preferences

1. Open the Print Management Administrative Tool
2. Expand Print Servers and then expand the print server
3. Click on Printers, right-click on the printer to be changed and then choose “Set Printing Default…”
4. Make the needed changes to the preferences then click OK button.
If your company is using Group Policy to deploy printers or needs any help troubleshooting network printers, then contact us for assistance.

Test SMTP Connectivity via Telnet

Had issues recently with another tech setting up a SMTP relay to Google Apps that didn’t work correctly and during the process of correcting their setup there came a need to test SMTP connectivity. Time to use a telnet connection to the SMTP server over port 25 method to test via my favorite telnet/ssh/console program PuTTY:
1. Open PuTTY and type in the Host Name of the SMTP server.
2. Choose Connection type of Telnet and change the Port to 25 then click the Open button.
3. Type EHLO [hostname] and then press ENTER.
4. Type MAIL FROM:[authorizeduser@domain.com] and then press ENTER.
5. Type RCPT TO:[anotheruser@domain.com] and then press ENTER.
6. Type DATA and then press ENTER. You will receive a response that resembles the following:

354 Start mail input; end with .

7. Type Subject: [Test Subject] and then press ENTER.
8. Press ENTER. RFC 2822 requires a blank line between the Subject: header field and the message body.
9. Type [Test Message Body] and then press ENTER.
10. Press ENTER, type a single period character and then press ENTER. You will receive a response that resembles the following:

250 2.6.0 Queued mail for delivery

11. To disconnect from the destination SMTP server, type QUIT and then press ENTER. You will receive a response that resembles the following:

221 2.0.0 Service closing transmission channel

12. Check the [anotheruser@domain.com] mailbox to see if the message arrived successfully.

This allows testing of the connection without end user intervention or the creation of a test account to send from. If there is SMTP authentication or encryption then there are other commands that will need to be entered.
If your company is in need of help troubleshooting or needs to test SMTP connectivity on your email servers, then contact us for assistance.

Google Apps SMTP Relay

Install Windows Server 2012 SMTP Relay Feature

1. Login as an administrator.
2. Go the the start screen and type “Server Manager”. Click on Manage and choose “Add roles and Features”.
3. Click “Next >” (Check the box to skip this in the future)
4. Make sure “Role-based or feature-based installation” is selected then click “Next >”
5. Choose the appropriate server then click “Next >”
6. Make no changes to the “Roles” page then click “Next >”
7. On the “Features” page scroll down and check the box by “SMTP Server”
8. Click “Add Features” (required for SMTP Server) then click “Next >”
9. Click “Install” then wait for the install to finish then click “Close”.

Configure Windows Server 2012 Google Apps SMTP Relay

1. Go the the start screen and type “Server Manager”.
2. In the Tools menu select “Internet Information Services (IIS) 6.0 Manager”
3. Expand the tree until [SMTP Virtual Server #1] is shown then right click and choose “Rename” (as appropriate)
4. Right click again and choose “Properties”.
5. Click on the “Access” tab then click the “Connection…” button
6. Select “All except the list below” then click “OK”
7. Click on the “Relay…” then select “All except the list below” then click “OK”
8. Click on the “Delivery” tab then click the “Outbound Security” button
9. Select “Basic Authentication” and type in the username and password of Google Apps user
10. Check “TLS encryption” then click “OK”
11. Click the “Outbound connections” button then change “TCP port” to 587 then click “OK”
12. Click the “Advanced” button then fill in the FQDN of the internal server (add custom DNS for future changes)
13. Fill in “Smart host” with SMTP.gmail.com – the name of the Google Apps SMTP server then click “OK” twice

Warning! You have an open relay now. Use this setup to check the email notification system. When you see it’s fully functional go back to the “Access” tab and narrow down the “Connection” settings to the necessary systems. When no other system needs to relay, just check “Only the list below” and grant “127.0.0.1” access.

Configure Google Apps SMTP relay service

1. Login to Google Apps Admin Console
2. Click on Apps
3. Click on Google Apps
4. Click on Gmail
5. Click on “Advanced settings >>”
6. In “Search settings” type SMTP relay then click the Configure button
7. Give the relay a name
8. Leave the “Only registered Apps users in my domains” option set
10. Select “Require TLS ecryption”
11. Click ADD SETTING
12. Click SAVE CHANGES at the bottom right

If your company is using Google Apps and needs a SMTP relay setup for use by a network device like a multi-function printer, then contact us for assistance.

Deploying Adobe Acrobat DC Cloud Edition

Had a school that bought the cloud licensing for Adobe Acrobat DC and wanted help deploying Adobe Acrobat to the workstations on their network. Began the process by creating an MSI based package with the Adobe Cloud Packager for deployment via group policy, but the deployment failed. Found that this is a known issue with Adobe Acrobat DC and can only be solved by running a script instead:

Creating Script for Deploying Adobe Acrobat DC Cloud Edition

Open an administrative command prompt

Change directory to – [Package Location]\Exceptions\APRO15.0en_US\Adobe Acrobat\

Run the following – Setup.exe /sALL /extUI /sl “en_US” /msi INSTALLDIR=”” EULA_ACCEPT=”NO” SUITEMODE=1 OWNERSHIP_STATE=1 LANG_LIST=”en_US” INSTALLLEVEL=101 AS_DISABLE_LEGACY_COLOR=1 IGNOREAAM=1

Open the application then Sign In to Adobe Cloud

Paste Product Key into the prompt that opens

This was found after some deep research into the Adobe Support site. Once you have tested these line of code then a batch file can be created for deploying Adobe Acrobat DC via Group Policy.

If your company is using Adobe Acrobat DC and needs help deploying Adobe Acrobat DC to network workstations, then contact us for assistance.

Network Ransomware Infection Best Practices

Steps for cleaning up after the network ransomware infection:

Event ID 1000 Faulting Application spoolsv.exe

Step 1: Clear the print caches to fix Faulting Application spoolsv

Step 2: Reset the printer spooler to fix Faulting Application spoolsv

Step 3: Remove Printer Drivers to fix Faulting Application spoolsv

Office 365 Email Distribution Group

Create an Office 365 Email Distribution Group

Exchange User Calendar Adding Permissions

Add Exchange User Calendar Permissions via Powershell

ShadowCopy Quickly Saves Your Bacon

To enable and configure ShadowCopy of Shared Folders:

Sage 50 Data File Database Corruption Detected

Fixing Sage 50 Data File Database Corruption Detected

Group Policy Deployed Printer Preferences

Making changes to Group Policy deployed printer preferences

Test SMTP Connectivity via Telnet

Google Apps SMTP Relay

Install Windows Server 2012 SMTP Relay Feature

Configure Windows Server 2012 Google Apps SMTP Relay

Configure Google Apps SMTP relay service

Deploying Adobe Acrobat DC Cloud Edition

Creating Script for Deploying Adobe Acrobat DC Cloud Edition

Recent Posts

Archives

Categories

Tech Blog

Steps for cleaning up after the network ransomware infection:

Step 1: Clear the print caches to fix Faulting Application spoolsv

Step 2: Reset the printer spooler to fix Faulting Application spoolsv

Step 3: Remove Printer Drivers to fix Faulting Application spoolsv

Create an Office 365 Email Distribution Group

Add Exchange User Calendar Permissions via Powershell

To enable and configure ShadowCopy of Shared Folders:

Fixing Sage 50 Data File Database Corruption Detected

Making changes to Group Policy deployed printer preferences

Install Windows Server 2012 SMTP Relay Feature

Configure Windows Server 2012 Google Apps SMTP Relay

Configure Google Apps SMTP relay service

Creating Script for Deploying Adobe Acrobat DC Cloud Edition

Recent Posts

Archives

Categories

Evaluation Signup