Antivirus XP 2008 or 2009 virus/spyware removal

I've come across a few PCs in the past month with the Antivirus XP 2008 problem. Basically its some spyware that fakes your Security Centre to look like there's a problem and needs fixing. It looks very authentic. There's a very thorough write-up at The Register, Anatomy of a Hack.

Two of the infections I saw had got in past AVG. One had 7.5 Free and the other had v8 but slightly dated definitions - unlucky timing, I wouldn't hold it against the folks at AVG. My AVG 8 Pro spotted the .exe as soon as I copied it over to the PC.

I've heard of a couple of cases where people have had to put hours into extracting the bad and getting their PC back up and running - should have called Redleg tech support first ;-) Best fix I've come across has been the AntiMalware product from Malwarebytes. You can find it over here.

SEP, SBS and SIFMSMSE - they're tech not medical in case you were struggling

There was a time when I could remember what the Symantec antivirus acronyms were - life was simpler with SAVCE (Symantec Anti Virus Corporate Edition) and even SMSMSE (Symantec Mail Security for Microsoft Exchange). Now we've got SEP which doesn't remind you of an AV connection, worse still with the current version its SEP11 which just says its all coming crashing down. Then the latest Symantec Information Foundation Mail Security for Microsoft Exchange which just trips off the tongue, even the acronym SIFMSMSE is longer than most competitors' product names.

Anyway to the point. I've had an SBS2003R2 server running SEP 11.0 MR2 (I'm not even going to go there with the rest of the acronyms, but it was pre MP too) and SIFMSMSE 6.0.6 generating daily warnings in the Event Viewer which were making it into the SBS 6am daily monitoring report. The daily report didn't actually show much other than the source was Symantec AntiVirus. Taking a look in the Event Viewer shows Event ID 45 and screams SYMANTEC TAMPER PROTECTION ALERT. Turns out its Symantec's own product, the SIFMSMSE server which happily lives in the old SMSMSE directory.

Long story short, you can tell the antivirus to stop worrying about Symantec playing with itself (yes there was probably a more popular blog title in that) by going into SEP Console > Policies > Centralized Exceptions > right-click on the policy and choose Edit. Click Centralized Exceptions and add a Tamper Protection Exception for
[PROPGRAM FILES]
\Symantec\SMSMSE\6.0\Server\SAVFMSETask.exe
with an action of ignore.

All quiet on the front now.

PS I do like Symantec products - one of the few - always worked well for me, although the complexity and management from an SBS point of view seems to be increasing significantly. Reminds me of the old MacAfee which just got too complex to manage quickly and easily for a small business - haven't touched that since.

Allocated Memory - please sir, can I have some more

More! Couple of SBS2003 servers have spells of hitting me with daily allocated memory alerts, i.e. the warning threshold has been tripped in the monitoring. Now you can simply push that threshold figure up in the Server Management console, look under Monitoring and Reporting. Then Change Alert Notifications > Performance Counters > Allocated Memory and edit the figure up from say 2147483648 to 2447483648, i.e. another 300MB ish to go at before it starts screaming.

But if you look closely in the Task Manager and find that there are large memory allocations (170MB+) for sqlserver instances, you can adjust their figures.

Details on changing the maximum memory for a SQL instance, e.g. for the SBS Monitoring or the ISA Firewall or the Update Services can be found in the SBS team blog on troubleshooting high memory use.

There are some suggested figures to use from Susan's blog on throttling. They worked fine for me - one server regained 550MB and another around 200MB, with no apparent performance hits. Looked to me like it might be more relevant to pre-R2 servers, but that may have been coincidence.

SBS Manchester meet 2008

Thursday's meeting of the SBS Partners group in Manchester was good. The group is several meetings down the line now and starting to feel like its got some direction. Great turn out from Microsoft with 4 people representing the company. In particular Gareth Hall, server product manager, and Emily Lambert, SBSC programme lead, who are heavily involved in the new SBS2008 launch and had plenty to tell us about what to expect in the next couple of months and how we could get involved. Certainly got me fired up for the new upcoming version.

Also pleased to meet Vijay who is the partner area lead for SBSC - think we'll just refer to him as the SBSC API ;-) Been keeping an eye on his iQubed blog for useful posts this year. Be good to see you up here again Vijay. BTW he seems to have more acronyms than Symantec.

(Hey Manchester got a mention :-)

The meeting isn't just about Microsoft either, we've got a range of partners from one-man to 20 staff so the peer support and discussion is varied and helpful. Next meeting is 18 September with some interesting third-party visitors from what I've heard. See you there.

SBS 2003 Monitoring Report cannot be displayed

Had a couple of Small Business Server (SBS) 2003 boxes throw up blank daily monitoring reports recently. Most servers have been ok apart from these two, both SBS 2003 R2 with WSUS 3.0 SP1. One's a home build basic PC spec and the other is a Dell PowerEdge 860 dual core with 2GB RAM.

I wasn't able to get a fix despite trying reboots, updates, disk checks, reconfiguring monitoring, SQL database checks, etc. Got a fix now thanks to advice from Les Connor a Canadian SBS MVP, see the link here.

Basically you need to go into the main WSUS console (from Admin Tools) then Options and Server Cleanup Wizard. Running this with just the first option for Unused Updates fixed both servers. The PowerEdge took 18 hours to complete - reporting unused updates 11,092 and revisions 3,830. Sounds like this WSUS maintenance needs to happen on a monthly/quarterly schedule to keep the server optimised.

The basic server crashed out at 19 hours with SQL timeout errors. The monitoring report didn't come back immediately, until after a reboot.

Both are happy again ... me included :-)

The Hotel Vista

Had some problems at a hotel client last year when the first new Vista laptops started appearing with guests and delegates. The guest wireless has no password so its as simple as its gets really. Some of the laptops failed to get an IP address allocated and therefore wouldn't connect out. The laptop would associate and then do nothing or report Limited Connectivity. Other times they would work for a short time and then appear to disconnect. Also saw what looked like a normal connection, you could ping an external IP but website site addresses and hostnames wouldn't resolve - bit strange to diagnose. Needed a Gregory House moment.

I managed to track down a couple of registry keys that helped. Thought I'd better post them now just for the record following a discussion recently about dodgy wireless connections.

First one is from Microsoft KB933340
HKLM\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\DhcpGlobalForceBroadcastFlag \1
"0"= dword:00000000

I was reminded of the second one by Susan Bradley who pointed out Steve Riley's post.
Start a Command Prompt
(there's a cool short cut to this by shift-right-clicking a folder such as Documents)
(or use Windows-R key combo and type CMD)
then run the command
netsh int tcp set glo aut=dis

Which came first - the memory dump or the rainy day?

Just came across a useful sounding MS blog post c/o SMBManagedServices group at Yahoo. Talks about resolving 80% of memory dumps using the debugger, sounds easy really.

Anyway thought I'd best save the link somewhere prominent for a rainy day.

http://blogs.technet.com/petergal/archive/2006/03/23/422993.aspx

Whilst I'm on the theme of useful SBS Yahoo groups, also worth a look at ...
http://tech.groups.yahoo.com/group/UKSBSG/

Symantec AntiVirus 10.x license expired at client

Got an SBS2003 network with around 20 clients on. I installed the new licence at the server but one of the clients refused to cooperate and just appeared in the Symantec System Center Console with a license expired and refused to deploy the new one even though there were unallocated seats. The error I was getting was 0x80004005 - helpful yeah!

Turned out the Windows Firewall was getting in the way. Disabling it fixed the problem temporarily so the licence would install but there was no client management available. All the tools like view event log failed. I found Symantec doc 2004070817071248 which talked about using port 2967 for client communications. Using the Group Policy Management in the server management console let me add a firewall port exception to enable this for all PCs on the network.

I updated the Windows Firewall policy under Computer Configuration > Administrative templates > Network > Network Connections > Windows Firewall > Domain profile
and edited the Define Port Exceptions to include this line:
2967:TCP:*:Enabled:Symantec AntiVirus Management - Port

Media Player authorisation

Recently put a new SBS2003 R2 Premium server in at a client. We're using the ISA Server 2004 component of Premium to provide monitoring and some internet access control. Someone spotted that you couldn't play video files from itv.com, in particular the British Touring Car Championship (BTCC) ones. They use embedded media player for playback and kept giving an ISA server authorisation prompt.

The ISA logging at the server showed this error:
Denied Connection
SERVER 13/06/2008 09:31:10
Log type: Web Proxy (Forward)
Status: 12209 The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied.

Tracked the fix down to this article http://www.freelists.org/archives/isalist/11-2007/msg00016.html which talked about an error when Media Player tries to resolve the proxy name. With Microsoft ISA Firewall Client installed you can disable the Media Player proxy setting for HTTP (Tools>Options>Network>HTTP>Configure and change from browser to do not use). The Firewall Client will then handle ISA authorisation correctly.

Using the GPO method to apply the change across all PCs made life easy:
"User Configuration\Administrative Templates\Windows Components\Windows Media Player\Networking"
set the "Configure HTTP Proxy" option to "Disabled"

Who to blame - Microsoft or cheap kit?

So that cheap router you bought to connect to the internet was meant to save you some £. Turns out one of the cheap models out there, the Billion 5200 series doesn't get on with the latest big update from Microsoft - Windows XP Service Pack 3. Billion blame Microsoft - which I can't see. Surely the router should be stable and not go into a constant reboot cycle, irrespective of what random data gets hurled down the line at it. I'm sure there must be worse hitting it from the internet side. At least they've made updates available.

So next time you have to make a choice on cheap kit or recommended kit that costs a bit more but is likely to have had better design and testing, you might want to think twice.

Wonder if there are any other dodgy routers to come out of the closet yet? Just waiting those phone calls once SP3 gets the green light through Microsoft Update ...