Most Popular Posts
Sunday, 19 June 2011
I LOVE CAKE!!
Cakephp that is :)
check out http://cakephp.org/
It is basically a MVC oriented framework for buildiing PHP applications, I have been working with it the last few days and have to say it takes so much of the heavy lifting out of building a web based php app.
but what does it do I hear you ask?
well, how does creating your database, a few tables and then running a few commands sound to get yourself a skeleton app built automatically sound? too good to be true?
Thats what I though but get CakePHP and spend the time to learn it because once you do it is going to save you so much time!
Mad props to Larry Masters the creator of CakePHP for this wonderful framework, seriously why are you still reading? go get it!, now! ^_^
Tuesday, 24 May 2011
SCCM Clients failing to install windows updates
Just a quick one..
I recently pushed a software update via SCCM to around 3000 clients and had around 15 come back as failing. I found that they had a value for a proxy set in the registry at this location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
Internally the clients shouldnt go via a proxy to grab these updates so I backed up the key and deleted the value WinHttpSettings
and lo and behold the updates now work!.
So now I need to find out where those clients are getting this value from and I also need to do some more testing and implement this fix
Cheers
I recently pushed a software update via SCCM to around 3000 clients and had around 15 come back as failing. I found that they had a value for a proxy set in the registry at this location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
Internally the clients shouldnt go via a proxy to grab these updates so I backed up the key and deleted the value WinHttpSettings
and lo and behold the updates now work!.
So now I need to find out where those clients are getting this value from and I also need to do some more testing and implement this fix
Cheers
Sunday, 17 April 2011
No mapping between account names and security IDs was done!
Sunday morning and I am busy setting up a SQL 2008 R2 in a VM but get this error message when trying to add in my service accounts, I checked and double checked the accounts, passwords etc with no luck and then wondered was it something to do with the fact that I had cloned these Virtual machines?.....
I then ran psgetsid.exe on my SQL server and DC and found the problem... duplicate machine Sids :'(
Moral of the story is always use sysprep before cloning a VM :)
which is really obvious when you think about it, oh well...
I then ran psgetsid.exe on my SQL server and DC and found the problem... duplicate machine Sids :'(
Moral of the story is always use sysprep before cloning a VM :)
which is really obvious when you think about it, oh well...
Friday, 8 April 2011
Firefox Profiles for home and work
Just a quick one about firefox profiles..... I wanted a way to get to all of my work related bookmarks at work and from home without mixing them with my personal ones. Here's how to do it:
create 2 new shortcuts as follows:
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -P WorkProfile -no-remote
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -P HomeProfile -no-remote
set up the new "Sync" feature in Firefox 4 and your all done! :)
create 2 new shortcuts as follows:
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -P WorkProfile -no-remote
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -P HomeProfile -no-remote
set up the new "Sync" feature in Firefox 4 and your all done! :)
Monday, 4 April 2011
vbma92a1.sys
So I was looking at another infected laptop *sigh*......
This one was redirecting web traffic to all sorts of places and stopping processes such as rootkit revealer, process explorer dead in their tracks. Since I couldnt see nothing obvious in services, the run key or Task manager I suspected a driver based rootkit... and I was right :)
I looked in system32\drivers and noticed a file called vbma92a1.sys that was dated a few days ago so I renamed it to .old and it recreated itself on next reboot, aha!
I then booted into an offline environment and deleted it and created a dummy vbma92a1.sys file in its place, denying everyone and everything access to it.
Upon rebooting all of my tools now worked :)
just gotta give it a quick scan with something other than what is installed and it should be good to go ;)
hope this helps!
This one was redirecting web traffic to all sorts of places and stopping processes such as rootkit revealer, process explorer dead in their tracks. Since I couldnt see nothing obvious in services, the run key or Task manager I suspected a driver based rootkit... and I was right :)
I looked in system32\drivers and noticed a file called vbma92a1.sys that was dated a few days ago so I renamed it to .old and it recreated itself on next reboot, aha!
I then booted into an offline environment and deleted it and created a dummy vbma92a1.sys file in its place, denying everyone and everything access to it.
Upon rebooting all of my tools now worked :)
just gotta give it a quick scan with something other than what is installed and it should be good to go ;)
hope this helps!
Labels:
Malware,
rookit,
spyware,
vbma92a1.sys,
virus
Sunday, 27 March 2011
Automatically Merge SCCM Conflicting Records
I have just stumbled upon a very promising looking post by Jörgen Nilsson, in it he shows how to have SCCM automatically merge conflicting records using a combination of a vbs script and a status filter rule, check it out!
Auto merging SCCM conflicting records
Auto merging SCCM conflicting records
Tuesday, 1 March 2011
Powershell script to monitor for idle CPU then put computer to sleep
Good evening, I have been working on a little powershell script and thought I would post it as it might come in handy for others.
Basically my laptop stays on 24/7 (its tucked away in a corner and runs DNS, DHCP,Downloads and that kind of thing). What I want to do is if nothing is downloading on it overnight then I want it to sleep. I use JDownloader to auto download files for me overnight which has the auto extract (unrar.exe) feature built in too. Take a look at the script you will see it looks for unrar.exe and if that isnt running checks the cpu usage of jdownloader (javaw.exe) if it is below a certain value 5 times then the powershell script calls a batch file and the laptop sleeps.
When it hits 7am a scheduled task (to ping localhost) wakes it up again, nice huh? :)
Anyway enough babbling heres the script:
####### SCRIPT START #######
[int]$ProcessorInactive = $null
do {if(($ProcessorInactive) -le 5)
{
Write-host "ProcessorInactive is less than 5"
do {if(($ProcessActive = Get-Process unrar -ErrorAction SilentlyContinue) -ne $null)
{
Write-host "unrar is active"
$ProcessAlive = "SomeValue"
Start-Sleep -Seconds 900
}
else
{
Write-host "unrar isnt active"
$Process = Get-Counter -Counter "\Process(javaw)\% Processor Time"
$Sample = $process.Countersamples[0]
$CpuTime = $Sample.CookedValue
$CpuTime = ($CpuTime/2)
do {if(($CpuTime) -gt 3)
{
Write-host "CpuTime is higher than 3"
Start-Sleep -Seconds 10
$Process = Get-Counter -Counter "\Process(javaw)\% Processor Time"
$Sample = $process.Countersamples[0]
$CpuTime = $Sample.CookedValue
$CpuTime = ($CpuTime/2)
}
else
{
Write-host "CpuTime is less than 3 now"
}
}
while ($CpuTime -gt 3)
#clear this variable else we will loop forever
$ProcessAlive = $null
$ProcessorInactive++
Start-Sleep -Seconds 30
}}
while (($ProcessAlive) -ne $null)
}
}
while ($ProcessorInactive -le 5)
echo "********VERY END OF SCRIPT NOW DO WHAT YOU WANT HERE*******"
cmd /c """H:\powershell\Sleep.bat"""
####### SCRIPT END #######
And if anyone wants to know the contents of "sleep.bat" are:
rundll32.exe powrprof.dll,SetSuspendState
Note: Aside from the obvious you may have to change this part:
$CpuTime = ($CpuTime/2)
to the number of cores you have (my laptop has 2) as the cpu usage is a total of all cores
Thanks for reading and hope it helps someone! :)
EDIT: I have since changed the cputime percentage for javaw.exe to 1 to see if this improves the script. I think that with it set to 3 the script is sometimes catching the usage below 3% 5 times and sleeping even though there are downloads left so altering this value should help. The 2 parts you need to change are line 21 & line 36
Basically my laptop stays on 24/7 (its tucked away in a corner and runs DNS, DHCP,Downloads and that kind of thing). What I want to do is if nothing is downloading on it overnight then I want it to sleep. I use JDownloader to auto download files for me overnight which has the auto extract (unrar.exe) feature built in too. Take a look at the script you will see it looks for unrar.exe and if that isnt running checks the cpu usage of jdownloader (javaw.exe) if it is below a certain value 5 times then the powershell script calls a batch file and the laptop sleeps.
When it hits 7am a scheduled task (to ping localhost) wakes it up again, nice huh? :)
Anyway enough babbling heres the script:
####### SCRIPT START #######
[int]$ProcessorInactive = $null
do {if(($ProcessorInactive) -le 5)
{
Write-host "ProcessorInactive is less than 5"
do {if(($ProcessActive = Get-Process unrar -ErrorAction SilentlyContinue) -ne $null)
{
Write-host "unrar is active"
$ProcessAlive = "SomeValue"
Start-Sleep -Seconds 900
}
else
{
Write-host "unrar isnt active"
$Process = Get-Counter -Counter "\Process(javaw)\% Processor Time"
$Sample = $process.Countersamples[0]
$CpuTime = $Sample.CookedValue
$CpuTime = ($CpuTime/2)
do {if(($CpuTime) -gt 3)
{
Write-host "CpuTime is higher than 3"
Start-Sleep -Seconds 10
$Process = Get-Counter -Counter "\Process(javaw)\% Processor Time"
$Sample = $process.Countersamples[0]
$CpuTime = $Sample.CookedValue
$CpuTime = ($CpuTime/2)
}
else
{
Write-host "CpuTime is less than 3 now"
}
}
while ($CpuTime -gt 3)
#clear this variable else we will loop forever
$ProcessAlive = $null
$ProcessorInactive++
Start-Sleep -Seconds 30
}}
while (($ProcessAlive) -ne $null)
}
}
while ($ProcessorInactive -le 5)
echo "********VERY END OF SCRIPT NOW DO WHAT YOU WANT HERE*******"
cmd /c """H:\powershell\Sleep.bat"""
####### SCRIPT END #######
And if anyone wants to know the contents of "sleep.bat" are:
rundll32.exe powrprof.dll,SetSuspendState
Note: Aside from the obvious you may have to change this part:
$CpuTime = ($CpuTime/2)
to the number of cores you have (my laptop has 2) as the cpu usage is a total of all cores
Thanks for reading and hope it helps someone! :)
EDIT: I have since changed the cputime percentage for javaw.exe to 1 to see if this improves the script. I think that with it set to 3 the script is sometimes catching the usage below 3% 5 times and sleeping even though there are downloads left so altering this value should help. The 2 parts you need to change are line 21 & line 36
Subscribe to:
Posts (Atom)