@Ambarishrh said in virus cleanup-advise needed:

Can webroot help me here, thinking of using webroot and see if it can clean

Maybe. Anything "might" work. But you'll never know.

@aaronstuder said in Contabo VPS:

@scottalanmiller Do you know how well nested KVM works?

Have not tested it.

@scottalanmiller said in Linode and Vultr Current Pricing Q1 2017:

Vultr has a much superior (IMHO) web interface. Linode's is not at all on par.

Completely Agree 100%

Circling back to this, it is like I was blind or something. This happened because owncloud made it into the EPEL. It says it right there in my screenshot.

I just installed a new CentSO system and wanted to see what it tried now.

[root@bna-nc ~]# yum install owncloud Loaded plugins: fastestmirror epel/x86_64/metalink | 12 kB 00:00:00 epel | 4.3 kB 00:00:00 (1/3): epel/x86_64/group_gz | 170 kB 00:00:00 (2/3): epel/x86_64/updateinfo | 751 kB 00:00:00 (3/3): epel/x86_64/primary_db | 4.6 MB 00:00:00 Loading mirror speeds from cached hostfile * base: centos.mirrors.tds.net * epel: mirror.oss.ou.edu * extras: ftpmirror.your.org * updates: bay.uchicago.edu Resolving Dependencies --> Running transaction check ---> Package owncloud.noarch 0:9.1.4-1.el7 will be installed

*stands close to @scottalanmiller , ready to pounce on him with an epipen, just in case*

We use HAProxy as our load balancer for Horizon View. Works amazingly well and is very light weight.

And there goes a successful mail test.

Mar 7 11:25:24 relay01 postfix/smtpd[2206]: connect from owncloud.domain.local[10.201.1.17] Mar 7 11:25:24 relay01 postfix/smtpd[2206]: CB2E6C0C82CB: client=owncloud.domain.local[10.201.1.17] Mar 7 11:25:24 relay01 postfix/cleanup[2208]: CB2E6C0C82CB: message-id=<[email protected]> Mar 7 11:25:24 relay01 postfix/qmgr[1665]: CB2E6C0C82CB: from=<[email protected]>, size=591, nrcpt=1 (queue active) Mar 7 11:25:24 relay01 postfix/smtpd[2206]: disconnect from owncloud.domain.local[10.201.1.17] Mar 7 11:25:26 relay01 postfix/smtp[2209]: CB2E6C0C82CB: to=<[email protected]>, relay=domain-com.mail.protection.outlook.com[216.32.181.170]:25, delay=2.1, delays=0.05/0/0.62/1.4, dsn=2.6.0, status=sent (250 2.6.0 <[email protected]> [InternalId=42704859829911, Hostname=SN1PR0201MB1854.namprd02.prod.outlook.com] 7564 bytes in 0.244, 30.254 KB/sec Queued mail for delivery) Mar 7 11:25:26 relay01 postfix/qmgr[1665]: CB2E6C0C82CB: removed

@wirestyle22 updates were applied only in the VM's not the host.. everything is ok, just for a vm an error about integration services

@Dashrender said in DNSMessenger malware:

That's all fine and dandy my point was that this hack is currently worthless on its own it requires a previous hack in order to make this one work

The point is not how the infection was started. The point is that the infection itself is completely fileless. Never writing data to the disk.

There are multitudes of ways into a Windows system that an attacker could use to execute the initial code.

Old thread but I just found this out after wasting a few hours last evening trying to get Hyper-V 2016 on my Dell 2950 lab server. Processors need to support SLAT
http://www.nodefinity.net/post/hyper-v-on-poweredge-2900-2950-the-end-of-the-road-is-windows-server-2012-r2

Same here. We do not normally put OpenVPN on endpoints.

LucidCharts?

@flabbergastedFiltch said in Linux: Finding Files:

Yea, Scott's reply led me to:

find . -name "*\ " -print

Not a big leap.

Now I'm all the way down the rabbit hole of xargs, grep, and perhaps sed (?)

Using FreeBSD on EMC Isilon.

I have to do this a lot, but the creative way users name files is ever changing:
filename.
filename. [filename dot space]
file*name

Here's a sample of a real directory:

./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEULIGCONOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUBLA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._TIMESEXTBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._GILLSANBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/GILLSANEXTBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVETICA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVETICANEUE3.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUHEACONOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUULTLIG.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUROM.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._ZAPFDINGBATS.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVEBOLOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVETICANEUE1.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._TIMESBOLITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVETICANEUE2.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEULIGCON.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUBLA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUHEACON.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVETICANEUECONDENSED3.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/GILLSANITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUMEDCONOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._TIMESSEMITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUTHI.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVETICANEUE3.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/TIMESBOLITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVETICANEUE1.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/TIMESEXTBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUHEACONOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUHEAITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/ZAPFDINGBATS.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUULTLIG.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUBLAITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUMEDCON.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/GILLSANLIGITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUHEAITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUTHI.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUHEA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUMEDCONOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUBLAITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUHEA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUTHIITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUMEDITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEULIGITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._GILLSANITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._GILLSANEXTBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._GILLSANBOLITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEULIGCON.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEULIGITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/TIMESSEMITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVEBOLOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUMEDCON.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUMEDITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUULTLIGITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/GILLSANLIG.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUULTLIGITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._GILLSANLIG.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVETICA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/GILLSANBOLITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEULIG.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUMED.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._GILLSANLIGITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUHEACON.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUMED.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVETICANEUE2.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEULIGCONOBL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/GILLSANBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUTHIITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVETICANEUECONDENSED3.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/._HELVENEUITA.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUBOL.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEULIG.
./WebUploads/FAMILYANDFRIENDS.1/b_Fonts/HELVENEUROM.

One or Two files (even 10) and I'd use mv to rename the files and remove the space or period or add extension, etc... This list represents just one folder out of a few hundred that have some gremlin preventing Windows NT Backup (don't ask) from taking a backup and deleting the originals.

Thanks for the reply and nudge. Now back to it after I change my Job Description on Linkedin to "Frustrated wannabe Software Developer".

As much as I like giant one liners, the best tool for this would be rename.

To remove a period just do

find . -type f -exec rename "." "" {} \;

You don't technically need to use find, but if the files span multiple directories it's easier.

@scottalanmiller said in Meraki MX400 NAT Question:

@dafyre said in Meraki MX400 NAT Question:

The team that is there now are the ones that have to convince the bean counters of the need to change.

It's a tiny cost though, right? We are only talking about a minuscule investment, I think. If it saves a few hours of effort, doesn't that cover the cost?

No you are not. You are neglecting to add in the labor costs and only calculating on the hardware costs.

Physically changing everything will add labor cost. Ordering, configuration, staging, installation.

Yes, something else is cheaper. But not as cheap as you try to make it sound.

The existing solution is in place and already paid for. A simple support call resolved the configuration issue. There is no reason to spend additional capital to change a working solution until you have to plan for new spend on the solution.

If the existing solution was actually not functional, or some other factors were in play to offset things, then it would certainly be worth switching solutions.

@scottalanmiller said in Protecting your business network:

@Dashrender said in Protecting your business network:

This problem does relate to the current IOT nightmare that exists in home networks (and sadly, many business ones too).

The nightmare is that the production network does need access to the IOT network. An example is the Amazon Echo app. I think (though I haven't confirmed), you have to be on the same network to control the Echo. So even opening firewall ports probably won't work since the app finds the device via broadcasts and those of course wouldn't go to the other network normally. I'm not even sure there is a way to make a many to many solution for this type of problem.

The issue is not IoT, though, just crappy products.

Oh, you're absolutely right! Sadly - medical equipment has been shown to be a crappy product!

KVM Networking was set to NAT not Routed 😞

I guess I am learning?........