Security Essentials on Server 2008

Source

November 26, 2009

Update 15. 3. 2010: this technique will fail at the genuity verification step of setup with recent Security Essentials installers. So it doesn’t work anymore. (And I will not be writing an update of this post, because I have moral problems with bypassing genuity verifications, sorry.)

I was getting a lot of e-mail about my recent article on installing Microsoft Security Essentials on Windows Server. Because the article shows up pretty high on google when searching for “security essentials windows server”, people kept asking me for a step-by-step tutorial. Originally, I didn’t want to do it because if someone isn’t able to follow the brief instructions I wrote in the original article, he won’t be able to fix problems that might show up after installing updates to Security Essentials. But whatever. Fasten your seat belts because here it comes:

REMEMBER: THIS IS NOT SUPPORTED BY MICROSOFT. IF YOU FOLLOW THESE INSTRUCTIONS, YOUR COMPUTER MIGHT BECOME UNBOOTABLE, SECURITY ESSENTIALS MIGHT APPEAR THEY WORK BUT THEY SILENTLY WON’T. ALSO, NIGHT ELVES WILL EAT ALL GROCERIES FROM YOUR FRIDGE WHILE YOU SLEEP.

This will only work for 64bit versions of Windows Server.

1. Follow my original article up to (and including) the point where you copy the unpacked setup files.
2. Download and install Microsoft Debugging Tools for Windows. Choose the version of debugging tools matching your operating system version.
3. Find WinDbg in the start menu and launch it elevated.
4. In the WinDbg menu choose File -> Open Executable and open the unpacked Setup.exe. Say no to the question about saving workspace.
5. A new window will show up. There will be a box for entering commands at the bottom of the new window. This is the command line.
6. Write this into the command line and hit enter: bp ntdll!RtlGetNtProductType "as /x ReturnValue rcx; gu; ed ReturnValue 1; g". This will set up a breakpoint that will modify the return value of RtlGetNtProductType (anyone has a clean way of doing this for 32bit Windows?)
7. Write g on the command line and hit enter to resume the installer.
8. The installer will start – focus it’s window and click Next.
9. Go back to WinDbg. Hit Ctrl-Break. Type the command bc * to remove the breakpoint and after that g to resume the setup. Finish installing. Done.

If at some point in the future something breaks, don’t go back crying to me. I warned you.

msiexec.exe

The basic syntax of msiexec is as follows:
msiexec /Option [Optional Parameter]
The usual option is to install (the /i parameter is for installing) a system with a command like this (program_name is the name of the .msi file).
msiexec /i program_name
There is also an uninstall option:
msiexec /x program_name

How to specify install language
setup.exe /L1031 for German install
With InstallShield's multi-language output, you'll point to the appropriate language transform:
msiexec /i Programabc.msi TRANSFORMS=1033.mst
Standard example:
msiexec /qb /i myusbonly_setup.msi ENABLE_ADMIN=1 SERIAL_NUMBER="12345-12345-12345" 
Few ways to uninstall an MSI package.
Uninstalling an MSI file from the command line without using msiexec

---

• If you have access to the original MSI used for the installation, you can simply right click it in Windows Explorer and select Uninstall.
• As stated above you can do the same by command line: msiexec /x filename.msi /q

---

• Just got to mention the normal approach though it is obvious
• Go start -> run -> appwiz.cpl -> ENTER in order to open the add/remove programs applet (or click add/ remove programs in the control panel)
• Click "Remove" for the product you want to uninstall.

---

• You can locate the required code to pass to msiexec.exe /x by opending regedit.exe at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and search for the application name (or just browse through each sub folder till u find it).
• When you have found it you can pass it to msiexec as explained above: msiexec.exe /x {0077A7C7-3333-2222-1111-111111111000}

---

• MSI strips out all cabs and caches each MSI installed in a super hidden system folder at %SystemRoot%\Installer (you need to show hidden files to see it).
• All the MSI files here will have a random name assigned, but you can get information about each MSI by showing the Windows Explorer status bar (View -> Status Bar) and then selecting an MSI. The summary stream from the MSI will be visible at the bottom of the Windows Explorer window.
• Once you find the right MSI, just right click it and go Uninstall.

---

• Finally you can uninstall an MSI via the Windows Installer Automation api
  Const msiUILevelNone = 2
  Set objInstaller = CreateObject("WindowsInstaller.Installer") objInstaller.UILevel = msiUILevelNone objInstaller.InstallProduct( "product.msi", "REMOVE=ALL") Set objInstaller = Nothing

Wink & CamStudio

Source 
(More tutorials created by Wink users and companies can be found

Wink is a Tutorial and Presentation creation software, primarily aimed at creating tutorials on how to use software (like a tutor for MS-Word/Excel etc). Using Wink you can capture screenshots, add explanations boxes, buttons, titles etc and generate a highly effective tutorial for your users.

at the User Forums)
This is a good example of how you can create tutorials in Wink, by capturing screenshots, mouse movements and specifying your own explanations with them. And all this in a standard Windows-based UI with drag-and-drop editing makes it very easy to create high quality tutorials/documentation. It is estimated that Macromedia Flash Player is installed in more than 90% of the PCs. Using Wink you can create content viewable across the web in all these users' desktops. Similar applications sell for hundreds of dollars, while Wink is free with unrivaled features. So spread the word about Wink to your friends.

 Features

Freeware: Distributed as freeware for business or personal use. However if you want to redistribute Wink, you need to get permission from the author. Cross-Platform: Available for all flavours of Windows and various versions of Linux (x86 only). Audio: Record voice as you create the tutorial for explaining better. Input formats: Capture screenshots from your PC, or use images in BMP/JPG/PNG/TIFF/GIF formats. Output formats: Macromedia Flash, Standalone EXE, PDF, PostScript, HTML or any of the above image formats. Use Flash/html for the web, EXE for distributing to PC users and PDF for printable manuals. Multilingual support: Works in English, French, German, Italian, Danish, Spanish, Serbian, Japanese, Brazilian Portuguese and Simplified/Traditional Chinese. Smart Capture Tools: Capture screenshots automatically as you use your PC, based on mouse and keyboard input (great time saver and generates professional captures). Performance/Quality: Creates highly compressed Flash presentations (few kbs to few hundreds of kbs, much smaller than competing commercial products) ideal for using on the web.

Tools: Navigation buttons to move to next/previous/random frames in the presentation, you can use custom bitmaps for these buttons (full transparency/alpha channel support). Callouts and shapes for displaying text explanations. The inbuilt Callout Editor is used to create custom shaped callouts as you want. Intuitive drag-n-drop editing of the frame, callout, cursor, navigation buttons and the title elements. Advanced features like templates, cursor editing, palettes, background images, control bars & preloaders for the flash output etc. Completely PC and Web ready with exports to PDF, HTML, SWF and EXE formats. Innovative compression techniques applied to reduce filesize of output Flash file. Generated flash file plays in Flash players from version 3 and above, giving you widest array of target audience. Uncompressed output to allow you import the output of Wink into other Flash editors.

As the first step after installation, please read the Wink UserGuide (present in the wink docs directory, also a link available in the windows start menu program group of Wink). Also, there are two tutorial projects created in Wink which you can view. Use the Help > View tutorial menu options to render and view them before you start using Wink. This will help you understand the basics easily.

Please post your queries/comments/reports at the Wink UserForum. The Wink UserForum is over here, please make use of it for posting your words about Wink so that fellow testers/users can benefit from what you have seen.

For Windows (version 2.0 build 1060)
• Download direct from SnapFiles.com
• Download from FreewareFiles.com
• Download direct from toolshape.com (thanks to Jocker for the bandwidth)
• Download direct from digital2b.com (thanks to Digital 2B s.n.c. for the bandwidth)
For Linux (version 1.5 build 1060)
• Download direct from linux-nerd.com (thanks to Olivier Garcia for the bandwidth)
• Download from Freeware4U.com
• Download direct from digital2b.com (thanks to Digital 2B s.n.c. for the bandwidth)
Notes for Wink on Linux (Read at source)

CamStudio

CamStudio is able to record all screen and audio activity on your computer and create industry-standard AVI video files and using its built-in SWF Producer can turn those AVIs into lean, mean, bandwidth-friendly Streaming Flash videos (SWFs)

Here are just a few ways you can use this software:

• You can use it to create demonstration videos for any software program
• Or how about creating a set of videos answering your most frequently asked questions?
• You can create video tutorials for school or college class
• You can use it to record a recurring problem with your computer so you can show technical support people
• You can use it to create video-based information products you can sell
• You can even use it to record new tricks and techniques you discover on your favourite software program, before you forget them

 Download Links

CamStudio: CamStudio20.exe

New CamStudio 2.6beta (experts only)
CamStudio_2.6b_r264_build_14july2010.exe

Lossless Codec:
New CamStudioCodec1.4.zip
CamStudioCodec14.exe

Support Forum:
http://camstudio.org/forum

FAQ:
camstudio.org/faq.htm

To manually install the codec, download the zipfile version, extract the contents to a folder, right click the camcodec.inf file and select Install.
If you don't have a lot of experience or just plain can't be bothered with all that mucking around [grin], download the EXE version and double click it to begin the install process.

Here is the project page on SourceForge where you can download the files if the above links don't work:

CamStudio on SourceForge:  

sourceforge.net/projects/camstudio/

News

AudioFlash is free audio recording software that will record you speaking via your computer and put it on your website with some nifty SWF control buttons.
Just wanted to let you know, I've released another tool called Podcast Autocue, which you can download as well from here: Podcast Software
There's now a "proper" blog for CamStudio where I'll post all the latest information, including updates on CamStudio V2.5. Click here to go to the blog

Issues
Trouble viewing SWF videos generated by CamStudio: It turns out there's a bug which means you can't see anything if you try watching them with Netscape or Firefox (Internet Explorer works fine) ...
Here's a temporary workaround:

Open the related HTML to the SWF you've just generated and look for the line starting with the "EMBED SRC" command ...

Change the Width and Height values in this line to match values in the line starting with "OBJECT CLASSID".

Save the file and you should be good to go ...

--------------------------
If your computer's memory or virtual memory usage starts climbing rapidly when viewing a SWF authored by CamStudio to the point when your PC locks up so you have to reboot it, recreate the SWF from your source AVI file and in SWF Producer, make sure you select the Advanced tab and check the Memory Management tickbox (Manage Flash player internal memory). That should sort the problem out. Thanks to Ben Ward for the fix.

Rizone Tech BeepCodes

The computer POST (Power On Self Test) tests the computer, insuring that it meets the necessary system requirements and that all hardware is working properly before starting the remainder of the boot process. If the computer passes the POST, the computer will have a single beep (with some computer BIOS manufacturers it may beep twice) as the computer starts and it will continue to start normally. However, if the computer fails the POST, the computer will either not beep at all or will generate a beep code, which tells the user the source of the problem. This little utility will help you to lookup these beep codes and figure out what they represent.

Download Information
File Name:	BeepCodes.zip
Size:	423 KB
Version:	0.0.1.168
Portable:	Yes (Run from USB drive)
OS Support:	Windows 2000, XP, 2003, Vista, 2008, 7
Downloads:	23096 Satisfied users
Download Mirror 1:	Rizone Technologies

Drive Manager

Source

If you have lots of drive letters of different types of drives, such as mapped network drives, thumb drive (USB memory sticks), smart media and compact flash, CD-ROM and DVD then this utility is perfect to help you manage them.
Using Drive Manager to identifying which drive is which.
Drive Manager helps you easily identify drives which are of the same type. As well as displaying the volume label it also displays vendor information so that multiply CD/DVD drives and removable drives such as USB thumb drives can be differentiated by their manufacturers name, version and revision date. Also the serial number can be seen as a unique ID for each drives.

Password Protect .exe Application Files

Source

Have some secret exe files that you don’t want it to be run by any one else? Then you can protect it with a password of your choice.

Empathy is a great portable application that can protect any executable file with a password of your choice. That means whenever any one tries to run the exe file, it will ask for the correct password first. If the password is provided, it will run else not.

The above image can tell you what happens when you try to run the file encrypted with Empathy.

Advantages:

•    Easy to use.
•    Small program that do not require installation.
•    Can be used any number of time.

Disadvantage:

This is the only disadvantage of Empathy, that it is a postcardware. This means that it can be used for unlimited time but to use it with all features, one needs to send     a postcard to the developer, who will send the unlocking code by e-mail. Funny?
====================================

Disable File, Folder and Text from Copy and Cut

Windows allows anyone to copy or cut any file or folder easily without any restriction. This is a problem if you have some secret files or folders that you want to keep with yourselves.

This was not possible for a long time but here is a tool that can do exactly that. Moreover the software is free and easy to use.

M File Anti-copy is great software that can lock and disable copy and move feature inWindows. The program requires a password to be used.

What you all need to do is just install this software and enter a password. You will see a home screen of the software from which you can activate the “Disable Copy” feature. After this the paste option in the right click context menu will get disabled.

However if you need to copy or cut the file then you can use the built in File Copier.

Advantages:

•    Free tool.

•    Disables file copy and cut in Windows.

•    Password protected.

•    Disables Task Manager and Registry Editor, so that some user can not end the process.

The only disadvantage I found was that you can however upload the file over internet. What you think?

Download M File Anti-copy

Enable show hidden files and folders

system hidden folders are made hidden by default by the Operating System and you can see those (if present on the disk) by unchecking the option of “Hide protected Operating System Files and Folders” in the Folder Options.
Source
Some malware can modify Windows settings to disable or prevent users to change setting of Show Hidden Files and Folders under folder options. These steps will help you regain access or modify and save the settings.

PROCEDURE A:
1 . Go to Start > Run
2. Type regedit on the box
3. On Registry editor navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL¡
4. On the right pane, delete the value with

• Name: CheckedValue
• Type: REG_SZ
• Data: 2

5. Create a new DWORD. Right-click on the right pane > New >DWORD Value
6. Value should be:

• Name: CheckedValue
• Type: REG_DWORD
• Data: 1

Note: If procedure A does not work, please use Procedure B.
PROCEDURE B:
1. Download folderoption.reg.
2. Save it in your Desktop or any folder where you can easily access it
3. Go to your Desktop
4. Double-click the folderoption.reg
5. If it prompts if you want to add the information on the registry, click YES
6. It will confirm that information was successfully entered into registry, click OK
7 You should now be able to modify Show Hidden Files and Folders settings.

Enable Show Hidden Files and Folders Using Free Tool
RRT or Remove Restrictions Tool is a free tool to enable access to different Windows process disbaled by virus infections.
This tool is used to enable access to:
- Registry Tools (regedit)
- Ctrl+Alt+Del
- Folder Options
- Show Hidden Files
Download RRT: click here to donwload
Related posts:

1. How to Enable a Hidden Folder Options
2. How to Enable Registry Editor
3. How to Enable Windows Task Manager

=================================
Source: bleepingcomputer.com

And I also used a RRT. exe program from the internet. It just made my hidden files and folders visible. And then I could not see any autorun.onf file! So i guess the inf file could not get installed.. 
Beyond that I do not know what happened.  
So Q2 Is there a chance to find out if there is some virus still lodged on my PC? Which tool will help me do that when all your tools have failed. and also I do not see any sign of virus except what I am going to tell you now.
After RRT worked. I found a new problem. I was now unable to hide the files again. It was as if what RRT promised was too true to its promise! The files kept being visible!
So after some research on the net I made the following settings in REGEDIT
HKEY_LOCAL_MACHINE-SOFTWARE-MICROSOFT-WINDOWS-CURRENT VERSION-EXPLORER-ADVANCED-FOLDER-HIDDEN-NOHIDDEN -checkedvalue and defaultvalue both =0 and 

SHOWALL-CHECKEVALUE= 1 AND DEFAULT=0
and
HKEY_CURRENT_USER-SOFTWARE-MICROSOFT-WINDOWS-EXPLORER-ADVANCED-HIDDEN value=1 (which means show I believe)
So then I could see the hidden files still. ok. So far so good.!!  
And now I could also change the setting using tools--folder options--view -- hiddden folders and files -- by choosing "do not show" radio button
The hidden files can become hidden again. Good.
But now the problem!! Now I am not able to change to the radio button "show" again
I go to regedit and see the settings changed to
HKEY_CURRENT_USER-SOFTWARE-MICROSOFT-WINDOWS-EXPLORER-ADVANCED-HIDDEN value=2 (do not show i believe) or 0 (that too does not show i believe)
===================================

Super Hide the Files and Folders

We often face several occasions when we want to keep our few important files privateand in secret especially on the system that is shared by many users. The files may be important documents, files storing private data like passwords or some content that we do not want to share. This can be done in XP with ease and even without using any software.

In order to do this we would make the files possess system attributes and these files will not be shown even if you tick the “Show Hidden Files and Folders” option.
1.    Go to Folder options then under the view tab untick the option of “Hide protected Operating System Files”.
2.    Open any drive and copy the “System Volume Information” folder to the location where you want to store the files.
3.    Empty this folder and copy your important files in it.

The files will become super hidden and will not be displayed even with show hidden folder option.