Monday, October 20, 2008

Step-by-Step Guide to Software Installation and Maintenance


Software Installation and Maintenance for the Windows® 2000 operating system allows administrators to manage software for their organizations, including applications, service packs, and operating system upgrades. This overview guide explains how to use the Software Installation extension of the Group Policy Microsoft Management Console snap-in to specify policy settings for application deployment for groups of users and computers.

Introduction

This document is part of a set of step-by-step guides that introduce the Change and Configuration Management features of the Windows® 2000 operating system. This guide presents an overview of Software Installation and Maintenance. It also explains how to use the Software Installation extension of the Group Policy Microsoft Management Console snap-in to specify policy settings for application deployment for groups of users and computers.

Software Installation and Maintenance is dependent upon both the Active Directory and Group Policy. Administrators who are responsible for Software Installation and Maintenance should be familiar with both of these technologies.

Publish vs. Assign

Administrators can use Software Installation and Maintenance to either publish or assign software:

  • Publish. Administrators publish applications that users may find useful, allowing users to decide whether to install the application. You can only publish to users, not computers.

  • Assign. Administrators assign applications that users require to perform their jobs. Assigned applications are available on users' desktops automatically.

For a comparison of these capabilities, see Table 1 below. Administrators deploy applications in Group Policy objects (GPOs) that are associated with Active Directory containers such as sites, domains, and organizational units (OUs).

Table 1 Publishing and Assigning Software


Publish to Users

Assign to Users

Assign to Computers

After the administrator deploys the software, it is available for installation:

If an application is deployed in a GPO that is already applied to the user from a previous logon, it is available for installation in the current logon session (from the Add/Remove Programs Control Panel). If the application is deployed in a new GPO that is not already associated with the user, then it is available at the next logon.

If an application is deployed in a GPO that is already applied to the user from a previous logon, it is available for installation in the current logon session (from the Add/Remove Programs Control Panel). If the application is deployed in a new GPO that is not already associated with the user, then it is available at the next logon.

The next time the computer starts (reboot).

Typically, users install the software from:

The Add/Remove Programs in Control Panel.

Start menu shortcut.
Desktop shortcut.
Add/Remove Programs in Control Panel.

The software is already installed.

If the software is not installed and the user opens a file associated with the software, will the application install?

Yes.

Yes.

The software is already installed.

Can the users remove the software using the Add/Remove Programs in Control Panel?

Yes. Users can re-install the application from the Add/Remove Programs in Control Panel.

Yes. The software will be re-advertised immediately. This means that the shortcuts will be present in the users' desktops and they can re-install the application by clicking on a shortcut, for example.

No. Only the local administrator can remove the software. A user can run a repair on the software.

Supported installation file types:

Windows Installer packages (.msi files), and ZAP files.

Windows Installer packages (.msi files)

Windows Installer packages (.msi files)

Supported Installation File Types

Software Installation and Maintenance supports Windows Installer packages (.msi files), repackaged files, and .zap files.

A Windows Installer package (.msi file) contains all the information necessary to describe to the Windows Installer how to set up an application. It covers every conceivable situation: various platforms, different sets of previously installed products, earlier versions of a product, and numerous default installation locations. Some applications such as Office 2000 provide their own .msi files. These are referred to as natively-authored Windows Installer packages.

You can create Windows Installer packages for your applications by using package-authoring tools provided by various vendors such as InstallShield Software Corporation and WISE Solutions, Inc. See the section on Windows Installer Applications for more information.

You can also repackage an existing application for use with the Windows Installer. To create a package for the application, you use a repackaging tool such as the VERITAS WinInstall LE, described later in this document.

Non-Windows Installer-based applications must use a .zap file to describe their existing setup program. A .zap file is a text file (similar to .ini files) that provides information about how to install a program, the application properties, and the entry points that the application should install. A sample .zap file is included in the appendix - An Excel 97 .Zap File.

Wednesday, September 17, 2008

regsvr.exe (Microsoft Corparation) Virus




regsvr.exe / Winhelp.exe / rundll.exe / (Microsoft Corparation)

regsvr.exe / Winhelp.exe / rundll.exe
===========================

File names

———–

Name : regsvr.exe
Name : winhelp.exe
Type of File : Application
Icon : Folder icon
size : 1.06 MB (1,114,588 bytes)
size on disk : 1.07 MB (1,122,304 bytes)
File version : 1.1.2.2
Description : Microsoft Corparation (its Microsoft Corp’a'ration not Microsoft Corporation)
Copyright :
Compiled Script : Microsoft Corporation
File Verion : 1,1,2,2
Language : English (United Kingdom)

Name : rundll.exe
Type of File : Application
Description : Generic Host Process for Win32 Services
Size : 161 KB (164,864 bytes)
size on disk : 168 KB (172,032 bytes)
File version : 3.8.0.7400
Company : Microsoft Corporation
Internal name : svchost-full-org
Language : English (United States)
Original name : svchost-full-org.exe

other supporting files, created during installation ofvirus

Name : MSINET.OCX
Type : ActiveX Control
Size : 60.5 KB (61,952 bytes)
Size on disk : 64.0 KB (65,536 bytes)
File version : 5.1.45.11
Description : Microsoft Internet Transfer Control DLL
Copyright : Copyright © 1987-1997 Microsoft Corp.
Comments : September 11, 1997
Company : Microsoft Corporation
File version : 5.01.4511
Internal name : MSINET.OCX

Name : ijl11pro.dll
Type : Application Extension
Size : 70.0 KB (71,680 bytes)
six\ze on disk : 72.0 KB (73,728 bytes)
File version : 1.1.2.16
Description : Intel® JPEG Library - Retail Version
Copyright : Copyright © 1999
Comments : Intel® JPEG Library
Company : Intel Corporation
File version : 1.1.2
Internal name : Intel® JPEG Library
Original name : ijl11.dll

x—x—x

Recognized by KAV
—————–

not-a-virus:Monitor.Win32.007SpySoft.q rundll.exe
Worm.Win32.AutoIt.s regsvr.exe
x—x—x

Running Process
—————

regsvr.exe 1-30% 2 threads
rundll.exe 0% 4 threads
Winhelp.exe SYSTEM 1-40% 1 thread

x—x—x

Behind the Screen
—————–

Files Created:
…………..

I:\DOCUME~1\PIYUSH~1\LOCALS~1\Temp\aut3.tmp
I:\DOCUME~1\PIYUSH~1\LOCALS~1\Temp\aut4.tmp
I:\DOCUME~1\PIYUSH~1\LOCALS~1\Temp\aut5.tmp
I:\DOCUME~1\PIYUSH~1\LOCALS~1\Temp\aut6.tmp
I:\WINDOWS\winhelp.ini
I:\WINDOWS\system32\rundll.exe
I:\WINDOWS\system32\ijl11pro.dll
I:\WINDOWS\system32\MSINET.OCX
I:\WINDOWS\system32\regsvr.exe
I:\WINDOWS\regsvr.exe
I:\WINDOWS\system32\winhelp.exe
I:\Documents and Settings\Piyush Chandra\Local Settings\Temp\~DFD5E6.tmp
I:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
I:\WINDOWS\system32\COMCTL32.OCX
I:\WINDOWS\system32\stdole2.tlb
ModifyFile I:\WINDOWS\winhelp.ini

Regsitries changed:
……………….

ModifyRegValue \REGISTRY\USER\S-1-5-21-1935655697-308236825-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79ebb8fd-f8e1-11dc-a1b1-806d6172696f}\BaseClass
etc
ModifyRegValue \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
CreateRegValue \REGISTRY\USER\S-1-5-21-1935655697-308236825-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger
CreateRegValue \REGISTRY\USER\S-1-5-21-1935655697-308236825-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NofolderOptions
CreateRegValue \REGISTRY\USER\S-1-5-21-1935655697-308236825-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
CreateRegValue \REGISTRY\USER\S-1-5-21-1935655697-308236825-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
CreateRegValue \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\AtTaskMaxHours
ModifyRegValue \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\system
CreateDir C:\WINNT\system32\ssdata\
CreateDir C:\Recycled\WinLiveUpdate32\scrdata\
CreateDir C:\Recycled\WinLiveUpdate32\
CreateRegValue \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\User Themes
CreateRegKey \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}
etc
CreateRegKey \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
etc
CreateRegValue HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\User “I:\WINDOWS\system32\rundll.exe”

Registry access:
…………….

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32
HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters
HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
HKLM\SYSTEM\ControlSet001\Hardware Profiles001
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness

x—x—x

More behind the screen
———————-

The virus gets completely installed only after rebooting two times.

It uses cacls.exe to change some permission setting (not yet discovered)

It saves printscreen images in c:\recycled\WinLiveUpdate32\ at an interval of 30 seconds
so it eats up the space for your c:\ if u are affected by this virus for long time

It saves some processes goining on the system in c:recycled\WinLiveUpdate32\scrdata\ in files namely Apps.data, Files.dat, Keys.data, scr.data, lgstat.ini

In simple words: it keeps a complete track about you computer.

Apps.data
………

Piyush Chandra|||2008-03-26 19:05:18|||Run|||Kaspersky Anti-Virus 6.0
Piyush Chandra|||2008-03-26 19:05:21|||Run|||Protection
Piyush Chandra|||2008-03-26 19:05:32|||Close|||Protection
Piyush Chandra|||2008-03-26 19:05:34|||Close|||Kaspersky Anti-Virus 6.0
Piyush Chandra|||2008-03-26 19:05:37|||Run|||Windows Task Manager
Piyush Chandra|||2008-03-26 19:06:04|||Run|||My Documents
etc

Files.dat
………

Piyush Chandra|||2008-03-26 19:31:55|||Create Dir|||H:\MyDocs\virus collection\Known\regsvr.exe Worm.Win32.AutoIt.s\Virus\New Folder
Piyush Chandra|||2008-03-26 19:32:00|||Rename Dir|||H:\MyDocs\virus collection\Known\regsvr.exe Worm.Win32.AutoIt.s\Virus\New Folder—>H:\MyDocs\virus collection\Known\regsvr.exe Worm.Win32.AutoIt.s\Virus\recycler files

etc

Keys.data
………

Piyush Chandra|||2008-03-26 19:10:03|||StartupMonitor Warning
{Enter}

scr.data
……..

Piyush Chandra|||2008-03-26 19:06:15|||Proactive Defense Alert|||C:\Recycled\WinLiveUpdate32\scrdata\2008032668776.jpg
Piyush Chandra|||2008-03-26 19:06:45|||Process Explorer - Sysinternals: www.sysinternals.com [PIYUSH\Piyush Chandra]|||C:\Recycled\WinLiveUpdate32\scrdata\2008032668806.jpg
Piyush Chandra|||2008-03-26 19:07:16|||Process Explorer - Sysinternals: www.sysinternals.com [PIYUSH\Piyush Chandra]|||C:\Recycled\WinLiveUpdate32\scrdata\2008032668836.jpg
Piyush Chandra|||2008-03-26 19:07:46|||~DFBFCB.tmp - Notepad|||C:\Recycled\WinLiveUpdate32\scrdata\2008032668866.jpg
Piyush Chandra|||2008-03-26 19:08:16|||Player

etc

Wanrning Messages
—————–

rundll.exe
Another program is currently using this file.

Kaspersky
Riskware: not-a-virus:Monitor.Win32.007SpySoft.q
File: I:\WINDOWS\system32\rundll.exe

x—x—x

Solution:
———

Start > Run > type the following

(if you have a lappy, then copy taskkill.exe in your c:\windows\system32\ folder)

End task
……..

taskkill /f /im regsvr.exe /t
taskkill /f /im rundll.exe /t
taskkill /f /im winhelp.exe /t

Registries
……….

at /delete /yes
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /f
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v “Yahoo Messengger” /f
reg delete HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run /v “Yahoo Messengger” /f
reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” /v System /t REG_SZ /d “” /f
reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” /v shell /t REG_SZ /d “Explorer.exe” /f
reg delete “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” /v “User Themes” /f

Files
…..

cmd /k del “%USERPROFILE%\Local Settings\Temp\aut*” /f
cmd /k del “%USERPROFILE%\Local Settings\Temp\~*” /f
cmd /k del “%WINDIR%\System32\rundll.exe” /f
cmd /k del “%WINDIR%\winhelp.ini” /f
cmd /k del “%WINDIR%\system32\ijl11pro.dll” /f
cmd /k del “%WINDIR%\system32\MSINET.OCX” /f
cmd /k del “%WINDIR%\system32\regsvr.exe” /f
cmd /k del “%WINDIR%\regsvr.exe” /f
cmd /k del “%WINDIR%\system32\winhelp.exe” /f
cmd /k del “C:\WINNT\system32\ssdata\”
cmd /k del “C:\Recycled\WinLiveUpdate32\scrdata\” /f /q
cmd /k del “C:\Recycled\WinLiveUpdate32\” /f /q
(and delete regsvr.exe, New Folder.exe and autorun.inf from pen drives)