dealing with malware that alters display properties

Over the past two weeks, I've seen three pieces of malware that alter the display properties in Windows XP. In each instance, I was able to get rid of malware with Symantec AV 10.1 and then Avast Antivirus 4.8. But the display properties remained changed.

In one instance, it created a strange screen saver that emulated a BSOD. In another instance, it changed the wallpaper to a spyware warning. But the weird thing is that if you go to the display properties, the necessary tabs you need to reverse those problems are gone.

Best course of action is to use this wallpaper hijacker remover:
http://www.majorgeeks.com/Wallpaper_Hijack_Remover_d4816.html

Here is what an altered wallpaper looks like:

Sharepoint publicly accessible breaks SBS IIS components?

I'm implementing SharePoint for a client, and they want it to be publicly accessible on their SBS box. As such, I installed SharePoint 3.0 and told ran the "Configure E-mail and Internet Connection Wizard" and told it to configure the firewall and to allow access to the Windows SharePoint Service intranet site. After that, things still worked, but when I ran the "SharePoint Products and Technologies Configuration Wizard" - it created the web site "SharePoint - 80" in IIS Management.

With "SharePoint - 80" in place, OWA does not work, nor does RPC over HTTP. In fact, with "SharePoint - 80" in there, the default web site shows as "stopped." When you try to start the default web site, it says "the process cannot access the file because it is being used by another process." Very strange.

allowing SRP on a BB server on an SBS Premium box

I'm documenting my own confusion here, as I know it'll come up later.

When creating a Blackberry Professional Express server, it needs to have SRP access to the Blackberry servers (port 3101). They have a test for this connectivity here:

c:\Program Files\RIM\BlackBerry Enterprise Server\Utility\BBSRPTEST.EXE

I was having trouble with getting port 3101 to connect to the RIM server, and then I thought I made some firewall changes to make it work - but even after disabling the firewall changes I made, it still worked - so I figure it worked without my assistance. For my own knowledge . . .

I opened up port 3101 outbound to all blackberry.net addresses and I made sure the SBS Internet Access Rule was set for all users and was not set to read only for FTP. I made these changes and then it worked. Then I disabled all these things, and it still worked. I have replicated this issue multiple times. Very strange.

This is what the test gives you when it's successful:

c:\Program Files\RIM\BlackBerry Enterprise Server\Utility>BBSrpTest.exe
NetworkAccessNode is srp.us.blackberry.net.
Attempting to connect to srp.us.blackberry.net (204.187.87.33), port 3101
Sending test packet
Waiting for response
Receiving response
Checking response
Successful

completely uninstall SBS Monitoring and Reporting

I uninstalled and reinstalled SBS Monitoring and Reporting to resolve a SQL issue with it today. And I referenced this blog post from someone else:

1. Control Panel -> Add Remove Program -> Windows Small Business Server 2003.
Set Server Tools to Maintenance. Set Monitoring to Uninstall and continue the setup process.
2. Control Panel -> Add Remove Program -> Microsoft SQL Server Desktop Engine (SBSMonitoring) -> Remove.
3. Rename the C:\program files\Microsoft SQL Server\MSSQL$SBSMONITORING Folder.
4. Reboot the server.
5. Control Panel -> Add Remove Program -> Windows Small Business Server 2003.
Set Server Tools to Maintenance. Set Monitoring to Install and continue the setup process.
6. Reboot the server.
7. Start MSSQL$SBSMONITORING and SQLAgent$SBSMONITORING services.
8. In Server Management Console -> Monitoring and Reporting: run the "Set Up Monitoring Reports and Alerts wizard”

increasing the number of PPTP users allowed on an SBS box

By default, an SBS box only allows 5 concurrent PPTP VPN connections. You can increase it by going to administrative tools -> routing and remote access and going to Port Properties as seen below:

WSS v3 upgrade - SBS needs in place upgrade

After spending 3 hours troubleshooting why I couldn't get SharePoint v3 on an SBS box, I found that the problem was the you CANNOT do an in place upgrade. You have to do a side by side install as per this Official SBS Blog entry:

http://blogs.technet.com/sbs/archive/2006/11/30/wss-v3-0-installation-on-sbs-2003.aspx

BES install guide for SBS 2003 or Domain Controller

This content is reproduced for future reference from:
http://www.blackberryforums.com.au/forums/microsoft-exchange/281-bes-sbs-2003-a.html

Gary's BES install guide for SBS 2003 or Domain Controller

1. Ensure the port 3101 TCP is open on the firewall (Outbound ONLY).

2. Create a new user called BESadmin and ensure you create a mailbox. Ensure this user is ONLY a member of "Domain users"

3. Make BESadmin a local Administrator of the server. This is done in AD via the "Built-in" Administrators group

4. Go to Admin Tools on open "Domain Controller Security Policy" and expand the "Local Policies" and "User Right Assignment". You need to add BESadmin to "Allow Log on Locally" and "log on as Service".

5. Open Exchange System Manager and right mouse click on "DOMIANNAME (Exchange)" and select Delegate Control. Follow the steps and add BESadmin as an Exchange View Only Administrator.

6. In Exchange manager expand the servers folder and right mouse click on your server and select properties. On the properties windows select BESadmin and add the permissions "Administer Mailbox Store, Receive As, Send As"

7. Open Active Directory and from the View menu select "Advanced Features". Then go to each user that will be added to the BES and open their properties, go to the security tab and add the user BESadmin and add the security permission "Send As". (This will overcome some MS patches that prevent BES sending emails)

8. Log on as BESadmin and install the BES software, normally you just install "BlackBerry Enterprise Server" as most sites don't use the MDS services (MDS is a much heavier install). Follow the prompts of the install and the server will be required to restart half way through the install. Restart the server and log back on as BESadmin and the install will continue. (Make sure the Connect Test works and the SRP ID etc is validated during the install)

9. After the install is finished open BlackBerry Manager, an error will appear about MAPI client which you can just hit OK. The MAPI setting windows will appear so just add the server name back in and select "Check Name", if it resolves just hit OK and the manager will start.

10. Within Blackberry Manager click on Blackberry Domain in the left column and then the users SERVERS tab in the center section, select your server within this tab and view the properties below. Ensure that "SRP Status:" is Connected (This can take a few minutes the first time so refresh the screen a few times). Once your status is connected you can start adding users.

11. Within Blackberry Manager click on you server name in the left column and then the users TAB in the centre section, just add a user and the click on that user. You will see all the users’ properties and a drop down menu called "Service Access” and select “Set Activation Password” and set a password of “a” for example.

12. Turn on you BlackBerry device and ensure Wireless is enabled. Go into “Options/Settings” and “Time & Date” and set the correct zone and time etc. Then from the home screen go to enterprise activation and enter the users email address and enter the password that was set in step 11. Press the track wheel and select Activate. Within a minute you should get data returned which indicates the process is functioning correct.

Extra

Note: Sites running SBS 2003 premium will need to change the BES "Web Server Listen Port" from 8080 to another available port (e.g. 8090 or 9090) as soon as it is installed. This port needs to be changed as the BES Web Server will be listening on the same port as ISA. To change this setting open Blackberry Manager, select MDS and then "edit Properties" and change the "Web Server Listen Port" to the desired port number.

a. Also ensure you review the IT Policy in BlackBerry Manager. This can be found in BlackBerry Domain > Global TAB > Edit properties. It is recommended that in the IT Policy you go into “Device Only Items” and set “Enable WAP config” to FALSE, this will force user to use the free browser (It uses the internet connection of your BES server). It is also highly recommended that you configure a password policy prior to rolling out any handhelds.

b. If you are unable to activate devices wirelessly you can test your connectivity to Blackberry buy running the following app from the command prompt:
C:\Program Files\Research In Motion BlackBerry Enterprise Server\Utility\BBSrpTest.exe
This will send a signal to BB and wait for a response, it this fails check your firewall settings (open and/or direct port 3101 TCP to you BES server)

c. If you have Domain Admins using BlackBerry devices you may have to run the following script if you are unable to send email for those users devices:
dsacls "cn=adminsdholder,cn=system,dc=domainname,dc=c om " /G "DOMAINNAME\BESadmin:CA;Send As"