ronanian

54 of my users received a scam email from a user at student.bham.ac.uk delivered by sun61.bham.ac.uk, and I can't seem to find an IT contact on their website to report the breached user. Of course I've already responded with appropriate security here, but I know that if one of my users was sending scams or spam through my servers I'd want a fellow sysadmin to notify me. Any suggestions how I can report it to them?

One other question: What is the actual exploit being used for? What kind of damage/payload are we looking at? Is there a known example of the exploit I can test against, as in a URL I can go to and see if I get infected?

So, how about practical discussion of how to protect our networks? Create \\server\share\unregvgx.bat (or .cmd or whatever you like) containing this: "%SystemRoot%\System32\regsvr32.exe" -u -s "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll" You all know where to get psexec: http://live.sysinternals.com/psexec.exe -- run this command: psexec -h -u domain\adminUserName \\* \\server\share\unregvgx.bat Quick and dirty and gets it out there to everything that's already booted up and listed in Active Directory. Also add \\server\share\unregvgx.bat to startup and login scripts. There are other ways to do all of this that are more refined but I like quick and dirty for stuff like this. Thoughts? Will that suffice to protect my network until Microsoft releases a patch?

Success! I figured out how to avoid the problem. All I have to do is NOT be an impatient jerk. Normally when Windows says I need to restart I say "You're not the boss of me, I'm in charge! http://allofftopic.com/images/smilies/gorilla_1.gif". This time I disconnected the (virtual) network cables, started Windows on the newly deployed VM, removed it from the domain, and when it asked to restart I actually allowed it to...then once it was restarted I assigned an IP, reconnected the (virtual) network cables, joined it to the domain, and when it asked to restart once again I immediately allowed it to do so.

Bump. Probably nobody knows exactly, but any unsure guesses at least?

I have VMWare ESXi 3.5 and 5.0 vSpheres. When I deploy a template or clone a VM running Windows I expect to see "The trust relationship between this workstation and the primary domain failed." unless I sysprep (and sometimes even then). The cure is to remove from the domain and re-join. Ok, no problem, I do that on the newly deployed VM. I have one Windows Server 2008R2 terminal server template that does something worse. When I deploy it, all existing live VMs based on that template get "The trust relationship between this workstation and the primary domain failed." What am I doing wrong? I have to deploy it again and I'm not looking forward to re-joining all of its siblings again.

OS is Debian Squeeze. Pretty much a default "desktop"-style installation with gnome and such. Out of the box, it successfully auto-mounts drives that I plug in via USB in /media/{UUID} or /media/{Volume name} (depending on if the drive has a volume name or not, I guess). I am very happy with that system and I want to keep it. My only complaint is the permissions. An NTFS filesystem gets mounted drwx------ (with owner and group as my regular user, not root). I want drwxr-xr-x. I've been trying to find out how it works, or how to adjust it. udev notifies udisks and gnome-disk-utility or something like that, I'm not 100% sure and I can't find anywhere to configure a default umask/fmask/dmask for it. Looking in /var/log/ at the time a drive was connected I can find ntfs-3g's entries in daemon.log and syslog telling me what options were passed to it but I can't see what called it. Does anyone know how it works or how I can adjust the default permissions provided by the existing automatic mounting system? I don't want to replace the system with another, I don't want to put stuff in fstab, etc...I want to learn how the existing system works.

Yeah, driver was my first thought too, but there's no way I'm messing with it. That HP Officejet Pro A910 driver is the most finicky, delicate driver ever made. I wish I could just manually assign a static IP to the printer and manually enter that into the driver instead of being required to use auto-detection that occasionally works. Anyway, since it works with everything else (including IE9) I hope eventually to fix what's wrong with IE10.

Went to look at a client's computer this morning. It has Windows 7 Home edition and IE10 (thanks, automatic updates!). It prints fine from OpenOffice, Firefox, Chrome, etc. However, IE doesn't print. You click Print, get the expected behavior, but nothing ever ends up in the print queue. Print Preview works fine. If you right-click and run as administrator it is able to print. If you disable IE's Protected Mode it is able to print. I found plenty of social.technet.microsoft.com results in a google search but they are all unresolved; people post that they can't print, they are asked if running as administrator or turning off protected mode helps, they say it does, then nobody says "ok, so now you need to do {something}". Any thoughts? I placed some bookmarks in Firefox for the user, who was happy enough with that, but the next time I'm there I'd like to fix it correctly.

IE10 seems to have some bugs to work out. I wouldn't go live with it yet...give it time to mature, like any other MS update.

That it works in another browser says that it's either a bug in the software or something messed up in the user profile, such as a setting or add-on. Next step is to run IE without Add-Ons and see if that works. Something like "Start->Programs->Accessories->System Tools->Internet Explorer (No Add-Ons)". If it works without add-ons, then it's just process of elimination. Disable some add-ons, see if it works, if not then enable those and disable some other add-ons, until you've narrowed it down to one. If it's not related to add-ons, it could be some other setting. Try logging in as a different user on that same machine and see if it works. If so, then log in as the original user and use IE's big reset button. Control Panel->Internet Options->Advanced tab->Reset http://ie.microsoft.com/testdrive/ieblog/2006/Jun/12_ResetInternetExplorerSettings_1.jpg What version of IE? I think I found a bug (unrelated to this, but I'm just saying this to point out that they may have released it in an imperfect condition) in IE10 this morning...google produces a few threads on Microsoft support forums but none that were resolved.

You might try NFS. You could mount it on another computer, or mount another computer on it. The other computer could be Windows, you just have to google for instructions on installing MS's NFS support (which works well). Then you could ssh in and use mv, or use a good tool on the destination computer; if Windows I would recommend Karen's Replicator which, while old, is fast and effective, won't waste time copying files that are already there, won't prompt you and wait when there's an error, just keeps a log of what went wrong and continues copying. You could also use SSHFS. SSHFS - Wikipedia, the free encyclopedia However, if WinSCP is almost doing the job, maybe it's worth another try - but use Move instead of Copy? That will eliminate the issue of going back for more. It also has Synchronize and Compare Directories commands that may be helpful. Are you using SCP or SFTP protocol? Could try switching. Make sure "Continue on error" is enabled as well as both "Automatically reconnect session" options, and tweak the "Maximal number of transfers at the same time". For large files you'll want to make sure resume is enabled. Get what's easy to get, make note of what doesn't transfer, then go back and use ssh+NFS with dd or cp (depending on just how bad it is). One more idea: Can the Drobo mount a USB drive or even an extra internal SATA drive? If so, you could do all your rescue locally, just using ssh to log in and execute the commands.

Facebook likes to mess with direct access to image files that they host, but in this case it sounds like a browser issue. Try it in a different browser. If it works in a different browser then you can start to look at the profile on the broken browser. Which browser are you using?

Linux is a rock-solid, no-fuss server OS for my Oracle server, one of my web servers, and a couple other servers. It makes my job easy. In some contexts Windows provides more compatibility, ease of configuration for advanced stuff, features, etc, but Windows is what makes my job busy. It's funny, while my co-workers can handle Windows stuff and know almost nothing about linux, it's really Windows that keeps me in a job -- and modern Windows servers run way better than those of the past. I've been using linux personally since around 1994 and professionally since 1999 or so. I've been in and out of fanaticism and at this point I care little for proselytizing, I just like to use the best tool for the job, so Linux fills certain niches and Windows is used elsewhere.

Does that one look like this? http://cnc.ucr.edu/exchange/images/outlook2010-configure.png If so, they may just need to enter the correct credentials including the correct domain.