Uninstalling Symantec Antivirus Client 10.2 from Windows 7 64bit Without the Uninstall Password

If you attempt to install Symantec Antivirus Win64 from Win 7 without the uninstall password, you'll probably find that people suggest that you change a registry key value:

HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security\UseVPUninstallPassword from 1 to 0.

That doesn't really work for the 64 bit variant as the key locations are different. I looked around a bit and found that the key was here, instead:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security\UseVPUninstallPassword

After changing that 1 to 0, you should be able to uninstall without a password.

Blocking Outbound File Attachments In MailScanner

MailScanner is a popular anti-virus/anti-spam open source package that supports several operating systems, including Linux and FreeBSD. It can be helpful for minor compliance work.

For exmaple, Company X wants to block outbound Microsoft Word Docs (both .doc and .docx) but allow people from outside to send them in. To set this up, you'll need to create a couple of files and modify the main config, Mailsca

In order to block only, say, word docs in Mailscanner, you need to do a few things.

Steps

1. add a rule to split the filename processing. On CentOS, we'll call this /etc/MailScanner/rules/filenameconf.rules

The contents are:

From:   *@mydomain.com /etc/MailScanner/filename.mydomain.rules.conf
From:       default /etc/MailScanner/filename.rules.conf

2. copy /etc/MailScanner/filename.rules.conf to /etc/MailScanner/filename.mydomain.rules.conf

3. edit /etc/MailScanner/filename.mydomain.rules.conf and set the rules you want. To block doc/docs:

deny   \.docx?$        Windows Word Doc                                                               Word  documents may contain sensitive information or viruses

(note, the fields are tab delimited, not space delimited!)

4. modify the main config file, /etc/MailScanner/MailScanner.conf and comment out this line:

Filename Rules = %etc-dir%/filename.rules.conf

and replace it with this:

Filename Rules = %rules-dir%/filenameconf.rules

5. restart mailscanner (sudo service MailScanner restart)

Qakbot Outbreak and Removal

I recently had to deal with a large Qakbot worm outbreak. Qakbot's an information gathering nuisance. It appeared that there were three different variants of the worm. The problem was that it spread through the desktops and the servers through domain admins. This is likely because of domain admins logging into infected workstations.
  Unfortunately, the centralized AV was not fully deployed - and was sometimes out of date. The problem was magnified by the fact that the company is multi-site and fairly wide open, subnet wise.
  Apparently, Qakbot spreads through CIFS shares. It likes to push itself through the administrative shares and place executables to be run into the All Users directory. It then creates registry entries to start itself upon login.  It does annoying things like changing permissions on the AV program directories such that updates won't work. It then uses the credentials of the user to attack the administrative shares and (likely) remote registry service of other machines. This can be bad if you happen to be a domain admin, Anyway, the virus doesn't seem to work correctly on Windows 7 or 2008 for some reason.

  The biggest problem removing it was that we were not able to isolate segments of the network, and by logging on, you'd simply activate it, if the executables had already been placed.
  I figured out a simple way to clean up a machine remotely (do this at your own risk, of course. You may damage your system if you are not careful.):

1. First, check out the administrative share of the machine:
    \\c$\documents and settings\all users\application data\microsoft

    The Qakbot worm creates a randomly named directory. Let's pretend our folder name was "gvcajscwxoq." I can't tell you exactly what it'll be called, but the name will be rather random and should have only one exe, two dlls, and maybe some .tmp or .dmp files.  So, we'd have a folder called:
  \\c$\documents and settings\all users\application data\microsoft\gvcajscwxoq
There will be an executable and two DLLs witht the same name as the folder "gvcajscwxoq." There may be a few other tmp files. What you need to do is delete or rename the files to a different extension - like .vir.

2. rename gvcajscwxoq.exe to gvcajscwxoq.vir.

3. rename all the DLLs in that folder called "gvcajscwxoq" to another name.


That works well enough if the virus isn't active on the machine. If it is, you'll need to kill the process remotely before logging in. I found a useful freeware commercial tool called Desktop Central:

Desktop Central

(note, I'm in no way associated with that company. I just found the tool to be useful.)

4. Anyway, after installing the free edition on your local work station, launch the tool and launch "remote task manager"

Provided it can connect to the infected machine, you should find the rogue process running as the same random  name of the folder you attempted to rename above. End that process (make sure it's the same random name!) Wait about 20-30 seconds and then try to rename the remaining files in the application data\microsoft folder. You should be able to. You probably can't rename the bad folder, yet.

5. Now, you can log into the box. Run msconfig and look under the startup tab very carefully. The worm likes to append itself to a legitimate application's startup. For instance, if you had a network management suite gui that started up, like the Broadcom control suite, it might modify that entry to launch itself and then the Broadcom suite. You should find one entry with the gvcajscwxoq.exe file listed. I'd recommend removing that portion or just disabling the service. Be careful, you'll be disabling a program that normally starts for all users.

6. Now that you've removed the threat, install/update your anti-virus. You may need to modify permissions for your AV software as Qakbot may have changed things. Check out your anti-virus vendor's help section; they may have a tool to change the permissions.
 

 I'd also recommend that all domain admins check out the administrative shares of boxes before logging into them. Remember from above:

For Windows 2000-2003, XP, look in
\\servername\c$\documents and settings\all users\application data\microsoft

For Windows 2008, Vista, and Windows 7, try looking in c:\programdata\microsoft

If you see a randomly named folder with an exe and two dlls in it, you'll need to cleanup the server before logging in.