Virtual Administrator

May 2013 Patch Recommendations

Dan Kolansky — Fri, 17 May 2013 21:09:58 +0000

10 Security Bulletins were released – 2 Critical, 8 Important, and 0 Moderate

This Month In Brief

We have not uncovered any widespread problems with any of these patches and are releasing all of them.

MS13-037 and MS13-038 are a top priority as they are rated critical and apply to Internet Explorer. Make sure to follow up on these and make sure they are installed successfully.

No out-of-band updates were released during the last month.

(Note: Regarding Microsoft Security Advisory (2847140) Vulnerability in Internet Explorer Could Allow Remote Code Execution. (http://technet.microsoft.com/en-us/security/advisory/2847140#section1) A bulletin was released on May 3 and a link to a “Fix It” solution was posted May 8. The patch for this “out-of-band” vulnerability was release as MS13-038 on May 14.

Exploitability

Publically disclosed: MS13-038, MS13-040
Being exploited: MS13-038
Rated CRITICAL: MS13-037, MS13-038
(The Severity Rating System: http://technet.microsoft.com/en-us/security/bulletin/rating)

Requires Restart

Servers: Yes
Workstations: Yes

New Security Bulletins

(MS#/Affected Software/Type)

CRITICAL

	MS13-037 Cumulative Security Update for Internet Explorer (2829530)	(Internet Explorer) The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. Details KB in Kaseya: KB2829530 Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7 Known Issues per MS: https://support.microsoft.com/kb/2829530
	MS13-038 Security Update for Internet Explorer (2847204)	(Internet Explorer) The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. Details KB in Kaseya: KB2847204 Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7 Known Issues per MS:

IMPORTANT

	MS13-039 Vulnerability in HTTP.sys Could Allow Denial of Service (2829254)	(HTTP.sys) The vulnerability could allow denial of service if an attacker sends a specially crafted HTTP packet to an affected Windows server or client. Details KB in Kaseya: KB2829254 Affected Software: Windows 8,Server 2012,Windows RT Known Issues per MS: https://support.microsoft.com/kb/2829254
	MS13-040 Vulnerabilities in .NET Framework Could Allow Spoofing (2836440)	(.Net Framework) The more severe of the vulnerabilities could allow spoofing if a .NET application receives a specially crafted XML file. Details KB in Kaseya: KB2804576, KB2804576, KB2804577, KB2804579, KB2804580, KB2804582, KB2804583, KB2804584 Affected Software: XP, Vista, Windows 7/8, Server 2003, Server 2008/2008R2/2012 Known Issues per MS: https://support.microsoft.com/kb/2836440
	MS13-041 Vulnerability in Lync Could Allow Remote Code Execution (2834695)	(Lync) The vulnerability could allow remote code execution if an attacker shares specially crafted content, such as a file or program, as a presentation in Lync or Communicator and then convinces a user to accept an invitation to view or share the presentable content. Details KB in Kaseya: KB2827750, KB2827751, KB2827752, KB2827753 Affected Software: Lync 2010, Communicator 2007 R2 Known Issues per MS: https://support.microsoft.com/kb/2834695
	MS13-042 Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2830397)	(Publisher) The vulnerabilities could allow remote code execution if a user open a specially crafted Publisher file with an affected version of Microsoft Publisher. Details KB in Kaseya: KB2553147, KB2597971, KB2810047 Affected Software: Office 2003,2007,2010 Known Issues per MS: https://support.microsoft.com/kb/2830397
	MS13-043 Vulnerability in Microsoft Word Could Allow Remote Code Execution (2830399)	(Microsoft Office Word) The vulnerability could allow remote code execution if a user opens a specially crafted file or previews a specially crafted email message in an affected version of Microsoft Office software. Details KB in Kaseya: KB2781197 Affected Software: Office 2003, Word Viewer Known Issues per MS:
	MS13-044 Vulnerability in Microsoft Visio Could Allow Information Disclosure (2834692)	(Visio) The vulnerability could allow information disclosure if a user opens a specially crafted Visio file. Details KB in Kaseya: KB2596595, KB2810062, KB2810068 Affected Software: Visio 2003,2007,2010 Known Issues per MS: https://support.microsoft.com/kb/2834692
	MS13-045 Vulnerability in Windows Essentials Could Allow Information Disclosure (2813707)	(Windows Writer) The vulnerability could allow information disclosure if a user opens Windows Writer using a specially crafted URL. Details KB in Kaseya: KB2813707 Affected Software: Windows Essentials 2011,2012 Known Issues per MS:
	MS13-046 Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation Of Privilege (2840221)	(Kernel-Mode Drivers) The vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. Details KB in Kaseya: KB2829361, KB2830290 Affected Software: Windows 8, Windows RT Known Issues per MS: https://support.microsoft.com/kb/2840221

Fixing Patch Management For Windows 8 Machines

Dan Kolansky — Wed, 15 May 2013 16:17:52 +0000

Some of our partners are noticing a few Windows 8/2012 machines are failing to scan properly. Windows 8/2012 require users to Opt-in to the Windows updates server. If machines Opt-out the WUA service will not work and because Kaseya patching relies on WUA. Without WUA, it will not scan properly. You’ll notice this when the machine reports that it cannot scan the machine inside of Kaseya (as pictured below in a patch log.)

If this is the case with some Windows 8 machines on your network we posted a script which fixes this issue. You can view it here: Windows 8/2012 Silent Opt-in for Windows Updates Service.

You can find more troubleshooting techniques for patch scans here.

Here is the article on Microsoft’s website regarding the issue that is causing this in the first place: http://msdn.microsoft.com/en-us/library/windows/desktop/aa826676(v=vs.85).aspx

Spam Soap Archiving Webinar

Dan Kolansky — Wed, 15 May 2013 04:00:00 +0000

In the three videos below, Eric Pinto shows off Spam Soap’s archiving product. Archiving is a fantastic tool for MSPs who are working with companies that have a lot of government restrictions, legal issues, or other things. This is perfect for industries such as law, government, medical and more.

Video 1 – Intro To Spam Soap

Introduction – Eric Pinto from Spam Soap introduces Spam Soap and shows the console and how the whole service works to defend your clients from email troubles from spam to data loss.

Video 2 – Spam Soap Archiving In Detail

Eric dives deep into Spam Soap’s archiving tool, giving some strong reasons for why you would want to put this tool in place on your customer’s domain.

Video 3 – Q&A About Spam Soap Archiving

Dan Kolansky and Eric Pinto do some back and forth Q&A about Spam Soap’s archiving feature giving some real life examples and answering other questions from the webinar audience.

Questions Asked:

What are some real life scenarios where archiving has saved the day?
Can you view your employee’s email archive directly without speaking to the MSP or Spam Soap? (yes its possible, Eric gives more details.)
What requirements are needed to run Email Archiving?
Is it possible to populate an email archive retroactively? (yes, it is possible)
How far back should you archive email? (Eric makes an arguement to archive as much as possible)

Intronis Spring Fling

Chris Amori — Tue, 14 May 2013 13:02:07 +0000

As Mother Nature starts warming the air, we thought we would try to heat up your backup sales with some special “Spring Fling” pricing on all Intronis backup quantities less than 500GB.

Starting immediately, you will pay the 250-499GB price of $.90 per GB.

If you are an existing VA-Intronis partner, your price will be automatically changed on your next invoice, if you are not currently using Intronis through us, hopefully this new pricing will entice you to give it a try… We offer 30-day free trials.

Keep in mind if you have larger quantities; please contact us directly so we can quote you properly. We have special pricing up to 5TB!

Click here for more information on Intronis Online Backup.

Silently scan a machine remotely with Microsoft Security Essentials (Windows Defender)

Dan Kolansky — Mon, 13 May 2013 17:30:40 +0000

Kaseya offers (depending on which package you have with us) not one, but two powerful Anti-virus modules (Kaspersky or AVG). There is also the anti-malware module (Malwarebytes). But sometimes, for whatever reason, you may not decide to be using the built in AV modules. Perhaps you didn’t build it into your budget, or perhaps you’re looking for a lighter solution. Microsoft Security Essentials (now known as Windows Defender in Windows 8) is a pretty nice option as far as Anti-Virus goes if you need a simple solution.

Security Essentials is included in Windows 8 by default as a module in Windows Defender, but in Vista and 7 it is super easy to deploy via a script we have written. We have several Securityessentials scripts available here.

Now, once installed, lets say your user calls you up and says that their machine is not running well. Running a quick scan is super easy! You can run MSE from the command line. This means that you can actually run an AV scan on the machine without bothering the user at all.

The secret lies in Live Connect. Using live connect you can bring up a connection to the machine that you want to operate (simply click on the icon next to the machine which needs a scan).

Once you’ve pulled up live connect, you can navigate to the command line option and then enter one of the two following commands:

For Windows Vista / 7:

"C:\Program Files\Microsoft Security Client\Antimalware\mpcmdrun.exe" -Scan -ScanType 1

For Windows 8:

"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1

This prompts a “quick scan” of the machine. To do a full scan, simply change the scan type from “1″ to “2″. This increases the time it takes to run the scan, but also how deep it scans (obviously).

Of course you can easily turn this into a script, and I’m sure we’ll have a script up eventually which runs this scan and can differentiate between machines. If we do write it, I’ll try to update this entry to link to the script as well.

Automating CCleaner To Install, Update, and Run Through Kaseya

Dan Kolansky — Fri, 10 May 2013 14:07:56 +0000

CCleaner is a powerful temporary file removal tool released by Piriform. Their tool has been an invaluable part of our toolkit for a long time, and it is one of the earliest tools which we automated through Kaseya.

Since CCleaner clears out temporary files, we can keep systems clean, running fast, and often can avoid spontaneous issues from software getting clogged up with junk files.

The script we deliver to Virtual Administrator partners is about as simple as they come. You can see it here (and can download it if you belong to ClubMSP): http://virtualadministrator.com/scripts/ccleaner-installupdate-runlogged-in-user/

This script basically tests the system to see if CCleaner is installed and if it is up to date. If it is, then the script runs CCleaner with a preset config.ini file which is downloaded from our servers if not, then it downloads and installs the latest version available.

Its literally that simple, and all you need to do is upload it to your Kaseya instance and then schedule it to run on your machines.

But what if you want to customize the ini file? This is also possible with a simple change to the script which we can do quickly and easily before we import the new script into Kaseya (or you can edit the agent procedure in Kaseya after import to make this change as well).

First thing is first, you need to download the config.ini at the following link: http://files.mymsp.com/va/files/ccleaner.ini . This is the most up to date version of the config.ini file. Once you have that, you can make some changes so that you clean the machine in any way that you please. You could also grab the ini file from the CCleaner folder in the program files folder.

If you want more information on how to modify the CCleaner INI file directly, Piriform has a fantastic resource, right here: http://www.piriform.com/docs/ccleaner/advanced-usage/ccleaner-ini-files

Once you’ve modified it, you will need to upload it to a public facing website (probably your own website). This will allow your machines to find the modified ccleaner.ini file so CCleaner only cleans what you wish for it to do.

Now you need to make a minor adjustment to the script. To modify the script, you can copy the XML into notepad and simply change the URL of the INI in the script before you import it into Kaseya. Then import and execute it on your machines.

How do you import the script? Here is a video with details: http://www.youtube.com/watch?v=bd2nTReP4J8&t=1m38s

CCleaner is not a non-profit endevor. If you are using them for your client’s machines, it is only right if you purchase some licenses from them to support this fantastic software. You can find more about their licenses here: http://www.piriform.com/business

Using Machine ID in Kaseya’s Agent Menu

Dan Kolansky — Thu, 02 May 2013 20:09:30 +0000

One of Kaseya’s best features is the minute size and non-intrusive nature of the Kaseya agent. It’s small, compact, and normally (unless you modify it) leaves a stylish little “K” symbol down in the system tray. This little icon does not just look pretty. It offers a unique lifeline between you and your clients in the form of the agent menu.

To setup this menu, you simply navigate to Agent > Agent Menu in the Kaseya interface. This opens up a page which offers several menu options that you can set, and define for all of your clients or even on a per client basis. These menu options give you the ability to put your clients at ease without even being present.

One of the most important menu features is the “Contact Administrator” feature. In a previous blog post, we covered how to turn that in to a mailto: link. Expanding on this just briefly, we can now put in the machine ID into our mailto: link or also link it directly into a ticketing system or email system.

You can see an example here: http://virtualadministrator.com/submit-a-ticket/?mid=va.rogueskies.unassigned.xps

While I don’t think I’m going to go into all the details of just how I created such a form (there are a million and one ways to do this depending on what your website is built with). As a brief summary, I used two key plugins for WordPress, one is called Cookie Monster, and the other is a premium plugin called Gravity Forms (contact us if you’d like my particular method in detail).

But you can easily use this new variable trick in the mailto: version of the link as well, by placing it into the subject line of the email. That way when a customer emails you with a new ticket, you’ll know the machine which the ticket originated from.

A sample Mailto line which you could use with this would look something like this: mailto://email@domain.com?subject=New%20Support%20Request:%20

If your client only has one or two machines, this may not be all that valuable, but when you find yourself dealing with a few dozen machines at a given site, then this is a fast way to figure out exactly WHICH machine your client is working on.

Just a small tip to make Kaseya more useful for you!

KServer Maintenance has ended

Jim Bulger — Fri, 19 Apr 2013 02:52:07 +0000

The KServers are back up and functioning normally.

VA Support

KServer maintenance starting at 10:00PM ET

Jim Bulger — Fri, 19 Apr 2013 01:32:23 +0000

We will be performing server maintenance on the Kaseya servers.

Your KServer may be unavailable during this period.

VA Support

Malware Bytes Database Update v2013.04.15.12 Crashing Computers

Dan Kolansky — Thu, 18 Apr 2013 23:14:44 +0000

Update 4-25-2013:

To determine if a machine has the bad update look for database version 913041512. Any definition version other than 913041512 is fine. This specific update version with the issue was only available for download for a few minutes before being pulled from availability. You do not need to run the patch on non-affected endpoints.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Original Posting:

Malwarebytes released an update on Tuesday (4/16) that is causing harm to end-unit client machines.

We are working on a script which we will post here when we have it available for general release.

In the interim, you can reference the following for additional information on this issue:

Kaseya Community Thread: http://community.kaseya.com/xsp/f/143/p/17923/84506.aspx#84506
Kaseya Wiki: http://community.kaseya.com/kb/w/wiki/1150.aspx
News article: http://www.v3.co.uk/v3-uk/news/2262234/malwarebytes-cripples-thousands-of-computers-with-faulty-software-security-update