To get right to the point, this is the backup script:

@ECHO OFF
SETLOCAL

REM Get date in format YYYY-MM-DD (assumes the locale is the United States)
FOR /F “tokens=1,2,3,4 delims=/ ” %%A IN (‘Date /T’) DO SET NowDate=%%D-%%B-%%C

REM Build a list of databases to backup
SET DBList=%SystemDrive%\SQLDBList.txt
SqlCmd -E -S MyServer -h-1 -W -Q “SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN (‘master’,’model’,’msdb’,’tempdb’)” > “%DBList%”

REM Backup each database, prepending the date to the filename
FOR /F “tokens=*” %%I IN (%DBList%) DO (
ECHO Backing up database: %%I
SqlCmd -E -S MyServer -Q “BACKUP DATABASE [%%I] TO Disk=’D:\Backup\%NowDate%_%%I.bak’”
ECHO.
)

REM Clean up the temp file
IF EXIST “%DBList%” DEL /F /Q “%DBList%”

ENDLOCAL

Assuming the date is 1/13/2009 and you have 3 databases named ‘MyDB’, ‘AnotherDB’ and ‘DB Name with Spaces’, the script will produce 3 files in the backup location specified:

• 2009-01-13_AnotherDB.bak
• 2009-01-13_DB Name with Spaces.bak
• 2009-01-13_MyDB.bak

Customizing and Running the Batch Script

Of course, you will want to customize the script to your environment so here is what you need to do:

• If your machine’s locale is not set to the US, the command ‘Date /T’ may not return the date in the format “Tue 01/13/2009”. If this is case, the NowDate variable will not produce the desired format and should be adjusted. (1 place)
• Change ‘MyServer’ to be the name of your SQL Server (add the instance name if applicable). (2 places)
• The databases named ‘master’, ‘model’, ‘msdb’ and ‘tempdb’ are databases which ship with SQL Server. You can add additional database names to this list if you do not want them to be backed up. (1 place)
• Change the backup location from ‘D:\Backup’ to the location where you want the database backup files stored.

Once you have customized the batch script, schedule it to run via Windows Task Scheduler as a user with Administrator rights and you are all set.

Library Software Install on New Systems

“Every time I try to do anything on the computer,” he told me, “I get a message saying it’s infected, and I have to pay $69 to clean it, but I tried to do that and I couldn’t.” He couldn’t even navigate to the Mozilla site to download Firefox; Internet Explorer was completely hijacked.

So, armed with a thumbdrive loaded with Firefox and AdAware installation files, I headed over there to take a look. Here’s what I found: The Norton AV trial subscription that came with Windows XP had expired and stopped protecting the machine, which was connected directly to my friend’s broadband ISP with Windows Firewall turned off. Windows XP hadn’t been updated since before SP2 had come out, because a friend of my friend told him not to trust any automatic updates. Because they might be spyware. Rogue software called XP AntiSpyware had taken over the machine.

XP AntiSpyware was the problem that prompted my friend to call, and it was the most hostile, insidious, and difficult-to-kill malware I’ve ever seen. It looked completely authentic and felt impossible to stop. Masquerading as a spyware killer itself, in the system tray, its icon was an almost perfect replica of the Windows Security Center icon. When you tried to visit a web site in Internet Explorer or do much of anything, XP AntiSpyware launched, and its window looked just like Windows Security Center. Once launched, it would start scanning your PC automatically, and tell you, in alarming red pop-ups, that dozens of files were infected and that you should delete them. There was no quit, there was no uninstallation available in Add/Remove Programs, and all the program’s options in its Settings area were grayed out/disabled. If you tried to run the real Windows Security Center or a program like AdAware, AntiSpyware would show up instead and start scanning again. If you tried to launch the Windows Task Manager (with Ctrl+Alt+Del), a message came up saying your computer administrator had disabled it—even though I was logged on as an administrator. There was no way to tell what startup entry the program was in msconfig, and when I restarted Windows in Safe Mode (F8 during boot) and tried to launch AdAware, this software started instead.

What a mess.

To fix it, I installed Chrome (which came bundled with AdAware). While AdAware itself wouldn’t launch, Chrome thankfully would, and after some Googling, I found this lifesaving article, which describes what “XP AntiSpyware” really is:

During installation, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will configure itself to run automatically every time when you run any program that have “exe” extension (99% of Windows applications). The rogue also uses this method of running to block the ability to run any programs, including antivirus and antispyware applications.
When XP AntiSpyware 2010 (XP Antivirus Pro 2010) is started, it will perform a system scan and detect a large amount of infections. All of these infections are fake, so you can safely ignore them. What is more, while the rogue is running, it will display various fake security warning and notifications from Windows task bar that have “Spyware infection has been found” or “Tracking software found” header. However, all of these alerts are fake and like false scan results should be ignored.
Last but not least, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will hijack Internet Explorer and Firefox and display fake warnings when you [are] opening a web site.
The solution was two-fold: first, you had to do a manual registry edit that stopped the program from starting in place of AdAware or any other spyware scanner. The lifesaving article had the registry fix-it entries, which I will reprint here for posterity.

Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\Software\Classes\.exe] [-HKEY_CURRENT_USER\Software\Classes\secfile] [-HKEY_CLASSES_ROOT\secfile] [-HKEY_CLASSES_ROOT\.exe\shell\open\command] [HKEY_CLASSES_ROOT\exefile\shell\open\command] @=”\”%1\” %*” [HKEY_CLASSES_ROOT\.exe] @=”exefile” “Content Type”=”application/x-msdownload”

Here’s what I did: I backed up the Windows registry, copied this text into Notepad, saved the file as fixme.reg, double-clicked it to apply the changes, and restarted Windows. Only then did I get the first sign of progress: once the registry was fixed, Internet Explorer was actually able to load web pages. Sweet.

Second, you had install a real spyware killer to kill XP AntiSpyware. (Imagine me trying to explain this to my computer illiterate friend. By now his eyes were glazed over.) Microsoft Security Essentials didn’t detect it. At the article’s suggestion, I installed Malwarebytes Anti-Malware and scanned away, cleaning off everything it found, including AntiSpyware.

From there the machine was usable, but still not ready for primetime. I ran Windows Update and got the machine Service Pack 3 and all the updates beyond that. (That alone was an hour and a half of progress bars and restarts. Did I mention this was a slow, year-and-a-half old HP PC from Costco?) I turned on Windows Firewall, and set up Microsoft Security Essentials. I uninstalled Norton AV to get rid of its nagging pop-ups, and because my friend said that Windows was slow to start up, I ran msconfig and unchecked the stuff he didn’t need to start up automatically (Java, Quicktime, and some other annoying “helper” apps). When I was done, the machine was speedier, usable, and not littered with both legit and malicious system tray pop-ups about infected files and software updates.

If I had more time, I would have formatted the hard drive and reinstalled Windows from scratch, and then installed a hardware router with a firewall on it between the computer and his cable modem. At any rate, I advised my friend to change all of his passwords before he did anything else on the machine.

Then, I tried to explain to him that some notifications and updates (like Windows Updates) are good and needed and he should get them, and others are malware trying to get his money (like Antispyware XP). But how does someone like him know the difference?

If you’re dealing with a malware situation and simply installing a spyware cleaner like AdAware ain’t working, you may have to Google the specific problem you’re having, like I did. Otherwise, check out my published-in-2006-but-still-holds-up article on cleaning your computer illiterate relatives’ and friends’ PCs, How to fix Mom and Dad’s computer.

UPDATE: I should point out that the screenshot included in this post is NOT from the machine I cleaned, and it looks slightly different. My guy’s PC must have had a different version of AntiSpyware, which seems to exist in many incarnations. However, if you click on the screenshot above you’ll see a pretty funny typo—”Protect your Widows PC.”

How to Remove XP AntiSpyware [Smarterware]

Some Internet messages may have been sent to Barracuda Quarantine. I’ve just noticed that most of my Internet mail is being sent to the Barracuda quarantine. Looking at the Spam Filter I found one of the BlackLists has gone off-line.

BlackLists are helpful in filtering out IP Addresses that are known to send Spam, and the services that this list provided will be missed. I’m presently looking for an additional list to help with this one going off line. While looking into why my Internet mail was being delivered to Quarantine, I learned that vox.schpider.com went off-line and to “notify” subscribers that they were closing, they have started to match every query sent to it. So any query good or bad will match as Spam and be delivered to quarantine. This issue has been corrected and legitimate email from the Internet should now deliver regularly to our mailboxes.

The Barracuda will send you a message when it delivers mail to quarantine that will allow you to act upon how you want the message treated (deliver, whitelist, delete, etc). You could wait for that message, or alternately you can logon to the Barracuda in your Web browser at: http://cuda.cajonvalley.net:8000 and use your full email address as your username. If you need a new password, the login page has a “Create new password” option at the bottom of the screen which will email you a temporary password allowing you to get in and manage your quarantine settings.

Chuck Reed
Network Engineer
Information Technology Services
Cajon Valley Union School District

The reset procedure is as follows:

1. Disconnect the printer from power
2. Hold 3 and # on the keypad
3. release the keys when the printer displays the setup menu.

I hope this helps.

The Fix was found here

These commands need to be run as either the root user or with the “sudo” command. For more information on the sudo command see the sudo man page.

Create a new entry in the local (/) domain under the category /users.
dscl / -create /Users/toddharris

Create and set the shell property to bash.
dscl / -create /Users/toddharris UserShell /bin/bash

Create and set the user’s full name.
dscl / -create /Users/toddharris RealName “Dr. Todd Harris”

Create and set the user’s ID.
dscl / -create /Users/toddharris UniqueID 503

Create and set the user’s group ID property.
dscl / -create /Users/toddharris PrimaryGroupID 1000

Create and set the user home directory.
dscl / -create /Users/toddharris NFSHomeDirectory /Local/Users/toddharris

Set the password.
dscl / -passwd /Users/toddharris PASSWORD

or

passwd toddharris

If you would like Dr. Harris to be able to perform administrative functions:
dscl / -append /Groups/admin GroupMembership toddharris