SCEP 2012 and the TeslaCrypt virus

Hello!
A user on one of our terminal servers was attaced my the TeslaCrypt virus (ransomware). The terminal server had SCEP 2012 running, with engine version 1.1.11502.0 and definition 1.195.2385.0. Policyname: Anitimalware Policy. Realtime protection: On
Is SCEP 2012, with these versions of engine and definition, expected to stop the TeslaCrypt virus?
If not, would any version of SCEP2012 or other antivirus Application stop it?
Regards
Trond Burud

It appears that Microsoft products categorize this malware family as Win32/Tescrypt
http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fTescrypt
If your system got hit with a variant that didn't get detected, you should submit the sample to Microsoft so they can add it to their definitions.
https://www.microsoft.com/security/portal/submission/submit.aspx

Similar Messages

I have a macbook pro 17" 2012 and the display colours are all too hard and the profile will not change it is stuck toLED Cinema display.

I have a macbook pro 17" 2012 and the display colours are all too hard and the profile will not change it is stuck toLED Cinema display.

Hello hbothner,
Thanks for using Apple Support Communities.
If you'd like to change the colors on your Mac's display, then you can calibrate your display by following the steps in the article below.
OS X Yosemite: Calibrate your display
Take care,
Alex H.

SCEP 2012 and VDI offline servicing

I've seen this question being asked before in another thread (Best practice to run Microsoft Endpoint Protection client in VDI environment) however the answer doesn't provide enough information (for me at least)
We are planning to use a Citrix XenDesktop environment with Provisioning services providing VDI clients. As far as I know the SCCM client will be installed in the VDI golden image and after some adjustments SCCM client registration will go well. We will
also use SCCM 2012 and deploy SCEP 2012 for anti-malware scanning.
SCCM 2012 provides offline servicing for Software Updates in WIM images, but what is a best practice in keeping the VDI's up-to-date? I can't find any good information about this, so maybe the answer is very simple?... Is there a way to offline service the
VDI image so Software Updates and Anti-Malware updates are injected in the image?
Or do the VDI's get updated as physical systems, at the time they are logged in to the network, discarding all changes when logging off. This doesn't seem the right way to go.
Any help would be appreciated.
thx. Niels

I struggled with this same problem for a while, and likewise didn't find a great answer anywhere. In our case, this is for an RDS VDI environment, but the solution I ended up employing should work anywhere.
First, set up SCCM/WSUS to download the updates to a UNC share (if you haven't already; here's a helpful guide:
http://blog.thesysadmins.co.uk/sccm-2012-scep-unc-definition-updates-automation-powershell.html). Also, create an antimalware policy for the VDI machines with the definition updates source set to UNC only, and set the UNC Path section accordingly.
Here's the key part: create a scheduled task in your master image to run based on boot or resume (RDS puts the VDI VMs in a Saved state rather than Off). Here are the settings I used for the task:
General tab: I set it to run as the SCCM Network Access Account; Run whether user is logged on or not
Triggers tab: Begin the task On an event; Basic; Log: System; Source: Kernel-General; Event ID: 1 (this pops up on a startup or resume event); Delay task for: 5 minutes (during VM creation, it boots the machine for just a couple minutes, and I
didn't want this task to be interrupted by a shutdown halfway through); Enabled
Actions tab: Action: Start a program; Program/script: "C:\Program Files\Microsoft Security Client\MpCmdRun.exe"; Add arguments: -SignatureUpdate
I left the other tabs with their defaults
In RDS, the VMs on creation are spun up briefly and then put into a Saved state. It then spins up just a few, waiting for users to connect. By the time a user logs in, the machine should have the latest updates, but even if it doesn't, it should be
no more than ~5 minutes before it does.
Hope this helps!
Ryan

SCEP 2012 and GP Update

SCEP 2012 Client settings currently have "Install Endpoint Protection client on computers" set to Yes. This is deployed to quite a few machines. The client installs just fine, everything updates, and we are set. In the Endpoint Protection Agent
log shows periodic checks for if SCEP needs to be installed. Which technically isn't an issue and eventually I'll flip this setting to No and leave it Manage only.
However, around the times it checks the client I notice a GP Update kicking off. Does anyone know if installing SCEP or having the client check to see if it is installed kicks off a GP Update?

Interesting. I didn't think to check that specific log. I do see activity in there for other GP objects besides SCEP. Perhaps it runs the equivalent of gpupdate /target:computer
I don't think I see any user items in there.
This reminds me of an issue I ran into before. Take the scenario of a domain joined machine that is currently connecting via the Internet. You have an IBCM server set up, so Internet connected machines are able to receive policy and software. You would think
that would include changes to SCEP policy too. However, if you make a change to SCEP policy and then try to update policy on the client, it won't actually apply the SCEP policy changes until it's back on the domain. I guess that's because whatever ConfigSecurityPolicy.exe
is doing requires a connection to be made to a domain controller and even though the SCEP content is stored locally in an XML file, it can't finish the process of getting it into Registry.pol and then into the Registry itself until it can connect to the DC
again.
Seems like it would make more sense to just import it directly into the Registry and bypass the GP client entirely. Anyway, I don't mean to hijack the thread but it would be nice to see Microsoft clarify exactly what's going on in both cases :-)

Macbook pro mid 2012 and the airplay feature does not come up. it comes up in itunes but not on the menu bar or in the displays settings. What can i do?

I just bought my macbook pro 2 weeks ago. I am new to apple so it is pretty much greek to me at this point but I have been able to figure out or google most of my questions. I have found a million posts about the Airplay feature for mirrioring and most of them are the same issue having a mac that is pre 2011. There should be no reason I would not have the Airplay option on my system.. I have done the updates avaliable for both the mac and the AppleTV unit, which is a Gen 2 or 3, Also brand new as of 2 weeks ago. Does anyone know what else I can do or is this something I will have to take in the the Apple Store to fix?

Welcome to Apple Communities
You're running Lion, and Mirroring is in Mountain Lion. http://www.apple.com/osx/uptodate

I have a macbookpro 13 inch (2012) and the screen has started flickering, I'm in Florianopolis Brazil, where should I get this fixed?

screen flickers and just trying to keep myslef calm. I have the applecare warranty and the store finder is only for US. Help!

Few one in this, a peer's forum, will be able to provide you with the information you want. You will want to contact Apple Brazil:
http://store.apple.com/br
You'll find a contact number at the upper right hand side of the page.

How to build a TestStand 2012 workspace ( insert a project / insert a folder) programmatically using LabVIEW 2012 and the TestStand API.

Hi everybody!
I am just trying to find out how to create a TestStand workspace … in LabVIEW using the TestStand API.
To create a new workspace was quite easy. Unfortunately I am not successful to insert a new or existing project to the workspace.
Furthermore I have to insert a folder from disk to the new or existing project in the way that I can use an absolute path for the directory …
Maybe someone had already solved this problem, in any case I am thankful for any hint.
Greetings from Germany,
Norbert

Have you find out how to add a folder to a project? I'm looking for this to... I tried WorkspaceObject.NewFolder[Name]whitout success...
For creating Workspace and project see the newer resolved thread I created.
Martin

Can SCEP 2012 SP1 detect malware name "Backdoor.Win32.Carbanak"

Hi all,
Basically I am working in bank and using System Center Endpoint protection 2012 Sp1. Antivirus is updating on daily basis. We just want to confirm that can SCEP 2012 detect the virus name
Backdoor.Win32.Carbanak.
Waiting your quick response guys.
Regards,
Kamran

I can't find any reference to Carbanak in the Microsoft Malware Encyclopedia, but this page from Trend Micro
http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_carbanak.a
says that Microsoft's alias for it is Trojan:Win32/Qadars.A
http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fQadars.A

Replacing FCS with SCEP 2012

I'm in the pilot phase of replacing FCS on our workstations, servers with SCEP 2012.
The FCS client was uninstalled as soon as the SCEP 2012 client appeared, SCEP Definitions are updated, but I'm getting prompted in the Software Center for http://support.microsoft.com/kb/2508824.
Why would I even need (be offered) this if FCS is not on the machine? If I try to install it it fails.
EDIT: am I right in assuming Client Update for Microsoft Forefront Client Security (1.0.1736.0) is not needed if SCEP is being used and I can just remove it from my Software Updates Group?

Yes, I know this is an old post, but I’m trying to clean them up. Did you solve this problem, if so what was the solution?
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

SCCM 2012 and collection settings

Hi all,
I am migrating SCCM 2007 to SCCM 2012 SP1 CU3.
All my 1200 collections are migrated to SCCM 2012 and the incremental option is enabled on most of my collections (about 1100).
Now I found out that my collections are updating very very slow.....
I read an article that best practice is to enable a maximum of 200 collections with the incremental option.
So i ran a powershell script to disable this option on my collections....
Now it seems that collection updates are faster again...
Do I need to disable the incremental option on all collections and enable the schedule full update eg. very 30 minutes ?
I hope someone could share his experience with this....

I ran this test this weekend since it has been a while since I have do this. Short version, yes I’m getting confused between CM07 and CM12. CM07 this work perfectly for User and PCs. In CM12 this only work perfectly for Users. If you want
to make this work for PC you need to do the following.
PC
Add the PC to the Security Group.
Wait of the Security group to replicate to the PC’s local DCS.
Reboot the PCs
Wait for the Discovery Data(DD) collection Cycle to occur, (default is every 7 days), However I recommend making this daily and in some cases hourly.
Once the DD data is in the CM12 db. You need to wait for the Collection to update (default is every 7 days)
Then you need to wait for the PC to retrieve it’s Machine policies. (~1 hour)
User:
Add the User to the Security Group.
Wait of the Security group to replicate to the PC’s local DCS.
Logon to the PC. With newer OS , just unlocking the PC will
do the trick.
Then you need to wait for the User Polices to retrieved.(~1 hour)
http://www.enhansoft.com/

SCEP going out to the internet after being migrated to SCCM 2012 and saturating facility MPLS.

I was unaware of the fact that SCEP was gonig out to the internet to pull down 120 megs worth of data each time a client is migrated. I'm trying to determine the easiest or best way to avoid this. I've done some research and it looks like bundeling the SCEP
policy with the migration package might work. I also saw some tool that you can use to add a SCEP update rollup to the package. Ultimately if i could just get the exact URL the clients are going out to our networking team could apply QoS to this URL. Unfortunately
though it appears in the MPCMDRUN.log to go to go.microsoft.com/fwlink, but on the networking side in pathview i seen the client ends up going to Akamai.
I'm assuming MS offloads their web traffic to Akamai and that first link is redirected, if that is even the right link. Does anyone know a way i can prevent this while still getting the client up to date. This entire time I thought the clients would pull
what they needed from the SCCM 2012 env. I'm using ADR to push the definitions and that seems to be working fine except for 2 situations. One a client is migrated, or 2 the client comes online after being offline for more than 7 days and goes out.
Either way if someone could provide me with the URL for throttling or a better method for deploying I would be very grateful. So far we've migrated about 8 thousand clients and have about another 10 thousand to go. The majority of the clients have local
pull DPs, and if further details of my infrastructure would be helpful please just let me know.
Thanks,
-KR

Jorgen,
I appreciate you pointing out the setting and that has helped partially and I was able to track down the URL that is being used by the clients for QoS by networking. Now management has pushed back with why are the clients going to the internet at all. I
can understand why. If were deploying all the patches why can't the clients pull their SCEP engine from the SUP/WSUS server. I see it finding it in the MPCMDRUN.Log file but it still goes out to Microsoft to pull the 120 meg file. Do i not have any other options
for pushing the engine to the clients, if ADR is working for current clients what am i missing. I'm sure its something obvious, but my migration is on hold up until I can keep the clients from going to the internet for their new engine and deltas.
Any help you could provide i would very much appreciate. Thanks again Jorgen.
-Sam Kachar

I have not been able to find any information re: the Flashback virus and Apple remedies on the Apple website. Am I missing something?

I have not been able to find any information re: the Flashback virus on the Apple website. Has Apple put out anything on this?

The ‘Flashback Trojan’:
A version of an existing Trojan Horse posing as a legitimate Flash Player installer (named “Flashback.A” by a security firm) is designed to disable updates to the default Mac OS X anti-malware protection system, potentially leaving the system open to the manual installation of other malware without any system warnings. The most recent versions bypass any user action and automatically installs itself after an affected website is visited.
http://www.appleinsider.com/articles/11/10/19/fake_adobe_flash_malware_seeks_to_ disable_mac_os_x_anti_malware_protection.html
(Adobe is aware of malware posing as its Flash Player and warns users to ignore any updates that didn't originate on its own servers. "Do not download Flash Player from a site other than adobe.com," said David Lenoe, Adobe's product security program manager, in an entry on Adobe Product Security Incident Response Team's PSIRT blog. "This goes for any piece of software (Reader, Windows Media Player, QuickTime, etc). If you get a notice to update, it's not a bad idea to go directly to the site of the software vendor and download the update directly from the source. If the download is from an unfamiliar URL or an IP address, you should be suspicious.")
Flashback Trojan - Prevention of infection:
In order to prevent a potential infection with “Flashback” Trojans, Mac users should always obtain their copy of Adobe Flash Player directly from Adobe’s official website and to disable the "Open 'safe' files after downloading" option in Safari Preferences/General to avoid automatically running files downloaded from the Internet. Also, do not turn on Java in Safari Preferences/Security. Few websites use Java. Javascript is something entirely different and should be left active.
The Flashback Trojan does not affect PPC (non-Intel) Macs, nor has it been noted to affect users running Tiger OS 10.4.11 or Leopard OS 10.5.8.
Last, but by no means least, using Open DNS is the simplest way of preventing infection in the first place. Open DNS also protects against phishing attacks, re-directs, speeds up your internet connection, and works for all users of OS X from Tiger upwards:
http://blog.opendns.com/2012/04/09/worried-about-mac-malware-just-set-up-opendns /
How to get it:
https://store.opendns.com/get/home-free
Flashback Trojan - Detection and Removal
Users with Intel Macs running Snow Leopard OS 10.6 or Lion OS 10.7 should ensure that they have downloaded all the recent Java updates from Apple, which are designed to prevent infection and also remove any infection already present.
New Macs running Lion do not have either Flash Player nor Java installed. If you running Lion and have not already downloaded and installed Java, you should download the ‘Flashback malware removal tool’ from Apple: http://support.apple.com/kb/HT5246 (356KB) which includes the same code as the Java update that plugged a security hole which allowed the malware to automatically install itself without admin authorization.
You can also use this to check whether you have been infected (for Intel Macs only) and remove it if required:
http://www.macupdate.com/app/mac/42571/anti-flashback-trojan
Flashback Trojan - Detection, and how to remove (with caution) if you are running other browsers than Safari:
http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

JAN 4, 2012 As of the Upgrade to   Lion,. and the Email portion, ..   DOES NOT allow a Video Clip to be sent via the Email as the I-Photo is not supported by Video Clips ( Previous Leopard No problem clip and drag via Quick Time Pro to the email

JAN 4, 2012
As of the Upgrade to   Lion,.   2007 I-Mac -   the Email portion, ..   DOES NOT    allow a Video Clips to be sent via the Email
as the I-Photo is not supported by Video Clips ( Previous Leopard )
No problem clip and drag via Quick Time Pro to the email and select the Attchment size to send. . Depending on the
Size of the Video Clip ..      Now Lion only Export's   1 size, .   only and as a result . . teh File is TOO Large and
Will NOT send via E-Mail    ???
Between the   Issue of   the   Lion, and Email issues ,   and the   Upgrade of   I-Touch to 5.1 from 4.2.1
as my Photo Size is Huge ..    70,000 + photos in the Computer. .   and was   40,000 in the   I - Touch .. .
The New I-Touch too will not Load the same as Previously used on either my 16 GB   or 32 GB   Unit . .
          No Help . ..   so far, .. as a Apple user   since   1996 ..    I have Never experieanced such frustration    ???
               ( any one have some help if similar experiances    ?     thank you     )

JAN 4, 2012
As of the Upgrade to   Lion,.   2007 I-Mac -   the Email portion, ..   DOES NOT    allow a Video Clips to be sent via the Email
as the I-Photo is not supported by Video Clips ( Previous Leopard )
No problem clip and drag via Quick Time Pro to the email and select the Attchment size to send. . Depending on the
Size of the Video Clip ..      Now Lion only Export's   1 size, .   only and as a result . . teh File is TOO Large and
Will NOT send via E-Mail    ???
Between the   Issue of   the   Lion, and Email issues ,   and the   Upgrade of   I-Touch to 5.1 from 4.2.1
as my Photo Size is Huge ..    70,000 + photos in the Computer. .   and was   40,000 in the   I - Touch .. .
The New I-Touch too will not Load the same as Previously used on either my 16 GB   or 32 GB   Unit . .
          No Help . ..   so far, .. as a Apple user   since   1996 ..    I have Never experieanced such frustration    ???
               ( any one have some help if similar experiances    ?     thank you     )

My Macbook Pro 2012 is painfully slow and the battery dies out really fast

I don't do a lot of downloading or installing on my computer, I basically just use it to browse the internet or use microsoft office. I haven't used much memory and all the specs on my computer seem fine. I recently went to the genius bar at an apple store and they ran a bunch of diagnostic tests but everything seemed to come up normal. I've backed up all my data and even restored my computer to factory settings. However, my computer still has the same problem. I was told I didn't have any viruses or malware/adware problems and the only reasonable solution the genius bar representative told me that it was tiem to upgrade. However, since these laptops cost over $1,500 new I don't think that's a reasonable solution for me. So if anyone could shine a light on what is possibly happening that would be awesome!
Thank you!

Pre-Mavericks
Open Activity Monitor in the Utilities folder. Select All Processes from the Processes dropdown menu. Click twice on the CPU% column header to display in descending order. If you find a process using a large amount of CPU time (>=70,) then select the process and click on the Quit icon in the toolbar. Click on the Force Quit button to kill the process. See if that helps. Be sure to note the name of the runaway process so you can track down the cause of the problem.
Mavericks and later
Open Activity Monitor in the Utilities folder. Select All Processes from the View menu. Click on the CPU tab in the toolbar. Click twice on the CPU% column header to display in descending order. If you find a process using a large amount of CPU time (>=70,) then select the process and click on the Quit icon in the toolbar. Click on the Force Quit button to kill the process. See if that helps. Be sure to note the name of the runaway process so you can track down the cause of the problem.
Try these in order testing your system after each to see if it's back to normal:
1. a. Resetting your Mac's PRAM and NVRAM
    b. Intel-based Macs: Resetting the System Management Controller (SMC)
2. Restart the computer in Safe Mode, then restart again, normally. If this doesn't help, then:
Boot to the Recovery HD: Restart the computer and after the chime press and hold down the COMMAND and R keys until the Utilities menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
3. Repair the Hard Drive and Permissions: Upon startup select Disk Utility from the Utilities menu. Repair the Hard Drive and Permissions as follows.
When the recovery menu appears select Disk Utility. After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the main menu. Select Restart from the Apple menu.
4. Reinstall Yosemite: Reboot from the Recovery HD. Select Reinstall OS X from the Utilities menu, and click on the Continue button.
Note: You will need an active Internet connection. I suggest using Ethernet if possible
            because it is three times faster than wireless.
5. Reinstall Yosemite from Scratch:
Be sure you backup your files to an external drive or second internal drive because the following procedure will remove everything from the hard drive.
How to Clean Install OS X Yosemite
Note: You will need an active Internet connection. I suggest using Ethernet if possible
            because it is three times faster than wireless.

When I log in on my computer none of my icons show up on my desktop and then a virus protection logo comes on. What can I do to resolve this issue without going to the repair store?

When I log ion to my computer and the desktop shows up all of my icons that were on my desktop are no longer there. Then a virus message pops up and asks me if I would like to buy some antivirus software and then a error report shows up and it ask me if I would like to send the error report out and then it gives me the option if I do not want to send it out.
== This happened ==
A few times a week
== 06/14/2010

That pop-up asking you to buy an anti-virus product (and some telling you that you are infected) is probably a virus.
For a possible solution and images of similar pop-up windows see (follow the instructions given in Post 3 of this):
http://forums.malwarebytes.org/index.php?showtopic=38629&st=0&p=193287&#entry193287
After doing the above, you may want to use other scanners to thoroughly scan your system for malware:
'''Scan for Malware'''
Install, update and run these programs in this order. They are all free for personal use, but some have limited functionality in the "free mode", but those are features you really don't need to find and remove the problem that you have. ('''Not all programs detect the same Malware.''')
Malwarebytes' Anti-Malware - http://www.malwarebytes.org/mbam.php
SuperAntispyware - http://www.superantispyware.com/
AdAware - http://www.lavasoftusa.com/software/adaware/
Spybot Search & Destroy - http://www.safer-networking.org/en/index.html
Windows Defender - http://www.microsoft.com/windows/products/winfamily/defender/default.mspx
Dr. Web Cureit - http://www.freedrweb.com/cureit/
If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://www.spywareinfoforum.com/
http://bleepingcomputer.com
'''''Other Issues''''': ~~red:You have installed plug-ins with know security issues. You should update them immediately.~~
'''Update Java''': your ver. 1.6.0.19; current ver. 1.6.0.20 (important security update 04-15-2010)
(Firefox 3.6 and above requires Java 1.6.0.10 and above; see: http://support.mozilla.com/en-US/kb/Java-related+issues#Java_does_not_work_in_Firefox_3_6 )
''(Windows users: Do the manual update; very easy.)''
See: '''[http://support.mozilla.com/en-US/kb/Using+the+Java+plugin+with+Firefox#Updates Updating Java]'''
Do the update with Firefox closed.
'''Install/Update Adobe Flash Player for Firefox''': your ver. 10.0 r32; current ver. 10.1 r53 ('''important security update 2010-06-10''')
See: '''[http://support.mozilla.com/en-US/kb/Managing+the+Flash+plugin#Updating_Flash Updating Flash]'''
-'''use Firefox to download''' and '''SAVE to your hard drive''' (save to Desktop for easy access)
-exit Firefox (File > Exit)
-check to see that Firefox is completely closed (''Ctrl+Alt+Del, choose Task Manager, click Processes tab, if "firefox.exe" is on the list, right-click "firefox.exe" and choose End process, close the Task Manager window'')
-double-click on the Adobe Flash installer you just downloaded to install/update Adobe Flash
-when the Flash installation is complete, start Firefox, and test the Flash installation here: http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_15507&sliceId=1
*'''NOTE: On Vista and Windows 7''' you may need to run the plugin installer as Administrator by starting the installer via the right-click context menu if you do not get an UAC prompt to ask for permission to continue (i.e nothing seems to happen). See this: http://vistasupport.mvps.org/run_as_administrator.htm
*'''NOTE for IE:''' Firefox and most other browsers use a Plugin. IE uses an ActiveX version of Flash. To install/update the IE ActiveX Adobe Flash Player, same instructions as above, except use IE to download the ActiveX Flash installer.
*Also see: http://kb.mozillazine.org/Flash ~~red:'''''and'''''~~ [[How do I edit options to add Adobe to the list of allowed sites]]

SCEP 2012 and the TeslaCrypt virus

Similar Messages

Maybe you are looking for