LabTech Scripts – Cryptolocker probe script finds infections fast

 

 

cryptolocker-680x400

Catch Cryptolocker in the act

We have created a script for LabTech that you can schedule against any system to scan for possible Cryptolocker Decrypt Files, a sure sign that you been infected.

 

The script can be scheduled against all agents and if an agent is a Mac or Linux it will skip it, The probe will scan each drive letter found and then review that scan to see if it has found any files. Once it finds a file it will email an address but you can easily have it create a ticket or even set an alarm state.

 

When executing probe against a system you can monitor the Scripts Tab for the progress of the probe.

Capture

As the image above shows, a scan takes just a minute to complete. The C drive scan started at 1:08:34 and ended at 1:09:51, the scan took 1 minute and 17 seconds to scan 80GB hard drive.

 

Version 1.0.1 download

 

 

 

download

 

 

 

 

 

Enjoy  Cubert

XYMON – ESX Hardware Health Monitor

Grab the Hardware Health of your VMware vSphere ESXi Host

Here is RC1 of my ESX Health Script for the XYmon monitoring server, not to be compared to the ESXi script going around for VM and Snapshot Health.  ESXHealth monitors the physical health of the hardware running the ESX hyper-visor  This script uses the xymoncgimsg.cgi to send status reports from a remote network to your XYmon Display Server thus allowing you to monitor ESX Host from anywhere really easily. Using this CGI allows you to run it from any windows box and send the notifications through port (http) friendly firewalls.

The only prereqs are, you must have installed the VMWare vSphere Perl SDK and have installed CURL or place the curl-nossl.exe provided in zip in the your PATH on Windows. Your XYmon server must have the xymoncgimsg.cgi moved from the xymon/server/bin folder to your xymon-cgi folder to allow web based status messages.

I have include the curl-nossl portable EXE with zip. Just drop it in the path for windows so you can call it by name. You will need to edit the script and update the URL to send the notifications to. I show an example in the script on how to use with a htpasswd protecting your web CGI for thoes who use that layer of security. If not then just place the standard URL for your xymoncgimsg.cgi and your good to go.

The script is very simple.

If all is good you get a “All’s OK” else if anything is bad it spits out any relevant info about that issue. The last error I got was for redundant Power lost to Supply 1 and was reported with plenty of detail to know what is wrong.

Just schedule windows to run every 15 minutes or so, see script for command line syntax for task scheduler

Download  -> ESXHealth-1.1  Monitor for XYmon

 

The monitor will look like the following examples: (Never mind my XYMon theme)

 

 

 

 

I hope this helps someone out there.

Cubert 😎