How to Re-Register Vss Dll Binaries (64 Bit)

Total Page:16

File Type:pdf, Size:1020Kb

How to Re-Register Vss Dll Binaries (64 Bit) QBR Knowledge base HOW TO RE-REGISTER VSS DLL BINARIES (64 BIT) SCOPE If the command vssadmin list writers does not have any output the following batch file will help to re-register the VSS Service's associated DLL binaries. There may be other reasons in which QBR support may also ask to run this batch file besides the inability to list the VSS Writers of the OS. Please note this will only work on 64bit systems, if you have a 32 bit system there is a separate article on this KB for you. COPY THIS TEXT INTO NOTEPAD AND SAVE AS FIXVSS08.BAT Then run this batch file with administrative privileges. rem FILENAME: FIXVSS08.BAT rem net stop "System Event Notification Service" net stop "Background Intelligent Transfer Service" net stop "COM+ Event System" net stop "Microsoft Software Shadow Copy Provider" net stop "Volume Shadow Copy" cd /d %windir%\system32 net stop vss net stop swprv regsvr32 /s ATL.DLL regsvr32 /s comsvcs.DLL regsvr32 /s credui.DLL regsvr32 /s CRYPTNET.DLL QBR Knowledge base regsvr32 /s CRYPTUI.DLL regsvr32 /s dhcpqec.DLL regsvr32 /s dssenh.DLL regsvr32 /s eapqec.DLL regsvr32 /s esscli.DLL regsvr32 /s FastProx.DLL regsvr32 /s FirewallAPI.DLL regsvr32 /s kmsvc.DLL regsvr32 /s lsmproxy.DLL regsvr32 /s MSCTF.DLL regsvr32 /s msi.DLL regsvr32 /s msxml3.DLL regsvr32 /s ncprov.DLL regsvr32 /s ole32.DLL regsvr32 /s OLEACC.DLL regsvr32 /s OLEAUT32.DLL regsvr32 /s PROPSYS.DLL regsvr32 /s QAgent.DLL regsvr32 /s qagentrt.DLL regsvr32 /s QUtil.DLL regsvr32 /s raschap.DLL regsvr32 /s RASQEC.DLL regsvr32 /s rastls.DLL QBR Knowledge base regsvr32 /s repdrvfs.DLL regsvr32 /s RPCRT4.DLL regsvr32 /s rsaenh.DLL regsvr32 /s SHELL32.DLL regsvr32 /s shsvcs.DLL regsvr32 /s /i swprv.DLL regsvr32 /s tschannel.DLL regsvr32 /s USERENV.DLL regsvr32 /s vss_ps.DLL regsvr32 /s wbemcons.DLL regsvr32 /s wbemcore.DLL regsvr32 /s wbemess.DLL regsvr32 /s wbemsvc.DLL regsvr32 /s WINHTTP.DLL regsvr32 /s WINTRUST.DLL regsvr32 /s wmiprvsd.DLL regsvr32 /s wmisvc.DLL regsvr32 /s wmiutils.DLL regsvr32 /s wuaueng.DLL sfc /SCANFILE=%windir%\system32\catsrv.DLL sfc /SCANFILE=%windir%\system32\catsrvut.DLL sfc /SCANFILE=%windir%\system32\CLBCatQ.DLL net start "COM+ Event System" QBR Knowledge base TEST VSS WITH THE MICROSOFT VSHADOW TOOL 1. First download the VShadow tool for your OS: Windows 2000 - Not available as Windows 2000 does not have VSS Windows XP 32 Bit Windows XP 64 Bit Windows Server 2003 32 Bit & 64 Bit Windows Vista 32 Bit Windows Vista 64 Bit Windows Server 2008 32 Bit Windows Server 2008 64 Bit Windows 7 32 Bit Windows 7 64 Bit Windows Server 2008 r2 32 Bit Windows Server 2008 r2 64 Bit 3. Download VShadow.exe to %windir%\system32\ 4. Once this has been copied to your Window's System32 directory the vshadow command can be more easily run at the command prompt. 5. Before running VShadow be sure to stop the VSS-related services that most likely are running, the following services should be stopped and set to Automatic startup state in services.msc: Background Intelligent Transfer Service Hyper-V Volume Shadow Copy Requestor Microsoft Software Shadow Copy Provider MS Software Shadow Copy Provider SQL Server VSS Writer Volume Shadow Copy 6. The syntax for this command is as follows: vshadow VolumeList 7. On the PC in the screenshot below we see a C:, D:, F:, and G: volume. The C: volume is the only hard disk on the machine so the VShadow syntax is shown as such. 8. If there was a hypothetical D: volume as well here the command would be: VShadow C: D: 9. If the VShadow tool fails to take a shadow copy then please try to reboot the system. QBR Knowledge base .
Recommended publications
  • Journey Through the Impact of the Recovery Artifacts in Windows 8 WENDELL Kenneth JOHNSON Iowa State University
    Iowa State University Capstones, Theses and Graduate Theses and Dissertations Dissertations 2013 Journey through the impact of the recovery artifacts in Windows 8 WENDELL Kenneth JOHNSON Iowa State University Follow this and additional works at: https://lib.dr.iastate.edu/etd Part of the Databases and Information Systems Commons Recommended Citation JOHNSON, WENDELL Kenneth, "Journey through the impact of the recovery artifacts in Windows 8" (2013). Graduate Theses and Dissertations. 13414. https://lib.dr.iastate.edu/etd/13414 This Thesis is brought to you for free and open access by the Iowa State University Capstones, Theses and Dissertations at Iowa State University Digital Repository. It has been accepted for inclusion in Graduate Theses and Dissertations by an authorized administrator of Iowa State University Digital Repository. For more information, please contact [email protected]. Journey through the impact of the recovery artifacts in Windows 8 by Wendell Kenneth Johnson A thesis submitted to the graduate faculty in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE Co-majors: Computer Engineering; Information Assurance Program of Study Committee: Yong Guan, Major Professor Doug Jacobson Jennifer L. Davidson Iowa State University Ames, Iowa 2013 Copyright © Wendell Kenneth Johnson, 2013. All rights reserved. ii DEDICATION This Thesis is dedicated to my family Jessica, Savannah and Brady. Without your unrelenting support and sacrifices I would not have been able to follow my educational and career dreams. To Lee Adams, while you will never see the finished work, your guiding light and compassion shown to me helped create the person I am today. My drive to succeed and to share my success comes from watching you give so much of your compassion to others.
    [Show full text]
  • Invalid Class String Error
    Tib4231 July, 2001 TECHNICAL INFORMATION BULLETIN Invalid Class String Error KODAK DC215, KODAK DC240, KODAK DC280, DC3400, and DC5000 Zoom Digital Cameras An Invalid Class String error may occur when you try to launch the camera software for the first time, or the Mounter or Camera Properties software may not operate properly.This error is caused when the program RegSvr32.exe is not located in the C:\Windows\System folder, preventing the DLL files from being registered. Use this document to help you properly locate the RegSvr32.exe program in your system, and if necessary, manually register the DLL files. The instructions in this document assume that you are familiar with copying and moving files in your computer, and installing software. Relocating RegSvr32.exe 1. Go to Start > Find > Files and Folders and search for regsvr32*.* Note the location of the program. 2. In WINDOWS Explorer or My Computer, copy RegSvr32.exe to the C:\Windows\System folder if it is not already there. When the file is in place, go on to Step 3. 3. Uninstall the KODAK software using the KODAK Uninstall application, or go to Start > Settings > Control Panel > Add / Remove Programs. 4. Close all background programs except Explorer and Systray by pressing Ctrl Alt Del, selecting each program one at a time, and clicking End Task after each. 5. Install the KODAK camera software. 6. Start the KODAK Camera Mounter and Camera Properties software for your camera. If the Invalid Class String error appears, manually register the DLL file using the procedure that follows for your camera.
    [Show full text]
  • How to Re-Register Vss Dll Binaries (32 Bit)
    QBR Knowledge base HOW TO RE-REGISTER VSS DLL BINARIES (32 BIT) SCOPE The command vssadmin list writers does not produce an output then following commands will help to re-register the VSS Service's associated DLL binaries. There may be other reasons in which QBR support may also ask to run this batch file besides the inability to list the VSS Writers of the OS. One of the most common causes for needing to perform these steps is that there has been a conflicting VSS-aware application being run on the protected machine. Please ensure that any other VSS-aware process is removed, including scheduled shadow copies in the OS, this will ensure further long term stability and reliability for the SnapToVM Agent to perform. Please note this will only work on 32bit systems, if you have a 64 bit system there is a separate article on this KB for you. TO RE-REGISTER VSS BINARIES AND SERVICES Run the following commands from within cmd.exe running with Administrative privileges cd /d %windir%\system32 net stop vss net stop swprv regsvr32 ole32.dll regsvr32 oleaut32.dll regsvr32 /i eventcls.dll <--This will fail to register on Vista & 2008 and newer which is OK regsvr32 vss_ps.dll vssvc /register regsvr32 /i swprv.dll regsvr32 es.dll <-- This will fail to register on Vista & 2008 and newer which is OK regsvr32 stdprov.dll regsvr32 vssui.dll <-- This only applies to server2003\server2008 regsvr32 msxml.dll <---This may not be installed and may fail to register which is OK regsvr32 msxml3.dll <---This may not be installed and may fail to register which is OK regsvr32 msxml4.dll <---This may not be installed and may fail to register which is OK Please reboot the machine if you have any trouble testing the VSS with the VShadow tool below.
    [Show full text]
  • Copyrighted Material
    Index Numerics Address Resolution Protocol (ARP), 1052–1053 admin password, SOHO network, 16-bit Windows applications, 771–776, 985, 1011–1012 900, 902 Administrative Tools window, 1081–1083, 32-bit (x86) architecture, 124, 562, 769 1175–1176 64-bit (x64) architecture, 124, 562, 770–771 administrative tools, Windows, 610 administrator account, 1169–1170 A Administrators group, 1171 ADSL (Asynchronous Digital Subscriber Absolute Software LoJack feature, 206 Line), 1120 AC (alternating current), 40 Advanced Attributes window, NTFS AC adapters, 311–312, 461, 468–469 partitions, 692 Accelerated Graphics Port (AGP), 58 Advanced Computing Environment (ACE) accelerated video cards (graphics initiative, 724 accelerator cards), 388 Advanced Confi guration and Power access points, wireless, 996, 1121 Interface (ACPI) standard, 465 access time, hard drive, 226 Advanced Graphics Port (AGP) card, access tokens, 1146–1147 391–392 Account Operators group, 1172 Advanced Graphics Port (AGP) port, 105 ACE (Advanced Computing Environment) Advanced Host Controller Interface (AHCI), initiative, 724 212–213 ACPI (Advanced Confi guration and Power Advanced Micro Devices (AMD), 141–144 Interface) standard, 465 Advanced Packaging Tool (APT), 572 Action Center, 1191–1192 Advanced Power Management (APM) Active Directory Database, 1145–1146, 1183 standard, 465 active heat sink, 150 Advanced Programmable Interrupt active matrix display, LCD (thin-fi lm Controller (APIC), 374 transistor (TFT) display), 470 Advanced RISC Computing Specifi cation active partition, 267,
    [Show full text]
  • How to Evade Application Whitelisting Using REGSVR32
    EXTERNAL/INTERNAL, RED TEAM, RED TEAM TOOLS CASEY SMITH, COM+ SCRIPLETS, DLL, FOLLOW US 10 SUBTEE, WEVADE, WHITELISTING MAY 2017 How to Evade Application Whitelisting Using REGSVR32 Jo Thyer // I was recently working on a Red Team for a customer that was very much up to date with their defenses. This customer had tight egress controls, perimeter proxying, strong instrumentation, and very tight application whitelisting controls. My teammate and I knew that we would have to work very hard to get command and control outbound from this environment, and that would be after obtaining physical access (yet another signicant challenge). Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD The week before going on-site, we began to LOOKING FOR research all of the various methods for SOMETHING? potential application whitelisting bypass. We assumed the best case defensive scenario whereby the customer would have all binary execution blocked with the exception of specic applications permitted. In prior tests SUBSCRIBE TO THE with other customers and this same BHISBLOG customer, we had used “rundll32.exe” to execute DLL content. This method is really useful if you can host shellcode Don't get left in the dark! Enter within a DLL, and have a nice controlled entry point. In the Metasploit case, the your email address and every DLL entry point is named “Control_RunDLL”. While this might evade time a post goes live you'll get instant notication! We'll also whitelisting, we also knew this old trick had been played before and we likely add you to our webcast list, so could not count on it again.
    [Show full text]
  • Tweakhound, Windows 7 Beta Default Services
    Sheet1 Name Startup Type Adaptive Brightness Manual AppID Service Manual Application Experience Manual Application Information Manual Application Layer Gateway Service Manual Application Management Manual Background Intelligent Transfer Service Automatic (Delayed Start) Base Filtering Engine Automatic BitLocker Drive Encryption Service Manual Block Level Backup Engine Service Manual Bluetooth Support Service Manual BranchCache Manual Certificate Propagation Manual CNG Key Isolation Manual COM+ Event System Automatic COM+ System Application Manual Computer Browser Automatic Credential Manager Service Manual Cryptographic Services Automatic DCOM Server Process Launcher Automatic Desktop Window Manager Session Manager Automatic DHCP Client Automatic Diagnostic Policy Service Automatic Diagnostic Service Host Manual Diagnostic System Host Manual Disk Defragmenter Manual Distributed Link Tracking Client Automatic Distributed Transaction Coordinator Manual DNS Client Automatic Encrypting File System (EFS) Manual Extensible Authentication Protocol Manual Fax Manual Function Discovery Provider Host Manual Function Discovery Resource Publication Automatic Group Policy Client Automatic Health Key and Certificate Management Manual HomeGroup Listener Manual HomeGroup Provider Manual Human Interface Device Access Manual IKE and AuthIP IPsec Keying Modules Automatic Interactive Services Detection Manual Internet Connection Sharing (ICS) Disabled IP Helper Automatic IPsec Policy Agent Manual KtmRm for Distributed Transaction Coordinator Manual Link-Layer
    [Show full text]
  • Conversion Server User Guide
    www.AutoDWG.com Thank you for using AutoDWG Conversion Server Software AutoDWG Conversion Server With AutoDWG Conversion Server, companies can convert dwg to pdf, dwg to image automatically at high speed in a centrally-managed server. Users upload or drop dwg files into a watched folder, the drawing will be convert into pdf, dwf or image automatcially at once, Users can set up different folders in different output policy to specify output file type, and others setting. Features • Windows Service Program, no AutoCAD required in the server. • Supports dwg to pdf, dwg to jpg, dwg to bmp, dwg to gif, dwg to bmp, dwg to png conversion. • Supports AutoCAD drawing format from R2.5 to the latest version R2008. Email us [email protected] for more information and pricing. Download Free Trial Quick Start: • Install the software, register the DLL files and the acs.exe service o RUN: Regsvr32 “Full path\DWG2PDFX.dll” o RUN: Regsvr32 “Full path\DWG2imageX.dll” o RUN: Regsvr32 “Full path\mfc42.dll” o Set up the PS path, copy the whole folder of “PS” to C:\windows\system32\PS o RUN: acs.exe /service o Start the service from the [Windows control panel\Administrative tools\Services] • Launch AcsCtrl.exe to set up profiles of the watched folders and output file formats o Click menu button “File/New Profile” to create new watched folder o Right click on the existing listed input folder, click “add a profile” to create more out put file formats or copy files without convert • Click on the button “Start Server” to start the conversion service Æ Go to Trouble Shooting and learn more on the installation www.AutoDWG.com User’s manual The AutoDWG Conversion server is enterprise class software, and recommended to installed with a server, the requirements to the server listed as below: Hard ware requirements, CPU: PIII 1GHz or greater, a modern processor is recommended, since the conversion calculation will be kind of heavy loading to the CPU.
    [Show full text]
  • Cxspectra How to Fix Hasp Com Windows.Dll Is Missing / Not Found Error Messages
    CXSpectra How To Fix Hasp_com_windows.dll is Missing / Not Found Error Messages Overview of Hasp_com_windows.dll What Is Hasp_com_windows.dll? Hasp_com_windows.dll is a type of DLL file associated with HASP SRM Assembly for Microsoft .NET developed by Windows Software Developer for the Windows Operating System. The latest known version of Hasp_com_windows.dll is 3.5, which was produced for Windows. This DLL file carries a popularity rating of 1 stars and a security rating of "UNKNOWN". What Are DLL Files? DLL ("dynamic link library") files such as hasp_com_windows.dll are small programs, similar to EXE ("executable") files, which allow multiple software programs to share the same functionality (eg. printing). For example, let's say you are running Windows and editing a document in Microsoft Word. The DLL file that controls printing does not need to load unless it's function is needed - eg. you decide to print your document. When you select "Print", Microsoft Word calls the printer DLL file, and it is loaded into memory (RAM) at that time. If you want to print a document in another program, Adobe Acrobat for example, that same printer DLL file will be used as well. Why Do I Have DLL Errors? Because they are shared files, DLL files exist outside of the software application itself. Although this provides many benefits for software developers, this separation also provides an opportunity for problems to occur. Quite simply, if Windows cannot properly load your hasp_com_windows.dll file, you will encounter an error message. Please see "Causes of hasp_com_windows.dll Errors" below for more information.
    [Show full text]
  • Distributing Our Instrumentation Activex Controls You Only Need To
    Distributing our Instrumentation ActiveX Controls You only need to copy and register the OCX files for those components that you program uses on the destination computer to successfully distribute our ActiveX components. You can follow one of the following methods to distribute our components. Our ActiveX components have no dependencies on any other operating system files. WARNING!: under our license agreement, you are not allowed to distribute the LIC (license) files that are associated with our ActiveX components to your end user's computers. Also, there is generally no need to distribute the associated TLB files. Just distribute the OCX files. Manual Registration This method involves a manual installation of your compiled software and our ActiveX components. This is generally used in situations where you are only distributing your application to a few number of computers. 1. Copy the OCX files that your program requires (Example: copy the "iStripChartXComponent.ocx" and "isAnalogLibrary.ocx" files if your program uses our Strip Chart and Analog Gauge components) to the target computer's system directory. This is usually "C:\WINDOWS\SYSTEM" for Windows 95/98 and "C:\WINNT\SYSTEM32" for Windows NT/2000 systems. 2. Open up a command or DOS prompt and execute the following command in the system/system32 directory where you placed the OCX files. You can also use the START/RUN command... Windows 95/98 Component Command Line Analog (isAnalogLibrary.ocx) regsvr32 isAnalogLibrary.ocx Digital (isDigitalLibrary.ocx) regsvr32 isDigitalLibrary.ocx
    [Show full text]
  • Empowering Users to Restore Files with Shadow Copies on Amazon Fsx for Windows File Server
    Empowering Users to Restore Files with Shadow Copies on Amazon FSx for Windows File Server Dean Suzuki, Senior Solution Architect, AWS February 2020 © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Scenario • User deletes one of their files stored on the server, OR • User makes a bunch of changes to their file (e.g. contract, report, spreadsheet), and saves it. Then they decide that they want to revert back to the original file. Result: • User calls Help Desk to restore the file from backup. Better Solution: • User restores the file(s) themselves. [Windows Shadow Copies] © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda • Demo Shadow Copies on Amazon FSx for Windows File Server • Walk through how to setup Shadow Copies on Amazon FSx for Windows File Server © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Shadow Copies on Amazon FSx for Windows File Server Demo © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Key Points • Can have up to 512 shadow copies per file system • By default, shadow copies are set to consume a maximum of 10% of the total storage capacity. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Setting up Shadow Copies: Prerequisites • Need a Windows client that has network connectivity to the Amazon FSx for Windows File Server file system. • Login to the Windows client with a user that has rights. • If using AWS Managed Microsoft Active Directory (AD), member of AWS Delegated FSx Administrators or • If using Self Managed Microsoft AD, the Domain Admins or the custom group that has permissions to manage Amazon FSx for Windows File Server © 2020, Amazon Web Services, Inc.
    [Show full text]
  • The Response by the Security Community to Are All Retained
    The magazine you!re reading was put together during an extremely busy few months that saw us pile up frequent flier miles on the way to several conferences. You can read about some of them in the pages that follow, specifically RSA Conference 2009, Infosecurity Europe 2009 and Black Hat Europe 2009. This issue brings forward many hot topics from respected security professionals located all over the world. There!s an in-depth review of IronKey, and to round it all up, there are three interviews that you!ll surely find stimulating. This edition of (IN)SECURE should keep you busy during the summer, but keep in mind that we!re coming back in September! Articles are already piling in so get in touch if you have something to share. Mirko Zorz Editor in Chief Visit the magazine website at www.insecuremag.com (IN)SECURE Magazine contacts Feedback and contributions: Mirko Zorz, Editor in Chief - [email protected] Marketing: Berislav Kucan, Director of Marketing - [email protected] Distribution (IN)SECURE Magazine can be freely distributed in the form of the original, non modified PDF document. Distribution of modified versions of (IN)SECURE Magazine content is prohibited without the explicit permission from the editor. Copyright HNS Consulting Ltd. 2009. www.insecuremag.com Qualys adds Web application scanning to QualysGuard Qualys added QualysGuard Web Application Scanning (WAS) 1.0 to the QualysGuard Security and Compliance Software-as-a- Service (SaaS) Suite, the company!s flagship solution for IT secu- rity risk and compliance management. Delivered through a SaaS model, QualysGuard WAS delivers automated crawling and test- ing for custom Web applications to identify most common vulner- abilities such as those in the OWASP Top 10 and WASC Threat Classification, including SQL injection and cross-site scripting.
    [Show full text]
  • Scheduling Operations in Networker
    Scheduling Operations in NetWorker Aaron Kleinsmith EMC Proven Professional Knowledge Sharing 2010 Aaron Kleinsmith P&E Consultant, EMC Education EMC² [email protected] Table of Contents Scheduling in NetWorker .................................................................................................... 3 Different ways to start backups .......................................................................................... 3 Group resource ............................................................................................................... 3 Scheduling the Group backups ......................................................................................... 4 On-demand Group backup ................................................................................................ 5 Restarting a Group backup ............................................................................................... 5 Savegrp ............................................................................................................................. 6 Savefs and save ............................................................................................................. 8 Windows Task Scheduler or Unix/Linux cron ................................................................. 9 External scheduling applications .................................................................................... 9 Using Schedules effectively ...............................................................................................
    [Show full text]