King Files

Use an automated backup script that will check your backup drive letter

I have tried many different tools for automated backup, both third party and the ones built into windows, but the best one by far is Robocopy. It is the most robust, stable and reliable tool that youll ever find to automate backups both in the enterprise environment and at home.

I use Robocopy scripts to mainly create backups onto an external USB drive that can be routinely taken offsite and switched with another external drive.
The biggest problem when using automated backup onto an external drive is the fact that the letter of the drive may change at some point if the drive was unplugged and then re-plugged. This causes your backup procedure to miss the target drive and backup will not run.

Heres an example of a script that overcomes the problem of the changing drive letter.

In this example we run a mirror backup of a server folder onto an external backup drive, and the script will find out whether the backup drive is using drive letter G: or H:


We start by creating a procedure that will check for a file called "ident.txt" (could have any other name or extention) - this is an empty file you should create and put in the root folder of your backup drive.
So if the file is present on drive G: - we point the script to a label called "run1" which runs the backup to drive G:. If the file is not present on drive G: (or if there IS no drive G:) we bounce the process to the label called "run2" which will then run the backup onto drive H:.

Robocopy then starts backing up a shared folder called "Administration" located on a server named "Server" onto the the external USB drive.

Available link for download

The Rootkit VBS Virus That Change Files and Folders Change to Shortcut Icon

Confuse why the files inside your removable device creates a shortcut icon folder, beware  maybe  your file and folders is infected with  a virus name ztorsftdgh.vbs. This kind of virus resides into your computer, some free anti-virus hardly detect this, confusing some users that they were not infected this.

Such as one of my customer argued me that his computer is not even infected with ztorsftdgh vbs. But he cant even explain why all the files in his flash drive changed to shortcut icon.

You cant easily remove this with free antivirus. But just try my guide, first update your virus definitions or install and the next step is show the hidden files and folders in your Windows XP, Windows Vista or Windows 7 and Windows 8 Operating System.
The selection is located in My Computer, Tools Menu , Folder Options, View Tab. In Windows 7 the Tools Menu  Options is hidden by default; you can access it  by holding the alt key and press t on your keyboard.

After the Selection you may scan your computer and lets see if your anti-virus figure this ztorsftdgh vbs virus. Once your system detect this and delete it, that is your lucky day, if not you may change your anti-virus program if you have a free version.

Once the Virus is deleted you may now safely insert your external storage device and run a full scan, but remember all the shortcut folder and files will be deleted and it appears that theres no file inside your flash drive.

Available link for download

TCP Wrapper that ALWAYS logs denials

During teaching of a class this week, one of my students noticed that the vsftpd service was being denied by his TCP Wrapper rules in /etc/hosts.allow and /etc/hosts.deny, but that nothing was being logged into /var/log/messages. He then asked me if there was still a way for the TCP Wrapper to start a process as an option. I told him about both the spawn and twist options, and referred him the to the hosts_access and hosts_options man pages. After both of us experimenting a little bit, we came up with the solution that all allow rules should be in /etc/hosts.allow and that /etc/hosts.deny should look something like this:

ALL:ALL:spawn (logger TCP wrapper in /etc/hosts.deny denied %c access to %d)

With this rule, anything that gets denied will be logged by spawn starting the logger process in a subshell (thus the parentheses) and that it would report the client (%c) who was attempting to connect to the daemon (%d). Now, anytime a denial is suspected, the /var/log/messages file can be checked for a TCP Wrapper message.

Available link for download