A little something about everything

With codeplex gone it can be a bit hard to find the real download for some things. I had to search an old server archive to find this.

Php manager 1.2 x64,

 PHPManagerForIIS-1.2.0-x64.msi

This is the original v1.2 64bit download from 2012.

Enjoy.

I also found the older 1.1.1 download should you want that instead,

PHPManagerForIIS-1.1.1-x64.msi

Error:

handler "extensionlessurlhandler-integrated-4.0" has a bad module "managedpipelinehandler" in its module list

The Fix:

You need to install ASP.NET 4.5 and Application Initialization.

You can do this via the Server Manager,

• Manage > Add Roles and Features
• Next > Next > Next
• Under Server Roles expand "Web Server (IIS)" > "Web Server" > "Application Development"
• Check the following
  • Application Initialization
  • Asp.net 4.5
• Next > Next > Install

That's it, your done.

So I've had several clients call me with these questions; what is this?, do I have a virus?, is my account compromised?, what should I do?

First off, if you are still using the password in the email go change your passwords! Its also a good idea to use separate email address for work, personal finance and social media sites.

What is this?

These emails are being sent by scammers that have come into possession of compromised social media databases that included your email, unencrypted or poorly encrypted passwords and other info such as contacts. 

Do I have a virus?

Perhaps but its not related to this email. Scan your system with a reputable antivirus scanner.

Is my account compromised?

If you are still using the same email address and password for any website, device or application then yes! you should change your password immediately. 

What should I do?

Don't send the scammers anything, never send them money no matter what. Check your accounts for weak password and update them. Always use https and verify you are on the correct website. Don't share anything on social media that you don't want people to know, its not secure and at some point it very well could be used in the next database breach to try and extort money from you.

Here is the email example,

Subject Text:

somee-mail-address-you-used@social-media-site.compromised:$om3o1dP@$$w0rd

Body Text:

It appears that, ($om3o1dP@$$w0rd), is your password. You might not know me and you are most likely wondering why you're getting this e-mail, right?

in fact, I put in place a malware on the adult videos (porno) web site and you know what, you visited this website to have fun (you know very well what I mean). During the time you were watching videos, your internet browser started out functioning as a RDP (Remote Desktop) which provided accessibility to your screen and web cam. and then, my software programs obtained all of your current contacts from your Messenger, Outlook, Facebook, in addition to emails.

What did I really do?

I produced a double-screen video. First part shows the recording you're seeing (you have a good taste haha . . .), and 2nd part shows the recording of your web cam.

what exactly should you do?

Well, in my opinion, $1100 is really a fair price for your little secret. You will make the payment by Bitcoin (if you don't know this, search "how to purchase bitcoin" search engines like google).

Bitcoin Address: [some scammers bitcoin address] (It's case sensitive, so copy and paste it)

Very important:
You've one day in order to make the payment. (I've a completely unique pixel within this e mail, and at this moment I know you have read through this email message). If I do not get the BitCoins, I will certainly send your videos to all of your contacts including relatives, co-workers, and so on. Having said that, if I get the payment, I'll destroy the recording immidiately. If you want evidence, reply with "Yes!" and i'll certainly send out your videos to your # contacts. It is a non-negotiable offer, that being said don't waste my personal time and yours by responding to this message.

This can be caused if you've changed your administrative account user to improve security on a server.

In order to resolve this issue you will need to stop the max view services in this order:

Then edit cimserver_planned.conf in your maxview storage manager, default path is:

C:\Program Files\Adaptec\maxView Storage Manager\pegasus\cimserver_planned.conf

open with text editor and alter the line from

enableAuthentication=true

to

enableAuthentication=false

It may look something like this: 

save and exit the conf file.

Now start the maxview Storage Manager services in this order:

Now you can login with your admin account correctly.

This can occur with with to many rdp connection attempts, someone may be trying to break into your computer/server. 

Check your resource monitor network usage, if you see many connections (10, 20+) with svchost.exe (termsvcs) then someone is attempting to break into the system.

Its best practice to limit RDP connections to specific IP addresses or via a VPN to prevent this. However, in some cases this may not be possible, so you may change the port number which may help mitigate the attack.

WARNING, Incorrectly editing your registry can cause your system to become non functional. Proceed at your own risk.

open regedit, and go to "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp" then select the PortNumber REG_DWORD entry and change the value data in Decimal to the new port number. Restart the service or system to make the change active.,

Solution #2

It can also be cause when a windows servers is running on vmware or hyper-v and in some cases with a stand alone server where hardware has changed. In most cases this error starts after virtual machine resource changes, or some windows updates.

The solution:

On the computer you are connecting to...

Open GPEdit

Then go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security

Then choose Require use of specific security layer for remote (RDP) connections

Enable > then choose Security Layer: RDP

Reboot the system.

Done.

note: I am not actually sure of the actual cause of this error, if someone has some details please share them below.