Use Sigcheck and VirusTotal to Scan Files for Malware

Sigcheck is a tool to check files digital signature, and recently is updated to auidt the root CA stores. And it can also be used to scan files for malware via VirusTotal.

Unless the -vs option is used, sigcheck only compares the hash of a file in VirusTotal’s database to determine whether the file contains malware.

• Download the latest version of Sigcheck (as of 01/26/2016, v.2.42)
• Unzip the zip file to a folder
• Open Command Prompt as Administrator, and change to the folder
• Run sigcheck.exe -vt, and enter y to agree the VirusTotal policy
• To scan a file: sigcheck.exe -v <filename>
• To upload a file that is not previously scanned to VirtualTotal; the file size is up to 128MB: sigcheck.exe -vs <filename>
• To scan a folder and subfolder: sigcheck.exe -v -s <foldername>
• To scan and create a CSV report: sigcheck.exe -v -s -c <foldername> > <report.csv>
• Check the VT detection column for the number of antivirus engine deteted a malware and used
• Open the URL in VT link in a browser to get the detail of the analysis - which antivirus engine and type of malware

Fix A VSAN Host Shows 0 of 0 Disks In Use

We have three hosts running on VSAN 6.1. Today the Disk Management in vSphere Client shows one of the hosts 0 of 0 Disk in Use.

And in VSAN General, it shows the warning of Mixed On-disk Format Version, and there is an upgrade button next to it. (Do Not Click It - I didn’t click it, and am not sure what the impact would be). Because our VSAN environment is built from scratch with VSAN 6.1, it is not upgrade from VSAN 5.5. It does not make sense the disk format requires an upgrade.

Troubleshoot

• Run VSAN Health check, everthing is green.

• The affected host shows all the disks under its Manage, Storage, Storage Devices.

Solution

• Click the first icon under Storage Devices to refresh the host’s storage information.

Now the Disk Management and On Disk Fromat are back to normal.

Configure ESXi Network Dump Collector

When booting the ESXi from a SD, you probably need to reconfigure the ESXi dump collector location to a persistent datastore or a network dump collector.

The reason is the ESXi installer puts the scratch partition in “/tmp/scratch” on the local ramdisk. see the quote below from Booting ESXi off USB/SD.

3.  Where does the scratch partition get placed when booting from USB?

Because USB/SD devices are sensitive to high amounts of I/O the installer will not place the scratch partition on a USB/SD device.  Instead, the installer first scans for a local 4GB vfat partition, if it doesn’t find one it will then scan for a local VMFS volume on which to create a scratch directory.  If no local vfat partition or VMFS volume is found, as a last resort the installer will put the scratch partition in “/tmp/scratch” (i.e. put scratch on the local ramdisk).  If this happens it’s a good idea to manually reconfigure the scratch partition after the install.

The persistent store can be any available datastore (NFS, FC, iSCSI, local), except the VSAN datastore. If the ESXi host is a VSAN host, it’s likely you need to use the network dump collector instead of the persistent datastore.

There are two parts to set up the network dump collector:

1. On the VCSA: Enable VMware vSphere ESXi Dump Collector service via vSphere Web Client
• Administration, System Configurations, Services, VMware vSphere ESXi Dump Collector
• Actions, Edit Startup Type, Automatic
• Actions, Start
• Note: the coredump file location is /var/core/netdumps
2. On each ESXi host:
• SSH to the ESXi host
• esxcli system coredump network get
• esxcli system coredump network set --interface-name <vmk0> --server-ipv4 <VCSA-IP-Address> --server-port 6500
• esxcli system coredump network set --enable true
• esxcli system coredump network check
• or check the VCSA log file /var/log/vmware/netdumper/netdumper.log
• /sbin/auto-backup.sh
• to save the configuration file to persist after a reboot

See more info from “Booting ESXi off USB/SD”, KB2002955, Configure and Test of ESXi Dump Collector.

Use Telnet to Send HTTP Request

• Launch Command Prompt
• telnet <web-server> <port>
• HEAD / HTTP/1.0
• press Enter twice

Or

• Launch Command Prompt
• telnet <web-server> <port>
• GET / HTTP/1.1
• host: <web-server-hostname>
• press Enter twice

Note: the HTTP commands in bold are case-sensitive, must be entered in the uppercase.

Removing Snapshots Can Cause VM Unresponsive

The first thing to remember is not to keep a VM snapshot for a long time – e.g. a few days for a busy VM. Because it

• Can impact the VM performance and
• Can cause the VM unresponsive when removing the snapshot (see KB1002836)

The second thing to remember is that removing or consolidating VM snapshots (particular a VM with a large snapshot file) when the VM is not busy.

Roll Back to A Previous Version of ESXi

Here are the steps to roll back to a perviouse version of ESXi: (source: KB1033604)

1. Reboot the ESXi host
2. When the hypervisor progress bar starts loading, press Shift + R.
3. On the pop-up warning message “Current hypervisor will permanently be replaced with build: X.X.X-XXXXXX. Are you sure? [Y/n]”
4. Press Shift + Y to roll back the build
5. Press Enter to boot

Extend a Logical Drive in Windows Server 2008 R2

I recently successfully P2V a Windows Server 2008 R2 physical server to a vSphere VM. The server has two drives (Drive C and D), and both of drives were originally on one RAID 5 LUN. I didn’t know how the drives were originally created on the physical server, e.g.  whether Drive D is a primary partition or a logical drive on an extended partition.

When the Drive D starts low on the free disk space, I thought it’s very simple to extend a drive since the server is running Windows Server 2008.

• I increase the size of hard disk 1 on the VM (both Drive C and D are on the hard drive) while the server is on
• In Wndows Disk Management, rescan disks and then the extra unallocated disk space is showed
• At this point, I noticed Drive D is a logical drive on an extended parition. I normally create the drive on the primary partition.
• When right-click on the logical drive, the “Extend Volume” option is grayed out.
• I had extended a non-OS drive in Windows Server 2008 via GUI before; and for Windows Server 2003, I had to use the diskpart utility.
• Why I cannot extend this drive? Is it because it’s a logical drive on an extended partition? I’m not sure.
• I know there are some third-party utilities can resize the partition. But I don’t have them handy.
• Finally, I want to try the diskpart utility.
  • First, I tried extending the extended partition. It didn’t work. (see the yellow highlight)
  • Next, I tried extending the logical partition directly. It worked. (see the green highlight)

  C:\Windows\system32>diskpart

  Microsoft DiskPart version 6.1.7601
  Copyright (C) 1999-2008 Microsoft Corporation.
  On computer: AVLDB

  DISKPART> list disk

    Disk ###  Status         Size     Free     Dyn  Gpt
    --------  -------------  -------  -------  ---  ---
    Disk 0    Online          360 GB  1024 KB

  DISKPART> select disk 0

  Disk 0 is now the selected disk.
   
  DISKPART> list partition

    Partition ###  Type              Size     Offset
    -------------  ----------------  -------  -------
    Partition 1    OEM                 40 MB  1024 KB
    Partition 2    Primary           3072 MB    41 MB
    Partition 3    Primary             60 GB  3113 MB
    Partition 0    Extended           200 GB    63 GB
    Partition 4    Logical            200 GB    63 GB

  DISKPART> select partition 0

  Partition 0 is now the selected partition.

  DISKPART> extend

  There is no volume selected.
  Please select a volume and try again.

  DISKPART> list partition

    Partition ###  Type              Size     Offset
    -------------  ----------------  -------  -------
    Partition 1    OEM                 40 MB  1024 KB
    Partition 2    Primary           3072 MB    41 MB
    Partition 3    Primary             60 GB  3113 MB
  * Partition 0    Extended           200 GB    63 GB
    Partition 4    Logical            200 GB    63 GB

  DISKPART> select partition 4

  Partition 4 is now the selected partition.

  DISKPART> extend

  DiskPart successfully extended the volume.