Translate

Saturday, February 22, 2014

Create Backups of Virtual Machines in Windows Azure by using PowerShell


Microsoft Scripting Guy, Ed Wilson, is here. Welcome back Keith Mayer as our guest blogger today. This is Part 1 of a two-part series. In Part 2, we’ll restore virtual machines in Windows Azure from these backups.
Photo of Keith Mayer
Keith Mayer is a senior technical evangelist at Microsoft, and he focuses on the Windows infrastructure, datacenter virtualization, systems management, and the private cloud. Keith has over 20 years of experience as a technical leader of complex IT projects, in diverse roles, including network engineer, IT manager, technical instructor, and consultant. He has consulted and trained thousands of IT professionals worldwide on the design and implementation of enterprise technology solutions.
You can find Keith online at http://KeithMayer.com.
Windows Azure Infrastructure Services provides the ability to easily provision or migrate storage, virtual machines, and virtual networks to the global Windows Azure cloud platform by using a cost-effective Pay-As-You-Go model. In my prior Weekend Scripter posts, Getting Started with Windows Azure and PowerShell and Remoting the Cloud with Windows Azure and PowerShell, I provided an introduction to using Windows PowerShell for automated provisioning of Windows Azure cloud fabric resources and workloads running inside virtual machines in Windows Azure.
Once you’ve provisioned a few lab virtual machines on Windows Azure, you’ll likely want to create a backup copy of each virtual machine. This is particularly useful in test lab scenarios, so that you can quickly revert virtual machines back to a known state prior to performing a set of tests.
When you are working in the on-premises world, this is typically performed via virtual machine backup, snapshot, or checkpoint capabilities. In Windows Azure, back up and restore of virtual hard disks can be quickly performed in the cloud with the Windows Azure PowerShell Module by leveraging the Start-AzureStorageBlobCopy cmdlet. However, there’s a bit of work we’ll need to do upfront to capture the information we’ll need for completing this process.
In this post, we’ll step through the process of building a Windows PowerShell script to back up virtual machines in Windows Azure. At the end of this post, I’ve provided a link to the next step, restoring virtual machines in Windows Azure, so that you’ll have the complete end-to-end process.
To back up virtual machines in Windows Azure, we’ll step through the following tasks:
  • Select a virtual machine to back up
  • Identify each virtual hard disk
  • Create a cloud storage container for storing backups
  • Back up virtual machines to cloud storage in Windows Azure
Note  To learn more about the basics of Windows Azure Infrastructure Services, you might also be interested in the “Early Experts” Cloud Quest and our scenario-based Cloud Labs step-by-step guides. Both are free online study resources that provide hands-on lab exercises for leveraging Windows Azure and building key IT pro cloud scenarios.

Select virtual machine to back up

The virtual machine you want to back up and restore can be selected by using the Get-AzureVM cmdlet. Running Get-AzureVM alone returns a list of virtual machines that are currently provisioned in Windows Azure.
Image of command output
  Get-AzureVM cmdlet output
To select a particular virtual machine, you can pass the ServiceName and Name values as parameters and set the output to a new Windows PowerShell variable.
Image of command output
  Selecting a Windows Azure virtual machine
Now our selected Windows Azure virtual machine can be referenced by using the variable $vm in the remainder of our script.
To capture a valid backup of each virtual hard disk, we also need to temporarily shut down the virtual machine to a state where the virtual machine is not running, but its configuration is kept in a provisioned state. We can accomplish this with the Stop-AzureVM cmdlet.
Image of command output
  Using Stop-AzureVM with the StayProvisioned parameter
Now that our virtual machine is selected and in the right state, we can proceed to the next step of finding each virtual hard disk we want to back up and restore.

Identify virtual hard disks

Virtual machines in Windows Azure can be provisioned with two general types of virtual hard disks: operating system disks and data disks. Each virtual machine will have one operating system disk from which it boots and runs the operating system. In addition, each virtual machine can have one or more additional data disks on which program code and data files can be stored. To perform a complete virtual machine backup, we’ll need to locate all of the virtual hard disks that our virtual machine is currently using.
To store the location for the operating system disk, we can use the Get-AzureOSDisk cmdlet.
Image of command output
  Locating the virtual machine operating system disk with Get-AzureOSDisk
For any virtual hard disk that we want to back up or restore, the two property values in which we’ll be most interested are the DiskName and MediaLink values, which are shown in the following image. These values provide the information that we’ll need to properly back up and restore each virtual hard disk that is associated with a virtual machine.
Image of command output
  Common property values for a Windows Azure virtual hard disk
To store the location for all data disks, we can use the Get-AzureDataDisk cmdlet. Because virtual machines can be provisioned with multiple data disks, this cmdlet returns of a collection of data virtual hard disks.
Image of command output
  Storing location for data disks with the Get-AzureDataDisk cmdlet

Create cloud storage container for storing backups

Prior to performing a backup, we’ll need to make sure that a container exists in our Windows Azure Storage Account to store these backup copies. First, we’ll need to determine the name of our Windows Azure Storage Account. We can do this by leveraging the MediaLink property of Azure Disks mentioned earlier.
Image of command output
  Determining the name of Windows Azure Storage Account by using MediaLink property
Now that we know the name of our Windows Azure Storage Account, we’ll want to set it as the current storage account for the remainder of our script by using the Set-AzureSubscription cmdlet.
Image of command output
  Setting the current storage account
Next, we can easily check to see if our desired container location for storing backups already exists inside our storage account, and if not, we can quickly create it by using the New-AzureStorageContainer cmdlet.
Image of command output
  Creating a new Windows Azure storage container
We can confirm that the new storage container has been created by using the Get-AzureStorageContainer cmdlet without parameters.
Image of command output
  Confirming creation of storage container with Get-AzureStorageContainer cmdlet
Now, we’re ready to back up our virtual machine!

Back up virtual machines in Windows Azure to cloud storage

To create a backup copy of the operating system disk on our virtual machine, we’ll first set the values for a couple variables that identify the blob and container names for the virtual disk that we want to back up. Then, we’ll use the Start-AzureStorageBlobCopy cmdlet to begin the copy process to our previously defined backup container location.
Image of command output
  Using Start-AzureStorageBlobCopy cmdlet to back up virtual hard disk
It’s important to note that the copy process performed by the Start-AzureStorageBlobCopy cmdlet is asynchronous in nature, and it runs in the background on the Windows Azure platform. To ensure that the copy process has completed before continuing with the next line in a script, we can use the Get-AzureStorageBlobCopyState cmdlet to wait until the copy process is finished.
Image of command output
  Using Get-AzureStorageBlobCopyState to confirm that the copy process completed
To back up our Windows Azure data disks, we’ll use a similar set of cmdlets, but we’ll run them inside a ForEach loop because Windows Azure data disks are returned as a collection.
Image of command output
  Back up data disks by using ForEach loop
After the backup process has completed, use the Get-AzureStorageBlob cmdlet to confirm that a copy of each virtual hard disk now exists in the backup storage container location.
Image of command output
  Using Get-AzureStorageBlob to confirm backup copies
Our backup process is complete, and we can now restart the Windows Azure virtual machine by using the Start-AzureVM cmdlet.
Image of command output
  Using Start-AzureVM to restart virtual machine after back up is complete
Congratulations! But keep learning!
You’ve completed the process for creating cloud backups of virtual machines in Windows Azure with Windows PowerShell! You can use the cmdlets and snippets in this post to quite easily build an automated approach to capture a backup of each Windows Azure virtual machine in your subscription, perhaps on a nightly basis.
In Part 2 of this series, we’ll walk through the process of restoring virtual machines in Windows Azure from these backups so that you can automate the complete end-to-end backup and restore process.
In addition, you may want to leverage these resources to continue your learning about Windows Azure Infrastructure Services:
Thank you, Keith, for sharing your time and knowledge.
I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.
Ed Wilson, Microsoft Scripting Guy

Monday, January 6, 2014

Sao lưu: Incremental hay Differential?


Một số các bạn có thói quan sao lưu dữ liệu (backup) – vậy thì quá tốt – bởi vì tôi đã gặp rất nhiều người hỏi cùng 1 câu hỏi: làm sao cứu dữ liệu của tôi – 80% đã quá trễ, 20% tốn từ 2tr đến 4tr để cứu những gì có thể cứu được. Do vậy, “backup or die”.
Các bạn nếu có dùng phần mềm backup sẽ hay nghe nói phần mềm này rất chuyên nghiệp, có tính năng backup “Incremental” và “Differential”. Vậy thì 2 thuật ngữ này là gì?
Về cơ bản, có 3 phương pháp backup: Full, Differential, và Incremental.
1. Full backup
Tên như người – nghĩa là backup tất cả
Ví dụ minh họa:
  • Bạn có 1 file text A.txt nội dung là 1 2 3 4
  • Bạn cấu hình Full backup hằng ngày vào buổi tối – phần mềm backup sẽ sao lưu y chang File đó mỗi ngày
Lợi điểm:
  • Dễ phục hồi dữ liệu (restore).
Ví dụ minh họa như trên:
Giả sử bạn cần phục hồi dữ liệu về thời điểm Thứ Bảy: Bạn chỉ cần 1 bản Full backup của tối Thứ Bảy
Bất lợi:
  • Tốn thời gian và dung lượng backup.
Tưởng tượng bạn có 10TB dữ liệu – mỗi bản Full backup lại 10TB nữa, 1 tuần backup mất 70TB – quá nhiều.
Trong thực tế, không áp dụng Full backup hằng ngày cho khối lượng dữ liệu lớn.
2. Differential backup
Backup những gì thay đổi so với lần Full backup gần nhất
image
Ví dụ minh họa:
  • File text A.txt có nội dung 1 2 3 4
  • Cấu hình backup: Full backup vào Chủ Nhật, Differential backup vào Thứ Hai, Thứ Ba, Thứ Tư, Thứ Năm, Thứ Sáu, và Thứ Bảy.
Giả sử Thứ Hai bạn sửa nội dung A.txt thành 1 2 3 4 5 –> Differential backup sẽ chỉ sao lưu phần thay đổi: 5
Giả sử Thứ Ba bạn sửa nội dung A.txt thành 1 2 3 4 5 6 –> Differential backup sẽ chỉ sao lưu phần thay đổi: 5 6
Lợi điểm:
  • Tiết kiệm thời gian và dung lượng backup.
  • Restore nhanh hơn so với Full backup
Bất lợi:
  • Restore cần đủ file: 1 File Full backup lần gần nhất và 1 File Differential backup vào thời điểm cần restore
Ví dụ minh họa nêu trên:
Giả sử bạn cần restore file về thời điểm Thứ Ba – bạn cần có file Full Backup của Chủ Nhật Differential backup của Thứ Ba
3. Incremental backup
Backup những gì thay đổi so với lần Incremental backup gần nhất
image
Ví dụ minh họa:
  • File text A.txt có nội dung 1 2 3 4
  • Cấu hình backup: Full backup vào Chủ Nhật, Incremental backup vào Thứ Hai, Thứ Ba, Thứ Tư, Thứ Năm, Thứ Sáu, và Thứ Bảy.
Giả sử Thứ Hai bạn sửa nội dung A.txt thành 1 2 3 4 5–> Incremental backup sẽ chỉ sao lưu phần thay đổi: 5
Giả sử Thứ Ba bạn sửa nội dung A.txt thành 1 2 3 4 5 6 –> Incremental backup sẽ chỉ sao lưu phần thay đổi: 6
Lợi điểm:
  • Tốn ít thời gian và dung lượng sao lưu nhất.
Bất lợi:
  • Restore cần đủ file: 1 File Full backup lần gần nhất và tất cả các File Incremental backup từ thời điểm Full backup đến thời điểm cần restore
  • Restore lâu hơn so với Differential Backup.
Ví dụ minh họa nêu trên:
Giả sử bạn cần restore file về thời điểm Thứ Ba – bạn cần có file Full Backup của Chủ Nhật Incremental backup của Thứ Hai Incremental backup của Thứ Ba
Trong thực tế, cấu hình backup phổ biến nhất là:
  • Full Backup hàng tháng.
  • Differential Backup hàng tuần.
  • Incremental Backup hàng ngày.
Chúc các bạn luôn an toàn trên xa lộ thông tin :).

SBS 2008 Using the POP Connector


To access the Windows Small Business Server POP3 Connector properties
  1. Open the Windows SBS Console.
  2. On the navigation bar, click Network.
  3. Click the Connectivity tab.
    The list view displays information about your network connections.
  4. In the list view, click POP3 Connector.
  5. In the Tasks pane, click View POP3 Connector properties.
To view error messages for the POP3 Connector
  1. Click Start, type eventvwr, and then press ENTER.
  2. In the console tree, expand Applications and Service Logs.
  3. Expand Windows Small Business Server 2008, and then select Microsoft Windows Small Business Server/Operational.
    The details pane displays error and event messages for Windows SBS 2008 including error messages from the POP3 Connector.

How to increase the Exchange Server 2003 Service Pack 2 database size limit


Link to original Microsoft article:
http://support.microsoft.com/kb/912375/


How to increase the Exchange Server 2003 Service Pack 2 database size limit



To increase the Exchange Server 2003 SP2 database size, follow these steps.

Important Before you increase the maximum size of an Exchange database, verify that sufficient hard disk space is available for the larger database.
  1. On the computer that is running Exchange 2003 SP2, click Start, click Run, type regedit, and then click OK.
  2. Click one of the following registry subkeys, as appropriate for the store that you want to increase:
    • For a mailbox store, click the following registry subkey:
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\Server name\Private-Mailbox Store GUID
    • For a public folder store, click the following registry subkey:
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\Server name\Public-Public Store GUID
  3. On the Edit menu, point to New, and then click DWORD Value.
  4. In the New Value #1 box, type Database Size Limit in Gb, and then press ENTER.
  5. Right-click Database Size Limit in Gb, and then click Modify.
  6. Click Decimal, and then type an integer from 1 to 75 in the Value data box.

    Note These integer values represent the maximum size of the database in gigabytes (GB). For example, a value of 75 represents a database that has a maximum size of 75 GB.
  7. Click OK, and then exit Registry Editor.
  8. Restart the Microsoft Exchange Information Store service. To do this, follow these steps:
    1. Click Start, click Run, type cmd, and then click OK.
    2. At the command prompt, type the following command, and then press ENTER:
      net stop msexchangeis
    3. After the Microsoft Exchange Information Store service has stopped successfully, type the following command, and then press ENTER:
      net start msexchangeis
  9. Examine the Application log to verify that the database size has been set successfully. To do this, follow these steps:
    1. Click Start, click Run, type eventvwr, and then click OK.
    2. In the Event Viewer tool, click Application.
    3. Double-click event ID 1216 to verify that the database size has been set successfully.

To determine if you're running Exchange Server 2003 SP2:

  1. Open Exchange System Manager
  2. Expand 'Servers'
  3. Right-click on [server name], choose Properties
  4. On the General tab, verify that the version is Version 6.5 (Build 7638.2: Service Pack 2)

Fix Outlook 2007 Certificate Errors


For SBS 2008 run the following commands in Exchange Management Shell:
Set-ClientAccessServer -Identity yourserver -AutodiscoverServiceInternalUri https://external.yourdomain.com/autodiscover/autodiscover.xml
Set-WebServicesVirtualDirectory -Identity “yourserver\EWS (SBS Web Applications)” -InternalUrl https://external.yourdomain.com/ews/exchange.asmx
Set-OABVirtualDirectory -Identity “yourserver\oab (SBS Web Applications)” -InternalUrl https://external.yourdomain.com/oab
Set-UMVirtualDirectory -Identity “yourserver\unifiedmessaging (SBS Web Applications)” -InternalUrl https://external.yourdomain.com/unifiedmessaging/service.asmx

For Exchange 2007 Standard or Enterprise on Windows Server 2008 run the following commands in Exchange Management Shell:
Set-ClientAccessServer -Identity yourserver -AutodiscoverServiceInternalUri https://external.yourdomain.com/autodiscover/autodiscover.xml
Set-WebServicesVirtualDirectory -Identity “yourserver\EWS (Default Web Site)” -InternalUrl https://external.yourdomain.com/ews/exchange.asmx
Set-OABVirtualDirectory -Identity “yourserver\oab (Default Web Site)” -InternalUrl https://external.yourdomain.com/oab
Set-UMVirtualDirectory -Identity “yourserver\unifiedmessaging (Default Web Site)” -InternalUrl https://external.yourdomain.com/unifiedmessaging/service.asmx
If you’re not sure which set of commands to use, type Get-WebServicesVirtualDirectory in Exchange Management Shell and see what is listed for name. You will either see EWS (SBS Web Applications) or EWS (Default Web Site). Match that up with the command set above and it should find the appropriate virtual directories.
On Windows Server 2008, if you see access denied errors then make sure you use Run As Administrator to run Exchange Management Shell.

Exchange 2007 Autodiscover Issues


Exchange 2007 Autodiscover Issues

Microsoft Exchange 2007We have recently begun installing a lot of Exchange 2007 servers, both Exchange 2007 standard and as part of SBS 2008. Starting with Exchange 2003 there is a lot of reliance on the web services part of the server which reside in IIS. In order to get things working properly we get a SSL certificate, usually from GoDaddy, to secure the exchange directories. This allows us to set up devices with Exchange Activesync, OWA without certificate warnings, and Outlook Anywhere.
We’ve noticed that when installing these certificates, Outlook clients on the domain begin to see a certificate error. This is because of the Autodiscover URLs that are part of Exchange server and the fact they no longer match the self-signed certificate that Exchange produces on installation.
In order to update those URLs you need to use Exchange Management Shell to run some commands. The commands are different for SBS installations and Standard installations. In the following commands, replace yourserver with the netbios name of your Exchange server and external.yourdomain.com with the external address of your server.
For SBS 2008 run the following commands in Exchange Management Shell:
Set-ClientAccessServer -Identity yourserver -AutodiscoverServiceInternalUri https://external.yourdomain.com/autodiscover/autodiscover.xml
Set-WebServicesVirtualDirectory -Identity “yourserver\EWS (SBS Web Applications)” -InternalUrl https://external.yourdomain.com/ews/exchange.asmx
Set-OABVirtualDirectory -Identity “yourserver\oab (SBS Web Applications)” -InternalUrl https://external.yourdomain.com/oab
Set-UMVirtualDirectory -Identity “yourserver\unifiedmessaging (SBS Web Applications)” -InternalUrl https://external.yourdomain.com/unifiedmessaging/service.asmx
For Exchange 2007 Standard or Enterprise on Windows Server 2008 run the following commands in Exchange Management Shell:
Set-ClientAccessServer -Identity yourserver -AutodiscoverServiceInternalUri https://external.yourdomain.com/autodiscover/autodiscover.xml
Set-WebServicesVirtualDirectory -Identity “yourserver\EWS (Default Web Site)” -InternalUrl https://external.yourdomain.com/ews/exchange.asmx
Set-OABVirtualDirectory -Identity “yourserver\oab (Default Web Site)” -InternalUrl https://external.yourdomain.com/oab
Set-UMVirtualDirectory -Identity “yourserver\unifiedmessaging (Default Web Site)” -InternalUrl https://external.yourdomain.com/unifiedmessaging/service.asmx
If you’re not sure which set of commands to use, type Get-WebServicesVirtualDirectory in Exchange Management Shell and see what is listed for name. You will either see EWS (SBS Web Applications) or EWS (Default Web Site). Match that up with the command set above and it should find the appropriate virtual directories.
On Windows Server 2008, if you see access denied errors then make sure you use Run As Administrator to run Exchange Management Shell.
At this point, we have solved problems with Autodiscover that resulted in error messages in Outlook clients but have not actually set up Autodiscover. The Autodiscover setup process usually includes setting up a new site in IIS for autodiscover.yourdomain.com and adding the autodiscover virtual directory to it. You’ll also need a SSL cert for it which is why we don’t usually set it up. We have yet to see any advantages to setting up Autodiscover since our clients usually don’t have that many clients connected to their Exchange server.

Exchange - Build Numbers and Release Dates


Version                          Build number              Release date

Server  4.0                      4.0.837                   April 1996
Server  4.0 (a)                  4.0.993                   August 1996
Server  4.0 SP1                  4.0.838                   May 1996
Server  4.0 SP2                  4.0.993                   August 1996
Server  4.0 SP3                  4.0.994                   November 1996
Server  4.0 SP4                  4.0.995                   April 1997
Server  4.0 SP5                  4.0.996                   May 1998

Server  5.0                      5.0.1457                  March 1997
Server  5.0 SP1                  5.0.1458                  June 1997
Server  5.0 SP2                  5.0.1460                  February 1998

Server  5.5                      5.5.1960                  November 1997
Server  5.5 SP1                  5.5.2232                  July 1998
Server  5.5 SP2                  5.5.2448                  December 1998
Server  5.5 SP3                  5.5.2650                  September 1999
Server  5.5 SP4                  5.5.2653                  November 2000

2000 Server                      6.0.4417                  October 2000
2000 Server (a)                  6.0.4417                  January 2001
2000 Server SP1                  6.0.4712                  July 2001
2000 Server SP2                  6.0.5762                  December 2001
2000 Server SP3                  6.0.6249                  August 2002
2000 Server post-SP3             6.0.6487                  September 2003
2000 Server post-SP3             6.0.6556                  April 2004
2000 Server post-SP3             6.0.6603                  August 2004

Server  2003                     6.5.6944                  October 2003
Server  2003 SP1                 6.5.7226                  May 2004
Server  2003 SP2                 6.5.7638                  October 2005

Server  2007                     8.0.685.24 or 8.0.685.25  December 2006
Server  2007 SP1                 8.1.0240.006              November 2007

Changing SBS 2008 Exchange Mailbox Limits


In Windows SBS 2008, the mailbox database and the individual mailboxes have a size limit of 2 GB. If the size limit of the mailbox database or the individual mailboxes on the Source Server is more than 2 GB, you must manually change the size limits on the Destination Server
To change the size limit of the mailbox database
  1. On the Destination Server, click Start, click All Programs, click Microsoft Exchange Server 2007, and then click Exchange Management Console.
  2. Click Continue in the User Account Control dialog box.
  3. In the Exchange Management Console navigation pane, expand the Server Configuration node, and then click Mailbox.
  4. In the result pane, click the Destination Server name.
  5. In the work pane, right-click Mailbox Database, and then click Properties.
  6. Click the Limits tab, specify the mailbox database limits, and then click OK.
To change the size limit of the individual mailboxes
  1. On the Destination Server, open the Windows SBS Console.
  2. In the navigation bar, click the Users and Groups tab, and then click Users.
  3. Click a user account, and then click Edit user account properties.
  4. Click the E-Mail tab, update the maximum mailbox size information, and then click OK.
  5. Repeat steps 3 and 4 until all user accounts are updated.

Changing Exchange 2003 Message Size Limits


To change the default limits for sending and receiving message size
  1. In Exchange System Manager, expand Global Settings. Right-click Message Delivery and then click Properties.
  2. Select the Defaults tab.
  3. Change the limits for Sending Message Size and Receiving Message Size.
To change the size limit of the individual mailboxes
  1. On the Exchange Server, open Active Directory Users and Computers.
  2. Select the user for which you would like to change message size limits, then right-click and click Properties.
  3. Select the Exchange General tab.
  4. Click on Delivery Restrictions.
  5. Set the Sending Message Size and Receiving Message Size and click OK.

Malware Removal Tools


The following is a listing of most common virus/malware/rootkit removal tools:

General Removal Tools

Malwarebytes' Anti-Malware: http://www.majorgeeks.com/MBAM_d5756.html

A very good free malware scanner. It will find and remove most types of malware automatically.

Trend Micro HijackThis: http://free.antivirus.com/hijackthis/

HijackThis is a malware scanner and removal tool that can find and remove Browser Helper Objects, auto run processes, and malware services.

ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

ComboFix is a malware scanner and removal tool that can remove most types of malware.

Rootkit Removal Tools

Sophos Anti-Rootkit: http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Sophos Anti-Rootkit is a malware scanner and removal tool. It scans for hidden files, registry keys, and running processes that can indicate a rootkit.

Malware Scanners

GMER: http://gmer.net/download.php

GMER is a thorough malware scanner only. It assists in finding hidden rootkits.

RootRepeal: http://download.bleepingcomputer.com/rootrepeal/RootRepeal.exe

RootRepeal is another malware scanner and reporting tool.

Sysinternals RootkitRevealer: http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

Rootkit Revealer is a malware scanner that compares API results from user mode and kernel mode calls that may indicate a rootkit is hiding itself.

Specific Malware Removal Tools

Kaspersky TDSSKiller: http://support.kaspersky.com/viruses/solutions?qid=208280684

Assists in removal of TDSS related rootkits.

Trend Micro CWShredder: http://free.antivirus.com/cwshredder/

CWShredder is a malware scanner and removal tool specifically targeted at removing CoolWebSearch

GooRedFix: http://forums.majorgeeks.com/showthread.php?t=182559

GooRedFix is a maleware scanner that looks for browser redirection malware.

 
Design by IT Manager | Bloggerized by Themes For IT Managers | MIS-DUONG