Revisions for Version 4.8.0.0

(Released August 27, 2007)

Modules Added:

  • Frequent Fixes and Solutions (FFS)
  • Super Magical Registry Tool (SMRT) (available via FFS)
  • Online knowledge base for FFS (Accessible via https://sp.bestbuy.com/ret/vista/MRI/FFS/default.aspx)

Features Added:

  • Field Notes Generator
    • Added full support for the APER portion of the Field Notes Template. This stands for Assess, Perform, Educate, and Recommend. A, P, and E, existed in all previous versions of the Field Notes Generator as Situation Report, Mission Briefing, and Debriefing respectively. The Recommend portion is covered by the new Post-op Advocation section where you can document any recommendations made to the client.


Revisions for Version 4.7.1.0

(Released May 31, 2007)

Bug Fixes:

  • File Manager On Duty
    • File copy/deletion bug where MRI.EXE would crash when copying files with long file names. Some examples are::
      • Copying a folder on the client’s desktop [x:\Documents and Settings\%user%\Desktop\folder1\folder2\folder3\file] to another location [c:\Documents and Settings\%user%\Desktop\folder])
      • Copying a user profile directory without clearly temporary files first


Revisions for Version 4.7.0.0

(Released April 30, 2007)

Modules Added:

  • Added SAMurai Password Reset Utility to MRI PE (Tools => SAMurai Password Reset)
  • Added Window Identifier (Tools => Window Identifier)
  • Created Winsock Fix (Tools => Winsock Fix)
  • Expanded upon Windows Utilities section in Agent Toolbox
  • Added Uninstall Manager (including sorting and automatic refreshing)

Features Added:

  • Full Windows Vista/PE 2.0 support
  • L.A.S.E.R.
    • Added Spyware Doctor
  • File Manager On Duty
    • Comprehensive drag and drop support.

Bug Fixes:

  • General
    • Changed hotkeys for incrementing and decrementing the current navigation category from Ctrl+Right and Ctrl+Left to Ctrl+PgDn and Ctrl+PgUp respectively. This was to accomodate the standard edit control hotkeys of Ctrl+Right and Ctrl+Left which move the cursor to the next and previous word. The most notable impact of this fix is when using these hotkeys in the Field Notes Generator.
  • File Manager On Duty
    • Removed redundant prompt when creating a new folder and changing the default folder name.move the cursor to the next and previous word.


Revisions for Version 4.6.1.0

(Released January 24, 2007)

Expiration Date:

  • Updated expiration date

Bug Fixes:

  • Startup Manager

    • Fixed bug causing Startup Manager to crash in a seemingly random manner. The crash can be attributed to startup commands that have an opening quotation mark around the path to the file, but do not have a closing quotation mark. If you have seen Startup Manager crash while enumerating entries, it is very likely that this bug was the culprit.

  • Temp File Cleaner
    • Fixed bug that could cause the Temp File Cleaner to scan the current user account multiple times on systems with multiple hard drives if "Scan Only Current User" was selected in the preferences.


Revisions for Version 4.6.0.0

(Released October 30, 2006)

Modules Added:

  • Added Field Notes Generator
  • Added Product Key Viewer

Features Added:

  • Process Analyzer:
    • Added lower pane window to view process details.
    • Added color coding.
  • File Manager On Duty
    • Added full Cut and Paste functionality. This includes pasting files that were cut by Windows Explorer (or other file management utility), and cutting files within F-MOD in a way that allows them to be correctly pasted by Windows Explorer.
    • Added "Open", "Open With", and "Open Command Prompt Here" and "New Folder" to context menu.
    • Added full functionality to the address bar.
    • Added Favorites menu with shortcuts to common folders.
    • Added heuristic based estimation of the time remaining for the current file operation to file progress dialog.
    • Added the ability to horizontally split the window into two panes for easier file transfers (drag and drop is not implemented, but is coming soon).
    • The list on the right now only refreshes after an item in the tree has been selected for at least 200 ms. This dramatically improves the performance of F-MOD when quickly traversing up or down the tree because the list does not have to refresh on every item that becomes selected.
  • Startup Manager
    • Added user account picture extraction. The tree on the left now displays a small icon representing the user account picture so that it is easier to identifiy users.
    • Added the ability to ignore "DllDirectory" as a startup item in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDlls
  • Agent Toolbox
    • Added dynamic updating to the menu so that it does not have to be reopened to refresh as files are located within the MRI disc structure.
    • Changed "Browse MRI..." option to open with F-MOD instead of Windows Explorer (other "Browse to..." links throughout application will be similarly modified in the future).
  • MRI Desktop Information
    • Added the ability to display Workgroup name if desired.
  • Command Line Scanner Configuration Wizards
    • Added "/TMAPTN" switch as a default for VScanTM.
  • Temp File Cleaner
    • Added support to clean two Java cache folders across all user accounts.

Bug Fixes:

  • L.A.S.E.R.
    • Fixed major L.A.S.E.R. bug where ntldr would report that hal.dll was missing or corrupt when booting to MRI Safe Mode. This could occur when:
      • The system had multiple partitions on the drive containing the Windows directory, AND...
      • The Windows directory was not on the primary partition, AND...
      • The value "SystemBootDevice" was not present in "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" (Windows 2000, XP pre-SP2).
    • Fixed bug causing HijackThis to remain as an entry in Add/Remove Programs after the L.A.S.E.R. operation was completed
    • Fixed bug causing the process that enables the connection for Black Ops agents to be terminated (L.A.S.E.R. saw it as a "non-critical" process).
  • File Manager On Duty
    • Fixed multiple F-MOD bugs that were causing the tree on the left to respond extremely slowly. This has led to a dramatic overall speed improvement in F-MOD.
    • Fixed two bugs in F-MOD's "My Computer" view. The first was drive letters were able to be renamed in the interface (it did not actually remap drive letters, it would merely appear that the letter was changed). Drive letters now cannot be renamed. The second bug was that selecting Properties in the context menu did not display the properties for the selected drive.
    • Fixed bug in F-MOD where the tree on the left would only refresh the folders but not the drives. On a refresh F-MOD will now remove any drives that are no longer present and add any drives that have been added to the system.
    • Fixed bug where F-MOD would enable the context menu options to delete, rename, cut, and paste files/folders to or from a non-writable medium. F-MOD now checks if the medium is writable and enables the items accordingly.
    • Fixed bug where right-clicking a folder in the tree view and then right-clicking a second such folder would not reopen the context menu for the newly selected folder.
  • Process Analyzer
    • Fixed bug that would occur when Windows would reassign a process ID to a newly created process that was previously assigned to the parent of an existing process. This would cause Process Analyzer to sort the list incorrectly, making it appear as though the newly created process was somehow the parent of the existing process.
  • Temp File Cleaner
    • Fixed bug that would allow the checkboxes to change states while a deletion operation was in progress (the checkboxes now become grayed out).
    • Fixed bug that could cause the Size column of the Temp File Cleaner's window to display a very large positive number of gigabytes if the number dipped below zero.
  • Command Line Scanner Configuration Wizards
    • Fixed bug where selecting a specific folder to scan would not enclose the folder path in quotes.
    • Fixed bug where unchecking all drives would still prompt that "at least one drive must be selected" when "Scan Logical Drives" was not selected.


Revisions for Version 4.5.1.0

(Released August 22, 2006)

Features Added:

  • Added debug log generator to LASER.

Bug Fixes:

  • Fixed F-MOD file/directory copying bug where neither file attributes nor file timestamps were copied correctly.
  • Fixed F-MOD bug causing it to be unable to delete directories with the read-only attribute.
  • Fixed the way in which Eurosoft's QA+Win32 is launched so that it does not fail in MRI PE.
  • Fixed the way in which McAfee's command line scanner is launched so that it does not hang while scanning x:\i386 in MRI PE.
  • Updated the definitions link for ewido 4.0 so that it applies the full set of updates.


Revisions for Version 4.5.0.3

(Released July 25, 2006)

 Modules Added:

  • Added Ludicrously Automated Spyware Eradication Resource (L.A.S.E.R.)
  • Added Startup Manager
  • Added EULA dialog box

Features Added:

  • Added full support for Spy Sweeper 5.0 on Windows 2000 and higher to L.A.S.E.R. (7/14/2006).
  • Added sweet Geekmobile icon to Agent Toolbox Run dialog. (7/14/2006).
  • Added column sorting to Process Analyzer (7/10/2006).
  • Added threads viewer to Process Analyzer Properties Dialog (7/7/2006).
  • Added full Unicode support across the entire application for Windows 9x/Me (7/4/2006).
  • Added full keyboard support to Temp File Cleaner (7/1/2006).
  • Added system menu when Geek Squad icon in the upper left corner of main application window is clicked, or when Ctrl+Space is pressed (6/19/2006).

·

Bug Fixes:

  • Fixed F-MOD file pasting bug in Windows 95-Me where the application would report that the destination medium was not writable and would then proceed to crash the system.
  • Fixed F-MOD folder deletion bug where the left hand tree control would refresh the entire parent item when a folder was deleted.
  • Fixed F-MOD sorting bug where sort column would not be restored after an item was deleted.
  • Fixed F-MOD selection bug where multiple selected files would not remain selected after the sort order was changed by clicking on a column.


Revisions for Version 4.0.1.0

(Released May 5, 2006)

Features Added:

  • Added log generation to the Antivirus Configuration Wizards (for all Command Line Scanners). Also added ability to scan a specific folder and pass custom command line strings. (05/03/2006)
  • Added better file/folder rename support to F-MOD, including context menu and F2 support. (04/19/2006)
  • Added New Folder support to F-MOD (04/19/2006)
  • Added basic LCD dead pixel tester to the MRI Application. (04/18/2006)

Bug Fixes:

  • Fixed bug causing F-MOD to only copy FOLDERS (but not files) in directories locked down by NTFS permissions.
  • Added Time Zone configuration page to PE Configuration Wizard so that the timestamp on the notes would be aligned with the timestamps from notes taken in the client Window install.
  • Fixed bug causing Trend Micro CLS to not remove viruses when you select "Scan and Clean." (added /D switch; it was previously "/S /C").
  • Fixed bug causing CLS's to not provide a log that they were started.
  • Fixed bug causing Process Analyzer to not running correctly on certain versions of Windows 2000.
  • Fixed bug causing Agent Toolbox to not work on any version of Windows prior to NT
  • Fixed bug where F-MOD would not check if the destination drive is writable before pasting or deleting files.
  • Fixed list control sorting bug where so that the same item remains selected after a sort.


Agent Toolbox

Intended Usage:

The Agent Toolbox feature of the MRI application is similar to the Windows start menu. One of the most requested features from agents across the country has been for a GUI that links to the many applications contained on the MRI disc. Agent Toolbox was designed to provide this interface without taking up so much screen space that it interferes with the usability of the rest of the application. The Toolbox contains links to the majority of the applications on the MRI disc as well as links to many utilities that are built into the operating system. Clicking on an item has a very similar end result to manually browsing to the file and double clicking it. Therefore, if the link is to a standalone utility, it will run it; if the link is to an installer, then the installation process will begin. Currently, the Toolbox's links are static, so they always perform the same task regardless of the state of the client computer. For example, if the client has application X installed on their hard drive, Agent Toolbox currently will still always run the copy on the MRI disc. Agent Toolbox can, however, detect the version of the operating system and launch the appropriate executable.

Figure 1: Agent Toolbox in action

Agent Toolbox for MRI PE :

The Agent Toolbox that is available in MRI PE is a slimmed down version of the regular Agent Toolbox. It contains utilties that are currently working in PE, as well as some PE specific functions such as the ability to open a command prompt or change the screen resolution.


Antivirus Configuration Wizards

Intended Usage:

The Antivirus Configuration Wizard is designed to automatically create and launch the correct command line syntax for the command line scanners included on MRI BDE. This wizard will work in both PE and normal mode. The Locations to Scan section allows for selection of the logical drive(s) or folder to be scanned. The Scan Options section allows the agent to configure what specific items will be scanned. The Log Options section will contain a pre-generated filename for the log file that is based on the current time (this can be changed to a different path/filename if necessary). The Additional Command Line Options field allows for custom commands to be added to the final command line string. Lastly, the Final Command Line section displays that final command line string that will be used when Start is pressed to launch the scanner.

Figure 1: Sample Antivirus Configuration Wizard


Internet Explorer VLAN3 Proxy Toggle

Intended Usage:

The majority of precincts use the VLAN3 network which requires the use of a proxy server. The VLAN3 Proxy Toggle was designed to make entering the proxy settings into Internet Explorer less tedious. Additionally, it functions as a visual, continuously updating indicator of the proxy state. The toggle button only applies and removes the VLAN3 proxy information from Internet Explorer for the current user. It also currently does not have an option to back up any previous settings (i.e. when the proxy is removed, it simply blanks the keys the registry rather than restoring to the previous settings).

Figure 1: Proxy Toggle in Off and On Positions


LCD Dead Pixel Tester

Intended Usage:

The LCD Dead Pixel Tester is designed to display various solid colors across the entire LCD screen so that it is easier to locate dead pixels. The test will not test individual pixels or provide any kind of definitive "result" such as "the pixel at coordinate (x=54, y=128) appears to be dead." The test is simply a utility that makes it much easier for the human eye to SEE dead pixels. It is (generally) easier to find dead pixels when the screen is one solid color rather than a busy desktop background (such as a cute picture of little Billy's fifth birthday party).

Upon starting the test, the entire screen area will become solid white and contain a help message. This message states that pressing the right or left arrow will cycle through the background colors, pressing 'H' will toggle the help message on or off, pressing 'M' will move the help message, and pressing Escape or Enter will end the test. The test can be accessed via the Tools Menu, and will run on Windows 95 and higher (including MRI PE).


MRI Desktop Information

Intended Usage:

MRI Desktop Information is designed to display a quick snapshot of the client machine on the Windows desktop. It is available on Windows 2000 and higher and will display information related to the operating system and system hardware. It will automatically refresh items that can dynamically change over time (such as the number of running processes or the IP address). The MRI Desktop Information window can be manually shown or hidden via the View Menu.

Figure 1: MRI Desktop Information in action

Configurable Settings:

MRI Desktop Information is fully configurable via the Preferences Manager. The settings are organized in the list control by category, and the description column provides a brief description (typically with sample output) of the information that will be printed on the desktop. This customizability allows the agent to configure only the items he/she would like to be present. If desired, MRI Desktop Information can be set to not display when the application loads (it can always be opened via the View Menu).

Figure 2: MRI Desktop Information Settings

Additionally, right clicking the title bar of the MRI Desktop Information window will bring up a context menu that has options to change the text color as well as hide the window. The current available colors are black, white, red, green, and blue. This was added for client machines where white text would be difficult to read when placed over the desktop wallpaper.


Preferences Manager

Using the Preferences Manager:

The Preferences Manager is designed to give each agent or precinct the ability to tailor specific aspects of the application to meet the needs of their unique agents and clients. It can be accessed through the File Menu, the Preferences button, or the Ctrl+P hotkey.

Figure 1: Preferences Manager

Saving the Preferences File:

MRI loads its preferences from the MRI_Prefs.ini file contained in the same directory as the MRI executable. If MRI is running from a writable medium (such as a hard disk or pen drive), the leftmost button on the bottom of the Preferences Manager will read "Save". Clicking it will modify (or create if not present) the MRI_Prefs.ini file in the directory containing the executable. If MRI is running from a non-writable medium (such as a CD or DVD), the leftmost button will read "OK". Clicking it will modify the preferences in the application's memory, but it will not save them permanently.

FAQ: How to modify preferences in the MRI BDE .iso image

As stated above, when running the application from a CD, there is no way to permanently save the preferences. Following the steps outlined below exactly will allow the agent to build an MRI BDE .iso image with customized preferences or to modify the current preferences file.

  1. Copy the MRI executable AND the MRI_Prefs.ini file (if you want to modify your saved preferences rather than the application's default preferences) to the same folder on any writable medium.
  2. Run the MRI excutable. As it opens, it will load all preferences currently defined in the MRI_Prefs.ini file copied in Step 1.
  3. Open the Preferences Manager. It will display the settings currently in the MRI_Prefs.ini file. If you did not copy the MRI_Prefs.ini file the Preferences Manager will display the default settings.
  4. Modify desired settings.
  5. Click Save to either generate an MRI_Prefs.ini file, or to save the preferences to the MRI_Prefs.ini file copied in Step 1.
  6. At this point, there should be the MRI executable and the MRI_Prefs.ini file in the folder. Open a Geek Squad approved ISO editing application (at the time authoring, this would be UltraISO).
  7. Copy the MRI_Prefs.ini file to the .iso image (and the MRI executable if it is out of date).
  8. Save the iso and burn away.


MRI PE: Configuration Wizard

Intended Usage:

The Configuration Wizard is designed to assist the agent in configuring MRI PE to talk to the client's operating system. The wizard will be expanded in the future, but currently allows for the remote registry hives to be loaded into the PE registry.

Figure 1: MRI PE - Configuration Wizard

Loading Remote Registry Hives:

On the first page, the MRI PE Configuration Wizard asks for the location of the remote Windows installation. It then searches for files containing the registry hives for the specified Windows installation. Figure 1 displays the registry hive files found for the Windows installation in "C:\Windows" on the sample machine. The challenge in MRI PE is that the live OS (PE) has loaded its own registry hives (such as "HKEY_LOCAL_MACHINE\Software"). However, the file "C:\Windows\System32\config\software" also would normally map to "HKEY_LOCAL_MACHINE\Software" if "C:\Windows" were the live OS instead of PE. Since the "HKEY_LOCAL_MACHINE\Software" location is already being occupied by the PE registry, the Configuration Wizard automatically selects the subkeys where the remote hives will be loaded. In the sample, C:\Windows\System32\config\software" will be mapped to "HKEY_LOCAL_MACHINE\RemoteOS-HKLM-SOFTWARE". Although at first glance it might seem like this process creates extra work and that the entire process should be automated, it is important to remember that PE can be used for a variety of tasks. In certain situations, the agent may want to use PE to overwrite a registry hive file on disk with a backup copy. If the configuration wizard were to have loaded the hive file into the registry, it would be in use by the operating system and hence would not be able to be overwritten. The wizard gives the agent complete control over whcich hive files are loaded into the registry.


Optimization: Temp File Cleaner

Intended Usage:

The Temp File Cleaner is a module designed to remove common temporary files that can build up and clutter the hard drive. Having an excessive number of temporary files can hurt system performance, slow down anti-malware scans, and unnecessarily consume disk space. Geek Squad's Temp File Cleaner is designed to safely remove temporary files, and to do so across all versions Windows and across all user accounts. It can even remove temporary files on NTFS drives in situations where the user account does not normally have access to the directory. It can be run on Windows 9x through Windows XP; Vista support will be added soon.


Optimization: Temp File Cleaner

Navigating the Window:

Navigating around the Temp File Cleaner window is very intuitive. The window is split horizonatally into two panes. The top pane contains detailed information about each temporary folder found in the scan; the bottom pane contains a summary of the entire scan. The toolbar along the top of the window has buttons that are outlined below.

Figure 1: Temp File Cleaner Window

Scan/Abort:
Starts a scan of the folders specified in the Temp File Cleaner Settings. As soon as a scan begin, the Scan button changes to an Abort button which can stop the current scan.

Delete Selected:
 Begins a deletion operation which deletes all files and subfolders of each checked folder in the list.

Browse Folder:
 Opens a Windows Explorer window to the folder highlighted in the list. This feature was added to allow for the agent to quickly check the files in a folder before deciding whether or not to include the folder for deletion.

Properties:
 Opens the Folder Properties dialog for the folder highlighted in the list.

Preferences:
 Opens the Preferences Manager. .

Add Note:
 Opens the Add AgentNote dialog box. This button has the same functionality as the Ctrl+N hotkey described in the topic Adding an AgentNote.

Navigating the Columns:

Below is a brief description of each column of the top list control of the Temp File Cleaner window:

Path:
Path to the location of the folder on disk.

Files:
 Total number of files in the folder.

Size:
 Total size of all files in the folder.

Description:
 Brief description of the folder that better defines what the folder is and why it is considered to contain temporary files. The Temp File Cleaner Settings reference each folder to be scanned by its description, so the agent can use the description column to correlate a folder directly to the setting that controls whether or not it is searched during the scan.

NTFS Access Denied:
 If an item has "Yes" in this column, it means that the folder specified in the Path column of the same row is normally not accessible to the current user. This means that clicking the Browse Folder button should result in an Access Denied error from Windows Explorer. These items are also highlighted in blue text.


Optimization: Temp File Cleaner

Keyboard Shortcuts:

Several keyboard shortcuts have been added to the Temp File Cleaner to allow it to function when the mouse is not available, or simply for super 133t hax0r Agents who prefer to use the keyboard. They are as follows:

Ctrl + S - Perform temporary file scan
Ctrl + C - Abort current temporary file scan (if scan is in progress)
Ctrl + A - Check all items, or (if all items are checked)
Delete - Delete temp file in all selected (checked) folders

Ctrl + E - Browse the selected folder in Windows Explorer
Enter - Open the file properties for the selected folder

Ctrl + P - View or edit the MRI application preferences
Ctrl + N - Open dialog box to add a note to AgentNotes


Optimization: Temp File Cleaner

Configurable Settings:

The folders scanned by the Temp File Cleaner are fully customizable. If a location is checked, it will be included in the scan; otherwise it will be skipped.

Figure 1: Temp Cleaner Settings


Optimization: Startup Manager

Intended Usage:

The Startup Manager is designed to give the user complete control over items that automatically start when the operating system performs a certain action. This can be a standard item scheduled to start when the operating system starts, a system service, a dll file that loads with every process, or even less obvious items that hijack the active desktop or screensaver. Although it scans a wide variety of startup items located in the registry, file system, and structures available via the Windows API, Startup Manager always presents the data to the user in the same way so that the interface consistent and the underlying locations do not matter. When running on an administrator account on Windows NT and higher, Startup Manager also has the ability to mount the user hives for individual user accounts on the system to modify startup items. All items that are found by Startup Manager can be permanently deleted, and everything except the Winsock Providers can be disabled and backed up so they may be restored later.


Optimization: Startup Manager

Navigating the Window:

Startup Manager is split vertically into two panes. On the left is a tree containing several different categories and on the right a list view that displays the startup items. Changing the selected item in the tree will display the startup items associated with the selected category.

Figure 1: Startup Manager in action

The toolbar along the top of the window controls allows the user to refresh the startup items in the list view, to change the filter or signature verification options, or to display a legend of the color coding used by Startup Manager.

Navigating the Columns:

Below is an overview of the columns of Startup Manager.

Figure 2: Startup Manager Columns

Name:
The name of the startup item. This is a value assigned by Startup Manager based on the item type. It is most commonly the registry key, registry value, or file name associated with the item, though in certain cases it may be another value that is more friendly.

Company Name (Image Path Dependent):
If the image file is found, this column displays the company name embedded in it.

Description (Image Path Dependent):
If the image file is found, this column displays the file description embedded in it.

Image Path:
The path to the process image file on disk.

Command:
The exact command line for the startup item.


Optimization: Startup Manager

Startup Item Operations:

Startup Manager supports several operations that can be performed on individual startup items. Some of these actions are dependent on the type of entry. All supported operations are listed below.

Figure 1: Startup Manager Operations

Disabling/Deleting Startup Items
Startup Manager was designed to give the Agent the power to remove any startup item. Sometimes this may be as a way of diagnosing a problem, and other times the item may be malicious. As such, Startup Manager allows for the deletion or disabling of any startup item. Disabling is best defined as deleting the item from its startup location but backing up the relevant data so that the item can be restored if necessary. To disable an item, press Space, click the checkbox, or use the option in the right click context menu. This should change the item's check state to unchecked. To re-enable the item, perform any of the above actions and the check state will change to checked. On the left is are several different categories and on the right a list view that displays the startup items. Changing the selected item in the tree will display the startup items associated with the selected category.

Browse to Image File (Image Path Dependent)
 Browse to the image file in Windows Explorer.

Image File Properties (Image Path Dependent)
 Open the file properties dialog for the image file.


Optimization: Startup Manager

 Settings:

Startup Manager currently does not have settings that can be permanently stored in the preferences file. This will be incorporated into a future build.


Removal Tools: L.A.S.E.R.

 Settings:

L.A.S.E.R. currently does not have settings that can be permanently stored in the preferences file. This will be incorporated into a future build.


Removal Tools: L.A.S.E.R.

 Intended Usage:

The Ludicrously Automated Spyware Eradication Resource is designed to use several applications to remove malware in an optimal environment. It uses a patent pending process of preparing the computer for the removal process and then running several proven anti-malware applications in succession. It also manages the results and compiles the data into easily viewable statistics. Advanced features include disabling System Restore on Windows XP and higher machines, backing up the registry from restore points, downloading of definition updates, and termination of non-critical processes.


Removal Tools: L.A.S.E.R.

L.A.S.E.R. Calibration Wizard:

Prior to running any L.A.S.E.R. operation, the Agent must run the L.A.S.E.R. calibration wizard to configure the precise parameters of the operation. L.A.S.E.R. was designed to aid in malware removals ranging anywhere from very basic to exceedingly complex and the calibration wizard was designed to give it this flexibility. The majority of pages (that is, those that actually require input from the Agent) are listed below. Any pages not listed are simply pages to display the status of tasks that are configurable via the pages that are shown.

Calibration Wizard Pages:

Boot Mode Selection Page

The L.A.S.E.R. calibration wizard begins with the boot mode selection page. This page allows the Agent to select the mode that the L.A.S.E.R. operation will be performed in. Choosing MRI Safe Mode (available on Windows NT and higher) will restart the computer into a slimmed down version of safe mode where MRI.exe functions as the shell of the operating system. Otherwise the operation will continue in the current mode.

Figure 1: Boot Mode Selection Page

Application Selection Page

The next step in the calibration process is to select the applications that will be run during the L.A.S.E.R. operation. The list view shows the application names, icons, and the run type of application. A checked application will be run during the operation and unchecked applications will be skipped. This page allows allows the Agent to select whether each application should run a full scan or a quick scan. The specific definition of full vs quick will vary for each application. As an example, a quick scan may instruct the application to scan only known spyware folders whereas a full scan will scan all files.

Figure 2: Application Selection Page

OS Preparation Selection Page

Once the applications and boot mode have been selected, L.A.S.E.R. will examine the operating system environment and display the OS preparation selection page. This page allows the Agent to configure advanced options/tasks to increase the chances of a successful removal as well as the usability of the environment. On Windows XP and higher, System Restore can be disabled if it is currently enabled and L.A.S.E.R. is also capable of backing up the copies of the registry from the two newest restore points before they are deleted. The agent can also control the safe mode screen resolution, download options, and the termination of non-critical processes.

Figure 3: OS Preparation Selection Page

MRI Safe Mode Configuration Page

This page will be displayed if MRI Safe Mode is selected as the boot environment for the L.A.S.E.R. operation. There are three major reasons for this page, the first of which is to display critical information about what is being modified in case the computer has boot problems. Secondly, it allows the Agent to adjust the boot timeout that ntldr will wait prior to automatically selecting MRI Safe Mode. This is important because some systems have slow response time so an increased timeout may help to ensure that the Agent has enough time to change boot modes if desired. Lastly, the Agent is forced to check the box stating that he or she is not a "n00b" and will be able to restore the boot.ini via MRI PE or other means if necessary.

Figure 4: MRI Safe Mode Selection Page

Downloads Page

Once L.A.S.E.R. reaches the downloads page, the operation becomes largely automated. In most cases, no input is required from the Agent on this page unless there is a problem connecting to the internet. If the Agent presses cancel or the operation times out, L.A.S.E.R. will pause and allow the Agent to configure network/proxy settings, etc. He or she then has the option to retry the download or to skip the download and use the definitions in the cache.

Figure 5: Downloads Page


Removal Tools: L.A.S.E.R.

L.A.S.E.R. Operation:

After the L.A.S.E.R. calibration wizard has completed, L.A.S.E.R. will begin the operation. This is basically a giant loop that performs several tasks for each individual application. At the end of the operation, a statistics page is displayed. The actions performed for each individual application are listed below.

Application Actions:

Install/Copy Files:

L.A.S.E.R. starts by getting the files for the application onto the hard drive. Depending on the type of application, this is either performed by a file copy or by an installation.

Perform Dynamic Update:

For applicable applications, L.A.S.E.R. will copy the definitions from the cache to the application's folder.

Run Application:

L.A.S.E.R. then performs any tweaks for the application (this can be suppressing warnings or configuring the scan) and launches it. If applicable, L.A.S.E.R. will script the application to start scanning.

Log Results:

After the scan L.A.S.E.R. presents the Agent with a dialog box to enter data for the scan (Figure 1). It prepopulates many of the fields but leaves the critical statistics for the Agent to enter. This is because the third party log files, though usually reliable, change often enough that we cannot guarantee their accuracy. As such, it is better to have the intelligence of a human entering the traces found/traces removed rather than trusting that none of the vendors will change their file formats.

Figure 1: Scan Results dialog

Uninstall/Remove Application:

For applicable applications, L.A.S.E.R. will automatically uninstall them/remove the files.


OS Utilities: Process Analyzer

Intended Usage:

The Process Analyzer is an integrated process manager that is much more powerful than the task manager built into the operating system. It similarly displays the process name, memory, and CPU usage, but goes above and beyond to display more details about the relationship between processes and the about the image file of each process. Additionally, Process Analyzer can kill, suspend, and resume a process, kill process trees, browse to an image file in Windows Explorer, and set a process' priority level.


OS Utilities: Process Analyzer

Navigating the Process Tree:

If you have never done so before, viewing the processes as a tree may seem a bit confusing at first. When one process spawns another, the existing is referred to as the parent process and newly spawned as the child process. This is particularly important when troubleshooting malicious software. In order to ensure that the threat is neutralized, it is imperative to understand not only where the software resides, but also where it came from. Knowing how and why a threat exists is half the battle in ensuring that it does not come back. If a given threat is a child of services.exe or explorer.exe, one would know that there are keys in the registry that are causing the malicious process to load (as a service, when explorer.exe loads, etc). Other threats continuously respawn no matter how many times you kill them. This is because there is a parent process that is continuously respawning the child. These are just a few examples of why the relationship between parent and child is important when troubleshooting common operating system problems. Because of this, Process Analyzer sorts the processes and displays them as a tree. A tree (in file browsing, family trees, and many other situations) is a means of displaying data in such a way that it emphasizes the relationship between parent and child (usually through indenting). This is shown in the figure below:

Figure 1: The Process Tree

A process that is all the way to the left (no indent) does not have a parent process that is currently running. This means that it either never had a parent, or that its parent has exited. In either case, since it does not have a live parent process, this is referred to as an orphan process. In the figure, "explorer.exe" and "System Idle Process" are orphan processes. Child processes are displayed below their parent and are indented one level. Processes with the same parent and the same level of indentation (i.e. two children of the same process) are referred to as sibling processes. In this example, "lsass.exe" and "services.exe" are siblings because they are both children of "winlogon.exe".

Navigating the Columns:

Below is an overview of the columns of Process Analyzer. More columns will be added down the road, as well as the ability to select and remove columns. In certain situations, such as running the application on a Limited user account on Windows XP, image file information cannot be retrieved if the process was not started by the current user (i.e. processes started by another user, services started by the user "NT Authority\System"). Some columns will display information specific to the image file. If the path to the image file cannot be determined, the indicated columns will be blank.

 Figure 2: Process Analyzer Columns

Process Name (Image Path Dependent):
This is the name of the process (almost always the name of the image file). Examples are "explorer.exe" and "System Idle Process". This column also contains the 16x16 icon of the process image file (if the image path is able to be retrieved).

CPU:
 The percentage of time a given process is using the CPU. A process that is unexpectedly using the CPU a very high percentage of the time could indicate (among other things) a CPU intensive operation, a software bug, or malicious code intentionally using CPU time to slow down other processes.

Memory:
 The memory usage (or total working set size) of the process. Unnecessary processes that are using a large amount of memory relative to other processes may hurt system performance.

PID:
 The unique identifer of the process. No two running processes have the same process ID.

Vendor Name (Image Path Dependent):
 The vendor name of the process image file.

File Description (Image Path Dependent):
The description of the process image file.

Image Path:
The path to the process image file on disk.

Lower Pane View:

As of release 4.6.0.0 of MRI.exe, Process Analyzer features a toolbar along the bottom that allows quick access to dynamically changed properties of each process. Currently, General information and Threads information are available. More information will be available in future releases. To use this feature, simply click on the information desired and the window will become split vertically displaying the process tree on the top and the information on the bottom. To collapse the information press the Close button. An example for explorer.exe is shown as Figure 3 below:

Figure 3: Process Lower Pane View


OS Utilities: Process Analyzer

Process Highlight Colors:

Process Analyzer highlights specific types of processes as shown in the figure below:

Figure 1: Process Highlight Colors

The highlight colors are defined as follows:

Yellow:
The process contains at least one service.

Blue:
 The user token of the process is identical to the user token of MRI.exe. Generally this implies that the process was started by the same user as MRI.exe. This is helpful when multiple users are logged on to the PC to differentiate which processes were started by the user account MRI is running from.

Red:
 The process was recently terminated.

Green:
 The process was recently created.


OS Utilities: Process Analyzer

Process Operations:

This topic outlines all operations that the Process Analyzer can perform on a given process. This includes terminating, suspending, setting priority, and browsing to image files. These operations are available via the toolbar, context menu, or hotkeys defined below.

Figure 1: Process Analyzer context menu containing operations that can be performed on the selected process

Kill Process:
Terminate the selected process. This option will be grayed if a handle to the process for termination cannot be opened, if the preferences are set to restrict the selected process from being terminated, or if the process is not able to be terminated (i.e. System Idle Process).

Kill Process Tree:
Terminate the selected process and all descendents. See the topic Process Analyzer - Navigating the View for a further discussion of process trees. Other than this, the same rules apply as Kill Process, above.

Suspend/Resume Process:
This will suspend the selected process so that all of its threads will stop executing user-mode code. In other words, for all intents and purposes the process is paused and cannot continue until Resume Process is clicked.

Set Priority:
 Sets the priority level of the selected process. The operating system looks at the priority level to decide which process takes precedence when distributing slices of CPU time. This feature is present in the Windows NT Task Manager and is included for completeness.

Browse to Image File:
Open a Windows Explorer window to the folder containing the image file of the selected process. Use this to gather more information about the files associated with a process. Additionally, browsing to the image file's parent folder allows for the image files of malicious processes to be easily deleted from disk after they are terminated.

Process Properties:
 View more detailed information of the selected process than can be shown in the Process Analyzer window. For further discussion, please see the topic Process Analyzer - Process Properties Dialog.


OS Utilities: Process Analyzer

Process Properties Dialog:

If you highlight a process and double click it or press Enter, it will bring up the Process Properties dialog box. This contains detailed information about the process, and will be expanded upon in future builds of MRI.

General Page

The general page displays information specific to the process image file and process startup. It displays the icon, process name, and file description, and has sections to display further details about the image file and the circumstances under which the process was launched.

Figure 1: Process Properties - General Page

Image File Information:
Displays information about the process's on-disk executable image file (usually a file in the portable executable format). All fields are relatively self explanatory and are dependent on the user account having enough access rights to open a handle to the process to retrieve the path to the executable image file.

Startup Information:
Displays information about the way the process was launched. The Command Line field is the exact command line string that was passed to the operating system, including any command line arguments that were passed to the image file. For example, if we were to launch "rundll32.exe /shell32.dll,Control_RunDLL appwiz.cpl", the image file is "C:\Windows\System32\rundll32.exe", and it was passed the argument "/shell32.dll,Control_RunDLL appwiz.cpl". Working Directory displays the current directory of the process. Start Time displays the time the process was launched. User Name displays the user that launched the process.

Threads Page

The threads page displays all of the individual threads of the process. It additionally lists the module and offset for the starting address of the thread, the CPU usage, Thread Identifier (TID), Company Name attribute of the start address module, and context switch count. Right clicking an entry provides options to kill the selected thread or to open the file properties dialog for the start address module.

Figure 2: Process Properties - General Page


OS Utilities: Process Analyzer

Configurable Settings:

Process Analyzer can be customized in several ways. Each setting is outlined below:

Figure 1: Process Analyzer Settings

Allow system critical processes to be terminated:
This will enable MRI to terminate processes that are critical for system stability. It should be used with extreme caution and only if there is a reason to be doing so. There is a decent chance that after terminating a system critical process, other aspects of the operating system may be unstable or unusable. This may result in having to reboot the computer in order to regain functionality.

Prompt before terminating non-critical processes:
 If enabled, MRI will prompt before terminating processes that are not system critical. MRI will always prompt when terminating a system critical process or a process tree.

Prevent MRI from terminating itself:
 If enabled, MRI will not be able to terminate itself. This helps if MRI is one of several descendents of a process, and you want to terminate the process tree without terminating the MRI process.


OS Utilities: File Manager on Duty

Intended Usage:

The File Manager on Duty (F-MOD) is a file browsing utility much like Windows Explorer. Although not all features are currently implemented, F-MOD can browse folders of the logical drives in the system. It can execute, cut, copy, paste, delete, rename, and display detailed information about files and folders. It also features a favorites menu and the ability to split the window vertically into two file browsers. All of these operations can even be performed on files and folders of NTFS volumes where the user account does not have access to the file. This utility was designed first and foremost to be a fast performing file browser for a preboot environment; however, some of its more powerful features make it an ideal choice for other situations such as data backups. Future enhancements will be made to make it a fully featured file browser.


OS Utilities: File Manager on Duty

Navigating the File Manager:

F-MOD is split vertically into two panes. On the left is a directory tree and on the right a list view. The directory tree is set with its root at My Computer is followed by all logical drives of the system. Changing the selected (highlighted) item in the tree will display the files and folders of the selected item in the list view. An item can be expanded in the tree if it has one or more subdirectories.

Figure 1: Directory Tree

The list view displays the details of each item in the folder displayed in the address bar. Double-clicking a folder will open the folder's contents in the list view. Double clicking a file will display the file name, icon, size, generic description of the file/folder type, modify date, and any special attributes of the object.

Figure 2: FMOD list view


OS Utilities: File Manager on Duty

File Operations:

F-MOD is capable of performing the standard file operations cut, copy, paste, rename, and delete. It also supports creating new folders and opening files. These operations are outlined in the topics below.

Figure 1: Supported F-MOD Operations

Cut/Copy/Paste/Delete:

Highlight the files or folders you wish to operate on; all of the operations may be performed multiple files/folders. It will work in either the directory tree or list view (although the tree is limited to selection of a single item). Right click and choose the operation in the context menu, or use a standard hotkey. When cutting, copying or pasting, file and folder names are copied to and pasted from the global Windows clipboard. This means that an agent can copy a file from F-MOD and paste it to the client desktop/Windows Explorer, or vice versa. Bear in mind that F-MOD can perform operations on files that may not be accessible in Windows Explorer. It is therefore possible that Windows Explorer may give an "Access Denied" error when trying to paste something that F-MOD placed on the clipboard. Once a copy or deletion operation has been started, a dialog box will come up to display the progress of the operation. It will display the current source file name and size, destination file, time remaining and speed of the operation. Unlike other file browsing utilities, the operation does not abort if it encounters an error (such as deleting an in-use file).

Figure 2: Copy status box

Renaming a file or folder:

Renaming a file or folder can be done in the list view only. Clicking the name portion of an item after it is selected will allow for in-place editing of the file or folder name. After editing, F-MOD will prompt you to confirm the name change.

Figure 3: File rename operation


OS Utilities: Frequent Fixes and Solutions

Intended Usage:

Frequent Fixes and Soultions is designed to be a comprehensive collection of fixes for common PC problems. In addition to providing textual descriptions of the solutions, FFS almost always will perform individual steps of the fix for you. All fixes are either taken from Microsoft Knowledge Base article instructions or from proven field fixes. FFS is designed to be easily searchable, fast, and safe. It accomplishes this through indexing fixes, using only proven and reliable methods, and creating backups of modified files/registry keys/etc whenever possible. The MRI Development Team has also created an online FFS Knowledge Base that is accessible from any internet connection (on VLAN3 you may be required to prepend your user ID with "NA\") and provides detailed descriptions, screenshots, and links for each fix. This system takes the "for agents, by agents" mentality of the MRI Development Team to a new level via the submissions portion of this site that allows any agent to submit fixes that he or she encounters for consideration to be added to FFS.


OS Utilities: Frequent Fixes and Solutions

Navigating the Window:

FFS contains three major windows starting with the task panel on the left that performs many actions within FFS. The right portion of the window is split vertically into the main FFS view (top) that contains all of the FFS fixes organized by category and the Operation Summary (bottom) that provides a history of all actions performed.

Figure 1: FFS in action


OS Utilities: Frequent Fixes and Solutions

FFS Knowledge Base:

The MRI Development Team felt that FFS's complexity combined with the necessity to continuously communicate with agents about new fixes and solutions for problems merited a knowledge management system. Not only does this system provided continuously updated documentation for each fix contained within FFS, but it also provides a submissions database that any agent can submit fixes or solutions to. It is accessible via:

https://sp.bestbuy.com/ret/vista/MRI/FFS/default.aspx

Figure 1: Sample page from the FFS Knowledge Base


Notes: AgentNotes/Event Log

Intended Usage:

The Event Log is a fully automated logging system for all application specific events. Examples of items logged are temp file scan/deletion statistics, processes terminated, files copied/deleted, and applications launched. The AgentNotes component allows the various agents working on the client computer to take notes on the fly without leaving the application or having to locate a ink-based character printing device. This is not, by any means, a replacement for handwritten notes; however, it allows for the automation of some of the repetitive aspects of note-taking. Since the Event Log stores itself locally on the client machine, it also can provide a detailed repair history reference for future service calls.

Viewing AgentNotes vs the entire Event Log:

  • Log messages shown in the AgentNotes window are a select subset of all messages in the Event Log.
  • In additional to all messages manually input by agents, highly relevant messages are also displayed in the AgentNotes view. For example, the AgentNotes window will display that "604 of 610 temp files were deleted" (highly relevant) but will not clutter the window with the error messages for the 6 in-use files that could not be deleted (generally less relevant information). If an agent needs access to this information, it is always available in the Event Log.

Log Format:

  • Uses proprietary Geek Squad Log (.gsl) file format.
  • Features basic encryption to prevent the file from being opened without the MRI executable.
  • Stores item text, formatting, date stamp, item type indentation.

Log Storage:

  • Stored as one global log (rather than one per user) so that it can be accessed while working on all user accounts.
  • Default storage location is in the “Geek Squad\MRI” directory of global Application Data directory*. An example of the storage location of the log file on Windows XP is shown in the figure below:

Figure 2: Location of the Event Log file on Windows XP

*On Windows 2000/XP: %AllUsersProfile%\Application Data; Windows 9x\Me: %Windir%\Application Data.


Notes: Adding an AgentNote

Add to AgentNotes Dialog Box:

The Add Note button or the Ctrl+N hotkey will bring up the Add to AgentNotes dialog box. This will allow the agent to quickly add an AgentNote. The dialog has two fields, one for the text of the note, and one for the agent's initials. If the initials are present, they are appended to the end of the AgentNote. The next time the dialog box is opened, the Initials field will automatically be populated with the last agent's initials. This is so the agent can add dozens of entries to the log, and only enter his or her initials once.

Figure 1: Add to AgentNotes Dialog Box


Notes: Field Notes Generator

Intended Usage:

The Field Notes Generator is designed to provide a user interface for creating notes that comply with the official Case Notes Template used by Double Agents, Special Agents, and Cadets. It provides an intuitive interface, has multiple export methods, and can even populate information from the system it is running on. The level and detail of information will vary greatly depending on the operating system version and user account type. Currently the Generator does not allow for the notes to be imported from a file, although this is on the roadmap for a future release. As such, if the application is closed any data that has been entered will be lost.


Notes: Field Notes Generator

Navigating the Window:

The Field Notes Generator uses a series of pages for data entry. All pages support tabbing between fields, and the suspect page allows to prepopulate some of the fields with information from the PC the application is running on. The level of information provided varies by operating system and user account type. There is a navigation bar at the top to navigate between pages, and a toolbar at the bottom for performing various commands. This is shown in the figure below:

Figure 1: Field Notes Generator Window

The window initially contains only the General page. The "Add" button in the bottom toolbar allows for additional pages to be added. These pages can be navigated via the navigation bar at the top. Once all desired fields have been completed, the information can be exported in plain text to either the clipboard or a .txt file. A button to open STS is also included to allow for easy access to the scheduling system.


OS Utilities: File Manager on Duty

Intended Usage:

The File Manager on Duty (F-MOD) is a file browsing utility much like Windows Explorer. Although not all features are currently implemented, F-MOD can browse folders of the logical drives in the system. It can execute, copy, paste, delete, rename, and display detailed information about files and folders. All of these operations can even be performed on files and folders of NTFS volumes where the user account does not have access to the file. This utility was designed first and foremost to be a fast performing file browser for a preboot environment; however, some of its more powerful features make it an ideal choice for other situations such as data backups. Future enhancements will be made to make it a fully featured file browser.

Navigating the Directory Tree:

F-MOD is split vertically into two panes. On the left is a directory tree and on the right a list view. The directory tree is set with its root at the user desktop folder. It then has My Computer and finally all logical drives of the system. Changing the selected (highlighted) item in the tree will display the files and folders of the selected item in the list view. An item can be expanded in the tree if it has one or more subdirectories.

Figure 1: Directory Tree

Copying/Pasting/Deleting:

Highlight the files or folders you wish to operate on; all of the operations may be performed multiple files/folders. Right click and choose the operation in the context menu, or use a standard hotkey. This is shown in the figure below:

Figure 3: How to copy, paste, or delete one or more files/folders

File and folder names are copied to and pasted from the global clipboard. This means that an agent can copy a file from F-MOD and paste it to the client desktop/Windows Explorer, or vice versa. Once a copy or delete has been started, a dialog box will come up to display the operations progress. The will show the current source file name and size, destination file, and speed of the operation. Unlike other file browsing utilities, the operation does not stop part way through if it encounters an error (such as deleting an in-use file). Rather, the operation will execute to completion and log any such errors in the Event Log.

Figure 4: Copy status box


MRI Application Help File