A lot of people ask me about how to OSX print screen (i.e take a screen grab in OS X) and also how to take a print screen in Windows XP/Vista. I know this has been covered before but I thought I would put up a little post up….

OS X Print Screen

In OSX you press [and hold] the apple command key, hold shift and then press either 3 or 4 (what does the command key look like?… click here). Here are the most commonly used options:

Capture Entire Screen: Command + Shift + 3

Capture Selected Area: Command + Shift + 4;  then click [hold] and drag a box around the area you wish to capture. Once you release the mouse button the image will be captured.

Using the above key combinations will cause OSX to take a screen grab and then store the file to your desktop. The first screen shot will be called Picture 1, and then further screen shots will be named Picture 2, Picture 3 and so on.

Windows Print Screen

Windows print screen copies the captured screen to the clipboard. Once you’ve done this the image can be pasted into a document using your application of choice (e.g Word/Wordpad etc.) by selecting >edit >paste from the toolbar or by pressing ‘Ctrl’ + ‘V’. There are two types of screen capture:

Capture Entire Screen: To take a screen capture of the entire screen in Windows 9x/XP/Vista simply press the ‘PrintScrn’ button. This takes a screen grab and stores it to the clipboard.

Capture Current Window: To take a screenshot of the current window (not the whole screen) in Windows 9X/XP/Vista hold down ‘Alt’ and Press ‘PrintScrn’.

I recently had a problem with a computer located over 300 miles away, it had a nasty malware infection and I didn’t fancy a 6 hour drive. Very often, it’s easier to blow-away a computer and reinstall the operating system rather than spending days scanning and cleaning trojans, viruses and spyware, but sometimes that’s not the easy option.

I started to think about the possibility of cleaning the machine remotely, but I’d need control over the computer whilst it was in safe mode.… well it would have to be safe mode with networking, at least. I often use VNC for remote control (its open source), but as far as I knew I couldn’t get it to run in safe mode with networking….or could I?

This is a guide to using VNC in safe mode (safe mode with networking). Tested with ultraVNC (www.uvnc.com) on Windows, haven’t tested with realVNC: -

1.    Get ultraVNC installed on the target computer. Make sure that you are able to access it; it needs to be installed as a service. You can talk someone through this over the phone. Yes, you may need port forwarding configured at the target site; but if it’s part of a WAN you won’t necessarily have to do this. VNC uses port 5900. Check VNC is working properly.

2.    Download Bootsafe; This is a utility that will allow you to restart the machine in Safe Mode , and Safe Mode with Networking (which is what you need to use). Remember if you restart the computer you won’t be able to hit F8 remotely! that’s why you need to use bootsafe and it needs to be on the target computer.

3.    Open the command prompt on the target machine (Start, Run, ‘cmd’)  and enter the following:

REG COPY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winvnc HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\winvnc /s /f

This adds a registry key that allows VNC to start and work in safe mode with networking.

4.    Run Bootsafe on the target computer; select ‘Safe Mode – Networking’, click on ‘Reboot’.

If all goes to plan then you should be able to connect to the machine after it reboots in safe mode with networking. Use ‘ping –t’ ; you can see when the machine reboots and when it comes back to life. VNC Safe Mode !

Yes, there are other ways that you can achieve remote control in safe mode, but this did what I needed it to do. There are paid tools like logmein and you can also try VNCscan (I couldn’t get it to work). I’ve since cleaned a couple of machines using the VNC Safe Mode method and it has been surprisingly effective. If you’ve got malware problems try ComboFix combined with malwarebytes.

Standard warning: Step 3 adds a registry key to windows. Editing the registry could damage your computer. Do not edit the Windows registry unless you are confident about doing so.

After rebooting a Windows 2000 Advanced Server (running Exchange 2000 SP3) the Microsoft Exchange Management Service Failed to Start. Manually starting the service generated the following error:

“Could not start the Microsoft Exchange Management Service on Local Computer. The service did not return an error. This could be an internal Windows error or an internal service error. If the problem persists, contact your system administrator.

The event log also contained an error:

Event ID: 6
Source: MSExchangeMGMT
Type: Error
Description: The Microsoft Exchange Management service encountered an error (0xThe specified module could not be found.)

A colleague of mine browsed eventID.net. A suggested solution was to check the path to the “atl.dll file in registry”. Registry Key:

HKEY_CLASSES_ROOT\CLSID\{44EC053A-400F-11D0-9DCD-00A0C90391D3}\
InprocServer32 @=”C:\\WINNT\\System32\\ATL.DLL

There were two keys present after searching the registry, one was pointing to the correct location (”c:\winnt\system32\atl.dll”) the other was pointing to c:\program files\ibm\dsa\atl.dll. The article suggests that only the c:\winnt\system32 path will work and the service will fail to start if it is pointing to a different location.

I’m no clearer as to the role that the atl.dll file plays with the exchange management service, but changing the second key so that it was re-pointed to c:\winnt\system32 did the trick. The service started successfully after a manual start. Earlier that week IBMs Dynamic System Analysis Tools (DSA tools) had been installed on the server. For whatever reason the tool seems to have changed one of the ATL.dll registry keys, causing the management service to fail.