OS X Print Screen

In OSX you press [and hold] the apple command key, hold shift and then press either 3 or 4 (what does the command key look like?… click here). Here are the most commonly used options:

Capture Entire Screen: Command + Shift + 3

Capture Selected Area: Command + Shift + 4;  then click [hold] and drag a box around the area you wish to capture. Once you release the mouse button the image will be captured.

Using the above key combinations will cause OSX to take a screen grab and then store the file to your desktop. The first screen shot will be called Picture 1, and then further screen shots will be named Picture 2, Picture 3 and so on.

Windows Print Screen

Windows print screen copies the captured screen to the clipboard. Once you’ve done this the image can be pasted into a document using your application of choice (e.g Word/Wordpad etc.) by selecting >edit >paste from the toolbar or by pressing ‘Ctrl’ + ‘V’. There are two types of screen capture:

Capture Entire Screen: To take a screen capture of the entire screen in Windows 9x/XP/Vista simply press the ‘PrintScrn’ button. This takes a screen grab and stores it to the clipboard.

Capture Current Window: To take a screenshot of the current window (not the whole screen) in Windows 9X/XP/Vista hold down ‘Alt’ and Press ‘PrintScrn’.

I started to think about the possibility of cleaning the machine remotely, but I’d need control over the computer whilst it was in safe mode.… well it would have to be safe mode with networking, at least. I often use VNC for remote control (its open source), but as far as I knew I couldn’t get it to run in safe mode with networking….or could I?

This is a guide to using VNC in safe mode (safe mode with networking). Tested with ultraVNC (www.uvnc.com) on Windows, haven’t tested with realVNC: -

1.    Get ultraVNC installed on the target computer. Make sure that you are able to access it; it needs to be installed as a service. You can talk someone through this over the phone. Yes, you may need port forwarding configured at the target site; but if it’s part of a WAN you won’t necessarily have to do this. VNC uses port 5900. Check VNC is working properly.

2.    Download Bootsafe; This is a utility that will allow you to restart the machine in Safe Mode , and Safe Mode with Networking (which is what you need to use). Remember if you restart the computer you won’t be able to hit F8 remotely! that’s why you need to use bootsafe and it needs to be on the target computer.

3.    Open the command prompt on the target machine (Start, Run, ‘cmd’)  and enter the following:

REG COPY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winvnc HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\winvnc /s /f

This adds a registry key that allows VNC to start and work in safe mode with networking.

4.    Run Bootsafe on the target computer; select ‘Safe Mode – Networking’, click on ‘Reboot’.

If all goes to plan then you should be able to connect to the machine after it reboots in safe mode with networking. Use ‘ping –t’ ; you can see when the machine reboots and when it comes back to life. VNC Safe Mode !

Yes, there are other ways that you can achieve remote control in safe mode, but this did what I needed it to do. There are paid tools like logmein and you can also try VNCscan (I couldn’t get it to work). I’ve since cleaned a couple of machines using the VNC Safe Mode method and it has been surprisingly effective. If you’ve got malware problems try ComboFix combined with malwarebytes.

Standard warning: Step 3 adds a registry key to windows. Editing the registry could damage your computer. Do not edit the Windows registry unless you are confident about doing so.

“Could not start the Microsoft Exchange Management Service on Local Computer. The service did not return an error. This could be an internal Windows error or an internal service error. If the problem persists, contact your system administrator.

The event log also contained an error:

Event ID: 6
Source: MSExchangeMGMT
Type: Error
Description: The Microsoft Exchange Management service encountered an error (0xThe specified module could not be found.)

A colleague of mine browsed eventID.net. A suggested solution was to check the path to the “atl.dll file in registry”. Registry Key:

HKEY_CLASSES_ROOT\CLSID\{44EC053A-400F-11D0-9DCD-00A0C90391D3}\
InprocServer32 @=”C:\\WINNT\\System32\\ATL.DLL

There were two keys present after searching the registry, one was pointing to the correct location (”c:\winnt\system32\atl.dll”) the other was pointing to c:\program files\ibm\dsa\atl.dll. The article suggests that only the c:\winnt\system32 path will work and the service will fail to start if it is pointing to a different location.

I’m no clearer as to the role that the atl.dll file plays with the exchange management service, but changing the second key so that it was re-pointed to c:\winnt\system32 did the trick. The service started successfully after a manual start. Earlier that week IBMs Dynamic System Analysis Tools (DSA tools) had been installed on the server. For whatever reason the tool seems to have changed one of the ATL.dll registry keys, causing the management service to fail.

After installing service pack 1 for backup exec 11d the server required a reboot. After rebooting and on startup experienced difficulty browsing other machines using explorer and was unable to access the network connections in my network places. Unable to Browse web. First checked physical network connection (replaced cable and rebooted). No effect. Server was responding to ping. Event logs contained errors relating to the remote access service saying that it had failed to start and also:Event ID 7011: Service Control Manager

Even using the basic modes, the camera takes fantastic photos.

Successfully managed to restore an Exchange 2000 server, when both its datastores had gone offline in a dirty state, and its transaction logs had been deleted. (very important to use exchange aware backup software).

Click here for an overview of the process.