nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

Error 0x80070057 #77

Closed Pacofc closed 5 years ago

Pacofc commented 5 years ago

Hi,

Since the update of May 20, i have this error on my servers 2012 R2:

set-FsrmFileGroup -name "Cryto Files" -IncludePattern @((Invoke-WebRequest -Uri "https:/ /fsrm.experiant.ca/api/v1/combined" -UseBasicParsing).content | convertfrom-json | % {$_.filters})

set-FsrmFileGroup : 0x80070057, Paramètre incorrect. Au caractère Ligne:1 : 1

Can you help me ?

Kind regards

davidande commented 5 years ago

I have the same problem on 2012 Powershell version 3 and also on a 2016 Powershell version 5

davidande commented 5 years ago

It's seems that there is forbidden caracters in the extension list image

You can check it by opening FSRM.msc , opening the extension list and clicking OK

xstarina commented 5 years ago

here are some bugs (colon and line breaks) in the https://fsrm.experiant.ca/api/v1/combined list

chrome_2019-05-21_15-39-10

chrome_2019-05-21_15-38-43

nexxai commented 5 years ago

Hey guys, I apologize for this, I'm not really in charge of this project anymore, so I've gone in and fixed the broken entries and will speak to the people who are now responsible for approving extensions to watch for these in the future.

davidande commented 5 years ago

Thanks man

Rooven-tech commented 5 years ago

Hi All, I found with the bad characters in https://fsrm.experiant.ca/api/v1/combined is causing CryptoBlockerGroup9 not to be created thus the template fails and the file screens are not created.

I download the raw data and stripped the bad characters out and then imported using list without the bad characters and it worked like normal

nexxai commented 5 years ago

@Rooven-tech was there an entry (or multiple) that I missed? If so, can you let me know which ones so I can fix them for everyone?

nexxai commented 5 years ago

I think I found all of the remaining \n entries. Please let me know if there are any further issues.

Rooven-tech commented 5 years ago

@nexxai is this line correct?

"\"!ymayka-email@yahoo.com.cryptotes\""

davidande commented 5 years ago

Ok it works great for me again. no more error but tested on my own script only Thanks

Pacofc commented 5 years ago

Hi,

Good for me again !

Thanks a lot :)

nexxai commented 5 years ago

@Pacofc Glad to hear it. There was also a problem with the caching that we had to clear and re-populate, but it should be good to go going forward. I also edited the "\"!ymayka-email@yahoo.com.cryptotes\"" entry you provided to only include filename-appropriate characters.

I'm going to close this issue, but please let me know if there are any other problems.