February 11 is BOSD day!

Windows patch cripples XP with blue screen, users claim Microsoft users are reporting on the company's support forum that Tuesday's security updates are crippling Windows XP-based PCs. For recovery, try: Note: you have an encrypted drive, you'll need to follow your software vendor's decryption instructions before you follow these. PointSec's instructions are available below these recovery instructions. 1. Boot from your Windows XP CD or DVD and start the recovery console (see this Microsoft article for help with this step) Once you are in the Repair Screen type: 2. CHDIR $NtUninstallKB978262 $\spuninst 3. BATCH spuninst.txt 4. systemroot 5. Repeat steps 2 - 4 for each of the following updates: * KB978262 * KB971468 * KB978037 * KB975713 * KB978251 * KB978706 * KB977165 * KB975560 * KB977914 6. When complete, type this command: exit Thanks to maxyimus and FindbyFollowMe on the Microsoft Forums for their research and suggestions: http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/73cea559-ebbd-4274-96bc-e292b69f2fd1/#e9b28c45-635c-4adf-8d24-817bf39c207 PointSec Recovery Procedure Pointsec has two methods to recover data from an encrypted system, bootable recovery disk and connecting the encrypted hard disk to another machine (Slave Drive). Only Computer Support Coordinators (CSC) and OAAIS Enterprise Information Security (EIS) can perform recovery tasks. In order to perform the following tasks, you must have Pointsec installed on your machine or access to a machine that has Pointsec installed. Pointsec Management Console requires Microsoft .net 2.0 later. http://www.microsoft.com/downloads/details.aspx?FamilyID=0856eacb-4362-4b0d- 8edd-aab15c5e04f5&displaylang=en Bootable Recovery Disk A common scenario in which recovery is required is when something fails in a computer that is protected by Pointsec PC, and you are unable to start windows properly. To Remedy this problem, the administrator creates a bootable media on another computer, using the recovery file of the failed computer. The administrator, or whoever is performing the recovery, then uses the bootable media to recover the faulty computer. The bootable media performs the following tasks:

• Enables the administrator to recover data on the faulty computer.
• Decrypts the faulty computer’s encrypted volumes.
• Removes the pre-boot authentication from the faulty computer.
• Gives direct access to Windows on the faulty computer once decryption has completed successfully.
• Pointsec PC stores the recovery file in two locations, locally in the directory C:\Documents and Settings\All Users\Application Data\Pointsec\Pointsec for PC and on the Pointsec file server.

Note: Recovery can only be performed if you have the appropriate Pointsec administrator access on the machine that has Pointsec installed. Creating a Recovery Disk

1. Insert a USB memory stick or floppy disk into your computer. oNote: Pointsec will erase the contents of the disk.
2. Open Pointsec Management Console - Start Menu-> All Programs-> Check Point -> Pointsec PC-> Management Console
3. Login to the Pointsec Management Console with your username and password and select Remote from the left column. Click on Create recovery media.
4. The recovery wizard will open, and follow the on screen prompts to select the machine’s recovery file.
5. After the recovery file is chosen Pointsec will prompt for administrator authentication, enter in both administrator accounts in to the screen prompts.
6. Once authentication is complete select which device the recovery disk will be created on.

Sourced from the PointSec Administration Guide.