China DOS Union

Cause: A few days ago, several dozen machines in a unit installed an sslvpn software due to work needs. After installation, it automatically adds a virtual network card, constructs a virtual VPN private network, and accesses a certain site securely through the SSL protocol.

Symptoms: After installation, all machines cannot run commands like ping, regedit, etc. It says these are not external or internal commands, nor batch files.

My analysis: Obviously, the system's environment variables were damaged. I checked the system environment variables and they were: %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem. There seemed to be no problem, and the ping, regedit, etc., commands were in the above paths. When I changed %SystemRoot%\System32\Wbem to %SystemRoot%\system32\wbem (with two letters in lowercase) or swapped the order of any two paths, the symptom disappeared. I quickly checked a new machine that hadn't installed this software and found its environment variables were also %SystemRoot%\System32\Wbem. According to this, this path should be correct. Then I randomly checked several faulty machines. Some had Wbem, and some had WBEM. It was really frustrating and I couldn't figure it out. When I opened the CMD window on the faulty machine and ran the path command, I found the problem. The window showed PATH=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem, while the normal machine showed PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem. But in the CMD window of the faulty machine, SystemRoot=C:\WINDOWS was displayed, indicating that the SystemRoot environment variable was correctly recognized. Why couldn't it be correctly replaced in the path? I've been really depressed these days. I hope an expert can come to the rescue.

In addition, I would like to ask about automatically modifying the IP address. Purpose: The virtual network card has no IP address by default after being added. Now, it is required to modify the IP address of the virtual network card according to the IP of the real network card. The method is that the first two digits of the IP address of the virtual network card are fixed as 11.123, and the last two digits take the last two digits of the IP of the real network card. For example, if the real network card of a certain machine is 192.168.9.7, then the IP of the virtual network card is 11.123.9.7, and the mask is 255.255.0.0.

I have searched and read some posts about this. Most of them use netsh to modify the IP, but the network connection names on these machines are many and different. For example, on some machines, the real connection is called "Local Area Connection 3", and the virtual one is called "Local Area Connection" instead; some machines have two network cards, one with an IP set and the other without. Moreover, I saw in some posts that the netsh command must enable the remote registry service, but I have already disabled this service on my machine, but netsh can still change the IP address. I don't know why.
I thought it could be implemented, but I didn't write it out. I used my commonly used strrpc text replacement tool. Since I really don't have time to study the for command, I want to see how other experts write it. I still ask for your advice.

Forgot to add one thing, the Description of the virtual network card is: sslvpn adapter 1.0

The problem of the first system environment variable is finally clarified. After installing that sslvpn software, the type of the path item in the registry is changed from REG_EXPAND_SZ to REG_SZ. The paths are all fine, but just because the type is incorrect, the system can't recognize the dynamic path. I've been depressed for several days. Oh, really want to curse.

The second problem, why don't the moderator and experts come to help? Even more depressed.

First, post your ipconfig /all result and indicate which one is the virtual network card and which one is the physical network card.