SysAdmin Linkfest - Chock'-o’-Videos Edition (G-rated version)

This is a super-heavy linkpost filled to the rim with video presentation linkages. Make sure you have some extra time and bandwidth set aside for all these.

Seriously. You think I’m joking, but all it takes is one sysadm running around careless with streaming video file links and then “bam” someone ends up loosing their bandwidth.

As tempting as it is, I’m just providing the links to the video rather than embeds of the video in a player itself. Not that Mark and the Defrag Tool guys aren’t handsome or anything, its more because I just hate seeing the Flash SWP pre-load in everyone’s web-browser when I then get behind in posting and you fans are hit with it when you land on a GSD blog page with embedded video and you aren’t using a Flash-blocking plugin, or have it disabled for my blog.

(the evidence as seen in Process Explorer as happened back from April 2013 - late June 2013 )

General philosophy: wipe the baby and keep it, toss the diapers

Why wiping decommissioned IT assets should be a must - Help Net Security - Duh.

The cost of cleaning up - ISC Diary

GrandStreamDreams blog has written heavily regarding securely wiping hard drives. It should be a no-brainer in today’s digital age…and coupled with some whole disk encryption (to boot). Likewise I just can’t grasp how it is cheaper to trash 170 PC’s because they were infected rather than having a secure-wipe/standard-image reload process. Don’t skip the ISC Diary article’s Comments section.

Sysinternals/Pass the Hash TechEd North America talks

Sysinternals - and Pass the Hash - at TechEd next week- Aaron Margosis' "Non-Admin" and App-Compat WebLog - These were five keynote talks back from June. In case you couldn’t stop by New Orleans last month, you got some serious catching up to do now!

• License to Kill: Malware Hunting with the Sysinternals Tools - Channel 9 - Mark Russinovich presenting
• Case of the Unexplained 2013: Windows Troubleshooting with Mark Russinovich - Channel 9 - Mark Russinovich presenting
• Sysinternals Primer: TechEd 2013 Edition - Channel 9 - Aaron Margosis presenting
• Pass the Hash and Other Credential Theft and Reuse: Preventing Lateral Movement and Privilege Escalation - Channel 9 - Aaron Margosis, Mark Simos presenting
• Defrag Tools: Live - TechEd USA 2013 - Channel 9 - Andrew Richards presenting

The Case of…

Case of the Slow Logon – Anti-Virus vs 3rd Party Application - chentiangemalc

Case of the Windows 8 Explorer Hang – Part 1 - chentiangemalc

Defrag Tools takes on Windows Performance Toolkit

You may recall the GSD blog post Case of the Unexplained Donut of Death where I started out using Windows 7 Xperf tool to do some performance troubleshooting. I then jumped from it to the new WPT set in Windows 8 SDK and outlined just how amazing the level of logging detail and analysis was.

As the time there was not a considerable amount of documentation out for us mere mortals on how leverage the true power the tools contained.

No more. The team at Channel 9 has hit the ground hard with a series of videos going into the details on the tool and its features. I suspect more will come. Now I can really start figuring out what all those indicators shown above really mean!

• Defrag Tools: #39 - Windows Performance Toolkit
• Defrag Tools: #40 - WPT - WPR & WPA
• Defrag Tools: #41 - WPT - Command Line
• Defrag Tools: #42 - WPT - CPU Analysis
• Defrag Tools: #43 - WPT - Wait Analysis
• Defrag Tools: #44 - WPT - DiskIO Analysis
• Defrag Tools: #45 - WPT - File & Registry Analysis
• Defrag Tools: #46 - WPT - Driver Analysis
• Defrag Tools: #47 - WPT - MiniFilter Analysis
• Defrag Tools: #48 - WPT - Memory Analysis - Pool

Offline Windows Updating

WSUS Offline Update - I have been a longtime fan of this tool, updated a few days ago to version 8.5. I never leave my cubicle to respond to a system or re-image/deployment without it on my USB stick. It is the #1 tool I know of to help conserve bandwidth and minimize impact at a site where we are doing a deployment. It remains highly Valca recommended! If you are a Windows PC deployment tech or analyst and you don’t have this tool, you either have some super-big circuits, an internal WSUS server, or you can swagger like Beckham and just don’t care.

Portable Update - This “bravo-ware” tool is new to me. Like WSUS Offline Updater, once built you can use it to redeploy Windows/MS patches to a target system. The process seems considerably different that USUS-OU but it may work better for your needs. I’m hoping to test it soon and have a better side-by-side experience to compare them against. For more information on the tool check out the application’s How to use page as well as this AddictiveTips post: Apply Windows Update To Multiple PCs From A USB Drive While Offline.

SysAdmin Tips

Run any app under the NT Authority\Local System account - TinyApps.org - Comparison between ETS (Elevate To System) tool (it has an optional GUI) and psexec.exe from Sysinternals.

FREE: Get Local Admins GUI – Find users with administrator rights - 4sysops

How To Make UEFI Bootable USB Flash Drive to Install Windows 8 - Next of Windows

Making a better, somewhat prettier, but definitely more functional Windows Command Line - Scott Hanselman’s ComputerZen blog

How To Quickly Unlock Local Administrator Account in Windows 8 - Next of Windows

Finally a Windows Task Manager Performance tab blog! - Ask the Performance Team

SysAdmin Utility & Software Leads

Updates: Mark's TechEd Sessions, Autoruns v11.61, Strings v2.52, ZoomIt v4.5 - Sysinternals Site Discussion

Updates: Autoruns v11.6, Procexp v15.31, Procmon v3.05, Sigcheck v1.92 - Sysinternals Site Discussion

Update: Autoruns v11.62 - Sysinternals Site Discussion

Free Windows virtual machines for Mac, Linux, or Windows - TinyApps.org blog - Official developer virtual machine files for XP, Vista, WIn7 and Win 8. These are really for Internet Explorer developers but are great for other software testing purposes. Even more details here: Making Internet Explorer Testing Easier with new IE VMs - Rey Bango.  Main VM’s download link here.

CopyToFlash - Foolish IT - This could be really dangerous. REALLY dangerous. Like most stuff over at Foolish IT. However it could just be dead-helpful for the right audience and application. Basically it just starts a drive monitoring process and then (with a few configuration actions) will copy the contents of a monitored source folder location to any USB flash drive that attaches to the system. Yeah. Dangerous but helpful if you are responsible for updating new content to tons of USB sticks. Oh, did you know it uses RoboCopy? Yep.

Office 2010 Service Pack 2 Released…(mostly)

Just in time after a major Office 2010 rollout at our coal-mine. Nice timing guys…

Microsoft delivers Office 2010 Service Pack 2 - ZDNet - Mary Jo Foley

Office 2010 and SharePoint 2010 Service Pack 2 Availability - Office Sustained Engineering Blog

Description of Office 2010 SP2 - Microsoft Support

How to obtain and install the service pack

Method 1: Microsoft Update (recommended)

Note In addition to the products in the Office 2010 suite, the service pack 2687455 also updates Microsoft Project 2010, Microsoft Visio 2010, and Microsoft SharePoint Designer 2010.

To download the service pack from Microsoft Update, go to the following Microsoft website:

Microsoft Update

You can opt in a computer to the Microsoft Update service, and then register that service with the Automatic updates to receive the SP2 update. Microsoft Update will detect which products that you have installed, and then apply all updates to the products.

Method 2: Download the SP2 package from Microsoft Download Center

The following files are available for download from the Microsoft Download Center:

• Download the Microsoft Office 2010 Service Pack 2 32-bit package now.
• Download the Microsoft Office 2010 Service Pack 2 64-bit package now.

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

For more information about a complete list of all released SP2 desktop packages, click the following article number to view the article in the Microsoft Knowledge Base:

2687521 List of all Office 2010 SP2 packages

Cheers,

Claus Valca

Read More

For-Sec & Utility Jumble Linkfest

The short weekend is done. The “Sandy Watch” is on for what could be -- for our northeastern friends -- a storm event to be remembered for many years to come. So comes a pile of security/forensic and utility-minded links spill out below for the curious and information hungry.

Forensics and Security

Girl, Unallocated: Be Very Quiet... I'm Tracking Emails Through Headers - Girl, Unallocated Blog. The Girl has a great post looking at email headers and their bits and perils. One gem is a report (PDF) from Stroz Friedberg and a particular focus on email headers. The report as a whole is a great read and again provides a lesson in technical report writing and presentation as well as some forensics pushback on anti-forensics techniques. At 102 pages, it isn’t a brief, but well worth the time to download and study.

The Girl’s post reminded me of another great publicly-available report that addressed emails in a forensic investigation.  In my GSD post Interesting Malware in Email Attempt - URL Scanner Links, I wrote the following bits at the end:

A recent Digital Forensics Case Leads post has mention of a super-fantastic investigation/forensic report involving anonymous emails. This is must-read material, not just in terms of the investigative methodology but also the way the report was composed and presented. Very clearly done!  I’m keeping a saved copy of the report for future reference; both technically and as a report template. From the post via the link above:

“University of Illinois recently released a detailed investigation report (PDF) regarding anonymous emails allegedly sent by its Chief of Staff to the University's Senates Conference. The report is an interesting read, and also serves as a potentially useful model for those looking for report samples and templates.”

How a Google Headhunter's E-Mail Unraveled a Massive Net Security Hole - Threat Level @ Wired.com.  I almost overlooked Kim Zetter’s post on how Mathematician Zach Harris -- as an exercise -- discovered a flaw in some providers user of a weak DKIM key to sign emails originating from them. Fascinating and short read.

DEFT 7.2 and DEFT english manual, ready for download! DEFT Linux - Computer Forensics live cd . New DEFT version out. Last one in x32 bits. Future versions will be strictly x64 flavored.

Xplico – Xplico 1.0.1 - Xplico new version release just dropped. From the brief post:

ChangeLog:

• nDPI integration
• performace improved
• FTP dissector improved
• Added the prism dissector
• CLI execution bug fixed
• PCAP-over-IP SSL encryption
• IRC dissector improved
• File reconstruction from Fragmented Payloads improved
• FaceBook Chat updated
• FaceBook Message (partial)
• HTTP without initial packets (packets lost)
• RTP dissector improved
• PCAP2WAV, RTP2WAV interface added

And don’t forget! Now you can update/get via apt-get! for Ubuntu 11.04 and higher.  Sweet!

sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" >> /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico

LastActivityView - Nirsoft brand new utility! - Use this new tool to view the latest computer activity in Windows operating system. Nir Softer has some more details on his NirBlog: New utility that shows general computer activity. Could be useful for incident response and analysis and other “quick peeks” for key system activity indicators to narrow down the search.

FileAlyzer Portable 2.0.5.57 (detailed file analyzer) Released -PortableApps.com

Hacking KeyLoggers - Open Security Research has a great post that not only identified a USB keylogging device, but takes it to the next level in hacking it to determine the impact of the device and when it might have been dropped. Clever stuff.

Attacking TrueCrypt - The H Security: News and Features. Another interesting post that almost slipped by me. Interesting by itself but also shows the benefit of using “cascaded algorithms” in TrueCrypt to thwart current attacks…for now.

Restoration of defocused and blurred images - Yuzhikov.com. This is super cool.  Vladimir Yuzhikov hasn’t just done a proof of concept for de-fuzzing blurred imaged (either out of focus or those blurred with a mathematical algorithm), no, he has actually released a free Windows app to demonstrate the possibilities. Besides images, text that is out of focus can be unblurred as well. This is very fascinating and could assist investigators facing images and other digital files with blurred faces or content. It’s not exactly easy or guaranteed to work, but it is very promising start and Vladimir notes he is continuing development and refinement. Read his work please and snag the download.

Google Drive opens backdoor to Google accounts - The H Security: News and Features . Quoting from the post, “The Windows and Mac OS X desktop clients for Google's Drive file storage and synchronisation service open a backdoor to users' Google accounts which could allow the curious to access a Drive user's email, contacts and calendar entries.”  read the post for more info. As usual it seems to be a convenience versus security trade-off again. Choose your cake wisely. I stick with using only the web interfaces and pass on the client versions of these cloud-based storages services…for now.

Virtualization

The TinyApps bloggist has been hard at work digging out great tips and techniques for importing the virtualized “Windows XP Mode” into popular virtualization software. As always, the posts are impeccable with lots of details and supporting source documentation for additional study and research.

• Import Windows XP Mode into VMWare Player - TinyApps.org blog
• Import Windows XP Mode into VirtualBox - TinyApps.org blog
• Must-have tool for VirtualBox users - TinyApps.org blog.

Oracle VM VirtualBox - Version 4.2.4 just dropped…by the way. I almost missed it were it not for my RSS feed filters. See the changelog for more details.  And be sure to grab the 4.2.4 VM VirtualBox Extension Pack as well.

Miles’ posts reminded me of an earlier GSD summer post Virtual Solutions and his great post comment guiding me to getting MS’s IE VirtualPC images running in Virtual Box.

How to run Microsoft’s IE VPC images in VirtualBox
http://tumblr.jonthornton.com/post/11405634980/how-to-run-microsofts-ie-vpc-images-in-virtualbox

ievms - Automated installation of the Microsoft IE App Compat virtual machines
https://github.com/xdissent/ievms

Browser Plugin Update Time…Again.

Yes dear readers, it is “Jack and Jill” time again. Bother.

Adobe Shockwave got updated, as of this post, the newest (Windows) version of Adobe Shockwave is currently 11.6.8.638.

• Adobe - Adobe Shockwave Player - direct download
• Adobe - Security Bulletin: APSB12-23 - Security updates available for Adobe Shockwave Player - Adobe
• Adobe patches 6 critical security flaws in Shockwave - ZDNet
• Adobe fixes critical Shockwave vulnerabilities - The H Security: News and Features

Adobe Flash was updated as well. Newest (Windows) version is currently 11.4.402.287.

• Adobe - Flash Player - version information
• Adobe releases 25 critical Flash patches - The H Security: News and Features
• Adobe - Security Bulletins: APSB12-22 - Security updates available for Adobe Flash Player - Adobe

Java also got a quick update to both build versions. Windows Java updates are available in 1.6.0_36 and 1.7.0_09.

• Java SE 6 Update Release Notes - Oracle
• Java SE 7 Update Release Notes - Oracle
• Java SE Downloads - Direct download

Trying to figure out if all your browser plug-ins are current can be a super-pain for the inexperienced and geekless.

My go-to recommendation remains to pop over to Qualys BrowserCheck in each of your installed web-browsers, be it Chrome, Windows IE, or Firefox. Alas, Opera, Safari, and other browsers are not currently supported, however a check in one of the supported browsers may quite likely uncover a outdated plug in, patching it may fix the others in the process.  For a backup check, hope over next to The Secunia Online Software Inspector for a second opinion.

If you want a good all-in-one location to manually download your plugs, check out Browsers and Plugins Downloads over at FileHippo.com.

Utility and SysAdmin Finds of the Week

Defrag Tools: #13 - WinDbg - Defrag Tools @ Channel 9. New video on Sysinternals tool usage; specifically integrating Debugging Tools for Windows.

Case of the CertUtil Import Refusing The Correct Password - chentiangemalc. Great practicum post on troubleshooting a strange password error where the password was correct but not being taken.

SpeedyFox - Boost Firefox,Skype,Chrome,Thunderbird in a Single Click! - CRYSTALIDEA Software . It has been forever…like dinosaurs roaming the earth eras ago…since I last saw any post anywhere on speeding up a pokey Firefox browser by “optimizing” the JSON databases. This is a dead-simple process to improve launch-time for a well-used Firefox browser. It’s been months since I last optimized mine. When I went to run SpeedyFox, my favorite tool to do so, I wondered if there had been an updated release. My version was at least a year old.  Happily I found there was a newer version, and that it now supports optimizing Chrome-based browsers as well. It remains available as a free edition. Current version is 2.0.3 but while I was sleeping, the developers have been adding support for Skype, Chrome (including SRWare Iron and Pale Moon), Mozilla Thunderbird, and Firefox (including Epic Browser). There is a Mac version (Firefox only) also.

If you use Firefox/Chrome/Thunderbird, stop, drop and run right now!  Did I mention it supports custom paths to your browser profiles so you can optimize portable versions on your drive/disks? Sweet baby Jebus!

CR2 Converter - I shot a lot of photos for Lavie and her family last weekend with the Canon 5D Mark II.  Pops asked for copies and when I was getting ready to pass them off, I realized I had not changed the setting from “RAW” only to RAW+JPEG. So I had over 300 digital images in RAW .cr2 format that his computer cannot read and that are not really a practical format for him anyway to use. Sure, I could batch-convert them in Lightroom/Photoshop, but I really just needed to get them quickly on a CD for him.  I have more than a few RAW freeware tools for tweaking individual RAW file images but that was too time-consuming to use. Luckily, with just a bit of Google diving, I found the freeware Canon RAW Image Converter “CR2 Converter”.   It supports batch-conversion and did an acceptable job for this task. My i7 x64 8 GB RAM system chewed through converting the files in no-time.  To my eyes the resulting images were a bit lightly purple-tinted…not bad or unpleasant but definitely noticeable when compared to the RAW file. Nothing that some simple color correction can’t fix if really important. For Pops it wasn’t but YMMV.  I wouldn’t use it everyday for batch processing but for quick-n-dirty RAW .cr2 to JPEG/JPG/GIF/BMP/PNG/TIFF conversions it is a super time-saver. Tuck it away for when needed in a pinch.

Cheers and hopes and prayers for the very best across the north-east seaboard as Sandy rolls in.

--Claus V.

Read More

Windows 8 - “It’s here” edition

I don’t know…it seemed like an appropriate lead-in to this Windows 8 post now that Windows 8 has been officially released.

• Poltergeist freaked a LOT of folks out when first released, with special effects, plotline of a normal family with their normal lives torn apart by a new evil released by new building over a hallowed ground.
• Heather O'Rourke as Carol Anne Freeling looks like she is reaching out to try to use the TV as a “touch/Surface” interface.  And she does get quite the interactive experience out of it!
• What seemed like pretty successful mainstream horror at the time now has become --over time and filmmaking sophistication--pretty cheesy and not even Halloween showing worthy to the youth of today.  Despite this, it remains regarded by many as a horror movie classic and possibly one of the very best and beloved ever made.
• A number of the actors that made the movie so compelling have since died fueling rumors the movie was cursed.

I wonder if Windows 8 will leave a similar mark on the Microsoft OS landscape?

So before we get to the Win8 linkage below, what’s my opinion?

• No “Family Pack” available…at least for now. However the $40/upgrade price per system still beats the Win7 family pack price so to upgrade our systems one-at-a-time this would still be fairly economical. In fact, Alvis's recent laptop purchase this summer might qualify for an even steeper discount…if I dared put it on her system.  Which I do not.
• I am not going to install Win-8 on any of our home systems, all running Win 7 Home Premium (x64) for now. Why? Well…
• …Win7 is too solid and perfect for my needs right now. I have no compelling reason to upgrade to Win8 just yet. Yes, I will miss out on the even faster boot times, the enhanced file/copy features, and the super-cool task-manager, and those crazy tile-apps. I can live with that for now.
• In running Win8 in a virtual machine pretty regularly now, I can comfortably work-around automatically bypassing the Start Screen interface and add back the traditional Start Menu. That will no longer be my primary concern or objection for NOT making the Win8 upgrade.
• Windows 8 is here to stay. This is the new face of Microsoft. Get over it. Get it. Or get a Mac or Linux or a Chromebook or a tablet or a game-console. Seriously. The days of desktop systems are on the decline. Sure, there will always be some hard-core geeks and freaks who will always want and need a traditional “desktop” based interface and OS system but between DRM  & DCMA changes, a brand-new, cutting-edge, super-efficient and user/platform agnostic computing technology is coming! Deal with it. They are called Smart dumb-terminals/tablets/phones & The Cloud!
• Umm…sorry, I forgot, that terminal/mainframe technology was how things got started in the first place before all that “personal computer” technology got us distracted on his march down a dead branch of the technology tree; kinda like how the railroad and Model-T’s got us all horribly sidetracked from the horse-n-buggy technology. My bad. Let’s head back to the past to make progress for the people again. Control the medium…control the message…control the consumption.

Sigh.

Drama aside, I’ll probably upgrade our systems to Windows 8 by spring of next year. It will need some post-install tweaking, some training to get up to speed for support and user navigation, stuff like that. However at the core, past all the interface changes and Modern versus Desktop usage sea-change, it seems to be a solid and advanced OS. I wouldn’t discourage folks looking to pick up a new system from adopting it. I wouldn’t discourage friends and family still using XP/Vista to switch to it. What I can’t do is find a compelling reason to try to convince anyone using Windows 7 right now on a system they have bought or built in the last two years or so to UPGRADE to Windows 8. Not yet at least.

Windows 8 could have been so much more by just being a bit more balanced between the old and the new. Instead they decided to go boldly forward and not look back.

Time will tell…but for now…”It’s here”.

If you like Windows…my advise is just deal with Windows 8 and try not to look too hard at the corpses popping out of the pit in the back-yard.

HUMOR: Ah. So that’s what happened. - Kurt Shintaku's Blog

Win8 - Start Here - Get It

• Microsoft Windows - Microsoft
• Reserve your copy of Windows 8 Pro and Pre-order Windows 8 PCs today! - Blogging Windows
• Windows Upgrade Offer - Landing Page - Microsoft
• FAQ: The ins and out of Windows 8 pricing - Computerworld
• Microsoft’s first stab at a tablet: Surface reviewed - Ars Technica
• Download Windows 8 Media Center Pack for free - The Windows Club

Win8 - Related Products and Services

• nothing new of note since last post.

Win8 - Install It

• How To Install Windows 8 From A USB Stick - MakeUseOf blog
• Microsoft Security Advisory (2755801): Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10 - Microsoft TechNet
• The Windows 8 upgrade install experience - Ars Technica
• Installation FAQ & diagnosis when Windows dies 8 Setup ... Part 1 - Borns IT & Windows Blog
• Windows 8 Installation & Setup troubleshooting FAQ ... Part 2 - Borns IT & Windows Blog
• How To Install Windows 8 As Guest OS Using VMware Player - Addictive Tips

Win8 - Under the Hood

• Windows, reimagined: A review of Windows 8 - Ars Technica
• Windows 8 review - BetaNews
• Introducing the Remote Desktop Windows Store App - Remote Desktop Services (Terminal Services) Team Blog
• Remote Desktop Windows Store app: Managing multiple PCs - Remote Desktop Services (Terminal Services) Team Blog
• Windows 8: rejuvenation of old computers? - Borns IT & Windows Blog
• Windows 8–Metered Connections - Anything about IT
• Windows 8 / Windows Server 2012: Faster Boot Process - Ask the Performance Team
• Maintenance in Progress Windows 8 What Does it Mean ? - Windows7hacker
• Windows 8 / Windows Server 2012: File Explorer - Ask the Performance Team
• Gentlemen, start your benches: Measuring Windows 8′s performance - Ars Technica
• A visual tour of Windows 8 - Ars Technica
• Removing Built-in Applications from Windows 8 - The Deployment Guys
• Review: Bing Apps are fast, slick, and responsive - Ars Technica
• The new and updated games of Windows 8 - Ars Technica

Win8 - To Go

• nothing new of note since last post.

Win8 - Tweaks

• Create Custom Windows 8 Start Screen Tiles Out Of Your Images - AddictiveTips
• Add Windows 7 Start Menu & Start Orb To Windows 8 With StartMenu 8 - AddictiveTips
• IObit StartMenu8 Free download, Bring Start Menu back to Windows 8 -IObit
• Prevent Users From Changing Windows 8 Start Screen Background - AddictiveTips
• Create Custom Windows 8 Start Screen Tiles For Programs & More - AddictiveTIps
• Create A Grid Of Custom Windows 8 Start Screen Tiles Out Of Any Image - AddictiveTips
• Pin Any Program, Folder Or Item To Windows 8 Start Screen - AddictiveTips
• Windows 7 & 8: Shutdown & Co via the context menu - Borns IT & Windows Blog
• Microsoft Rolls Out Windows 8 "Service Pack" - Before Its Launch -ReadWrite
• User Account Picture - Change in Windows 8 - Windows 8 Forums
• Windows 8 Tutorials - Windows 8 Forums
• Pokki For Windows 8 Adds A Start Menu & Start Screen Bypass Controls - AddictiveTips
• HOWTO: Add names to Program Groups in Windows 8 - Kurt Shintaku's Blog
• Top 20 Windows 8 Tweaks, Hacks & Tips - AddictiveTIps
• How to Change the Default Search Provider in Internet Explorer 10 - Groovy Post
• Top 10 Secret Features in Windows 8 - Lifehacker
• Best Windows 8 Start Screen Modifiers And Start Menu Apps - AddictiveTips
• Personalization Gallery - Now merged at Microsoft.com
• How to enable multi-user concurrent Remote Desktop sessions in Windows 8 -Tenniswood Blog - See post update below.

Post Update: On October 29th, Kent over at Windows 7 Hacker blog picked up the technique from Tenniswood Blog I posted above (and included a hat-tip back-link here to GSD) regarding a patch to enable multi-user concurrent Remote Desktop sessions in Win 8. It seemed very similar to one for Windows 7 I had posted about three years ago (RDC hack post & followup clarification post) so I didn’t think much of it. I did not install it on my own virtual Windows 8 test system. A few days later a dear friend emailed me his perspective about the patch and potential concerns. So I’m coming back and adding a few more thoughts. First the technique requires application of Windows 8 Patcher which changes some Windows OS file binaries to enable the process to work and can remove the watermark from Windows 8 Release Preview. Second, I’m no programmer so I cannot fairly analyze the source code to confirm it may not have other effects on the system/stability/security once modified. It seems to be based on or very similar to prior Win 7 work for the same feature enablement. The developer of the code is a very smart and clever programmer and has given a number of presentations in the computer security industry; his best work is in the field of bootkits and rootkits. Back in 2009 there was a bit of love/hate swirling around the security industry based on some of his work. All this to say, please treat with consideration the application of the patch with care and forethought. It should fall under the “here may be dragons” label. Is this a feature you really, really need on your Windows system? Are there vetted/stable alternatives you have already explored first and found lacking? Have you done due-diligence and after reviewing the open-source code provided found it sufficiently clear and safe for your purpose? Is this a patch you are authorized to apply to a system? All I am saying is read the whole forum thread to familiarize yourself with it first.I confess I find it technically interesting, but TightVNC meets my remote session needs and I don’t need to run multi-user concurrent sessions on my personal Windows 7/8 boxes. Do you really need it? If you do apply the patch, future Microsoft updates may impact how the patched system works (or even prevent it from working). Enough said. Moving on…

Win8 - Deeper Insights

• Out Now: Windows 8 and 2012 Group Policy Reference Spread sheet - Windows 7 Hacker
• DOWNLOAD: Group Policy Settings Reference for Windows (8) and Windows Server (2012) - Kurt Shintaku's Blog
• Updating our built-in apps for Windows 8 - Building Windows 8
• Microsoft: Windows 8 seam with the end of the service packs? - Borns IT & Windows Blog
• Windows 8 “XP Mode” – Part 1: Hyper-V - 4sysops
• Windows 8 “XP Mode” – Part 2: Setting up Windows XP - 4sysops
• Windows 8 “XP Mode” – Part 3: Gotchas - 4sysops
• hiberfil.sys in Windows 8 and why you should never delete it by disabling hibernation -Windows7hacker
• Windows 8 Start Screen Customization with MDT - The Deployment Guys
• Turning to the past to power Windows’ future: An in-depth look at WinRT -Ars Technica

Win8 - Usage Tips

• How To Defrag Disks in Windows 8, including SSD Drives - Windows7hacker
• Prevent Windows 8 File Explorer From Deleting Image Thumbnail Cache - AddictiveTips
• Windows 8 wireless networking – Part 2 - 4sysops
• Multimedia 8 is a native Windows 8 app alternative to media player - Windows7hacker
• Download Work Smart Guides for Windows 8 & Internet Explorer 10 - The Windows Club
• Metro Commander: Windows 8 Modern UI File Manager With SkyDrive Sync - AddictiveTips
• Listen To Your Favorite Radio Stations In Windows 8 With TuneIn Radio - AddictiveTips
• Norton Satellite For Windows 8: Scan Local & Dropbox Files For Malware - AddictiveTips
• Browse Google Maps & Get Turn-By-Turn Directions In Windows 8 - AddictiveTips
• The Official Google Search App For Windows 8 Now Available - AddictiveTips
• Windows 8′s Start Screen: Navigating a brave new world - Chron.com’s TechBlog
• DOWNLOAD Getting Started: Your Guide To Windows 8 - MakeUseOf Blog
• Windows 8 / Windows Server 2012: Start Screen and User Interface Part 1 - Ask the Performance Team
• Windows 8 Review - Complete Guide To New Features - AddictiveTips
• Windows 8: A safe harbor with the ‘classic’ desktop - Chron.com’s TechBlog
• Remote Desktop App TeamViewer Touch Comes To Windows 8 - AddictiveTips
• Windows 8: Sleek apps for Mail, Music and Photos - Chron.com’s TechBlog

Win8 - Miscellanea, Rumors, & General Grumblings

• Is Windows 8 Already In Trouble? Survey Says Most Win 8 Users Prefer Win 7 - ReadWrite
• NEWS: The early returns on Windows 8 (Updated 10/23/12) - Kurt Shintaku's Blog
• Why Windows Just Can't Win - Wired.com
• Could Restoring The Windows 8 Start Button Fix Everything?  - ReadWrite
• Op-Ed: Prepare for Windows 8 induced user rage - Ars Technica
• Paul’s take on Windows 8 - Paul Allen’s Idea Man
• Top 10 Windows 8 Features #1: The Windows Store - ReadWrite
• Microsoft co-founder dings Windows 8 as 'puzzling, confusing' - ComputerWorld
• First Windows 8 PCs appear early, crapware included - ZDNet’s Ed Bott 
• Acer, Gateway already shipping Windows 8 PCs – crapware included - Chron.com’s TechBlog
• 5 big reasons businesses should consider Windows 8 - BetaNews
• Conflicted: The tension in Windows 8 - Chron.com’s TechBlog

Windows 8 - GSD Previously Posted

• Windows 8 Linkage: “Majestic Metro” version
• Windows 8 Linkage: “Passage Public Metro” version
• Windows 8 Linkage: “Metro Santiago” edition
• Windows 8 Linkage: “Metro at Nightfall” edition
• Windows 8 Linkage: Product Name “Something or Another”
• Windows 8 Linkage: In Which a Name is Chosen
• Windows 8 Linkage: A Bit Behind the Ball

Cheers and good luck.

--Claus V.

Read More

Virtual Solutions

Continuing in the troubleshooting theme today, here are a couple of solutions I worked out playing with some virtualization software and machines this weekend.

Tip # 1 - Microsoft Tester VHD images still available

When I moved to my “then new” laptop, I ended up discarding a lot of virtual machine images I had been keeping around to testing and lab-work. One of which was an XP tester build in Microsoft’s Windows Virtual PC.

While Virtual PC on XP had been pretty easy to use, the “embedded” operation of it in Windows 7 is a bit more of a headache. (Note: I wonder if Windows 8 will retain an “XP Mode” feature? Anybody know?). So I had dumped them when I started using Oracle VM VirtualBox.

Last week I needed to do some work in XP again and decided to grab one of Microsoft’s IE App Compat VHD’s over at the Microsoft Download Center.  I snagged the tiny (by comparison Windows_XP_IE6.exe) package. They also have some larger Vista/Win7 VHD packages also.

While these do time out/expire (they can be “re-armed” following the instructions on the download page above), they provide a quick and easy way to grab and run XP for testing purposes.

Tip # 2 - Converting other virtual disks to VMware format

(Alert: dead-end coming)

While I was able to get the XP VHD working just fine in Virtual PC on my Windows 8 system, I wondered if the performance would be better in VMware Player. It also has slick support for “Unity” which is a “XP Mode” feature that doesn’t require you to be using Windows 7 in Professional/Ultimate builds.

So I figured I would just convert the VHD file and convert it to the VMWare format and roll on.

First I tried StarWind Free V2V converter. Downloaded and installed OK with no fuss, however when I tried to launch the converted VMDK file in VMware, it bombed out.  That said, I’m still keeping it around as I suspect something else was going on and it wasn’t an issue with the software.

Next I read about WinImage which per a handy post from VMpros, can convert VHD to VMDK. However since it is trial-ware, I decided to skip that option.

Finally, I settled on the free VMware vCenter Converter. Download requires registration with VMware but it was painless and the application was a breeze to use. In no-time it converted my VHD file to VMDK format and I had it running in VMware Player. For a good walkthrough check out this AddictiveTips post Convert & Use Your Physical Machine In VMware, VirtualBox & Virtual PC.

Well…not really.  See as I found out (and should have remembered but it has been too long) the Microsoft IE Tester images are set up only for Virtual PC specific “hardware”. By that I mean while you can convert them to another virtualization platform, XP will then see that your “hardware” has changed and require re-activation and require you to put in a fresh product key from scratch to activate it.  I suppose a clever person could work around it and get it working in VMware, but that would seemingly violate the EULA agreement for these packages.

Like I said, this lead to a dead-end, but it was fruitful in finding the Microsoft IE Tester packages are still available for use and (for a bit longer) still offer XP as an option.  Also, I found the VMware vCenter Converter software to be wonderful to use and am sure I will rely on it more in the future.

Tip # 3 - Don’t Forget your old install media

After the dead-end above, I remembered I still had an old XP Home (SP1a) install disk and license I had bought when I built my first small-form-factor desktop. Since that time, all the newer systems we bought came pre-loaded with Vista/7 so eventually that SFF system (and the XP load) were wiped clean and while the SFF box patiently waits re-purposing to FreeNAS one day, the XP Home OS has not been used since.

So I used it to build/activate a fresh install directly in VMware Player and got it fully patched/updated and running smoothly for all my XP testing needs.

Tip # 4 - Getting ChromiumOS (Hexxeh’s Vanilla builds) running in VirtualBox

After all the fun I was having getting these virtual systems tweaked, on a whim I decided I wanted to check out Chromium OS.

I decided to take the easy way out and use a “Vanilla” build of the Chromium OS builds by Hexxeh. I downloaded the VirtualBox file, got it configured in VirtualBox and launched away.

Only while it ran fine, I couldn’t get though the first-launch setup landing page I because the “network” was unavailable and no networks were offered. I was using “NAT” setting but no dice.

I did some digging and found that there were a number of folks with Questions Tagged With network - CrOS QA in the forums.

Took a while but I finally figured out the trick (at least if you NAT for network connection on VirtualBox).

Go into the Network settings for your ChromiumOS virtual machine. if you NAT by default it should look like this.

Next click the “Advanced” triangle (as shown above) to expand it.

Change the adapter type to an appropriate "Intel PRO” interface. Your options may appear differently from the one I selected below.

Save your settings and re-launch the virtual machine.

This time the network was available and I was able to complete the setup and running of Hexxeh’s ChromiumOS build with no issues.

I need to play more with it before posting my opinions but it worked just fine.

Tip # 5 - VirtualBox supports Windows 8 “natively” now.

In my recent Windows 8 GSD blog post I bemoaned being able to successfully install the VirtualBox additions into my Windows 8 Consumer Preview build in VirtualBox.

Thanks to the comments of a kind anonymous tipster, I realized many older “how-to” instructions on the process on the web recommended selecting “Windows 7” as the OS type during the creation process, then running the VirtualBox Additions in “Compatibility Mode” to install. The newer versions of VirtualBox now offer “Windows 8” as an OS type during the virtual machine setup process and if done so, you can just run the Additions “as-is” with no need to do so in Compatibility mode. They go on just fine.

Anyway…by the time I had already figured this out I had since followed an Install Windows 8 Consumer Preview on VMware Player that worked so seamlessly I don’t think I’ll use VirtualBox for Windows 8 testing at this time. YMMV.

Tip # 5.5 - VirtualBox 4.1.1.16 now out

On 2012-05-22 Oracle released a new version of VirtualBox: Changelog – Oracle VM VirtualBox

Get the Download – Oracle VM VirtualBox along with the matching VirtualBox 4.1.16 Oracle VM VirtualBox Extension Pack that is also on that page.

Tip # 6 - More Virtualization Tippage sites/blogs

By no means complete, these sites seem to have great tips on virtualization platforms.

• Virtual PC Guy's Blog - Ben Armstrong’s MSDN Blog
• Virtualization Resource Site: Articles & Tutorials - VirtualizationAdmin.com - Check the sidebar for great linkages.
• VMPros - Lots of good community expert posts here!

Cheers.

--Claus V.

Read More

Mostly for Sysadmins and Windows Tweakers

One last linkfest dump before I turn my attention back to a freshly arrived hardback copy of George R. R. Martin’s A Game of Thrones to close out this dark, drizzly and fast-chilling night here on the Gulf Coast. My brother is deep into the book/HBO series and I think he runs an underground distributed book club network of sorts on it. Hence his gifting me this newfound wonder.

This linkfest is a collection of stuff mostly of interest to system administrators and Windows tweakers…your interest level may vary.

Looking at page hits (which I rarely do) it seems that the following posts remain all-time GSD favorites for some reason.

Blocking IE 8 "InPrivate" Mode

Blocking IE 8 "InPrivate" Mode – Updated

Some folks had issues following the steps to make their own REG files to enable/disable “InPrivate” mode on their own system, so I did some and posted the download linkage in the comments section.

I've created the registry keys myself and uploaded them to a shared folder on box.net. http://www.box.net/shared/b0fr5x0qg2

Click that link (or copy/paste it into your browser address bar) then download the "IE8InPrivateMode-Disabled.reg" file directly to your PC.

Depending on your anti-virus application it may complain as .reg files could be malicious. If you want to check, simply open it in Notepad to see that it matches what I have listed on my blog post.

Once you have it download it, right-click on the file and select the "Merge" option.
Depending on your version of Windows and the user-rights of your profile, you may have to confirm some warnings. If all goes well it should be added to the registry and when you re-launch IE8, you should see the option grayed out.

The other registry key in that folder re-enables the option. Follow the same steps and it will allow InPrivate Mode option to work again, unless blocked differently by one of Microsoft's Family Safety programs...

They work on both IE 8 and IE 9 by the way despite the posts being IE 8 centric at the time.

Anyway, the other day I noted this post Internet Explorer InPrivate Browsing Enable or Disable - Windows 7 Forums.  In it, “Brink” also offered some download REG files for merging into the registry.  Out of curiosity I compared them and they were pretty much the same except where my REG files just cover the HKEY_LOCAL_MACHINE key location, Brinks keys have that as well as one for the HKEY_CURRENT_USER key location as well. So basically with Brink’s you get a two-fer deal.

Mine or Brinks…take your pick.

How to REALLY hurt yourself with PSEXEC - Deleting the Undeletable Registry Key and More - Scott Hanselman Computer Zen- Scott’s battle with a “undeletable” registry key makes for a fun read. That said, while his PsExec method worked, I’ve had fantastic success when I’ve run into similar keys on malware-infected systems by using Malwarebytes : RegASSASSIN. I don’t know for sure if it would have helped in Scott’s issue, but I would try that first via the GUI it offers before dropping to the PsExec CLI work (though it is really cool). Related for difficult to delete files: Malwarebytes : FileASSASSIN.

It has been over 4 years now since I set Dad up on his Vista system at his house. In that process I ran into a challenge; how to get his and his wife’s profiles to display at different screen resolutions? She liked a relatively low resolution to see things larger, while dad liked the highest resolution to get the best screen display quality.  In my post of my fix Vista/XP Quick Screen Resolution Toggle Tip I used ResSwitch & ResCopy to create custom desktop icons that lets them just click-to-set the display level at their preference rather than digging into the properties each time.  So when I read this post at Windowshacker How To Set Different Screen Resolution for Individual User in Windows 7, I was curious.  Turns out there is a neat freeware product called Carroll that almost automagically can set individual screen resolution for every user when they log in.  No more clicking desktop icons. And it only took 4 years to get here!

Just in case it keeps you up at night fretting about the text for your Windows desktop icons being underneath them, the Windows Club offers a tip on D-Color which can Display Desktop icons text on the side in Windows 7. Now you can sleep easier.

Decoding Intel’s Laptop Processor List [Technology Explained] - MakeUseOf blog.  Nice explanation.

Dynamic Computer Naming in ZTI Deployments - The Deployment Guys - For you Zero Touch Installation (ZZTI) fans with that issue and need.

Any tech mystery that can combine low-level Windows troubleshooting and analysis with Hello Kitty makes it a Must Read in my book!  Submitted for your education--seriously.

• The case of the broken Hello Kitty IZMO toy (Part 1 of 2) - Within Windows blog
• The case of the broken Hello Kitty IZMO toy (Part 2 of 2)- Within Windows blog

Need more standard low-level troubleshooting tips? How about this exercise.

• The case of the vanishing print jobs - Ask the Performance Team

I’m not yet a Hyper-V guy, but I think it is really cool stuff and read up when I can.  I found this Series: Hyper-V upgrade posts at 4sysops to be helpful stuff.

Tenniswood Blog serves up some awesome remote access card P0rn with a nice Review: HP Microserver Remote Access Card.

Create internet bookmarks as browser-independent files on your desktop with HTMtied - Freewaregenius.  I’ve always found it frustrating that I can’t do this as easily as it seems it should be. Turns out the free tool HTMtied can assist with that process and make it a bit more bearable to do.

How to fix incorrect logon information for Windows XP mode - Virtual PC Guy's Blog - Ben’s solution is pretty easy to follow and will get you running again in no time.

Windows 7 Background Customization - The Deployment Guys blog. There are a number of ways to change the background image in Windows 7, doing so is a “signature tweak” I like to perform on all the systems I am asked to help set up for friends and family members; leaving them with an image that reflects their home/personality is a nice touch.  This post is a bit more technical and geared for pushing such changes for enterprise branding and such. Still good stuff.  I personally prefer to use Julien Manici’s free Windows 7 Logon Background Changer but there is also the Tweaks.com Logon Changer for Microsoft Windows 7 and the Windows 7 Logon Screen Tweaker 1.5. Many Windows7 tweaking suites also include this feature in them.

FREE Download Preassembled Windows 7, Vista, and XP VPC Images From Microsoft - Windows7hacker. I try to always keep the latest versions of these handy for ad-hoc testing in Virtual PC. Although at home we now exclusively run WIndows 7, there may be times when I want to trial something in XP or Vista. Rather than dual-booting or keeping another physical test-bed around, I just fire up one of these in a virtual session and away we go! They do have some operational limits baked in, but nothing that should be too much of a headache if you use em regularly.

FREE: Delprof2 – Reliably delete a user profile - As reviewed by 4sysops.  Seriously, if you ever deal with Windows user profiles and occasionally deleting them, you really need to refresh yourself on this post as well as the great freeware tool Delprof2.  While you are there, check out some of the other cool Free Tools from Helge Klein such as DiskLED and ListRegistryLinks which could be handy when doing some incident response work.

MoonPoint Support Weblog - List Installed Programs - This post tips us to a Bill James VBScript script, InstalledPrograms.vbs which when run from the command line prompts for a IP or PC name to remotely check for installed software (or leave blank to check your own). Save the resulting text file for review.  There are a number of “system audit” programs that can do something similar for local systems, but this is the first I’ve seen quite like this.  For generating a list of installed Windows programs on a local machine for reporting purposes and review, I prefer Nir Sofer’s MyUninstaller which seems to be significantly faster than Add/Remove Programs (XP) or Programs and Features (Win7) anyway for adding and removing programs. With MyUninstaller, after running I just select all and save the file in whatever supported format I prefer (usually tab-delimited).

Cheers,

--Claus V.

Read More

Freeware Smorgasbord

Here is a collection of new and/or updated freeware offerings that caught my eye over the last month.

Because they survived the winnowing process, there was something about them that was worth me keeping and may be worth you checking out…even briefly.

Advanced Visual BCD Editor for Windows 7 and Vista via The Windows Club  “Visual BCD Editor is an advanced GUI for the BCDEdit utility in the Windows operating system. In fact it looks to be the first GUI utility to implement full editing of the BCD store. The user can create and change the value of more than 120 properties of BCD objects by simple edits. Other similar utilities do not  give access to not more than 30 properties.”  Utility project page link: BCD Editor for Windows 7 / Vista

Looks be be a lower-level BCD editor than my favorite EasyBCD 2.1 - NeoSmart Technologies utility.

H2testw 1.4 (via Google Translate) - German c’t website utility that is useful to check and verify your bargain bin USB drive grab is really not a fake that has had the reported storage-size manipulated. Use with caution (remove key data from your drive and not for use on the system-boot disk).

MJ Registry Watcher (Version 1.2.7.3) - free registry change watcher/monitor application has been updated with some new features.

TEncoder: Open Source Multi-threaded Video Encoder [Windows] - via MakeUseOf blog review. Video format converters are now a dime-a-dozen. I probably have a collection of at least six portable ones that I keep handy (although-truth-be-told, I tend to use one or two exclusively.) However, this one caught my eye as it offers multi-thread processing.  Very handy if you have a multi-core system and a lot of video files to process. Utility project page link: TEncoder 

TeraCopy - my favorite alternative Windows copy handler from Code Sector has been updated again some time ago and I missed it. FileHippo has a well-summarized Change Log outlining the latest adds and fixes.

FreewareGenius reviewed ProEject recently. Eject USB devices quickly and safely with ProEject post via freewaregenius.com. Clever tool to help those who live off their USB sticks manage them a bit more friendly-like.  Not a critical tool but a useful one.

Virtual Magnifying Glass Portable 3.5 (screen magnifier) - PortableApps.com. No, the Valca eyes have not gone so bad that I need this tool (yet) but that said, there are a lot of commercial products around there that accomplish what this one does, and not quite as nicely. So if you need an on-screen magnifier utility…for your family/relations, keep this one in mind. Just saying friendly like.

CCleaner 3.09 and CCleaner for Mac Beta 3 - Piriform has been hard at work enhancing their premier system cleaning tool and it shows.  Amazing both in terms of features and performance, this and Nir Sofer’s CleanAfterMe are the only two Windows cleaning tools I go to when doing the kind of Windows housecleaning work that must be done from time to time. (related: CCleaner Enhancer Adds 270 New Rules to CCleaner - How-To Geek ETC)

Newsfox - My favorite RSS Feed Reader for Firefox got an update.

This TinyApps.Org Blog : Backup to drive label instead of drive letter led me to the wonderfully featured Create Synchronicity backup and sync tool. Sweet! Thanks TinyApps!

VIrualBox has been getting some updates of late. BetaNews introduces the biggies in their post Finally, VirtualBox 4.1 brings Aero support, VM cloning.

Having been spoiled with Widows Virtual PC and it’s bundled “PC Additions” pack, I guess I didn’t do due-diligence in my ongoing parallel use of VirtualBox. Embarrassingly, I appear to have overlooked the fact that while you can install a similar “additions” pack into guest systems in VIrtualBox, there is also a separate “extensions pack” to bring more enhanced features to the VirtualBox software.

Installing VirtualBox and extension packs - VirtualBox.org manual page.

Downloads - VirtualBox (and the Extension Pack)

• VirtualBox 4.1.2 Oracle VM VirtualBox Extension Pack All platforms
  Support for USB 2.0 devices, VirtualBox RDP and PXE boot for Intel cards. See this chapter from the User Manual for an introduction to this Extension Pack. The Extension Pack binaries are released under the VirtualBox Personal Use and Evaluation License (PUEL).
  Please install the extension pack with the same version as your installed version of VirtualBox! If you are using VirtualBox 4.0.12, please download the extension pack here.

Cheers!

--Claus V.

Read More

Worn Down and Rusted Out Linkfest Edition

cc attribution: 14. An Antique Truck by Jinx! on flickr

Thanks for the messages of kindness checking on me that a few GSD faithful have sent in over the past few weeks.

I’m pleased to say that Claus V. is still alive and kicking…just worn down and rusted out a bit.  As many of you have correctly surmised, work assignments have pretty much overwhelmed me and left me with little energy left except for watching Phineas and Ferb, iCarly, and Bones with the ladies off the DVR on the few free hours when I drag home at night as well as wearily wake up on the weekends.  Everyone has had to really crank up the productivity (already red-lined) due to economy pressures with more special-projects in the pipes.

I even got some time off today to catch the Disney movie “Tangled” with Alvis this afternoon.  I’m a sucker for princess movies!  I can’t wait to put the Blu-ray version of this one next to my “Enchanted” disk set.  Good family movie for all ages!

Anyway, the positive news from this unplanned blogging hiatus is that I have really been able to focus on applying many of the security/forensics tools and techniques in a myriad of very unusual incidents so while I am still exhausted to the frame-rails, it’s been a fun trip along the way.   Look for some neat stuff soon from that camp.

Nor have I been taking a “Net-free” sabbatical.  The RSS-feed collector has been diligently at work as well and I’ve been distilling the results to some of the most interesting and helpful links of all that survived the winnowing process.

So, without more ado, sit down, strap in, and hang on tight.  The Linkfest begins!

Microsoft Security Essentials 2.0 ?

Microsoft Security Essentials 2.0 looks like it may have been released.

Microsoft Security Essentials - Microsoft Download Center. Publish date 12/16/2010  (Note: as of this post, that link still shows a version number of “1”.)

I've been running the Beta MSE 2.0 versions on our Windows 7 x64 & x32 systems for some time and have been pleased. Love the inclusion of a right-click context menu "scan with MSE" menu item now.

This morning my Beta MSE version was 2.0.522.0

After downloading and over-installing the new setup file version downloaded from that page, it now checks in at 2.0.657.0

Some more info on what the new edition offers over at this Security Essentials 2.0 releasing tomorrow mynetx post.

I assume patient users of MSE already will eventually get a push/Windows Update to bump it.

Meta data in the setup file (x64 version) I downloaded and used did report it was a 2.0 version as well…so maybe MS hasn’t updated the version number on the page until an official release announcement…or it could be one last final beta bump before the final release?  I’m not certain.

Spotted over at the (German) Caschys Blog post:  Microsoft veröffentlicht kostenlose Sicherheitslösung Security Essentials 2.0

i-odd Firmware updates and other multi-boot/formatting toys 

I-Odd has released some firmware updates.  If you don’t recall the iodd : Multi-boot madness! post, the i-odd is an external USB2.0/eSATA drive enclosure that allows you to store boot-disks in ISO format and then boot a system with any of them via the selector toggle.  It is wicked cool.

The US i-odd site is offering Firmware Version 1.42.48 (ISO) that supports either FAT32, EXFAT or NTFS partition handling for loading disk images.  Until recently only FAT was supported.

The Korean manufacture's i-odd site actually is serving an even newer firmware version at 1.42.53.

Take your pick.

FAT/FAT32 formatting limitations typically have restricted partition sizes so you have had to use alternative formatting tools to get around those limits if you wanted a really big FAT32 partition to store your ISO’s on.

TinyApps.Org Blog recommended the FAT 32 Formatter from Ridgecrop Consultants Ltd.  If that CLI version isn’t to your speed, they also offer a Windows GUI version of fat32format.  Miles’ recommendations are always golden so that’s the tool I still use.

I recently found mention Fat32Formatter which has a slightly different GUI.

That was picked out from RMPrepUSB HomePage which has an interesting tool to partition/format USB drives and make them bootable for SysLinux or grub4dos bootloaders. 

That was found via this XBOOT vs 1.0.0 beta4 - reboot project that is working to aid in the creation of a multi-boot USB builder.

All this is still very interesting, but TinyApps’s find of the i-odd device makes all these exercises almost academic.  Get the enclosure, buy a 2.5” drive to stick in it, update the firmware, and copy your boot ISO images over to your heart’s content.  Then just toggle to the ISO you want to boot with, select it, and boot away.

One last TinyApps mention: check out his amazing documentation work TinyApps.Org : Mounting disk image partitions.  He sent the link to me some time ago but I’ve been swamped and only had time to do very limited Linux-based work at work so I haven’t been able to give it its true due.

Secunia PSI 2.0 Beta Available 

Security company Secunia announced in September the release of the PSI 2.0 Beta.

Auto Update your Programs - Secunia PSI 2.0 Public Beta - Secunia Blog

From the blog post, the engine remains the same but the user interfaces, the auto-updates, and reporting have all been revamped. Secunia PSI changelog

While I and everyone else can continue to benefit from the cloud-based Online Software Inspector (OSI) version, having a localized Personal Software Inspector (PSI) on your Windows system can go a very long way to ensuring your applications are able to be kept current without much mess or fuss.

Adobe Advances

The Adobe folks have been hard at work revamping and prepping a number of products that are often found on many enterprise and consumer Windows systems.

Adobe Labs - Adobe Flash Player 10.2 beta - This is the latest “mainstream” Flash beta version.  It includes enhanced support for IE 9.0 releases and full screen mode support for users with multiple monitors.  However it only comes in a x32 bit release version.

Adobe Labs Download: Flash Player 10.2 Beta Release

Adobe Labs - Adobe Flash Player "Square" is also available and does include x64 bit support for Windows, Mac OS, and Linux.  I’ve been running this one on my x64 Windows 7 system with no issues at all.

Adobe Labs Download: Adobe Flash Player "Square" Preview Release

Related: How-to: Disable Chrome’s built-in Flash to use a Flash beta release. DownloadSquad

You may also have heard Adobe released version 10 (a.k.a “X”) of the Adobe Reader.

Adobe Reader X is Here! « Adobe Secure Software Engineering Team (ASSET) Blog

Adobe - Adobe Reader download

PDF security guru Didier Stevens has some initial thoughts: Quickpost: Adobe Reader X and provided a wicked-helpful link to Adobe’s FTP server. The en_US FTP folder contains both msi and exe based installer versions!

To add to the helpfulness, Aaron Parker at StealthPuppy has a number of great Adobe Reader deployment tips and tricks postings.

Deploying Adobe Reader X | Aaron Parker

Uninstalling Adobe Reader | Aaron Parker

…including a tip-out to the Customization wizard for pre-deployment installer tweaking; note you can get the 10.x version from the FTP site.

Network Nuggets!

One of the duties that has required a lot of my time has been network monitoring and traffic analysis.  I continue to make good progress with Microsoft’s Network Monitor 3.4; specifically the nmcap.exe CLI tool.  I’ve not had a dropped packet yet during a capture session.

Marking Frames with Network Monitor 3.4 - Network Monitor Blog

Network Monitor Freezes While Loading Capture - Network Monitor Blog

CodePlex Parser Site - Check for the latest Network Monitor parser sets here.

In case I haven’t mentioned it recently (it’s been a while) inSSIDer Wi-Fi Scanner over at MetaGeek is now out at version 2.0.  It was a great help tracking down a network tap some time ago.

And despite my comfort and pleasure with Network Monitor 3.4, I am now trying to transition back to Wireshark.  NM3.4 only seems to output in “cap” format, not pcap.  That’s no big issue but I then have to do an extra step of “editcap -F libpcap infile.cap outfile.pcap” to convert things.  This has been quite fast, but it is a step I shouldn’t have to be taking. 

My biggest complaint to date with Wireshark (and it’s a noobie one) is that I kept getting occasional crashes during capture in the Wireshark GUI mode.

However since I’ve gotten comfortable working in the NMcap CLI tool mode, I’ve started flirting around the the TShark CLI utility for captures as well.  It seems to be more stable for longer-run capture sessions.

Along those lines I’ve been collecting resource links on TShark:

Tshark examples: howto capture and dissect network traffic - CodeAlias

tshark filters - PacketLevel

tshark examples - random notes

TShark Packet Filtering - TheSprawl

Wireshark/TShark Utilities - TheSprawl

Pcap format is essential as I continue to use the NetworkMiner Network Forensic Analysis Tool (NFAT) and Packet Sniffer for much of my post-capture analysis work.  Unfortunately, it doesn’t handle NM “cap” format files, thus the conversion to pcap first in editcap.  So capturing in pcap native files is a time-saver.

You may also recall that I’ve been restricted to using an older .88 version of NetworkMiner as some packet captures end up forcing a premature shutdown in versions up to the current .92.  I actually was able to engage developer Erik Hjelmvik in this Topic: Versions past .88 prematurely exit discussion.  He was awesomely kind and patient.  We eventually took the discussion off-line and with his gentle guidance I was eventually able to provide him some helpful data that explained the issue.  He thinks that the issue “…could occur when there are partially overlapping TCP segments at the same time as the TCP packets arrive out-of-order.”

A future version of Network Miner should address this issue, and bring many more enhancements.  Hopefully Erik will release an updated version soon!

It was really challenging but really rewarding having the opportunity to work with Erik on this issue.  He is a really great guy for kindly providing that level of support to me on a free-to-the-community project.

Microsoft Tips, Tricks, and Treats

Download details: The Windows® Automated Installation Kit (AIK) for Windows® 7 - Released in mid-November under version 2.0.

The Case of the Slow Project File Opens - Mark’s Blog; troubleshooting awesomeness!

The Windows 7 Guide: From Newbies To Pros [FREE EBOOK] - MakeUseOf - Nice resource for you all who are planning on handing out Windows 7 systems as gift to current XP users.

Enhanced Event Viewer for Windows 7 released - The Windows Club is a fancier version to view and search event logs.  Pick it up over at the sateesh-arveti - Site Home  on TechNet Blogs

Tenniswood Blog has an update tip on How to enable Remote Desktop in Windows 7 Home Premium.  Follow his links to grab the new and improved bits.  Me?  I’ve still got this around on our home systems as a “just in case” but am really loving the TightVNC 2.0 application even more.

While we are still on the subject, MakeUseOf blog has a really interesting Control Your Computer Remotely Using HTML5 With ThinVNC post worth checking out.

The Best Ways To Customize The Welcome Screen In Windows 7 by Simon Slagen on MakeUseOf has a trio of ways to modify your Windows 7 login screen ranging from the very simple to the very complex. Of them, I agree with the post and found that for most users the Logon Screen For Windows 7 tool by DanielNET software was the easiest to use.  That said I’m surprised my first utility to encounter in this class, Windows 7 Logon Background Changer didn’t get included.  It hasn’t let me down yet.

Image is Everything

TOOL: Image Resizer 2.11 for Windows 7/Vista  - Kurt Shintaku’s Blog is a dead-simple, integrated way to let anyone quickly and easily resize their images fast.  It’s a must add.

Freemake Video Converter updated with cool new features - freewaregenius.com is yet another great and very full featured video converter.

Lightworks - Open Source highly complex but wonderfully approachable video editor is out in a public beta.  I’ve been waiting for this one for some time and am amazed it is sitting on my desktop.  The GUI is very well designed but start digging under the hood and I think this tool has the stuff to leave the other freeware/open-source video editors in the dust.  For a Windows platform, this must be seen.  I’m itching to get a new video-production project to toss at it.  This is not for casual users who might find Windows Live Movie Maker 2011 or another similar non-MS product easier to get started with.  Registration (easy and free) with Lightworks required to get the download bits.  Lots of documentation in PDF form is a happy bonus.  Requires download of third-party “Matrox VFW” codecs.

For other options and software tools in video editing see this GSD Blog Video-Editing Resource Roundup.

Finance Planning Tools 

Things have been very tight around the Valca home.  For almost the past two years we have had to painfully downsize to a single-income family lifestyle.  It has been almost that long since Lavie was able to work.  However thanks to discipline and the kindness of family and friends, we have weathered the belt-tightening fairly well.  Hopefully the new year will bring new riches both in terms of our family employment outlook as well as the bank account.

We continue to benefit from the use of Microsoft’s free “Sunset” edition of Microsoft Money Plus.  I’m using the Money Plus Sunset Deluxe version but there is also the Money Plus Sunset Home and Business. 

However, if you trust and and are looking for a cloud-based financial planning tool, check out the following finds:

Sprouty - Simple and easy budgeting

Mint.com

Either of these along with some healthy Finance & Family encouragements from zenhabits, those (by choice or circumstance) living in the “simple life” may find some great tools and resources to help them breath.

More Utilities

These didn’t seem to fit in other categories, so here they reside:

CSV file editor, for Windows - CSVed is now updated to version 2.1.3.  This freeware tool has saved my rear lots of times for complex pre-editing of tricky CSV files before dumping into Access or Excel.

BulletsPassView - NirSoft’s new build to view the passwords stored behind the bullets in Windows / IE.  Doesn’t work for everything but is super-useful in a pinch. May set off AV as “hackware” or PUP.  That’s a AV thing nothing wrong with the tool in the right hands.

6 Must-Have Apps For Computer Repair Technicians - MakeUseOf blog.  Interesting roundup. Not what I would pick for my “must have 6” list, but they are worthy to add to your toolbox.

FOG-ing the Future?

With only a literary nod to JKR, the FOG project is one really neat looking project.

fogproject.org

FOG allows for Windows system imaging capture/deployments from a Linux OS.  It is very cool looking and very neat, particularly with an almost turn-key PXE-based capture/deployment solution.

Windows Image Deployment with FOG - Petri.co

Lifting the Fog - Compendium IT

Cloning Windows 7 VMs Using FOG - The Horrendous World of IT

FOG - Computer Cloning/Imaging solution Server (0.27) - VMware Virtual Appliance Marketplace

See also these FOG Project Video Tutorials

There is a lot of documentation and YouTube video resources and it looks to be a very mature (and still developing) project.

If you haven’t heard of FOG yet, it’s worth checking out, particularly if you are an imaging guy.

That said, I still like working with Microsoft ImageX WIM file images and deploying them in PE-based methods in our environment.  Being able to off-line mount and service image files has helped me lots of times.

Virtualizations

In the “Lifting the Fog” link above, the author incorrectly states that the virtual version of FOG uses Oracle’s VM VirtualBox.    That isn’t correct.  It is a VMware appliance version, not VirtualBox.  I guess it is easy to get them mixed up by name alone.  I currently have Windows VirtualPC, Oracle’s VirtualBox, and VMware’s VMware Player all installed on my system!

VMware Player still is getting updated (and remains free).  If you don’t want to register to get the bits from VMware, try this Download VMware Player 3.1.3 link via FileHippo.com.

Think the VMware Player will trap you into using only pre-configured VMware appliances?  Check out the free VMware resources by developer DEVFarm Software such as the really cool VMX Builder. One of may cool tools at VMXBuilder.com

VirtualBox fans may be surprised (or not) to learn that while the public build of VirtualBox is at 3.2.12, if you dig around you can find and use VirtualBox 4.0 beta builds.  I’ve been using these for a while and they are really nice!  I really find the GUI interface improvements particularly enjoyable…not to mention all the under-the-hood updates!

Download VirtualBox 4.0.0 Beta 3 - Change Log - FileHippo.com

Index of /virtualbox/ - Oracle’s FTP site for direct VirtualBox bits including the [DIR] 4.0.0_BETA3/

Whew!

Hope you found something here enjoyable and I appreciate the GSD fans who have been waiting for a new post.

Check back again soon for the forensics and security linkfest followup.

Even more goodies await!

Cheers!

--Claus V.

Read More