A Dell Named Tatiana

After much family encouragement and a fair bit of penny-pinching, I recently ordered up a new personal laptop system from Dell.

This was to be a replacement for the well-loved Gateway MT6451 notebook I’ve been using.  I had already had the DC plug repaired once and it was failing again.  I wasn’t ready to reinvest in another repair, so it had been sitting static on my desk to avoid having to re-jiggle to cord/plug to keep power flowing.  Not very practical for a laptop.

As noted in a recent GSD post, I did a lot of research and consideration for this system choice.  I wanted something “small” so it would be a bit more portable than the 17” + notebooks now commonly available. I wanted power, so that meant an  Intel i7 core system, and I still needed something that was at a decent price point.

In the end, fueled by some good discounts, I settled on a Del Studio 15 (1558) notebook.  It’s got the i7 core, a 500GB drive (SATA…no SSD for me yet…),and a wireless 802.11a/g/n card that now finally allows me to take full advantage of the D-Link DIR-655 Xtreme N Gigabit Router wireless router I picked up some time ago.

I did spring for the full 1080p high-def display option (gorgeous!) though a Blu-Ray drive wasn’t an available option at the time.  However, standard DVD playback is really, really good.  It also has dedicated 1 GB video video card. And I got the Ruby Red lid.  A wise purchase as it really conceals fingerprints, and as my brother says, “…red makes it go faster.”

Alas, the Gateway just couldn’t successfully run many higher-end graphic applications under Win7; including Celestia, Photoshop C4 x64, Google Earth, and a few others.  It was getting to be an annoyance.  No more.  Google Earth renders beautifully fluid.

It takes about a minute to go from a power-off state to desktop.  I’ve yet to really challenge the i7 core.  I’ve done some x64 bit Photoshop work already as well as video editing and it barely causes a bump on the utilization graphs. (I run Process Explorer at boot as a scheduled task, sending to the system tray with the “-t” switch.)

I’ve not had time to finish setting up my virtual machines yet, so I’m very hopeful the i7 core will really add virtualization performance.

Sure, an i5 core would have probably been sufficient, but this is the very first time I’ve actually allowed myself to get a system I really wanted (from a feature standpoint)…and then a splurge of a bit more in power.

I’ve christened it “Tatiana” due to the red lid and power in honor of the Last Exile character Tatiana Wisla and the complex relationship between Tatiana and Claus in the Last Exile anime series.  She masterfully pilots a red “vanship” fighter and is Claus’ match.  Seemed fitting.  Hence when it was on order and I was anxiously awaiting delivery, Alvis would tease me with a wicked tone, “Dad’s been busy getting to know his new mail-order-bride. Tatiana.”

The biggest concern after reading reviews that really gave me pause to consider were findings that the cooling fan was obscenely loud in early Dell 1557 Studio 15 models with the i7 core: Review Dell Studio 1557 Notebook - Notebookcheck Reviews and this Dell Studio 15 (1558) Review - Laptop Magazine. And they got really hot on the bottom/top.  I am pleased to say that isn’t the case with my experience with the 1558 model.  While the power brick is thinner than I would expected (my work Latitude E6400 brick is almost twice as thick to only support a dual-core) it is the only thing that seems quite warm.  The 9-cell battery pack lifts the notebook up creating a large air zone underneath.  I find using a hard-board placemat to rest it on while on my lap is perfect.  The fan rarely spins up unless the core is really working, and the keypad/wristpad does get warm, it is not hot to me.

Software is loaded up. Things are tweaked.

Thanks to Tiny Apps blog for the Tiny HDD activity monitors post.  This notebook has no HDD activity LED indicators at all (what up with that Dell?) so I settled on the HDDMon utility. Sweet!

I’ve also tweaked it for some network usage requirements.  I miss the old XP style network activity indicator icon in the system tray so I added in a free Network Activity Indicator for Windows 7 - IT Samples.  More here Get the Classic Style Network Activity Indicator Back in Windows 7 - How-To Geek.  I’m going to return to network tweaking for Win 7 systems shortly.

All in all it seems to be a rock-solid, wicked-powerful notebook that I hope to get a lot of use out of.

Hopefully this will expand my computing abilities and enhance the GSD posting activity and adventures to come.

So, the Valca home welcomes it’s newest member, Tatiana!

Cheers!

--Claus V.

Been too long…

Yep still here.

As Alvis has commented more than once recently in a wicked tone, “Dad’s been busy getting to know his new mail-order-bride.”

While not nearly as salacious as it sounds coming from her, I’ll save that info for a follow up post. However she is partially correct.

Last Monday, I had planned a relaxing Labor Day holiday chilling out at home catching up on blogging and clearing some pieces of work.  Mom had called however and decided she needed some out-and-about activity with son #1 since son #2 was living large in Colorado on a respite before leaving fair Texas for an long term work-assignment in a foreign country; Baton Rouge, LA.

So mid-morning I drove over to Mom’s, loaded up the car and pointed it to the shadow of downtown Houston.

She had caught a local news piece on the local Houston connection to the movie Mao’s Last Dancer and was determined to see it before it left the single screen that was showing it.  It’s got flashbacks to communist China and the humblest of villages, ballet, opera, love, ballet dancers, Houstonians, Houston sights and scenes, ballet dancers, a famous local lawyer and an international showdown.  And the F.B.I. makes an appearance at least once.  What’s not to love! Right?

Anyway I’d seen neither the trailer nor the news piece so was suspicious but a good sport.

We drove over the the 1930’s-era River Oaks Theatre, found one of the few parking spots that didn’t have a “30-min shopping only” sign painted boldly on the hot black pavement and stood in line for the tickets.  (Only later would I spy the nice super-new parking garage hidden across the street from the theatre. Oh well…next time…)

While I have known and heard of the River Oaks Theatre, I’d never been inside.  It reminded me instantly of a similar home-town one long since crumbled that I used to go to as a kid.  This one has been lovingly cared for by a devoted staff and brings back an instant ambiance of the golden-screen days.  The seating was very comfortable and I felt we were falling back in time. Well, had it not been for the fancy Hagan-Daas ice-cream bar mom was munching on.  The theatre specializes in international, art, and foreign films that would almost never see the light of projectors in the local mega-movie-plex.

It was a very full house.  And the movie was really good.  Sure, some of the Houstonian stuff seemed a bit over the top, but I guess that’s how most of the world thinks we talk. (We don’t.) And there were some local scenes in the background shots that were not period to the ‘80s.  But small quibbles aside, it was a very impactful movie.  Like most in the audience, I was leaking man-eye-sweat at the end of the film.  Definitely recommended and worth seeing.

Afterwards, Mom wanted to go across the street to the B&N to replace a Julia Childs book she has lost.  I got a bit sentimental (maybe it was from the movie) but it was strange.  Right inside the entry was a kiosk where a clerk was demonstrating the benefits of an e-book reader to folks, selling units, and books.  Time is turning my friends.

I worked in the local library growing up in my teen years and used to love the proximity and time spent among the shelves.  It was a perfect job. Now I seem to dash into the bookstore for a technical book, and dash right out.  Not with mom.

We lingered.

She looked at the tables, opened up random books, chatted away, and just was present there.

That forced me to be so as well.

And I noticed lots of books again; history books, cartography books, novels.  Their covers carefully planned to invite and entice.  Best sellers and bargain buys.  One shelf was filled with strange and unique books, selected by the local employees, with little cards on the shelf edge. The cards had the staff-member’s name and a single sentence why they loved it so much and recommended it.  The comments were more wonderful and mysterious than any ad-campaign or glitzy display. It was humble and seemed genuine.

And as I stood there surrounded by all the books two things struck me; that these books represented so many new authors trying to get started and old ones firmly established, all telling their own, special story, and that I probably was like many now, in too much of a rush to linger and let the books and stories seduce me as they used to so passionately, instead being addicted to the mad-hose-pipe flow of RSS feeds, Internet media, and that damned moving picture screen in our living-room.  What will such book stores look like 10 years from now? The same? or will they have been replaced by the Kindles and Nooks and the warmth of the pages on a cold winter’s night be replaced by the cool plastic.

I mean I get it. Really.  While I don’t (yet) have an e-book reader in our house, I see and understand the convenience and flexibility of having so many stories and such available on download demand, but real books are still touchstones, for now.  And it has been too long since I slowed down enough to just hang out with them and let them try to lure me away from the straight and narrow, to Timbuktu’s and fields and fen.

Anyway, by now mom was hungry so I suggested a local Mexican eatery in the East End or maybe a local BBQ place.

No.  Mom would have nothing of that.

We re-crossed the street (sorry Houston, you still have a long way to go to being a pedestrian-friendly town) and mom led the way over to the nearby La Madeleine café.

While familiar, I’d never eaten there yet.  Mom had and soon she had picked her quiche and tiramisu while I had scored a French-dip sammy and a cup of French roast coffee.  We sat at a small table, chatted, and took our time eating.  Both the time and the food was delicious.  And the people watching was quite entertaining.

Eventually we ended the early afternoon and we braved the now impending downpours of what was left of Tropical Storm Hermine as she started her two-day deluge of our bayou-based city.  We made it home, but there was some major ponding on the freeway lanes.  Only good timing and fortune allowed us to have our walkabout without a single drop falling until we were headed home.

Been a long time since I spent that kind of long, lingering day.  And I guess Mom knew I needed it even more that I realized.

Moms are so wonderful…

--Claus V.

This Week in Security and Forensics: Beware the cake!

Cube Party! image used with permission from John Walker at "rockpapershotgun.com"

Yeah, the cake is a Portal thing.  Let’s dispense with introductions and get right down into it this week before GLaDOS barges in.

Anti-Virus

Not new but I think it is worthwhile to reflect on the impact rogue/fake AV products have.  Not only did I get the joy of cleaning one such infection off my own dad’s system, last week I painfully listened to another dear friend tell of dropping almost $400 to local PC shops to remove another such infection…in the end they just reinstalled Windows for him.  I told him to call me first next time.  My local pizza house rates are much cheaper, and I find it perversely fun to hunt and clean this stuff off a system.

• Rogue Antispyware: WireSharkAntivirus -- Yep. Leave it to someone to seed the world with this weed.  Unfortunately it is playing on a very large and well-known name in the network and security business. More: Sunbelt Blog: Oh yea, right! A rogue named “Wireshark”
• Sniff free or die » Antivirus Outbreak -- This is the legit Wireshark blog’s personal account of the aftermath of their name being hijacked by this fake av product.  The company had to deal with and field and guide irate and disgruntled persons contacting them since they thought Wireshark was responsible for the fake av product.  Sadly that wasn’t the case, but folks just don’t seem to figure this out.  From the post.

Lessons:

Communicate. Luckily its victims were visiting www.cacetech.com, so we could pass along updates in near real time. Google and Bing helped track down users posting questions to online forums. I responded to each question with any information I had at the time.

People don’t run AV software. Seriously — you should at least be running something like MS Security Essentials by now.

Even cake is dangerous. One of the infections apparently happened while looking for pictures of cake on Flickr.

• Fake Antivirus abuses regular software names - Avira - has some more background analysis into the fake tool itself.
• Remove Wireshark Antivirus (Uninstall Guide) - Bleeping Computer - guide from Grinler to getting it off.

It’s my understanding that the free VIPRE Rescue tool can also cleanse it from a system.

• "Wireshark Antivirus" Malware · Wireshark -- PSA by Wireshark including multiple links to manual-removal instructions.
• Sunbelt Blog: Fake MSRT “suggests” you purchase a rogue - Yep.  Even the name o Microsoft’s own legit Malicious Software Removal Tool (MSRT) is now being used by the fake av scam artists.  Nothing is sacred here folks.  Constant Vigilance!
• Anti-malware tools crumble under Virus Bulletin tests - Donna’s SecurityFlash via SC Mag.

The winners:  Microsoft Security Essentials, AntiVir, Avast, Agnitum, AVG, EmsiSoft, Eset, Kaspersky, Symantec, PC Tools, Check Point, Lavasoft Ad-Aware, Kaspersky and of course, Sunbelt and many others. 

• Clam AntiVirus - Recently released in version 2.0.  This is not your father’s ClamAV any longer.  Now includes “cloud-based” protection engine and many more enhanced features.  See also VRT: ClamAV Release Announcements for a full detailing of the little devil.
• Alureon Evolves to 64 Bit - Microsoft Malware Protection Center - This was fascinating and a sure sign of the growing prevalence of x64 bit systems.  Alureon is a rootkit that has commonly targeted x32 bit Windows systems.  Security teams noted the inclusion of an inert file called ldr64 as part of the file system.  Lately it now has morphed into an active version that can infect 64-bit systems.  Fortunately, it’s presence is detected by Microsoft Security Essentials and evidence is easy to find manually if running.  The Disk Management pane of Computer Managmenet console will be blank of all local HDD and DiskPart command doesn’t locate any disks when “list disk” is run.

Tips and Techniques

• E-discovery is hard -- Security For All -- Be careful what you ask for!
• Computer Forensics: Identifying Disk Differences -- Broken Mirrors -- SANS Computer Forensic Investigations and Incident Response Blog -- excellent process walkthrough of validating your disks to be examined when potentially in a mirror state.
• Digital Forensics Recertification (Beyond the Cert) -- SANS Computer Forensic Investigations and Incident Response Blog - -Encouragement for the front line troops.
• Computer Forensics: Using Evidence Cleaners to Find Artifacts -- SANS Computer Forensic Investigations and Incident Response Blog -- I think what the post is saying is that you can learn a lot about potential evidence locations by studying the tools offered to clean them.
• Getting Started in Digital Forensics: Do You Have What It Takes? -- SANS Computer Forensic Investigations and Incident Response Blog -- great reality check for folks who are considering the digital forensics field as a career.
• Digital Forensics Case Leads: An OS X based Live CD, a Free Forensics App for Windows, Spying, and High Performance Password Cracking -- SANS Computer Forensic Investigations and Incident Response Blog -- Lots of tips, particularly the Creating an OS X Incident Response CD for Live Response link.
• Acquisition -- Apple Examiner.  New (to me) Apple forensics-centric website Apple Examiner with some guides to addressing acquisition of late-model Macintosh systems. Lots of good stuff here!  hat-tip to TinyApps blog for bringing this to my attention.
• OS X: Mount disks as read only or block automounting altogether -- TinyApps.Org Blog then goes to the mat with a word of a GUI tool Disk Arbitrator  to change OS X’s automount behavior.
• Forensic Linux Live CD issues - Forensics Wiki.  TinyApps also passed me this link to a long list of potential “gotcha’s” when relying solely on software/LiveCD based forensics distributions to perform “forensic” drive acquisitions. It would do well to be familiar with these issues in advance.  As always, it seems the only rock-solid way to guarantee a non-writeback acquisition of a drive occurs is to use a proven hardware-based forensic bridge; say the Tableau T35es and their T8-R2 or the WiebeTech USB WriteBlocker
• NetAnalysis Date and Time Fields -- Digital Detective. Great write up of Windows time/date field handling.
• The Pitfalls of File Initialization for Forensic Analysts -- cmdLabs -- more learning opportunities await!
• The U.S. Department of Justice hosts an ongoing series of publications including forensic releated documentation.  Note these gems!  While there are only some “recently” published works here and most are a bit dusty, these all remain great resources.

Review a complete list of reports from the Computer Forensic Tool Testing Program.

See also test specifications, support software and test documentation for:

• Disk Imaging
• Forensic Media Preparation
• Write block (Software)
• Write block (Hardware)
• Deleted File Recovery
• Mobile Devices
• String Search

Making Material

• Fundamental Computer Investigation Guide for Windows -- Microsoft TechNet -- Not sure where I came up with this. Dated back from 2007 but still is a small free resource zip file to download, read, and archive. Besides the primary information document, it also contains some DOC files to use as worksheets and templates…or as inspirations to design your own. Download

The Fundamental Computer Investigation Guide for Windows discusses processes and tools for use in internal computer investigations. It introduces a multi-phase model that is based on well-accepted procedures in the computer investigation community. It also presents an applied scenario example of an internal investigation in an environment that includes Microsoft® Windows®–based computers. The investigation uses Windows Sysinternals tools (advanced utilities that can be used to examine Windows–based computers) as well commonly available Windows commands and tools.

• I’m not sure where I found the link from, but the US Justice Department’s CyberCrime Laboratory created an awesome Digital Forensic Analysis Methodology Flowchart (PDF link).  Print this one out. Study it, and keep it handy for review.
• Just dropping this older GSD Post Focus on Forensics Linkfest in the mix here as it contains links to multiple templates and forms for chain of evidence recording and such.
• Intro to Report Writing for Digital Forensics -- SANS Computer Forensic Investigations and Incident Response Blog -- Must read because it never is enough just to dig up the pieces during an investigation, to be successful you must document your process as well as present it in an understandable manner for non-technical folks to understand and technical folks to be able to validate.

Tools and Utilities

• Quickpost: .LNK Template Update -- Didier Stevens -- tool update to now identify well-known Shell GUID’s as well.  See also his .LNK template post for additional info.
• Fget -- (freeware) -- HBGary tool “…The fget tool forensically extracts files from raw NTFS volumes on remote windows systems in your domain. This tool works over the network and can extract any file (including those that are locked and in-use) in a forensically sound manner, without altering target filetimes or attributes. In particular, the tool can be used to extract files that are critical to timeline reconstruction.”  Spotted via this FGET: Network-capable forensic data acquisition tool post at Help Net Security.
• Fingerprint -- (freeware) -- HBGary tool “…framework for scanning binaries (preferably binaries extracted from memory so they are already unpacked). It allows scanning for ascii/wide strings and byte patterns, then annotating results. Results are saved in an xml format and can be compared to previous results. The goal is to allow quick development of new search patterns and easy comparison to previous binaries.” Spotted in a great write up Open Source Malware Fingerprinting – Free Tool at the ESET ThreatBlog.
• Historian -- (freeware) -- Reads history, bookmark, cookie and cache information for raw browser files from Gaijin software.  Recently updated to version 1.4.4.  While there are lots and lots of tools now to help with browser history examination, I still like having different ones at my disposal to give me flexibility in both analysis and reporting.
• RegFileExport -- (freeware) -- It’s a new NirSoft tool!  This gem is a CLI tool to “…easily extract data from offline Registry file located on another disk drive. RegFileExport read the Registry file, ananlyze it, and then export the Registry data into a standard .reg file of Windows. You can export the entire Registry file, or only a specific Registry key.  RegFileExport may also be able to export some of the Registry data even when the Registry file is corrupted and cannot be loaded by Windows.  Check out the whole page to get the usage and “more information” areas understood as well.  It can even handle extraction of Registry data from XP restore points!  “You can find the Registry files of every restore point under C:\System Volume Information\_restore{guid}\RPxxx\snapshot. However, you must change the permissions of this folder in order to access these files, or alternatively, you can run cmd.exe as a SYSTEM account (with 'at' command), and then you'll be able to access this folder and the Registry files that are stored in it. Be aware that the _restore{guid} subfolder also has 'hidden' attribute.”  Sweet!
• TinEye Reverse Image Search -- I thought this was cool.  Suppose you come up with a image file that appears to have been downloaded from the web, but you don’t have a context for the source?  You could try TinEye to see if you could find locations where the file came from on the Web.  While it would be difficult to say with certainty that was the source, it might help provide some interesting information especially if taken as part of a larger context of data.  via Idée Labs

Mostly Wireless

I had spotted that the next two items were recently updated and then decided to go ahead and list other wireless-related utilites since birds of a feather…well…you know…

• Xirrus Wi-Fi Inspector -- (freeware) -- Xirrus now updated this neat tool to v1.1.1
• inSSIDer Wi-Fi Scanner -- (freeware) -- MetaGeek updated their BOSSIE winning tool to a newer version (1.2.8.0331).  I also see their forums says version 2.0 is working its way to Beta release in September. Link with screenshots here: inSSIDer 2.0 Preview
• WirelessNetView v1.27 -- (freeware) -- NirSoft tool
• BluetoothView v1.37 -- (freeware) -- NirSoft tool
• BluetoothCL v1.05 -- (freeware) -- NirSoft tool
• WirelessNetConsole v1.00 -- (freeware) -- NirSoft tool
• WirelessKeyView v1.34 -- (freeware) -- NirSoft tool
• D-Link routers get DNSSEC and CAPTCHA protection - HelpNet Security post

Oh those DLL eyes

• It’s those darned DLLs again... -- Windows Incident Response blog -- Probably the very best roundup and review of the latest DLL “vulnerability” now capturing the attention of the for/sec groups since the .LNK brouhaha. 
• Malware Persistence without the Windows Registry -- M-unition Blog -- Noted here both for the great technical explanation of the issue as well as the provision of a free tool to help assess the situation on a system.  From Nick Harbour’s post:

I’ve written a program to identify all locations and filenames that a DLL could be placed to achieve persistence on a given system.  The idea is that you can run this program on a clean (Gold Image) system and forensically search for any DLL name listed in the output on a machine you suspect of being compromised with this method of persistence. 

The program examines running processes and determines hijackable DLL locations by the following properties (applied to each loaded dll in every running process in the system):

1. The process executable that loaded the DLL is not located in the System32 folder
2. The DLL name is not found in the KnownDlls object
3. The DLL is not found in the same directory as the executable

Any loaded DLL that contains all three properties is susceptible to being trumped by search order hijacking.

The tool (compiled and source) to identify possibly malicious 32-bit DLL locations from a clean system can be found here.

You have to run it from the command line and it requires "elevated" or administrator privileges to run.

Also, the output will be to the CLI window. Depending on how much data you have you may not be able to see all the results.

Try "piping" the output to text with a command similar to below. Then when done open the resulting text file in notepad.

finddllhijack.exe > dllwatchlist.txt

Worked great on my x64 Windows 7 Home Premium system and I got output of a total of 560 different dll files/locations to keep an eye on.

"Here be Dragons" caution: This tool doesn't provide a "smoking gun" to any actual malware-based dll's or vulnerabilities. So please don't go deleting stuff just because it shows up here. That's not the point of the tool. It does help collect information about potential targets for the examiner to then consider with the points made by Mandiant above.

Returning to the linkage roundup…

• Windows DLL flaw may affect hundreds of programs -- TechBlog -- Dwight Silverman spells it out for the masses.
• Quickpost: Ariad & DLL Preloading -- Didier Stevens -- Yep. Didier already has some tools for that…Ariad (no file execute) and SRP
• DLL Preloading - Update Microsoft Recommendation -- TripleCheck Consulting Blog -- Thoughts on mitigation of the risk.
• Exploiting DLL Hijacking Flaws and Better, Faster, Stronger: DLLHijackAuditKit v2 -- Metasploit also provides a system auditing tool to help examine the issue on your own systems.  This isn’t for the faint of heart. Check out this DLLHijackAuditKit v2: Better, Faster, Stronger DLL Tests! post for a distilled guide from PenTestIT on how to get it armed and working.  Read the Metasploit posts for the full picture.

Finally let’s let Microsoft give us all the remaining bits of the scoop from their perspective.

• Microsoft Security Advisory (2269637): Insecure Library Loading Could Allow Remote Code Execution - Microsoft TechNet Security
• More information about the DLL Preloading remote attack vector - Microsoft Security Research & Defense Blog

As well as their tool to help mitigate the issue (platform specific tool download links at the bottom of the page).  Just read well to understand the tool and how it works before using!

• A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm -- Microsoft Support.

And if you haven’t guessed it, this is just a new resurgence in an old exploit.

• MS09-014: Addressing the Safari Carpet Bomb vulnerability - Microsoft Security Research & Defense Blog - April 2009
• DLL Preloading Attacks - David LeBlanc’s Web Log - February 2008.

Yes my friend, only eat the cake if you dare….

--Claus V.

Oh for the love of Pete!

Seriously Dell.

So about two weeks ago I assisted a dear older friend of mine with setting up his new Dell Studio 16 system.  What followed was almost a repeat of Dealing with the Dell … 2010 Edition that I had done for his Inspiron desktop system back in March 2010.

We didn’t touch that system but only copied his user folder files (my documents, my pictures, etc.) over to this new system.

Case closed.

Only he called me back the next day to report his desktop system wouldn’t turn on. Something about it coming up in “power-save” mode on the monitor and then nothing.

I swung back over the following night after work and took a look.

The “power-save” mode message was a red-herring as that was his LCD display displaying that message.

He said the day after I had left, he came in to find it just dead.

I hit the power-button and got the BIOS, then it went into the Windows 7 “Safe Boot/Normal Boot” option.  Then it went dark.

No biggie, I punched the power button again but got nothing this time, not even BIOS.

Hmm.

Suspecting a loose power-cord I eased the unit out of the desk cubby to pull/replug the power plug into the PSU, only I heard a strange deep grinding noise.  Odd.

So I unplugged all the cabling, set the case on the side, and opened it up to inspect.

Everything looked OK, but then my eagle-eyes caught that the heat sink seemed a bit off-kilter.

Closer inspection found this indeed was the issue.  It looked like the clip holding the fan/heat sink to the core had popped loose.  The loose heat sink banging against the case lid was the noise I had heard.

I went to reattach it and found the core problem.

If you look at the image to the left, the top area outlined in green shows the plastic knuckle the single spring-clip attaches to on one side of the core.

On the bottom can be seen the second mounting point…only the plastic knuckle for the clip has broken off.  (I found it after a bit of searching in the case.)

So the final root cause analysis is that the plastic knuckle failed (defect?) causing the heat sink clip to no longer apply tension to the heat sink/cpu.

The contact had become loose enough now that the CPU could not cool and at boot, got hot and tripped the thermal safety fuse, shutting down the system and preventing boot.

No telling how long things had been this way.  Since the orientation of this desktop model is tower-based, the system board is vertical so it is possible that gravity and thermal-paste adhesion allowed the heat sink to make just enough contact for the heat-transfer to continue for some time.  Just fortunate the other clip end held to keep the block of aluminum from crashing loose down the system board all this time, including my blind removal of the unit from the desk cubby.

It was late so I gave him all the information to provide to Dell support (it was under warranty) the next day. Serial Number/Service Tag, Express Service Code; tell them the plastic mounting bracket that attaches to the system board has failed, heat sink not coupling to CPU causing the failure and you need a replacement. The fact that I initially saw a normal BIOS/Windows boot recovery screen made me feel the CPU itself hadn’t burned up earlier. Case closed. 

FAIL #1 -  My dear friend called Dell the next day and spent an hour with tech-support. They were following the handbook troubleshooting flowchart and wanted him to allow them to remote attach to the system so they could diagnose what was failing themselves remotely.  Goodness.  No boot.  Good luck with the remote attach and control there Dell overseas support.  He gave up in frustration.

I came back again later the next day and made the call myself.  When we finally got our call picked up, I passed the information over to the dear Dell support rep for the system, then simply explained what the issue was, that I needed a replacement mounting bracket. “We’ll send a motherboard, memory, PSU as well just to be safe.” was the reply. 

My friend was amazed.  I guess I deal with enough PC support vendors at work that I just talk the geek-talk directly with authority and am not challenged. Five minute discussion with me verses a hour for him. Go figure.

Two days later the Dell tech contractor rolled out and changed out the motherboard entirely, and PSU for good measure.  This set the stage for…

(Note: Fail # 1.5 -- the Dell rep didn’t bring out any fresh thermal paste with him.  When challenged by my friend on this (since I had mentioned it to him) the rep said something to the effect that there was enough still on the pieces anyway and that removing the paste already on there to put fresh paste on would lower the thermal performance. WTF?)

FAIL #2 -  My dear friend called Lavie the next day asking if I could help him again as now he has a black desktop wallpaper and the system says it is running counterfeit software!

As Lavie repeated their conversation I knew exactly what happened.  Sweet Jebus, Dell!

Stopping by again on the way home, my friend explained how he had spent another hour + with Dell trying to solve this on his own with them.

After repeated attempts by him to enter his Windows 7 key code (copied from the label on the case) he and the Dell rep gave up as it wouldn’t “take” for some reason.  The Dell rep then had him boot into the Dell recovery/diagnostic partition and told him to do a system restore.  Thank goodness my friend had the presence of mind to ask “Won’t this delete all my data?”

Yep. Said the Dell rep. But it was the only way to get his system back again since there obviously was an issue with the product key.

So my friend hung up and called Lavie to send me over.

I got there, fired up the system, went to the product (re) activation area on the system properties window and selected “activate by phone”.

• How To Activate Windows 7 by Phone Step-by-Step Guide - Kodyaz Development Resources

Awed, my friend watched as I fed in the numeric code the system had presented me and then entered in the response code echoed by the automated Microsoft system.

Accepted, activated. Rebooted. Done.  Moving on.

Because Dell had chosen to replace the entire motherboard, rather than just taking off the plastic mounting bracket from the good motherboard and swapping it for the bad one, the system board had changed tripping Windows 7 internal anti-piracy measures and required a product reactivation.

To make matters worse, neither Dell rep (in person or on the phone support line) had even suggested he just attempt to activate over the phone when the on-line method failed.

So now he is up and moving along just fine again, and swears he will call me first before calling Dell ever again.

How’s that for customer service?  I’m sure my check from Dell is in the mail right now.

--Claus V.

Windows Utility Toy-Chest Roundup

Way back when I was a little tot, we got hauled every six months to the family dentist.

After a cleaning/filing as needed, we got the joy of picking something out of cardboard “toy-chest”.  It had the usual toothbrushes and dye pills to see what a sorry brushing job you did (great for Halloween and vampire play) along with some cheesy plastic toys, pencils, and if you were really lucky, you might be able to find a tiny (but functional) sytro-plane to punch-out and play with.

So this will be a real grab-bag of sorts, but I’m sure there is something here for everyone!

Video (mostly Flash)

I continue in my search to find a good/quality way to convert the standard-capture direct-to-DVD video output we are collecting at the sound/video desk at church into a more web/user friendly format.

For each service we capture video/audio feed and pipe it through a mid-level video mixing board into a DVD recorder which writes it to the disk; finalizing after the service.  I suppose we will eventually pipe the output instead into our PC system digitally and then edit/press it to DVD for church members when requested…but for now, I’m working with reprocessing already pressed DVD disks.

So what I have to do is to rip the DVD back into a digital video format, edit it in some cases, then resave in a more web/PC friendly file format.  I had been trying to convert into Windows Movie Maker friendly format but the quality is still not yet what I want.

So I decided to see if converting to a Flash format would work better, and in many ways I am much more pleased with the results, though it does bring new ones.

(Tips and suggestions welcome here from the GSD fans in the know of such things….)

Generally what I do currently is to import/convert the DVD Video_TS file into a FLV file.  Then I use an FLV editing app to trim it up a bit (or extract the message section if just that needed). Then I re-save and share the resulting FLV file.

While it is a bit different from my Windows Movie Maker work, I have found at least two decent freeware tools that allow simple editing of Flash video files:

• RichFLV – Apollo FLV Editing Tool and RichFLV – Apollo app updated - This is cool in that it is an Adobe Air based solution.  The results are quite good and it is fairly intuitive to work with.
• Moyea FLV Editor Lite - Also free and has quite a lot of features to do basic/medium-level FLV file editing.  The interface is easy to work with.
• Adobe - Flash Quick Starts: Using Adobe Media Encoder CS4 - NOT free and not really a FLV file editor, however leave it to Adobe to deliver a pretty powerful solution to import and encode video media into FLV format.
• Format Factory - I have traditionally used this program for my DVD to video file format converting. It is updated regularly but I am still trying to dial in the best conversion settings for best quality.
• Koyote Soft - Offering both a free FLV converter as well as a more robust Video converter application, I’m trying to see if these provide any better quality.
• Freemake Video Converter - Another free DVD ripper/file-converter I’m fiddling with.  Review here from Freewaregenius.
• Pazera Video Converters Suite 1.2 - This is amazing.  I have used other Pazera video converting software before (MP4-AVI) but this suite gives you everything for free.  They don’t use a lot of eye-candy but the no-nonsense approach gets the job done in a well organized manner..  Definitely worth keeping in your kit.
• Hamster - Another oft-mentioned freeware video format converter. Added to my download pile to review and testdrive soon.
• XMedia Recode (Google Page Translate) - Freeware German (English language support included) that is recently updated.  Features include auto-cropping, color correcting, drag-n-drop encoding, zooming (none, letterbox, media, pan/scan, fit-to-screen), volume correction/normalization, and many more). In both an installable and “portable” edition. Cool.
• WinFF - Free Video Converter - The real plus on this one is that it supports both Windows and various *Nix versions. It’s actually a GUI wrapper for the CLI video converter FFMPEG
• HandBrake - One of the major players in video conversion. New builds include x64 support. Drawback is that newer version also outputs to MP4 format so other desired video file outputs are not available, or have to be re-converted.  Earlier versions can still be found with wider output support, but without the enhancements from the newest versions.  But hey, it seems to be primarily geared to the Apple playback device support.
• Free FLV Player for Mac and PC - I love keeping this gem on my USB stick for fast FLV file playbacks.

For the Sysadmins

• Bossie Awards 2010: The best open source software of the year -- Open Source - InfoWorld.  Yep the 2010 BOSSIE’s are out.  I wasn’t as impressed with the offerings this year. Not to disparage any of the winners…they are great…but there weren’t that many smaller apps/utilities this year. Most are much larger platforms.
• FOG Project (screen shots page) - This was the only 2010 BOSSIE winner that caught my attention.  It offers a neat way to PXE push/pull images to systems.  I’m going to see if this has any possible applications in a mass-deployment scenario in our environment…say for getting a special post-disaster custom image onto a lot of boxes fast.
• DOWNLOAD: Windows Server Architecture Posters - Windows Live - Kurt Shintaku has a lot of links to cool MS reference posters (PDF) including one for Remote Desktop Services Component Architecture.
• More partner momentum around Microsoft RemoteFX in Windows Server 2008 R2 SP1 Beta -- via Network Steve blog - More news and linkage on Microsoft’s RemoteFX technology.
• Improving Your Image: Sector-Based, File-Based, and Sysprep - What Makes the Most Sense? Part 3: Deploy-time Build Automation and Recommendations - Windows SpringBoard Series Blog - Part 3 in discussion on imaging issues.
• The Compound Case of the Outlook Hangs - Mark’s Blog - Always awesome.  New post on how multiple techniques used to diagnose Outlook Server issues.  I learned lots of new things!
• Fix Windows 7 MBR « the back room tech - Julie has a series of great tips for getting a Win7 system back up and running.
• Windows XP or Windows 7 Won’t Boot into Safe Mode « the back room tech - Even more great tips to bookmark for future system recovery work!
• August 2010 | TechNet Magazine - Now out.
• Customising the MDT Task Sequence Editor - The Deployment Guys - MDT tips and suggestions.
• Remote Control From Anywhere – Beta 1 Release - IntelliAdmin has a beta trial now available to do internal remote control management.  Requires setup of an reflection server along with clients. If you like it get the pre-order license (unlimited systems) only $599.  Final version pricing will be a $59/per PC seat license.  Worth considering…and it looks like a neat product.
• Windows Logon Notifier (WLN) v1.0 Updated - I am JustNC - Good start at a customized Windows Logon notice builder.  I could do without a bit of the graphics but it’s a start.
• Create a logon message for users in Windows 7 - The Windows Club - Of course, if you run AD, you can make some edits to do so on Vista/Win7 via policy.  I think that XP also has a similar feature.
• Beta testing Microsoft RemoteFX in Service Pack 1 - Network Steve blog - Coming soon to a Windows 7 SP1 release…
• Windows 7 DX11 Receives a Boost in Performance - Network Steve blog - Win7 now can download a DX111 update to enhance performance.  Should be rolled into the SP1 update as I understand it.

Laptop Lust

I’ve been on the prowl for a new higher-end laptop for home to replace my bedraggled Gateway MT6451 Notebook.

I’ve actually bit the bullet and after much work, saving, and research picked out what I hope to be a portable-powerhouse.  I’m saving the big announcement for when it has arrived but until then, here are some systems I considered along with laptop review sources I found beneficial.

…and I’m finding it really hard to wait on FedEx!  Delivery may be mid-week.

• The MSI GX640 & the beauty of Device Stage -- Windows Experience Blog - This MSi systems laptop is quite sporty from both design and delivery.
• The ASUS U Bamboo: Naturally Beautiful -- Windows Experience Blog - Downright gorgeous from a design perspective. And Amazon has what appears to be a deal on them at $999.  I also checked out the other ASUS offerings as well since many are now including the newest USB 3.0 spec on ports.
• The Origin EON 18: Crush your enemies and see them driven before you -- Windows Experience Blog - Again, another example where design form seems to meet power-function. ORIGIN EON Custom Gaming Laptops 15 and 18.
• Toshiba Satellite® Laptop Computers - The local BestBuy had a few very nicely rolled up Toshiba Satellite systems. The design was good and the hardware included was pretty nice.  The discount price at the time was sub $1000 including an i7 core.
• The Dell Studio XPS 16 is music to my ears -- Windows Experience Blog - I really liked both the design as well as the performance for this system.  Though I ultimately didn’t spring for a SSD drive, I can see where if the capacity goes up (say 320-500 GB) but price drops to consumer-level purchasing, that I will want to put one in my soon-to-be-here system.
• Dell Studio 17 (Core i7) Review - A Review of the Dell Studio 17 (Core i7) -  Laptop Mag -- seriously.  An i7 Core in a $1000 range 17” laptop? That seems ridiculous!
• Notebookcheck: Review Dell Studio 1557 Notebook - Hold on.  Scratch that previous comment.  An i7 Intel core processor in a 15” laptop?  OK.  That doesn’t sound like a laptop. That’s a highly modded Corellian Engineering Corporation YT-1300 stock light freighter! (see also this link)

In my research and work I was particularly impressed by the following laptop review sites.  They were exceedingly thorough and helped me to make my final decision.

• Notebookcheck: Notebook & Laptop Reviews and News
• LAPTOP Magazine - Product reviews, tech news, buying guides, and more

Misc Utilities of Note this week

• AeroTweak is an option-filled tweaking app for Windows 7 - DownloadSquad offering for a Win7 tweaking tool.
• Create Synchronicity: “tiny” file backup and sync program.  See reviews at CyberNet News and Lifehacker for more details. Available in install and “portable” versions.
• ImageGrab - screenshotter for avi,mpeg, wmv, live video streams + others.  Pretty cool.  Spotted via Lifehacker post.
• 45 Free Applications For Designers And Developers - Noupe Design Blog. What a round-up for graphics and media folks.

Sound(s) Great!

Nature Sounds - Fun and clever (and easy to use) nature-sound generator.  Build your mix then export to file.  My favorite mix was “Creek” + “Darth Vader” + “Children Giggles” + “Cat Purr”. I could just imagine Vader sitting in a public park alongside a creek, chillin out watching kids play on the playground, chatting up with the moms, and petting his cat fluffy.  Spotted via Download Squad.

That post then introduced me to SimplyNoise - “The Best Free White Noise Generator on the Internet”.  Besides the quick white, pink, and brown noise generations, they also have some free “advanced” download file Soundscape - Thunderstorm (60m) for relaxation as well as others for a donate+download availability.

Browser News

• Firefox 4 Beta 4 Released - Firefox Extension Guru’s Blog.
• Firefox’s Awesome Tab Candy Renamed Panorama, to Be Included with Sync in Firefox 4 - Lifehacker.  Yep. I found it once manually enabling in my x64 Nightly release version of Firefox 4.  Remember, magic words for now? Ctrl + Alt + Space.
• Newsfox and mozdev.org - newsfox NEWEST: installation. Version 1.0.6.2 now out.  I download the .xpi file then drag/drop on my Add-ons window to install. Release notes
• Did Microsoft Russia leak the new Internet Explorer 9 user interface? (Download Squad) and Did Microsoft Russia leak the new Internet Explorer 9 user interface? (ars technica).  Truth or Fiction?
• Chromium Adds Web Store Placeholder, Labs, And An Awesome Expose-Like Feature - Network Steve blog - I’m using Chromium nightly builds so I decided to enable this “Apps” area feature just to play.  Took a bit of work:
• Install Google Web Apps in Google Chrome (Google System blog) - Had to do these steps to get it armed and loaded with the Chromium-included Google Mail, Calendar, and Docs apps.
• See also Weekend Project: Install Web Apps in Chrome or Chromium - ReadWriteWeb - More info.
• Developer’s Guide - Installable Web Apps - Google Code - Then did this to add in Google Maps app.
• You can also type “about:labs” to see some new stuff you could enable if desired. See this Google Chrome to get Gmail Labs-like experimental features post at Download Squad.
• Weekend Project: Install the New "Google Chrome Labs" - ReadWriteWeb - More info.
• Google adds more official themes for Chrome -- to the Extensions Gallery? -- Download Squad.  I know, right?
• Hardware Acceleration is Coming to Chrome - Try it Now - ReadWriteWeb - Read the post, then get a Chromium build and launch the application with the --enable-accelerated-compositing flag.  Performance results may vary.

Cheers!

--Claus V.

Making Material and a PSA video

This past week (as well as the prior one) have been fairly slow on the “new app” front.

I’ve been collecting these links for a bit so here you go. Pick ‘em over, yard-sale style.  No rush.

• Windows Live Essentials 2011 beta refresh - My WLWriter just got updated. I was running the earlier beta and it worked great but was like a old sedan with the wax left on…functional but off. This new one has had the wax buffed off and polish added. GET : Windows Live Essentials beta
• Reboot computers on your network -- (IntelliAdmin) - Handy micro utility.
• Remotely Enable Remote Desktop -- (IntelliAdmin) - It does work as delivered.
• Open command prompt in any folder -- (IntelliAdmin) - see above comment.
• Enterprise Remote Control – Beta -- (IntelliAdmin) -- clever new beta tool that could be used with an internal “reflection server” to help manage remote-connection negotiations with minimal bandwidth hit.
• Cleanup Outlook Attachments -- (IntelliAdmin) -- new GUI tool to help manage those blasted Outlook Secure Temporary files.  I personally like my own OSTff batch file clearing solution.
• DriverBackup! -- SourceForge.net project.  Previously mentioned here on GSD recently but this Free tool to backup drivers post by IntelliAdmin blog has more details on it.  I personally like Double Driver myself though DriverMax is popular and Nir Sofer’s DriverView is a must-have as well for cataloging/auditing.
• Mouse Jiggler got updated with a new “Zen jiggle” feature which “virtually” jiggles the cursor for the system but visibly no movement occurs so it isn’t annoying while using the system.
• WhoCrashed -- automatic crash dump analyzer from Resplendence software. Couple that with BlueScreenView and AppCrashView and you have some great sytem-troubleshooting tools.  Related:How to read the small memory dump files that Windows creates for debugging - MS KB Article 315263 and Download details: Microsoft Exchange Server Error Code Look-up Tool. with Looking up error codes with Err.exe - Alex D’Angelo’s Blog
• Google makes a smart move; makes Chrome MSI available to Enterprises -- The Windows Club. Direct link: Google Chrome Standalone Enterprise MSI package
• girl quits job on dry erase board exposes farmville boss called her hopa -- theCHIVE  Absoulutely not related remotely to anything here but even though this is now revealed as a spoof/hoax, the real “actress” Elyse Porterfield is cute as a button and has that sultry Angelina Jolie look that GSD finds sooo irresistible.

GSD PSA

For social American cultural redemption from the above Elyse Porterfield and Angelina Jolie yumminess link and comments, I offer you this video.

Soldiers returning from war surprise kids, loved ones. NSFW b/c you will bawl your eyes out (video) - TheChive

FYI, the song synced in the video is "Praan," by Garry Schyman.  Interesting but wonderful choice.

Saw this one at my bro’s last week with my mom and had to fight back the man-eye-sweating.  Damn, hate it when that happens.

Back to normal Linkfest programming…

• Introduction to the new Sysinternals tool: RAMMap - Ask the Performance Team -Granted RAMMap isn’t really that new anymore but this is indeed a great introductory post on the utility.
• The Mystery of the Missing Memory -or- It Pays to Know Your Hardware  - Ask the Performance Team - Awesome troubleshooting post that introduced me to the Redundant Memory, or RAS Memory Mirroring feature supported in some server hardware BIOS systems. Cool!
• OutlookStatView -- NirSoft utility updates.  “Added 'Add Header Line To CSV/Tab-Delimited File' option. When this option is turned on, the column names are added as the first line when you export to csv or tab-delimited file.” and “Added 2 new columns: 'Average Incoming Messages Size' and 'Average Outgoing Messages Size'.”
• OutlookAttachView -- NirSoft utility update.  “Added support for embedded message attachments (attachments of another message). These attachments are saved as .msg files that can be opened by Outlook.”
• NK2Edit -- NirSoft utility update.  “Added 'NK2 Control Center' which allows companies to watch the status and the location of Outlook AutoComplete files (NK2) in all computers.”
• Roadkil’s Unstoppable Copier -- Recently bumped up to v5.0 “· Now supports unicode, automatical system shutdown and basic context menu integration.”
• FileZilla - The free FTP solution and FileZilla Portable. I’m having to play with this tool now a bit at work and also found this recent post Top 3 FTP Applications for your Windows PC | The Windows Club offered some alternatives as well.
• SunlitGreen -- is a new source that has some light-weight freeware photo image management tools well worth checking out. Lifehacker featured SunlitGreen Photo Editor in a recent article.
• WirelessNetView -- Nir Sofer tool update.
• altdrag - was a tiny tool highlighted by CyberNet News to help manage “lost” windows that open on a phantom position when you have removed a dual monitor output.  Sure if you are in Windows 7 you can do that natively.  My favorite freeware power-tool to do this is Window Seizer. Works on all my systems from XP to Win 7 x64 just fine. It has lots of other features as well for Windowed management.  See also: WinSize2 and the WindowPad projects.

Windows Program Launch tools

Note: I know there are LOTS of other great app-launchers, not just these.  I’m only focusing on “dock” style launchers in this conversation.

Nexus -- I’m going to follow up to this blip in a later detailed post but for now, know that I have upgraded my Windows dock utility from the GSD-beloved free RocketDock application to the spanking hot Nexus dock system on my Windows 7 x64 platform which I had to destroy as noted in my last post.  RocketDock is not specifically offered as Windows 7 compatible, though it generally plays well on my system, it is prone to issues with startup and shutdown of the system.

So I did some research and came up with Nexus.  It is very mature and come is both a free (full featured!) version and a “Ultimate” for $ version.

It supports Windows 7, has all the eye-candy and high-res icon support you can want. Nice defaut skins and icon-action management options.

For a tiny version on Windows 7 systems, check out Ali’s Dünnpfiff’s free Jumplist-Launcher.  It took me a while to get familiar with it (not because it is technically hard, just a different way of interacting with an power-icon).  It is now my preferred quick-pick launching solution on business systems I use as it is more sedate but just as useful as the eye-candy of Nexus.

Of course you can still go “old-school” even in Windows 7 and use a Win2k/XP style “quick-launch” toolbar on your taskbar/superbar. Quick Launch - Enable or Disable - Windows 7 Forums

Want more options?

• 5 Amazing Dock application for Windows 7 ultimate tweak ALL FREE! -- Windows7hacker
• Replacing Start Run - The Quest Continues -- Scott Hanselman’s blog

Finally, not related, but I found this tool as well supporting customization of Win 7 logon screens.

• Logon Editor - Freeware - via a Windows7hacker post.

It has a lot more options and logon screen control setting tuning options than my oft-usedWindows 7 Logon Background Changer tool.  I still also deploy the FxVisor Shortcut Arrow (method two) tool to minimize but retain the Windows Shortcut symbol applied to shortcut icons.  Frameworxx looks to have disappeared but the VistaForums hosted downloads are still kickin.

Cheers.

--Claus V.

Bending “Bend” and Related Miscellanea

A few posts back I made note of a sexy new notepad application for Windows 7 systems

Bend - A modern text editor -- (freeware) -- a positively beautiful GUI with an almost zen-like quality.  Spotted via Tenniswood Blog.  Windows 7 only.  Stunning.

The ever practical How-To Geek has a detailed walkthrough as well with lots of images : Edit Your Text in Style With Bend.

Granted, it was a bit slow on launch (at least on my Win7 system), coders reported some of the supported syntax highlighting was off, and internal search didn’t quite deliver all the goods.

Overlooking those minor quibbles, it is a great first-delivery in a new application GUI design paradigm for most users.  It simply looks stunning in simplicity and breaks decidedly with the typical Windows application form, including the Ribbon style.

Only one thing.  You can’t officially have it any more.

In echoes of Right Said Fred, “Bend’s too sexy for my Window, too sexy for my Windows, too sexy it hurts….”

Seriously, not too later following Bend’s public splash and meteoric rise on it's home on CodePlex, this mysterious notice appeared on the How-To Geek’s post.

*Update* – It looks like the developer has removed Bend from the CodePlex page. We are trying to find out what happened and will keep you updated!

Hmm…Indeed, for days the Bend link would only return directly to CodePlex home page.

Now, it at least falls on a Unpublished Project Page for Bend.

The mystery swirls!  Was it powered with escaped alien technology? The MiB? Did the Men from Redmond find it was too sexy and violated Windows development EULAS?  Did Apple perform a buyout to prevent Windows from moving in the All Things Beautiful™ land that they own for computing resources?  Where is the Mystery, Inc! gang when we really need them!

The Windows world needs more application design like Bend!

Lacking any news on what happened with the developer and the project pull, I set about working on an alternate mystery…where was the application stored on my system…and could I possibly port this Windows 7 goodness over to my XP system?

The Bend download actually appears to consist of a web-based “seed” installer that is reminiscent of the Windows Live mechanisms.  Once executed it retrieve the main file set from the Net.

Unfortunately for me, I had done a CCleaner and CleanAfterMe pass on my system shortly after installing and scrubbed all these juicy bits away.  I suppose I could have dived into my Shadow Volume stores but this is more fun.

I figured, maybe I can just copy the program’s folder to a USB stick and fire her up on my XP system.

The quickest way I know how to find the executable on a installed program is simply look at the target properties for the shortcut icon placed in the start menu list.

However this doesn’t help with Bend as it is really a “break-the-mold” app.

Turns out this icon is a “ClickOnce Application Reference (.appref-ms)” link.  Goodness.  That means if you follow the target path you will end up at somewhere like

C:\Users\profilename\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bend\Bend\Bend.appref-ms

Decidedly not helpful and a portent of new kinds of shortcut links to come (and more headaches for examiners and sysadmins no doubt.)

Aside #1 - ClickOnce Application Reference (.appref-ms)

Nir (not That one) describes it thusly:

If you open the appref-ms file in a text editor you'll see it contains the Url for the application, culture, processor architecture and key used to sign the application, so yes, it's just a link.

The difference between those "Application Reference" files and shortcuts (.lnk) is that the application reference points to the original application Url and not the location of the exe on disk, when you run the appref-ms file the system knows how to find the copy of the program on the local disk and run it from there without accessing the Url (this is not accurate and depends on settings in the ClickOnce manifest, but its a close approximation).

DotWhat.Net has more:

The APPREF-MS file is an application reference file that is used by the Microsoft ClickOnce deployment system in order to install, update, and run remote or local applications.

The APPREF-MS file and the correspoding APPLICATION file is part of the .NET framework and give the remote or local link to the application that is to be run; this link also contains information relating to the updates for the application.

These files are created by the Microsoft Visual Studio software for application development.

Johnny Coder has great info on how this interfaces with AutoStart: ClickOnce Run at Startup

Finally, CODE Magazine - Article: Welcome to the Future of Deployment has on page #3 a more detailed presentation by Craig S. Boyd.

In the case of an installed, offline-available, ClickOnce application, the ClickOnce installs the application in the user’s profile directory. Every user that installs the application on a given computer will end up with their own profile’s isolated installation. The directory into which an offline-available ClickOnce application is installed looks very similar to the following:

C:\Documents and Settings\Profile Name\Local Settings\Apps\2.0

ClickOnce’s installation routine does not simply creating an application directory based on the Product Name and install all of the application bits into it. That would have been too easy. The scheme that Microsoft has devised is much more complex and it involves having the components that make up the application installed in a lot of different directories and subdirectories beneath the 2.0 folder shown above. ClickOnce installs the application in one location, the data in another, and the manifests in yet another. The install is essentially compartmentalized.

Back to White Rabbits and Alien Ninjas

Opening up the Bend.appref-ms reference found on my system, in Bend, resulted in this:

http://bend.codeplex.com/releases/clickonce/Bend.application#Bend.application, Culture=neutral, PublicKeyToken=0000000000000000, processorArchitecture=x86

Yes Sally, that was a non-local hyperlink reference.  Clearly this is subversive alien technology (or for you few Last Exile fans, maybe Guild managed) released from 1 Infinite Loop, Cupertino, California Area 51 designed to phone home at launch.

I suppose I could have done the easy thing and just launched Bend and peeked at it’s image path in Process Explorer.

Nay. I launched Process Monitor and launched Bend to arrive at the location on my own system:

C:\Users\ClausV\AppData\Local\Apps\2.0\3KOVR9H8.BMY\YOJLRJZC.G26

That’s exactly where any user would have expected it to be!

Underneath there are four more alien technology based directories containing various files:

bend..tion_0000000000000000_0000.0008_bb2abada039deb14
bend.exe_0000000000000000_0000.0008_none_fc971fb0826fb84c
icsh..edit_9cc39be672370310_0004.0000_none_bf8d008a5b793b82
manifests

And of course, logically we will find the application executable under the clearly named bend.exe_0000000000000000_0000.0008_none_fc971fb0826fb84c (nope) bend..tion_0000000000000000_0000.0008_bb2abada039deb14 folder!

Having read all the above side-bits on this appref-ms file stuff, I clearly realized just how important all those other folders really were.  So I copied the main 3KOVR9H8.BMY folder and subs to my USB flash drive.

Then making sure that my XP Pro system was able to receive the alien technology (it was, having the required .NET 4.0 installed), plugged it up and drilled down and launched the Bend.exe file.

It worked, and did launch much faster than on the Win7 system.

So yes, if you have these files, and .NET 4.0 you can take Bend with you to Vista/XP just fine.

Unfortunately, if you just have the Bend installer, you don’t have Jack as the Bend source server isn’t available to pass you the files once run.

I suppose I could package up these files from my system and give them too you, but I’m worried for my safety now that I’ve shared all this fascinating goodness.

So I’m going to let them chase “Juan” from the How-To Geek post’s comments who said this:

http://cid-38dd082d08a09987.ph.....s/Bend.zip

@bob

Hey, I got it when it was still from Codeplex, though this is not the installation, it is the actual contents from the app. Enjoy!

I checked Juan’s file/contents, and at the time of my access, it did match the contents of my own bend.exe_0000000000000000_0000.0008_none_fc971fb0826fb84c directly perfectly, though Juan did not bother kindly to include all the other alien technology folders as well.  Seemed to work OK though without them.

At the same time I have been writing this post, I have also been concurrently performing the Gutmann method, burning, shredding, and letting a 2-year old borrowed neighborhood child with loosely attached sippy-cup lid to render my blogging system laptop non-functional at the time of writing this post.  Oh, I’m also right now tossing it into my father-in-law’s fish-pond with the old DISH Network disk to swim with the catfish.  This should sufficiently ensure that alien ninjas nor MiB nor Apple execs will not be concerned and disappear me like they did Bend’s developer.  Like I said, go find Juan.

Don’t feel bad for the loss of my laptop.  I’m waiting on a humble little new Dell i7 core laptop so I can putter around safely…free of this heady ClickOnce Application Reference stuff.

Then again, maybe the developer got CodePlex servers hammered with the downloads and distribution/ ClickOnce Application Reference design model and had to yank everything and regroup.

Nahh..that would be crazy talk.  I like Apple alien ninjas better.

More Notepad / Notetaking Software

Seriously.

Bend really is spectacularly sexy in design and getting there in function.

That said, I can’t see any way I currently could leave my trusted and highly-recommended high-production text editors for it anytime soon.

• NOTEPAD++ - THE notepad of our age. Something for everyone and nothing left out.
• Notepad++ Portable - PortableApps.com Edition
• flo’s Notepad2 - both in x32 and x64 flavors. Yummer.
• EditPad Lite - Free Text Editor for Windows for non-commercial use
• editor PSPad  - freeware developer’s text editor

None of these are particularly sexy though they are all very robust.

If you do want a deliverable Notepad alternative that is more “girl-next-door sexy (SFW)” than the sophisticated “Euro/Metro sexiness (SFW)” of Bend, consider bringing FluentNotepad home to meet the folks at Sunday brunch.

• FluentNotepad Beta 3 Release - ~SalvoG92 on deviantART
• FluentNotepad Adds the Office Ribbon UI to Notepad - How-To Geek

It does have that pleasant and predictable Windows Ribbon working for it grandma likes.

See also:

• Battle of the Notepad Alternatives - Lifehacker Roundup.  Others suggested in the comments were TextPad, ConTEXT, EditPad Lite, Crimson editor, metapad, LopeEdit, and EmEditor.
• Notepad Replacements - Grand Stream Dreams blog post

Then there are these spinoffs that aren’t notepad apps, but do have the minimalist form for text composition:

• Q10
• Jarte
• Dark Room
• And related to actual note-taking:
• PNotes Portable - virtual sticky notes for your desktop
• The Guide - Outliner tool
• SEO Note - Note and Outlining tool
• CaseNotes - for free for forensicators (awesome introduction here)
• MANDIANT Highlighter - Powertool for large-size log-file loading, editing, and analysis.

Cheers!

--Claus V.