Super Sunday Linkfest: Utilities Galore

Just past 6 PM and most of the Valca household chores are done.

One last linkfest to empty out the blogging hopper.

Wireshark version 1.0 network sniffer released - News - heise Security UK - Actually it has been a few weeks since Wireshark's v 1.0 release came out. It's still all good.  Available in builds for OS X, Linux, and Windows (and USB portable) systems. All free.

Microsoft Network Monitor 3.1 is another full-featured software sniffer some folks also prefer.  Lots of good elements to it. For some how-to's take a gander at this Microsoft guide: How to capture network traffic with Network Monitor.

And if you want a good collection of other freeware network utilities, don't forget this GSD post: Free Network Utility Nuggets.

SpywareBlaster v4.0 - (freeware) - is one of my favorite tools for helping to protect client workstation browsers from the dangers of malicious websites and surfing.  It has recently been updated to version 4.0.  Not only does it prevent installation of Active-X malware, it blocks targeted spyware and tracking cookies in both IE and Firefox. Plus it blacklists a great collection of "dangerous" websites in IE.  This latest version is more polished than ever.

Eset - ESET SysInspector - (freeware) - Now out in version 1.1.0.97.  Great tool for helping to highlight potentially dangerous running processes and files.  Won't remove anything, but a great tool to help analyze systems.  See this GSD post for more info: SysInspector: New System Utility from ESET.

Workstation Migration Assistant 1.0 RC2 | dcunningham.net - (freeware) - Another update on a great GUI based tool from Dan Cunningham. The latest changes cleans up the utility used to help transfer user profiles between systems.  Nice work Dan!  Don't forget his other tip; Disabling Apple Software Update items using registry entries.

RegRipper - (freeware) - Harlan Carvey of Windows Incident Response blog has done us all a great service by providing a beta tool used to inspect and log key entries used in forensic examinations of Windows Registry files.  I've been playing with it for the past week and can't wait to see as it continues to be developed.  It's a great and easy to use tool.  Thanks Harlan!  Download hosted over on SourceForge.

PreviewConfig - (freeware) - TweakVista tips us to a new utility by Microsoft MVP Ramesh Srinivasan.  This tool lets advanced users quickly and easily register file types with the Windows Explorer file preview pane.  Must have for power Vista users.

DynLogger - (freeware) - Wow. For hard-core system process explorers, this tool logs all dynamically retrieved functions by reporting the module name and requested function. Great for looking for "hidden" functions used by an application.  Not a daily use utility, but likely to be useful when examining mysterious and/or malicious processes on a system.

Did you see that Adobe FlashPlayer got an update? Browse to the Flash Download site in each of your browsers to ensure you get the proper update.  There are different ones for each browser. The updates patch various security issues.

Don't forget to uninstall the old Flash files as needed afterwards!  The Secunia Software Inspector online scan will help identify which files you may need to delete afterwards.

Microsoft Sysinternals has pushed some updates to key applications out their doors:

Process Explorer v11.12: This update includes a number of minor enhancements and bug fixes, including support for tracking commit and non-paged pool limits.

Process Monitor v1.30: This major update adds support for importing and exporting filters, records system information in log files, presents more information about specific operations, includes translation of additional operation error codes, and tracks CPU and memory activity that it displays in a revamped process summary dialog.

Also, the ever amazing Mark Russinovich takes on on an examination on System Process CPU spikes in Vista.  Turns out it is a Broadcom driver causing all the ruckus!

Before we leave Redmond, one last blog post: IEBlog : IE8 Security Part I: DEP/NX Memory Protection.  The IEBlog team shares some insight on how IE8 will leverage DEP/NX memory protection.  Interesting angle to take.

Over in Nirsoft, a few favorite products have gotten some updates including CurrPorts and PingInfoView is now released.  This new tool pings multiple host names and IP addresses with results displayed in one table. You can set various thresholds for ping/time rates and you can export the results in your format of choice.  Great stuff for documenting networking issues.

IcoFX - (freeware) - This great and awesome full-featured icon editor and creator has had a major update to v. 1.6.  I really like the power in this tool.  Not only can you download an installable version, but the developer has kindly had the foresight to provide a portable USB version as well. Awesome!

Windows Tip: Simulate "No to All" in file copy dialog - Download Squad - Ah!  Just hold down the "Shift" key when you click "No" and you effectively have done a "No to All" action!  I will remember this one!

Mark Jacobs's MJ Registry Watcher - (freeware) - Is a great tool used to monitor key Windows startup files, registry keys and values often attacked by trojans and malware.  It will catch and alert on many registry changes.  I like using this tool when I am installing new software on my system to try to catch all the places it drops into the registry.  The latest version is 1.2.6.2.  It's similar in many ways to the fantastic application WinPatrol. 

Interestingly, Bill Pytlovany is getting ready to release the first beta version of WinPatrol 2008. Can't wait to see what's coming!

CPUID - (freeware) - Used to monitor and get information on your system's processor(s) has just been version-bumped to 1.44.2.  Always interesting to see what exactly is going on with the CPU in the machine.

SIW | System Information for Windows - (freeware) - A great system information gatherer that is 100% standalone has been version-bumped to 2008-04-02.  The latest version includes a new "Security" module, WinPE 2.1 support, U3 support, enhanced "Updates" module.  Enhanced "Ports" module.  Detection of MS Office Pro Plus 2007. More hardware and software support, along with the latest AMD/Intel CPU's, an updated device database, and miscellaneous fixes.  Also worth downloading and using, the SIV (System Information Viewer).  Quite incredible.

Hope you didn't get whiplash there with that linkfest.

Got to go on a burger run.

--Claus

Windows Live Writer Post-Patch Tip

In case you didn't notice, rolled up in the Windows Updates was a minor update patch for Windows Live Writer.

I had noticed the primary issue before (that images posted to Blogger in WLW would open in a download box rather than the image in the browser window) but thought that was a bug in Minefield (Firefox 3.0 betas).

Windows Live Writer update details - Microsoft KB951125.

If you check you Windows Updates after you apply them, you should see that it was included if you have Windows Live Writer installed on you system.

Anyway, once I applied the update on my systems, I found that I was now unable to post to Blogger at all.  I kept getting post failure messages.

So I tried something easy.

On the menu-bar I went to Weblog > Edit Weblog Settings...

I clicked the "Update Account Configuration" button.

Then I just clicked "Next" without making any changes so WLW could re-download my Blogger settings and configurations.

That completed successfully without errors.

Then I tried to repost the blog post I had just composed but which was failing.

It posted quickly without any errors now.

Looks like the update causes some minor issues with some posting configuration files.

So if you run into that issue, post WLW update, give this a shot to refresh the settings.

Worked like a charm.

--Claus

Our Hibiscus in Bloom

One of the few gardening projects we have been successful at by doing nothing.

My kind of gardening...

--Claus

Weekend HelpDesk Warrior: tfsnifs.sys

The Red Phone Rings

Friday night, a call came into to the Valca Help Line.

It was a voice I hadn't heard from in over a year...one of our former pastors (and who also officiated Lavie and I's wedding).

For the most part, there is a select handful of folks who I do "off-the-clock" system support for; parents, one or two friends, and this special pastor.  Other IT co-workers of mine seem to have a number of these side-job enterprises they engage in.  For some reason I prefer to share my help through this blog with the masses.

Anyway, like I said it had been just over a year since my last repair session.  I took it as a good sign that he hadn't called; either he was out of the country again on missionary work or my configurations have kept him out of trouble that long.

We agreed for me to stop by early Saturday morning and take a look at his system; a Dell 8300 desktop, running Windows XP Home.

Recon

So I showed up as scheduled.  I had spent the night before making fresh sysadmin tools to take with me.  In my new job a project-lead I don't generally bring my work laptop and software kit home with me on the weekends.  I burned up an older copy of my custom boot-disk and auto-run utility disk for which I keep an ISO around, along with a fresh version of VistaPE boot disk.  I also updated my USB-hockey-puck drive with my ever-growing collection of standalone sysadmin programs.

Armed with these tools I began assessing his system.

The primary problem was that his CD-ROM tray would not stay closed.  It would close, then pop-open again.  And the sound was out on his system.

Because the CD-ROM tray was wonky, he couldn't burn backup files of his extensive Quicken account.  This was the major concern.

First thing I did was to fire-up Process Explorer and AutoRuns for Windows looking for any malicious processes that might get in the way of any ongoing work.  Fortunately it was clean and clear.

A quick assessment told me that I needed to focus my attention on updating the system and programs before I dealt with the sound and CD-ROM issues.

Let the Updates Begin

I checked for Windows Updates.  Those were in good shape thanks to my setting Windows Update to automatically download and install.  I did have to manually install Internet Explorer 7 as he had waved that update off not knowing if it should be done.  I also had to bring Firefox out of the 1.5 build up to the 2.x builds.

A "Custom" Windows Update scan found about five hardware drivers that needed updating. Done.

He had already purchased Norton Security Suite (ugh) so his system was running a bit boggy, but as he had paid his hard-earned $, no sense in pulling it off right now.  We will consider moving to AVG Free or Avast! free once his "subscription" for Norton's ends in a few more months.  I did have to download and apply an update to Norton's.  That process took about forty minutes, even with a DSL connection.  Yuck.

We had previously disabled the firewall component of Norton's suite and he was using ZoneAlarm.  However, based on the system performance I was observing (just 512MB RAM) I took ZA off and switched to Sunbelt Personal Firewall instead.  It is considerably lighter in the system RAM needs and he just really needs inbound firewall protection only.

Curiously, when I applied the Norton's update, it re-engaged the Norton's firewall on-top of the already running Sunbelt Firewall.  Odd that it allowed two firewalls to run at the same time. Granted, it did present a dire warning about Norton not being compatible with Sunbelt Firewall and helpfully recommended I uninstall it first. I didn't.  I did re-disable the Norton Firewall and all was well again.

I had to install Java SE. I can't believe I hadn't done that before on this system.

Adobe Reader got updated to version 8 from 7.

I upgraded SpyBot to the latest version.  We pulled off Ad-Aware SE and installed Ad-Aware 2007.

Scans turned up a minor malware apps and a number of cruddy URL drops and cookies.

I then ran The Secunia Software Inspector.  It reported all was well expect for a Flash update (which was on my list of things still to do).

I disabled a few unnecessary auto-run items.

With the system humming along much nicer, I turned my attention to the CD-ROM tray and sound.

Houston, We have a problem....

First thing I wanted to to was review the status of the system Hardware/drivers

I right-clicked on the "My Computer" icon and selected "Properties".

And was slammed in face with a Windows dialog box notifying me that the security properties set on the system have restricted access to that element by the administrator. Something along the lines of "This operation has been canceled due to restrictions...”

Hmmm.  Don't recall doing that.

So I went looking for the Control Panel so I could check the user account. Only the Control Panel had been removed from the Start menu.

So I tried launching it via the Run box by typing "control" only I got the same error message.

Then I tried running specific control panel items to launch via the Run box.  None worked.

I booted in Safe Mode to get to the Administrator account on the system. Nope.  Same lockdown here.

Now I was getting frustrated.

In the end I fixed it by using Doug Knox's Windows XP Security Console utility.  I download this free (limited) tool and ran it.  Going through the options I found the setting where it had been disabled.  I re-enabled it and rebooted the system.  All was back to normal.  Seems like a malware event had tripped that setting.

I later found this post "Unable to open Control Panel In Windows XP" over at TechieZone that has some additional techniques for dealing with this "Restricted Control Panel" situation.

To the Drive!

Now that I was able to access the Device Manager view of the system, I checked the drivers and hardware device state.  All were well and no errors were seen.

I shut down the PC and opened up the case.  I extracted the CD-ROM drive from the chassis for inspection.  I had already counseled that my friend might need to make a trip to the local GoodPurchase store to pick up a new CD-ROM write drive.

Older Dell systems such as this have funny case inserts that create a facade in front of the CD-ROM drives.  As such it is hard to see them without the drive removed.

Looking at it I saw where the drive clearly was not allowing the tray to fully retract and when the tray was fully pushed in, it was sitting at an angle and not-flush to the drive body.

I opened and closed the tray a few times and finally with a bit of pressure on the tray "CLICK" the drive tray re-seated itself in its track.

A quick reassembly later and reboot showed the drive tray working perfectly again.  I took a music CD and it accepted it, closed fully, and played wonderfully...well, without sound, but to that in a minute.

That problem was fixed.

TFSNIFS.SYS BSOD?!!!

So we fired up Quicken and attempted to write a save of a Quicken backup file to the drive. Only it wouldn't save.

Seems the CR-ROM disk had gotten something corrupted on it as it would not be written to.

Happens.

In the process, Quicken would lock up (as well as the system).  This is what led originally to my friend borking the CD-ROM tray to begin with attempting to extract the "stuck" disk.

So we rebooted and set that disk to the side.

Then we tried a different CD-R disk which worked fine for the copy.

Only when I ejected it when done, the system BSOD'ed due to tfsnifs.sys.

Hmmm.  Anytime I see an unknown process, unfortunately named "*snifs*" I get concerned. Looks like a very bad thing.

Another reboot later and some Google work turned up that it was, in fact, a system driver related to Sonic's Drive Letter Access (DLA) which shipped with the Dell system and allowed direct writing/reading to a formatted (but not closed) CD-R disk. Not bad, but terribly named.

We tried two more fresh CD-R disks and they worked great, right up until ejection when the BSOD reared its head again.

I uninstalled the DLA software, then the Sonic software. Reboot.

We dusted off his original Dell system disks and I reinstalled the DLA software and the Sonic software. Reboot.

Further tests found no more BSOD's.  CD-R's formatted fine again and disks could be inserted, written to, then ejected with no more errors.

Whew.  That was a close one.

A Sound Ending

I figured the sound issue would be pretty easy to diagnose.

I checked the speaker cable connections and wiring.  All were correctly plugged in.

I checked the speaker set, it had power and the knobs were all turned up.  I could hear a faint "hum" from the speakers.  I checked the system sound settings. Drivers were good, mute was not enabled.  Various CD's and YouTube tests still presented no sound output.

So I checked the sound card.

I disconnected the speaker wire and connected a set of headphones directly to that output jack.

Yeah!  Sound spilled forth.

Turns out the external speaker set had gone bad in the amplifier unit.

Knowing my friend's sound needs, I simply recommended picking up a new set of two mini-speakers for his system for about a Jackson.

In all, I think I spent close to six hours visiting, working, and trading stories from our common past.

I did recommend he visit Crucial.com and showed him how to run a RAM scan test. I advised him to consider upgrading his 512MB RAM system to 1.5 or 2 GB of RAM.  Lucky guy's 8300 system actually comes with four slots on the system-board so he could (technically) upgrade to 4 GB.  However his needs would only justify a 1.5 to 2GB RAM configuration.  And the prices remain quite good.

It was a great system-repair visit and all turned out well.  He generously share a few $ with me for my efforts. Enough to get my hair skinned down and flat-topped and then take the girls and Mom out for a pleasant dinner at the local Dead Lobster.

Case closed.

--Claus

Vista BSOD: Leave it to Alvis...

It has now been almost a full year since Lavie brought home our cherished Vista notebook.

The wisest choice I've made with it is to do a RAM upgrade from 1GB to the full 2GB the system will support.  Night-n-Day!

We have come to happy terms with UAC.

I even managed to get Vista SP1 on the silly thing a few weeks ago.

Not once, in all that time, have I ever seen a BSOD on the Vista laptop.  Ever.

I might get a BSOD once a quarter on our XP Home systems, but usually I instigate it by mucking up a device and driver.

So the other night, I was amazed to see the very first BSOD on our Vista system.

Alvis has been feeling a bit sick and has claimed our bed as her own, thus to be found under the covers, with juice or hot tea on the bedstands, piles of teen-glamour magazines on the floor, and the laptop on her lap.

It was time to forcibly remove her from her nest and toss her in her bed for the night.

I asked her to shut down the laptop and she informed me it was applying updates and said that the screen said not to turn it off until completed (good girl...she reads).

Then she closed the lid.

I opened it back up to bring it out of slumber-mode so it could complete them, unfortunately, when it popped back up, it BSOD'ed.

Apparently, placing your Vista system in a hibernation mode, in the middle of patch application, isn't a recommended Microsoft practice.  Make a note.

I had to do a hard-power reset.  It came up and fussed about not being shut down properly.

It then rebooted and went back into a "stage 0 of 3" message display about patching.  That lasted another minute then it came up to the usual login.

A check of the updates showed they all (as far as I can tell) were successfully applied after-all.

The system is up and running fine.

Leave it to Alvis.....

--Claus

Astros' Madness & Baseball Card Karma

Some time ago, by Dear Brother called me up and asked if I would be interested in a "Boy's Night Out" at the local ballpark.

Sure!

Take Me Out to the Ball Game

So last Monday, I showed up after work and met brother, brother's friend, dad, and dad's friend to watch the Astros season home opening game.

Alvis and Lavie were very jealous, but sometimes one has to just roll with the punches.

The tickets little-bro scored were located immediately in front of the press-boxes, right behind home-plate.  Needless to say they were gorgeous.  I don't ever think I will ever again have the chance to sit in better ballpark seats.

The Navy parachute team dropped into the stadium through the open roof. Spectacular!

Noise was ridiculously loud.  I think the brick wall behind us for the press-boxes was reflecting a lot of the sound making it more that it would have been in "normal-man's" seating.  It was fruitless trying to hold a meaningful conversation; just as well as the game was pretty intense on the field.

The game was very good and had a fast pace.  I was still in pain (see previous post) but was willing to tolerate it.  Then the Cards tied up the 'Stros and brother's friend was elated ('Cards fan). Then the 2nd homer went flying and Game Over, Astros win!

Took me almost an hour to get out of the grid-lock of parking post-game.  I had parked in a lot over by the lofts on the east-side of 59, but that didn't help.  Finally gave up and took Harrisburg east and out of downtown.  Next time I think I will splurge at the Convention-center hotel parking garage and just walk the extra blocks so I can get out faster.

Take Me Out to the Ball Game - Wikipedia

Say Mister, that's some swell cap you got there...

Little bro collects three things passionately: Coins (birth year mint and errors), baseball cards, and homeless kittens.

The first and last one he seems to have gotten under control.

Our Prussian clan seems to thrive best when we are passing good Karma around.  Mine usually lies in doing PC support and tippage.  His, well....

Seems little-bro has been enjoying a fellow card-collecting blogger over at Wax Heaven.

Little-bro (a.k.a. "Anonymous Astros Fan") got a good selection of pulls in a recent pack of cards he picked up.  Feeling generous, he fired off an email to Wax Heaven and said he would pass it on for free.  A few more pulls later and he was sending off a grand-collection to Mario.

The whole fascinating story of baseball card love and generosity among fellow hard-core collectors was captured here: A day I won’t soon forget… « Wax Heaven

Anyway, for some reason, little-bro was feeling some good mojo flowing in the Force.  He decided last night to issue a challenge to Wax Heaven on the outcome of last-nights Astros-Marlin game; Andrew, don’t let Tatiana down!… « Wax Heaven

(This being a very brave thing to do considering the losing streak since the home-opener aforementioned.)

Poor (but cute) baseball card blogger and Marlins fan Tatiana faced having to be publicly photographed wearing an Astro's cap if the 'Stros (finally) won.

If not, little-bro would surrender some choice Marlin's cards from his extensive collection.

Alas, Karma won and Wax Heaven lost: So, It Looks Like I’ll Be Sportin’ An Astros Cap << For the Love of Baseball

So look forward to a sweet Astros pic soon....

Isn't baseball fun?

--Claus

Claus is Back in the Pilot's Seat!

Hurrah!

I can't believe that I have gone almost half-a-month without posting.

Sometime after getting back from Austin last month I came down with a chest cold. Not an unusual thing...I get them at least twice a year.

However, after tolerating it for about two weeks, it decided to do one up on me.  One Friday night about four weeks ago I ended up having the Mother of all Coughing Fits.

When I woke up the next morning I could hardly move.  Felt like I fractured a few ribs.

I kept up at work for the next week, but the pain didn't abate. So the following Monday I ate humble pie and went to our family doctor's office.

Got X-rays and everything.

In the end, the diagnosis was Costochondritis; a very painful inflammation of the junctions where the ribs join with the cartilage.  My entire left side rib-cage felt like I had been tackled by a free-safety at full speed.  As long as I found my "happy position" all was well, but to move outside of it was pure misery.

Treatment was a regime of steroids and muscle relaxants and some cough medicine to keep the occasional cough from bringing me to my knees.

Yes...I kept going to work as well.

(When I mentioned this diagnosis to Mom a week ago, she said that she had it as well back when I was a kid and she had to be put into the hospital for a few days for treatment.  Yikes!  Either I'm really tough, stupid, or lucky it didn't get that bad!)

So for two weeks I've put up with this, along with having my eyesight blown-out a few steps by one of the side-effects of the steroids....something called "inter-ocular pressure" in the little indications brochure that came with the steroid pack that no-one reads but me.

I've been off them for a week now and my eyesight is returning back to its regular "corrected" state. Whew.

So during these few weeks of hiatus, I've been crashing in bed on the weekends and only lightly keeping up with my RSS feed pile.  Luckily it has been a slow month so far.

That and the seriously large phone-system deployment I've been managing has meant some very late-night stints as we do after-business hour cutovers to replace some aging phone systems.  I'm not used to working--in pain--until near midnight, then having to commute another hour and a half or more home, then turn around and be back at the site the next day bright and early.

Fortunately, the weekend here in the Houston area is cool, breezy and sunny.  A perfect Spring day.  My energy is picking up, the pain is now a faint echo, and my eyesight is near normal. Perfect conditions for recharging and flying high again!

So, hopefully great things will appear again here at GSD!

Cheers!

--Claus