Pocket Hard-Drive Utilities

photo credit: Chance Agrella from Free Stock Photo

OK...I'll do the honorable thing and dispense with any suggestive lines that come to mind just now.

Suffice it to say, it's always good for a system administrator to have a variety of tools to manage and diagnose potential hard-drive trouble spots.

Here is a mid-sized collection of freeware utilities I use to accomplish hard-drive service tasks.

All are free, and all are (or can easily be made) portable to carry on USB drives.

The Main Players

Xinorbis - (freeware) - Really, really powerful heavy-duty hard drive analyzer. Uses graphs, tables, and directory tree views. Provides a really extensive report on just what is going on on that drive. Even sorts the files into categories based on file-type. Supports singe or multiple drives, report generation, report comparisons, and shell integration. Scan-times depend on size of drive and number of items it contains. I installed it first, copied the program folder to my USB drive, then uninstalled the product. Seemed to work just fine off USB that way. Spotted recently on Download Squad

Drive Manager - (freeware) - Beautiful tool from Alex Nolan. Lists all drives, label, the type, information on the format of the drive, the size (freespace/used), volume serial number, if it is visible or not, vendor information, SMART drive details (if drive supported), file system flags and what has been enabled on each drive, a check disk (CHKDSK) wizard, an optical drive information and capabilities wizard, and filtering, and you can "hide" drives from Windows Explorer. Supports both local and network (mapped) drives. Runs fast and has a very well designed GUI. It's a single EXE file, so it is highly portable on USB.

HD Tune - (freeware) - I've been using this tool for a very long time. It is updated pretty frequently. It provides temperture information, a benchmarking utility, disk information (partition numbers, drive letters, label, capacity and usage %, format type, and boot identification. It provides a checklist of features the installed drive(s) support, firmware version, the serial number (something REALLY useful so you don't have to physically rip out the drive to get this info), the capacity, buffer, what standard it uses and which modes it supports. It has a Health report for supported SMART drives, and can do an error scan displaying any damaged blocks found. Easily portable off USB by copying the installed program files into a 2nd folder location.

DiskCheckup - (freeware) - This tool from PassMark is a SMART hard drive monitoring utility. Unlike others that have the ability to provide SMART information as part of what they do, this tool ONLY does SMART drive work. Once ran, it provides a list of all supported drives it locates on your system. Select the target drive and you can view detailed device info on the hard-drive's hardware, SMART drive information and monitoring points (Raw value, status, value, Worst, threshold, and TEC date. If so enabled, you can save records of your drive's condition periodically and then compare the results over time to build a history report. That alone is a valuable feature. I was able to install the application, copy the program folder to another location, then uninstall the program from the system. I then went back and could run it from the copied location or USB just fine.

WinDirStat - Windows Directory Statistics - (freeware) - A popular highly graphical utility to visualize just how much space applications/folders are taking up on your hard-drive. This is a really popular hard-drive utility. The last version was released in 09/2007 with the promise of a new version coming "soon" with new functions. I'm looking forward to this one. Can be run "portable" off a USB drive if program files are copied from the installation location.

Sequoia View - (freeware) - This tool from the Technical University of Eindhoven (TU/e) is very similar to WinDirStat. In fact, it amazes me that WinDIrStat seems to get all the attention here in the States, while Sequoia View gets very little recognition. I actually prefer Sequoia View, myself. It is fast and provides a great visual view of what is taking up space on your hard-drive. Can be run "portable" off a USB drive if program files are copied from the installation location.

TreeSize Free - (freeware) - Handy little tool from JAM Software. Run this tool and it clearly and quickly tells you just how much space on your drive a folder and its contents are taking up. It's not easily apparent, but there are semi-transparent bar-graphs displayed under each folder. You can configure it with a lot of optional settings. It is fast and comes in both an "installer" and Zip version which can be run off USB.

FolderSize - (freeware) - Brilliant tool by Jan Horn out of Johannesburg. Select a drive or folder, click the "Calculate Size" button and away it goes. When done (very quickly) it provides either a color-coded folder-tree view showing how much space a folder takes up, or you can view by a bar-graph. You can change the size thresholds for the folder colors depending on your needs. It uses a single EXE file so it is very portable and truly "standalone" on USB drives.

Special Teams Players

These tools aren't ones that I commonly use. I expect that most home users would do well to steer away from them.

Roadkil's Sector Editor - (freeware) - With a name like "Roadkill" it must be good! This tool allows users to display, edit, print and search hard-disk data by individual sectors (in Hex code or ASCII). Sectors can be copied and exported to files. Really useful when doing a "mid-level" disk investigation or looking at a malware file. Portable as it uses a single EXE file.

Disk Investigator - (freeware) - Much more powerful than Sector Editor, it also allows you to explore, view, and copy drive sector information. It claims to bypass the operating system and view the raw drive secotors. You can view information based on drives or directories. Disk information is provided, and you can copy/view information found by Hex, Text, or Decimal formats. What I really like about this program is that it allows you to increment the view and lists the specific sector you are viewing. There is also a slider bar to scroll through the sectors and disk from front to back. Very handy. You can search for strings in the sectors or the drive. Handy. As well as view the cluster ins a breakout detail window. Disk Investigator is a simply amazing tool. I have used it "portably" for a long time off CD media and USB drives.

Dimio's HDHACKER Tool - (freeware) - Written by Dimitrios Coutsoumbas, this tool is a "micro-utility" that "...saves, visualizes, and restores the MBR (from a physical drive), the BootSector (from a logical drive) or any specified sector from any disk (even removable disks). HDHacker can be used, for example, to save and restore a particular boot manager (such as LILO, for example)
before a new Windows setup (which, obviously, overwrites it)." Again, not a commonly used tool, but nice to keep handy in a pinch. Portable and supports Windows 2000/XP/Vista.

Bart's Stuff Test 5 - (freeware) - I don't usually recommend thrashing a hard-drive, but Bst5 does just that. I've used it when I wanted to see if a drive at work was going bad. Says Bart, "Bst5...is a small win32 application for long term heavy stress testing storage devices. Bst5 supports testing at file and device level. File level support enables you to test any local or remote volume by file access. This makes it possible to test almost any storage device. As long as the operating system can write or read files from it, you can use bst5 to test it. In Bst5 this is seen as a "high" level test, you write/read data to/from a file using the file system support from your operating system. Device level support enables you to test local devices directly block-by-block. You can use this to test any removable or fixed logical drive, physical hard disk, or tape device. In bst5 this is seen as a "low" level test, bst5 writes/reads data directly to/from the storage device without the use of any file system. In other words, the storage device or media does not need to be partitioned or formatted before testing. If any file system exists on a storage device or media, a non-read only test will overwrite any data on it. Bst5 supports very large volumes, up to 16 exabyte (17.179.869.184 Gigabyte) enough to last for at least 30 years." Portable and handy to have when you really need it.

TeraByte Unlimited - Disk Info (DOS) - (freeware) - OK. First, this is a DOS program that ONLY works when run from a DOS boot floppy (or boot CD). It doesn't work from a Command-Line DOS box opened in Windows. OK? So don't waste your time trying. What it DOES do, better than ANY utility I have ever found, it get a ream of hard-drive hardware data about your drive. Lots and lots. Have you ever secure-wiped a hard-drive and then forgot you needed the serial number of the physical drive for auditing purposes in your company? Yep. Time to open up the case. However, if you have this tool on a boot floppy or boot CD, you can type "diskinfo.exe > a:Info.tx" and it will pipe the output to a text tile for review. Be amazed and the wealth of data you can get with it and not have to crack the case open and pull the drive. See also "The All In One Boot Floppy" or "FREEDOS Ripcord BootDisk"

Ultimate Hard-Drive Utility Package

Ultimate Boot CD - (freeware) - Why include a highly advanced and specialized boot CD in this list? One reason, it contains the largest collection of "off-system" hard-drive utilities assembled in one place that I know of. All geeks and sysadmins should have this in their CD case. Period. It's that good when you need it. Certainly a "niche" product and not quite approachable as a BartPE or WinBuilder VistaPE disk, but certainly more useful for most folks than a basic Win PE 2.0 boot disk.

What hard-drive tools does it come with? Try this out:

Hard Disk Installation Tools - MaxBlast 5 (Maxtor) 5.0, DiscWizard 2003 (Seagate) 10.45.06, Disk Manager (Seagate) 9.56a, Disk Manager (Samsung) 10

Hard Disk Diagnostic Tools - Drive Fitness Test (IBM/Hitachi) 4.09, Diagnostic Tool (Fujitsu) 6.90, SeaTools for DOS (Seagate/Maxtor) 1.09, SHDIAG (Samsung) 1.25, HUTIL (Samsung) 1.21/2.03 , DLG Diagnostic (Western Digital), 4.15/5.04c, Data Lifeguard (Western Digital) 11.2, SCSIMax (Maxtor/Quantum) 1.21, GWSCAN (Gateway) 3.15/5.09, ESTest (ExcelStor) 4.20, Salvation HDD Scan and Repair 3.0 (Demo version), MHDD32 4.6, ViVARD 0.4, HDAT2 4.52 (For personal use only).

Hard Disk Device Management Tools - Feature Tool (IBM/Hitachi) 2.05, AMSET (Maxtor) 4.00, MAXLLF (Maxtor) 1.1, UATA100 (Seagate) 3.06, Ultra ATA Manager (Western Digital) June, 2003, SUTIL 1.01, ESFeat (ExcelStor) 2.10, ATA Password Tool 1.1, SMARTUDM 2.00, ATAINF 1.3m,

Hard Disk Wiping Tools - Darik's Boot and Nuke 1.0.7, CopyWipe 1.14, Active@ KillDisk Free Edition 4.1 (Free Edition), PC INSPECTOR e-maxx 0.95, HDDErase 3.1.

Hard Disk Cloning Tools - HDClone (Free Edition) 3.2.6, g4u - 1.17, UDPcast, PC INSPECTOR clone maxx - 0.95 Build 769, XXCOPY 2.93.1, EaseUs Disk Copy 1.0, COPYR.DMA Build 013, CopyWipe
1.14.

Hard Disk Low-Level Editing Tools - Disk Editor 3.0, DISKMAN4 4.01, PTS DiskEditor 1.04,

Partition Tools - Ranish Partition Manager 2.40, Free FDISK 1.3.0, SPFDISK (Special FDISK) 2000-03t, XFDISK (Extended FDISK) 0.9.3 beta, Cute Partition Manager 0.9.5, PTDD Super Fdisk 1.0, Partition Resizer 1.3.4, FIPS 2.0, Active@ Partition Recovery 2.1.1 (Demo version), TestDisk 6.5, Partition Saving 3.40, MBRtool 2.3.100, MBRWork 1.07b.

Boot Managers - Smart BootManager 3.7.1, Gujin 1.9, GAG 4.8, XOSL 1.1.5, Super Grub Disk 0.9590.

And those are just the ones addressing hard-drive. There are a bunch more other utilities on this monster CD image as well.

Download the ISO file and burn it to CD, or play with it on a virtual pc session to get your feet wet.

Really cool.

Kissing Cousins

These final utilities are not really directly related to hard-drives, but as they are useful for working with files that are on them, I still find them to be very beneficial "kissing cousins".

Process Monitor - (freeware) - Ultimate monitoring tool to show what files, registry items, and process threads are open on your Windows hard-drive. Very useful to tracking down and understanding just what is actually going on on your hard-drive. Not for the feint of heart, but I can't imagine a successful desktop support tech being unfamiliar with this tool. From Microsoft Sysinternals.

TCPView - (freeware) - Tool for listing all TCP and UDP listening and open ports and the processes that created them on your system. From Microsoft Sysinternals.

OpenedFilesView - (freeware) - NirSoft's tool to show you what files are open on your Windows system. Another great diagnostic and troubleshooting tool, especially when dealing with pesky malware and files that refuse to allow you to delete/terminate them.

CurrPorts - (freeware) - Another NirSoft tool to show which files are open on your system that have opened up network connections. Great for tracking down malware and unknown sources of network chatter on your systems, especially if your enterprise systems don't run (leak monitoring) firewalls within the company network.

VStat - (freeware) - Another network connection monitoring tool like CurrPorts, this one from Robin Keir. Has a bit more "polished" GUI interface, but that's about the main difference. Again, good for finding out what program on your hard-drive is connecting to the network.

Pick and choose, it's your pocket. What you decide to keep in it is your business!

--Claus

GSD Bowl: With more links than a your average bowl-game!

Confession:  I don't normally watch Pro NFL football games.

I will watch them now we are in playoff season, but that's the only time.  I might watch the Super Bowl...but only for the commercials (which last year were disappointing).

I do LOVE to watch the college bowl games, however.

And have been staying up much too late all this past week watching the prime-time college football games.  (I prefer college football over professional any day. Go Cougs!)

So, I've been hard at collecting links of note while they have been moving the sideline marker sticks.

Be warned, however.

I have a bunch of Christmas decorations to take down today...so this will be a fast and furious scramble

Vista Tips, Tweaks and Solutions

Three ways to reset a Windows Vista admin password - (Tip) - via 4sysops - Because I am a sysadmin, I have authorization to break into our own desktop system's passworded user profile accounts.  Surprisingly it's not too difficult to do if you know how.  I never considered how one would approach the task for Vista (or if it was as easy).  Luckily (or unluckily) I find in this post..it still is.

Here are those and a few more options

1. Create a Vista Password Reset Disk -  RamanNathan blog (probably easiest for home users) -

2. Reset Your Vista Password with Your iPod - ITsVISTA blog derivation on the first one with awesome screenshot walkthrough.

3. Get Petter Nordhal-Hagen’s NT Password & Registry Editor - Wicked awesome, now supports Vista. My favorite tool. Freeware.

4. Get the commercial Password Changer - Not freeware but is supposedly easier to use (for non Linux/command-line folks) than Petter Nordhal-Hagen's freeware disk.  For more details see the product page and ITsVISTA Tip 50: Reset your lost Vista password without a reset disc.

5. Trinity Rescue Kit - See this video for a walkthrough process on using it. Freeware solution.

6. ERD Commander - If your organization happens to have a copy of Winternals (now Sysinternals) ERD Commander floating around, it contains a tool called Locksmith which I understand still works, even on Vista systems.

(Note, all these should work with XP as well.)

Vista4Experts - (freeware) - Yet another advanced Vista tweaking utility that allows making certain registry changes to the system that impact UAC, Windows Defender, and other user interface modifications in a nice simple GUI interface.  Nothing earth-shattering or can't be done with other programs or methods, but this one is very simple and fast. Probably a good thing to keep handy for making quick mods to your Vista system.  Written by Daniel Pistelli...who appears to be a brilliant guy.

Disable UAC Prompt for an Application - (Tip) - Don't want to disable UAC on your entire system?  Then check out Ryan's post on how to disable it on a per-application basis based on Microsoft KB946932.  It does require download and installation of the Application Compatibility Toolkit. And it is defiantly "advanced-level" workaround stuff, but certainly a nice option for some users who need a more granular approach to UAC control with applications.

Speaking of Vista and UAC - 4sysops ran a poll that found 67% of it readers who responded to the poll have disabled UAC entirely.  Granted, as they admit, their audience is highly tech savvy.  The post goes on to consider the implications of what this means and the UAC security model in general.  I still have UAC enabled, but have disabled the elevation prompts.  That to me is the best of both worlds.  I still think it is good to leave enabled for most home users.

Vista’s UAC: 8 ways how to elevate an application to run it with Administrator rights - (Tip) - if using TweakUAC isn't your thing, then 4sysops has (9-now) alternative methods you can use to elevate an application to run with Administrator rights.

Windows Vista Tip: Return the Menu Bar to Vista Explorer - (Tip) - Lifehacker has noticed that the traditional "menu-bar" is now missing in Vista.  If you just really miss having it handy, they show you how to quickly and simply add it back: click "Organize" --> select "Menu Bar".  Done!

Windows In General

Xtra Windows Stability - (freeware) - Little application that is supposed to force Desktop, Explorer and Internet Explorer into running as separate processes. This way, if IE or Explorer crashes, your desktop doesn't get wiped out and have to be rebuilt (by itself or at a reboot).  Recommended by downloadsquad.  Standalone application...no installation required. so run as needed or desired.

Protect your PC while Running Suspicious Programs - (Tip) - MakeUseOf.com reminds us that in XP you can right-click a file and select "Run As" then launch it in a protected-mode.  I had forgot about this feature (using it only for elevating some of my admin programs to Administrator while working under one of our PowerUsers profile accounts).

What does this do exactly?  Well, Aaron Margosis nicely points out in his post Running restricted -- What does the "protect my computer" option mean?

The net effects

The bottom line is that the app runs with a “restricted token” that basically has these net effects:

• Group membership: If you were logged in as a member of Administrators, Power Users, or certain powerful domain groups, the app runs without the benefit of those group memberships.
• Registry: The app has read-only access to the registry, including HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. The app has no access to HKCU\Software\Policies.
• File system (assuming NTFS): The app cannot access the user’s profile directory at all. That includes “My Documents”, “Temporary Internet Files”, “Cookies”, etc.
• Privileges: The app has no system-wide privileges other than “Bypass traverse checking”.

In that post, Aaron cleverly recommended using this mode to run Internet Explorer in "restricted-mode" as it prevents malware or other web-surfing activity from writing to the registry or the user's profile folder.  Awesome...although some IE stuff doesn't work when used this way as his post goes on to explain.

For more details, see this additional post by Aaron: "RunAs" basic (and intermediate) topics

Aaron's "Non-Admin" Weblog quality is pretty great although it hasn't been updated for quite some time.

I was shocked and humbled by the back room tech's Julie linking to a recent post of mine on Secunia PSI and speaking kindly of my blog posting.  I really get a wealth of information and tips from Julie, especially the refreshing Novell tips she shares.

She recently posted a how-to on Reinstalling System Restore on Windows XP - (Tip) - which outlines how to fix a busted System Restore on your XP systems.  Granted, this will wipe out all the previous System Restore points, but it is a darn-clever tip to keep handy.

Offered Up for Consideration

You may or may not have heard, but Adobe is now offering a method of injecting advertisements into PDF documents.  Yuck!  You can avoid them by using an alternative PDF viewer if you wish, something I highly recommend for other reasons (speed, expanded features, etc.).  But, downloadsquad does post on how to disable the ads in the document.  It's an optional feature that appears to be set by the PDF creator...if they don't want ads to appear they can disable the option when they make the document in Adobe Acrobat.  Still, it seems like one more nail in the Adobe Reader coffin to me.  You be the judge.

Wired.com is one of my favorite lazy-weekend stops for tech-related news.  Good articles, wide scope of coverage, interesting perspectives.  Good stuff.

So when I saw a wired article for Vote for the Sexiest Geeks of 2007, I was curious.  Sure there was the obvious "What am I about to see" curiosity, but what I discovered were there are a bunch of women who are doing great work in technology fields who might not be getting their due. 

Good for them and their admirers! 

Where photos are present, the ladies look professional (in a corporate way).  Being the father of a daughter, I am very, very aware of the current body-image and career-image issues facing Alvis.  It is such a challenge standing in the supermarket checkout lane with her and having Vogue, Cosmo, and all the other magazines right there seemingly presenting the only options for women today to be pretty and fashionable, or be an world-class athlete.  So it's hard for me to find and discuss positive female role-models my own daughter can look to to see it is cool and wonderful to be both attractive, smart and and successful in technology, business, or whatever she aspires to do.

1943 Steel Penny - Retro Thing - Dad was quite the coin collector. As a kid I would pour over his collection books.  I never got bit by the bug, but my brother has..hard.  Of all the coins in the collections, it was the steel penny that fascinated me more than all of the rarest coins he had.  They were just so different from what I was used to.  Retro Thing's post offers some information on the  rare (but not priceless) coins.

Freeware Finds

PST Import XPI - (freeware) - Nifty little tool that allows you to import Outlook PST email files into Thunderbird.  Not a common need for most users, but nice to have when you need it.  Spotted via Lifehacker.

Window Clippings - (freeware) - Screen capture utility supporting XP and Vista.  Single EXE file so no installation needed.  What's nice is that it fully supports Vista's transparency and shadow effects on windows.  Spotted via CyberNet News.  Although I am still a fan of the last freeware version of FastStone Capture (v 5.3).

Free SnagIt 7.2.5 & Camtasia Studio 3 Downloads - (freeware) - SnagIt is another screen-capture utility worth noting.  Camtasia is a tool to make and edit video web casts.  TechSmith has newer versions but they are ($) and for a limited time (until 1-7-2008) they are offering free downloads of older versions of both applications.  Even if you don't think you want/need them I wouldn't hesitate to go grab these now before the free-offer expires.  At least you can have them handy.

IZArc - The Ultimate Archive Utility- (freeware) - Yes, I know, do we really need yet another file compression program?  Goodness knows I've already picked up a small list of favorite freeware ones. IZArc provides a nice user interface with a host of compressed file format supports for unpacking.  It also opens ISO, BIN and other CD image files.  It supports most A/V scanner integration, secure encryption of files, integration with the Windows right-click context menu, and may be able to repair broken or damaged archive files. Oh yes, it also comes in a Portable "IZArc2Go" version as well as a command line add-on and "standard" installable version.

NTCore - Explorer Suite - (freeware) - Daniel Pistelli's suite of tools which includes a process viewer and a PE editor called CFF Explorer.  Not only can you view and examine running processes but you can also dump PEs or memory regions.  Could be useful in reverse-engineering malware samples. Really full featured application.

NTCore - PE Detective - (freeware) - Another handy program of Daniel Pistelli.  This one is a standalone element from the Explorer Suite above.  It scan scan a single PE file or entire directories and generate a report.  Again, not tools for the common user, but useful for examining code in programs and files of interest.

Over at Sysinternals

Some more goings on at Sysinternals.

First, AutoRuns got updated to version 9.01. This version "fixes a bug in the way that it handles certain shell extension points and adds awareness of several additional shell extensions."  Always happy to have the latest version of this gem.

TCPView for Windows got updated ot version 2.52. This tool shows which processes are running network connections on your system.  Good for seeing if a malware file is attempting a network connection, or finding the source of a network connection on your system. This version "fixes a bug that causes partial display of UDP endpoints on Windows XP. "

Mark's Blog : The Case of the Missing AutoPlay - Mark Russinovich takes us on an investigation on why the "AutoPlay" dialog box suddenly stopped appearing on his Vista system.  It's a quick tutorial on how to use Process Monitor to tease out the solution.  Spoiler: It was a change in a registry key setting set by Microsoft's own internal Group Policy.

Malware Watch

TechBlog: eStarling's Wi-Fi-enabled photo frame is a hit - is a great post by guest TechBlog blogger John Whiteside on his new Wi-Fi enabled digital photo frame. Cool stuff.

So when I saw this post by ISC-SANS security Digital Hitchhikers Part Two, I paid attention.

Seems that some folks are finding some malware installed on some other digital photo frames.  While there is no link to the eStarling product, it does slam home an important warning.

Don't forget good security practices in your excitement to get your new digital product unboxed and loaded up and connected!  If it contains drivers, software, or accessible memory space and you can hook it to your Windows system, be sure to run your anti-malware/anti-virus scanners over it first.  Otherwise you might just get bit.

Reminds me of an event that occurred one summer when I was a kid.  My parents were on an overseas trip and we were staying at the neighbor's house.  I had worked hard to save up my $ and had made a mail-order (Sharper Image?) purchase of a cool Casio digital dive watch. One afternoon we were playing in our yard when I spied the box sitting under the welcome mat on our front door.  It was the watch!  I ran to the neighbor's house, grabbed a knife and cut into the box, and nearly cut my thumb off when it slipped in my haste to get the package open.  Bummer.  Kind of took the fun out of the moment.

Don't make the same mistake when it comes to your electronic/software supported gadgets.  Especially if they are "off-brand" names you grab while in the checkout lane of Kroger's or a dollar store.

You received a fax message asking you to use remote desktop? - Donna's SecurityFlash - Social Engineering hack at it's best (or worse).  Seems some hackers are faxing businesses a message that "helpfully" offers tech-support advice.  It basically instructs users to configure Remote Desktop support for Windows to point and allow access by a specific IP.  Well of course, that's what the hackers want!  Don't give them a key to your door.  It seems incredible that people fall for these things, but it never fails that making just such request using a "non-standard" message delivery system seems to fuzz the logic cells in some folk's brains.

Now...if I could only fuzz my brain and forget about the decorations that need to come down....

--Claus

Ad-Aware SE Personal: No Longer Supported? Workaround!

Since the time of it's first post, Ad-Aware SE Update Problem - Simply Fixed x2 has been in the top three posts of my blog.

Seems like a lot of people were having problems getting the Ad-Aware SE updates to flow due to what was ultimately a DNS issue with the update servers.

Judging by the number of hits, there are a LOT of folks who still use and love this version over the newer 2007 version.

Now comes word that Lavasoft's Ad-Aware SE Personal will no longer be receiving updates to its DAT signature files.

Cry, pout, throw a tantrum.  Riot like Canadians after a hockey match gone sour or no beer in the taps.

Doesn't matter.

Without current DAT files, there isn't much value in keeping Ad-Aware SE on your systems.

But WAIT!

Claus Valca has a solution to keep it going a bit longer - read on!

Ad-Aware SE Personal- No More Updates

Donna's SecurityFlash snuck this little post in this week.

• Are you using Lavasoft's Ad-Aware SE? Remove it - Donna's SecurityFlash

Donna did the homework found out that according to this Lavasoft Blog post and a forums post

Definition files for Ad-Aware SE Personal will no longer be updated!

She goes on to state:

This means you need to REMOVE Lavasoft Ad-Aware SE from your computer because it is not useful anymore without the definitions update.  You do not want to scan your system all the time with out-dated antispyware definitions.

That's quite true.  A anti-malware or anti-virus tool is only as effective as its updates.

She points us to going ahead and adopting the new Ad-Aware 2007 product which also ships with a free personal version.

Only there is one problem...it doesn't seem to be able to run without a running service...which means that the 2007 version cannot be run in a portable mode.

Ad-Aware SE - Love it.

When I was first dipping my toes into the anti-malware system cleansing waters, there were two signature anti-malware products above all others (and there weren't many others either back then); LavaSoft Ad-Aware SE Personal and Spybot Search & Destroy. Sure there were other utilities to clean out auto-run locations and registry items (HiJack This) but for doing a full system-scan and removal of malware and cookies, these were the best.

What brought them added-value was the fact that I and others soon found that you could install them into your "Program Files" folder, then copy that installation to other media (USB/CD) and run them from there on an infected system to clean it...even when you couldn't download and install them directly.

Soon Ad-Aware SE was one of an elite number of Plugins for the Bart's Preinstalled Environment (BartPE) bootable live windows CD/DVD.

It does have it's limitations: It doesn't scan Firefox/Mozilla or Opera locations (that I am aware of) and sticks just to Internet Explorer cookies.  Also, it only scans under the current user's profile, and not in the Internet Explorer cache/cookie files of other user profiles on the same machine.

But it remains fast.  And although there are now a host of additional anti-malware scanners of great quality, I keep Ad-Aware SE around and still use it as on of several scanners I sweep a system with in-turn.

So hearing that DAT files for it will not be supported any longer is disappointing.

Ad-Aware 2007 - Like it, but...

I've spent some time with the new free Ad-Aware 2007 product and in May 2007 posted the following review:

• Ad-Aware 2007 Final Release info - Grand Stream Dreams

It supports Internet Explorer, Firefox, and Opera. The user interface is much more polished. The scan engine seems faster and more powerful.  Overall, it seems like a really great product.  And the final release version is compatible with Vista, XP, and Windows 2000.

Except as I mentioned, it requires a service to be running to function. Disable the service or not run it and the program won't work.

So much for portability...so I've just kept going with Ad-Aware SE.

Until it looked like the door was shuttered.

But is it True?

Since Donna's notice came out, I had been trying to run my updates for Ad-Aware SE and the last one I got was SE1R210. 27.12.2007.

The updater runs normally, attempts to fetch an update, but then gives the response that no new updates are available.

Unlike my previous problem, this isn't a DNS issue.  They really appear to have turned off the spigot.

No more updates....

And I began this post with the intention of it being a funeral dirge.

But then I found (yet again) another simple solution

How to Keep Updating Ad-Aware SE Personal

See, when I was re-reading Donna's post I noticed something I had missed before

NOTE:  Ad-Aware SE Plus/Professional/Enterprise is NOT affected.

Catch that?

Other versions of Ad-Aware SE are not affected.

That means it is likely that compatible DAT files are still being issued.

So, knowing that Lavasoft does publish DAT file packs for manual download I popped over and took a look:

• Lavasoft Security Center - Current Definition File Download

Yep.  There on the right is a nice big green button offering the current DAT files for Ad-Aware SE.

1. Download the SE version file to your local system,
2. UnZIP the DAT file and find the defs.ref file.
3. Locate your Ad-Aware SE Personal program installation location.
4. Delete the defs.ref.old file.
5. Rename the existing defs.ref file to defs.ref.old
6. Copy in the new defs.ref file you downloaded and unpacked, overwriting the current one.
7. Restart Ad-Aware SE Personal.

You should see that your DAT file is now reported as the latest.  When I did this post mine was now reporting in as SE1R11 02.01.2008

I ran a scan of my system with the new updated DAT file installed and it worked fine, no errors encountered.

Found a bunch of tracking cookies.

There you Have It

So it's up to you.

If you don't need a "portable" version of LavaSoft Ad-Aware SE Personal, then go ahead and dump it.  Heck you have to download it from software file repository sites anyway, Lavasoft doesn't provide it to you.  It really is starting to show its limitations in functionality.

Go download the LavaSoft Ad-Aware 2007 Free version which really is a much more robust and useful product for most home/personal users now.

If you DO however want to keep using it (for nostalgia or for BartPE style usage)  just know that you really do have to handle the updating manually.

Or, consider one of the multitudes of other (freeware) anti-malware products now on the market: Anti-Malware Tool Roundup - #3.  Lots to pick from.

I'm going to keep Ad-Aware SE Personal around a bit longer since DAT files are still available...but even I have to admit, there is going to come a day when no DAT files for ANY Ad-Aware SE versions will be published.  Then we will really have to upgrade to Ad-Aware 2007.

Maybe by then someone will have figured out a workaround to make it "portable" as well.

I'll be the first to adopt it!

--Claus

Weird Firefox Thing

I guess my Firefox 2.0 profile was a bit corrupted.

I had noticed that the "Search This Blog" API on my sidebar had not been loading for about a week.

It would just bring up a little "...Loading" dialog but never resolve.

Today I tested it in Internet Explorer, Opera, and Minefield, and it worked fine.

Hmmm.

So I launched up some various Firefox 2.0 "portable" builds and it worked fine in them as well.

Hmmm.

So I started troubleshooting by disabling the likely offending parties, NoScript, FireBug, AdBlock, etc. and restarting.  None of that made any difference.

So then I disabled ALL my extensions and restarted.

The Google "Search This Blog" function still wasn't working.

Hmmm.

I restarted a few more times and it popped to life!  Temporarily. Then it stopped working again.

So I backed up my profile, uninstalled Firefox and installed it fresh.

Still not working.

So at this point only thing I could consider was that something was definitely scrambled in my profile.

So I deleted my profile folder's contents and copied into it an almost exact duplicate I had built from another "portable" 2.0 build.

Launched Firefox 2.0 again and now it is working again.

Weird.

I did have to go back and do a few manual reinstallations for some extensions that didn't quite survive (functionally) the brute-force copy of one profile folder into another, but overall it did work and most all of my settings and preferences were preserved.

Weird.

--Claus

A Philosophical Security Stance

On the heels of my last post on how to convert FLV format video files from the web to an iPod compatible format, a commenter with the moniker "LNA" made a request I check out a new "Beta" on-line file conversion site.

I started to drop this post in as a comment response to LNA, but it was getting a bit long, and I thought some others might be interested in my personal feelings about on-line format conversion websites.

In addition to websites that can help you acquire the FLV steaming file and save it to your local drive, there are a number of "on-line" format conversion websites. A quick few are:

• You Convert it (Beta)
• Zamzar
• Media-Convert

You Convert it

You Convert it is in a "Beta" release status. Which either means they are trying to be "cool" like Google, or they want to get some load-testing on their servers underway.

You can convert a wide range of document, image, video, compressed, and sound files to other formats.  You can send files (up to 1000 MB) from your system to others or post a link to them for up to seven days. And you can convert units from one format to another.

I looked specifically at the website LNA mentioned (You Convert it) and analyzed its Terms of Service, Privacy Policy, and DMCA Policy.

The TOS/PP are pretty standard fare, with the usual statements that the site may use advertising, web beacons/cookies, and offer "additional content" via third parties that are associated with, but not controlled by You Convert it.

I do find it very curious that the site took the time to craft and post a DMCA Policy and how to submit takedown requests.  If the site is only handling conversions for users and not posting this converted material, why might they need a DMCA takedown policy?  Does this suggest they might be posting converted material in the future?  It's not clear. Maybe it is just CYA.

The supported formats for conversion are very extensive.  That does look appealing.  I don't think there are many sites that have this scope of conversion options.

You are required to provide an email address to use the service.

It might just indeed become a premiere on-line file conversion location on the web.  It does look very Web 2.0.

A Philosophical Security Stance

I'm ambivalent with my feelings on these types of sites, which is why I strongly prefer local pc-based format conversion software I run on my own machine, and not off a remote Web-server not under my own control.

Let me be clear; these feeling from a security stance perspective are a philosophical one against on-line file/format conversion sites in general...and in no way directed to this (or any other such website) in particular I may have linked to. Understand? I'm not slinging mud, I'm evaluating the landscape now.

The Big Question™: How does the end-user know they can trust the site with their original document/file content?

Sure I'm sure everyone on the web is on the up-and-up and all websites are 100% trustworthy (read: sarcasm), but suppose I was interested in hacking or corporate espionage. 

What better way to trawl for inside information or other goodies than by offering up a web-based file conversion service? 

Miss Kimiko's boss has a top-level organizational financial document that has to be distributed to the board-members ASAP.  He is calling her from his home at 2 AM in the morning and emailing the document to her at her home.  She doesn't have "GoToMyPC" or other software. She doesn't even have a corporate pc/laptop at home.  Boss Man needs it done now and her job is on the line.

So Miss Kimiko gets the document but finds that Boss Man used a format that she doesn't have the software to support on her system, nor do the other blokes on the board. It's a two-hour commute into the office (when the subway is running) so she does a quick search and finds a handy on-line file format conversion service.  Hurrah!

She uploads the file, gets the converted format back, sends it to all the board members and goes back to sleep dreaming of her heroic act and hoping for a raise.

Only when she gets in the office, her boxes are packed and an internal security investigation is going on how a top-secret document was able to be obtained and used by nefarious parties outside the organization.

Unbeknownst to poor Miss Kimiko, someone had created a "honey-pot" of sorts at the website she used.  Miss Kimiko uploaded her document to the server, a copy was set aside for later data-mining, and then the re-formatted copy was provided back.

Miss Kimiko was none the wiser.

How can any end-user know they just lost the company's inside information?

They don't and can't; until the cow-pie hits the fan.

Why "Local" remains "Safer" (Generally)

At least with locally installed software-based format conversion software, I can run the application through the A/V wringers, Sandbox it (or run in a virtual session) for inspection, run it behind a firewall to see if it "leaks" information out, and so on.  This way I have much more control over monitoring what happens with the data I am converting; especially from a data security point.

Again, my stance is a philosophical one from a security stance against on-line file/format conversion sites in general...and in no way directed to this one website in particular.

Businesses and corporations should have a clearly defined IT policy regarding use of off-site/web-site file storage and/or file conversion activities.

File formats used internally by the organization should be standardized and ALL employees, vendors, and contractors should be afforded access to the same software used to generate and read them.

Home users probably don't have to apply quite the same degree of diligence, but they DO still need to remain vigilant about what the personal nature of content in documents and files they are submitting to on-line locations for conversion.  It's one thing for pooch Spot's chasing the cat up the Christmas tree video to get "appropriated."  It's an entirely different thing for that PDF of your tax forms you converted on-line to get "pilfered."

In the end, I'm not sure of ANY method to determine what happens to the files submitted during and after the conversion occurs at an on-line website.  You have to "trust" them to be responsible and do the right thing.  Statements and declarations of policy by the service providers regarding data-retention are helpful (when you can find them), but they aren't worth much if you can't independently verify them.

I'm sure at best, most of these sites are designed and ran buy folks who found a niche service on the web, who want to do it very well and in a trustworthy way to their clients, and maybe, they can serve up some Ads for revenue to pay the server and bandwidth bills (with a little extra on the side to go eat burgers on). If they play their cards right, maybe a Big Fish™ like Google or Yahoo will be interested and gobble them up so they can buy a Porsche and retire at twenty-six..

At least with video file "download-helper" websites, you are just funneling the data down to your local pc from the web.  They might track your usage, IP address(es) and what content you are downloading, but you likely aren't releasing many secrets otherwise.

It's the sending-up of data that I would be most concerned about.

I know I am likely being a bit of a nerdy security-minded alarmist...but that's my job and personality.

I'm sure they are all great, just use them with caution...even if they do look rockin-handsome and handy.

--Claus

Converting FLV files for your iPod nano

Alvis always has enjoyed YouTube and other video-media sites.

Generally she searches out content that deals with her favorite bands, or cute animals caught doing really stupid things...you know, America's Funniest Home Videos kinds of things.

So since her new iPod Nano can support media files (.m4v, .mp4, and .mov) she naturally wondered if it would be possible to put some of her favorites on her iPod.

And do it easily, quickly with freeware for Windows users?

Yep!

But...first things first...

Legalese

It's important that you check the Terms of Use for each website to verify if you actually have the legal right to download content and then convert/save it to your iPod or other media player.

Each site has it's own ideas and rules, so check them out carefully.

I'm not a lawyer, but in ever-confusing world of digital media and publisher/user rights being as murky as the Gulf of Mexico off Galveston...it seems reasonable to make every possible effort to play by the rules.

Although, even with YouTube, it seems a bit confusing.

For instance, YouTube's Terms of Use has the following points:

4. General Use of the Website -- Permissions and Restrictions

H. You agree not to use or launch any automated system, including without limitation, "robots," "spiders," or "offline readers," that accesses the Website in a manner that sends more request messages to the YouTube servers in a given period of time than a human can reasonably produce in the same period by using a conventional on-line web browser. Notwithstanding the foregoing, YouTube grants the operators of public search engines permission to use spiders to copy materials from the site for the sole purpose of and solely to the extent necessary for creating publicly available searchable indices of the materials, but not caches or archives of such materials.

5. Your Use of Content on the Site

B. You may access User Submissions solely:

• for your information and personal use;
• as intended through the normal functionality of the YouTube Service; and
• for Streaming.

"Streaming" means a contemporaneous digital transmission of an audiovisual work via the Internet from the YouTube Service to a user's device in such a manner that the data is intended for real-time viewing and not intended to be copied, stored, permanently downloaded, or redistributed by the user. Accessing User Videos for any purpose or in any manner other than Streaming is expressly prohibited.

See, it seems that it is ok to use an "automated system" to access YouTube, so long at it loads the servers no more than it would by a normal person using a web-browser. Seems fair enough. And search engines can copy materials, but not create cache's of the materials.

And it appears you can only use YouTube videos via YouTube functions, via streaming connections, and not copy them, store them, permanently download or redistribute them. In fact, accessing them in any manner other than streaming is "expressly prohibited."

What I find curious about this is that it seems entirely fair and reasonable for YouTube to want to control access to conserve its bandwidth and server loads, to keep the streaming good for all. And I understand it's desire to allow other parties to cache copies of their material. But I'm a bit confused about requiring its content access only through streaming and real-time viewing.

As we will see, depending on your web-browser and its settings, in many cases the simple of of viewing a streaming YouTube (or other site's streaming media) may leave a copy of the streamed video file in your local hard-drive's cache file.

So it appears that YouTube want's to preserve it's bandwidth and server loads, but at the same time, wants you to watch it's videos in Streaming format, and not save or re-view the video directly from your cache-file location once it's there. Does that mean I am required to delete my browser cache file once we are done watching videos?

I'm so confused...just read all the fine print and be a good/honest digital media citizen.

Getting the Videos

First you need to get video file before you can convert it to an iPod compatible format.

Most (but not all) streaming web-video sites use a Flash format for the video files (FLV).

You could use (check legality) a web-site based tool like that at TechCrunch: YouTube Video Download Tool. Just copy and paste the YouTube URL into the bar and it will download the file. Other such websites exist all over the Net.

If you are a Firefox user, there is the DownloadHelper Firefox extension which helps alert you to downloadable media and makes the downloading of the file very simple.

NirSoft has a standalone freeware utility WebVideoCap that can help. Fire up the tool and as you browse, it will identify and list media files it can download for you. Very small and very easy to use.

Finally, (assuming the site's Terms of Use allow it) you could do what seems like the responsible thing, and just watch the video, then use the media file right out of our browser's cache. NirSoft also has the freeware utility VideoCacheViewer which allows you to locate these cached streaming media files in your browser cache and then copy them, or view them again.

There is one other tool specifically for supported on-line video supported websites that I will mention in the next section that does both the downloading and conversion in almost an all-in-one bundle.

Conversion of the FLV file

Once you know what video file you are interested in converting for your iPod, and you have acquired it, it must be converted into a format the iPod can use and understand. Most websites use a Flash video file format, FLV. This is the format I will be addressing in this post.

Some sites use Quicktime .mov files. Using these on you iPod is very easy. Grab the .mov file and just drag/drop it into iTunes. Good to go. (Exceeding easy if you have QuicktimePro.) But that will be another post...

For my FLV to MP4 conversion tests, I am going to be using the Just Giraffe video from Blip.tv as Blip.tv seems to have a fairly generous "fair use" description in it's Terms of Service

If you download or print a copy of any Blip.tv content for personal use, you must retain all copyright and other proprietary notices contained therein. You may not otherwise use, reproduce, display, publicly perform, or distribute such content in any way for any public or commercial purpose unless such use is expressly granted by a particular license.

VideoCacheView quickly located it in my Firefox cache location.

I copied it to a temp folder to use for some of the conversions.

In its raw FLV format, the Just Giraffe file size is under 11 MB.

Ares Tube

My first choice would usually be just to use the Ares Tube. This freeware program is a cinch to use. Launch the application and you are present with a browser-like interface. You may use it to browse to a variety of video websites from the default homepage that appears, or just copy the video's URL from your browser page directly into the address bar at the top and "enter" or press the little green arrow at the end of the address bar.

If the video/site is supported by Ares Tube, it will load and play in the window.

Note, you might need to clean up the URL first if it has "extra" stuff on it. For example, the original URL is http://blip.tv/file/569410?utm_source=featured_ep&utm_medium=featured_ep but I cleaned it up to http://blip.tv/file/569410.

To download/convert the video, click the little green button with the "+" at the end of the address bar.

This will add it to your download list.

Select the item and then click the "Download" button. This will begin to download the target FLV file to the target location (make sure the directory exists first or you will get conversion errors). Once downloaded, it will convert the FLV file into an iPod compatible video format, mp4.

Click the "Options" button and you will see that you can select the "Save To" location, set the default conversion format to iPod, MPEG, or AVI, as well as delete the original file once converted and import the converted file directly into iTunes when done (just drag/drop the file into iTunes).

The compression settings are pre-set and don't appear to be changeable. That said, in my tests, Ares Tube provided the lowest size mp4 files after conversion.

Quality was acceptable for viewing on the iPod nano but high-quality video files do take a bit of a hit over those of a lower starting quality.

Final mp4 conversion file size was just over 3 MB, but for some videos, that small file size does come with a bit of a price in final quality after converted.

Very simple and very easy to use.

Super

Super is another freeware video conversion program. It is, well super-awesome. It can handle format conversions on a bazillion formats. OK, maybe not that many, but most of the usual ones.

The website is a pain to navigate to find the download link. You have to go through a couple of pages, but it is there, eventually, at the very bottom of the final page. Or you can just grab a copy off of a download site like MajorGeeks and save a bit of page-navigation frustration.

Once installed, launch Super.

The window is a bit intimidating, but stay with me and it is pretty easy.

First, at the top find the "Select the Output Container" and click the drop-down arrow. Pick "Apple - iPod" option.

Second, move to the "Select the Output Video Codec" and click the drop-down arrow. Pick "MPEG-4".

Third, move to the "Select the Output Audio Codec" and click the drop-down arrow. Pick "AAC" format.

Fourth, you should be able to go with the defaults showing in the Video section. For the Nano, I used video scale size of 320:240, Aspect 4:3, Frame/Sec of 25, bitrate of 672, and Options "Hi Quality and 48K Audio" change them at your will.

For the Audio, I went with the defaults of 44100 sample freq, 2-channels, and a 64 bitrate.

Now the only tricky part...selecting your output file save-to location.

Right-click on the reddish Output section and a menu will come up. Find and select the "Output File Saving Management" item from the list. Now pick your save-to location for the output converted file. pick the options as you wish. Save the changes.

Find your original FLV file (from your cache, download location, wherever) and drag/drop it on the gray area. It will appear with a checkmark.

When you are ready, click the "Encode (Active Files) link and the conversion will begin.

You get a nice status-bar to monitor the progress.

When done it will report done.

With these default settings, final mp4 conversion file size was just over 10 MB. Not much of a drop in size, however quality is almost perfect to the original. Drag/drop the converted file into iTunes.

MediaCoder

MediaCoder is another freeware tool I located.

Download and install the application, then launch. At first it will open up a homepage in your default browser, but this may be disabled.

On the file-menu, find and select the "Extensions" option.

Select the "Digital Media Players" then "Apple iPod".

This will open a mini-window where you can accept the defaults or adjust them as you wish. I just kept the defaults.

Drag and drop the original flv file from your cache or saved location into the big window area on the left. It will be added to the list.

Pick your "Output Folder" location from the top bar.

Now click the "Start" icon button.

You will see two additional windows open up. The first shows the frame-by-frame conversion of the file. The second shows you the conversion statistics. On the main window you will also see the conversion progress.

When done, browse to the saved location and see your work. With the default settings the widescreen aspect was nicely cropped into a full 4:3 aspect ratio and the final size was just a hair over 10MB. Quality was very good.

On my system, this program performed the fastest flv to mp4 file conversions, with the Just Giraffe video only taking 77 seconds to convert.

Drag/drop the converted file into iTunes.

Videora iPod Converter

Videora iPod nano Converter is a freeware program that is a bit odd in application appearance.

Additionally, their main site has a number of versions for iPod Classic, iPod Touch, iPod nano, iPhone, and iPod Video converters. Pick as you need, but I am using the iPod nano version here.

Install the application and the application window appears. It is GoogleAd supported it appears, so if you don't like this "feature" then you might be turned off.

If you select the "Settings" link on the menu bar, you can set the encoding profile, the converter settings and file output directory (as well as automatically adding the converted file to iTunes), and basic user interface tweaks.

To begin conversion, you need to click on the "Convert" icon on the menu bar.

Click the "Video File" tab, and you can select either the "Normal Mode" or "Power Mode"

Click the "Normal Mode" and then follow the window's steps, nicely illustrated to assist you.

First browse for and select your flv file from where you saved it.

Next, confirm or pick the output directory.

When done click the orange "Next" button in the main window.

Step 3, give it a name.

When done click the orange "Next" button in the main window.

Check the Video Settings and adjust as you might want,

When done click the orange "Next" button in the main window.

Press the "Start Converting" button in the bottom-left corner.

If you want to see what is going on, click the "View Conversion Progress" link in the main window and you get a nice bar. There is also a checkbox you can enable to view even more details about the conversion process.

Videorea also allows you to grab and convert videos directly online if you select the "Online Video" tab. The process for getting and converting is very similar.

The final file size was just about 13.5 MB, actually a bit larger than the original file.

Quality was very nice and the wide-aspect ratio was maintained.

Video Websites

There are lots of great sites out there for finding and viewing on-line video.

As previously mentioned, carefully read and understand each site's Terms of Use/Service before deciding if you can use any of these steps/applications. You may or may not have a legal right to do so and this post in no way is suggesting you have the right to do so.

Some of my favorite sites for on-line videos are:

• YouTube - Broadcast Yourself.

• SPIKE/iFILM - Video, User Video, Movies, Trailers, Music and Viral Videos

• JibJab - Comedy/Satire

• blip.tv (beta)

• VMIX Video Sharing & Hosting Community

• Veoh Video Network

• NARA on Google Video - National Archives videos. Classic and great!

• Internet Archive: Moving Image Archive - More classic and current goodness!

• Wired Science . Videos | PBS - great geeky videos on current tech issues!

More lists of video sites

• Video Menu: Your A to Z Guide to the Best Video Websites

• List of video sharing websites - Wikipedia, the free encyclopedia

• Streaming Video Websites - focuses on academia and lectures.

Happy encoding.

--Claus

This Week in Utilities - Mostly New Anti-Malware Tools

Been a busy week for finding nice utilities.  Here are quite a few worth looking into:

Malwarebytes - Anti-Malware

Some time ago I made mention of Malwarebytes' announcement that they were working on a new anti-malware product.

This is the same group that has produced these very finely crafted tools:

RogueRemover FREE - (freeware) - removes rouge antispyware, antivirus and hard-drive utilities.

FileASSASSIN - (freeware) - deletes files locked by malware processes.

RegASSASSIN - (freeware) - deletes registry keys locked by malware processes.

StartUpLite - (freeware) - tool to locate and disable/remove startup entries from system.

Unfortunately, their blog hasn't leaked any new clues to the status or design of the new anti-malware product they are cooking.

Luckily, gHacks has spilled the beans!

Malwarebytes Anti-Malware - gHacks review of an early beta-release version was overall fairly positive.  Like most of us, we don't really keep "malware-infested" systems lying around to test the efficacy of these scanners.  My own test mirrored gHacks results closely.  The scan ran well and was pretty fast.

Once installed the mail application presents eight tabs.

• Scanner - chose a quick scan for common malware, or a full scan for all hard-drives/partitions.
• Monitor - offers "real-time" protection of  your system. Only available in the paid (Pro) version.
• Update - checks for new signatures.
• Quarantine - shows any infected files that have been made safe by the application.
• Ignore List - shows any "skip" files the user has set to "ignore".
• Settings - Various user configuration options for scanning and action.
• More Tools - Bug reporting for the program and FileAssassin (locked file killer).
• About - version information.

Still in beta status, but worth keeping an eye on.  Like many anti-malware programs, they seem to be only as effective as their definitions are current or their heuristics abilities are well designed. Malwarebytes previous products have a good and trusted reputation and lots of community support so I hope a final version delivers.

Malwarebytes Anti-Malware Beta test - Download link to sign up for public testing.  Log in and get the download link.

FileForum | Malwarebytes Anti-Malware - Download link to version 0.84 beta, if you don't want to register.

Universal Extractor

Universal Extractor - (freeware) - is one of my most-favorite unpacker utilities in the entire universe.  I have quite a few file compression utilities I like, but when it comes to mucking around and unpacking application setup files, Universal Extractor simply can't be beat.  This application is in my "pending posts" pile to do a full and worthy writeup one day.

It can unpack over 40 compression formats, automatically. Amazing.

The one thing it seems to have problems with is keeping up the the latest versions of Inno Setup.

Luckily, the program's forum page is rife with fans and a developer who is quick to provide the latest version of an unpacker module.  Just download the latest one, unpack it, and replace the program's old file with the newer one.

It it is a packed file or setup file, chances are Universal Extractor can open it.

RunScanner

RunScanner - (freeware) - This is a very new single exe file startup and hijack analyzer utility.  I am very impressed with it.  It doesn't require installation, seems quite USB drive portable, and packs a wallop with finding and researching system processes and startup entries.

At launch it offers three modes, "Beginner" which scans only and provides a log for upload to forums, "Classic" which a simplified and fairly safe method to scan and fix potential problems, and "Expert" which is the full deal with no training wheels.

Scans are pretty fast, and options are very easy to save the log file or send it for online analysis

Results are listed in sections that are clearly named.  Each item contains a description, path/info details, the company name (if available) and who the security certificate issuer was.

Tabs are available to look at common hi-jack area, a process killer, loaded modules, and even a HOSTS file editor.  All very handy.

You can select items for action, (disable/delete), but right-clicking allows you to kill running processes, delete or rename on reboot, upload to VirusTotal for scanning, or even Google search. A bottom window pane can be opened which allows easy copy/paste of item details.

Having a number of handy resources to research and deal with the items is very useful.

I'm really impressed with this tool so far.

Drawbacks?  Might not be quite as thorough as some other "focused" utilities listed below, and it doesn't seem to present the running processes in a "tree" view like Process Explorer so it isn't as easy to see dependencies.

Alternatives:

a-squared HiJackFree - Very similar program, with other options.

Process Explorer v11.04 - The Godfather of Process tools.

AutoRuns for Windows - The Godfather of AutoRun entry tools.

TrendMicro HijackThis - Oldie but still a goodie on dealing with malware auto-start items.

I'll not be discarding any of these because of RunScanner, but it will be added to my USB sysadmin utility stick to help support them.

mst IsUsedBy - Ugly name, clever tool

Obviously the developers at mst software decided they weren't going with the Web 2.0 naming game when they released their handy little freeware product.  Taking a more NirSoft-like approach with practical naming, IsUsedBy does what it says.

mst IsUsedBy - (freeware) - This handy little program helps you figure out what process on your system has a particular file open.  Great when fighting malware and you are trying to delete a file but it keeps reporting it is unable to do so because the file is locked and in use.

Run the application, and a small window opens.  Drag and drop the target file from Windows Explorer on it and it will rat-out the process that has it locked down.

A few curiosities; first it comes in either an .msi or exe installer format. Second, for such a nice little program, it must be "installed" on your system.  However, copy the single program file to your USB and uninstall the program and it seems (so far) to work Ok.  Finally, it requires administrative privileges to work.  EULA says it is for private and non-commercial use only.

Spotted via 4sysops.

Alternatives:

OpenedFilesView - (freeware) - NirSoft's wondermous little gem. Run this baby and it will provide a listing of all the files that are open on your system, in a handy table format view.  No drag-n-drop needed.  Find the one you are looking for, find the process using it, right-click on the item and attempt to close the open handles or kill the process using it.  All-in one.

UNLOCKER - (freeware) - Probably one of my all-time favorite file-in-use killing tool right now. This marvelous tool has some of the most comprehensive methods for shutting down a file, and not only can you try to kill it, but you can also set a file to be moved, renamed, or deleted after reboot. Definitely a must-have for any malware hunter or sysadmin.  Not really "portable" and should be installed on a system to work effectively.

Locked Files Wizard - (freeware) - Handy tool that lets you pick out a target file that is locked (manually), the view the processes locking it.  From there you can attempt to stop the locked process or flag the file to be deleted/renamed at reboot.

WhoLockMe Explorer Extension v1.04 beta - (freeware) - I used to use this one a lot on my Windows 2000 systems I had to support.  It did have some drawbacks. First it needed to be installed so it could appear in the right-click context menu.  Kinda messy when you are hunting malware.  Second, it was released in 2002 and doesn't seem to have been updated since. However, if you have a Windows 2000/XP system and want a resident locked-file research tool, it is nice to have on right-click demand.

For a full list of locked file finders and process/file killers see this previous GSD post: I will kill thee a hundred and fifty ways...freely.

Zenmap/Nmap Duo

I've not yet had the opportunity to really work with Nmap, but it keeps coming up over and over again.  Most of my network scans are simply to find used/unused IP's or network printers on our networks when they get shuffled around.

So the other day I found a note that Nmap has a really great GUI called Zenmap.

The screenshots look quite nice.

I'll be downloading it at work and giving it a workout to see just how useful it could be in our network environment.

Nmap - (freeware) - Insecure.org. Free and open source utility for network exploration or security auditing.

Zenmap - (freeware) - Insecure.org's official cross-platform Nmap Security Scanner GUI.

Download Link - distributed as a combined pair.

Reference Guide - Getting started guide. 

Documentation - Going deep.

One More Duplicate File Finder

In my early December post Seeing Double I listed five (plus one hybrid) applications I love for hunting down duplicate files on a system. In order of preference; DupKiller, Easy Duplicate File Finder, Duplicate File Finder (DupFinder), DoubleKiller, Duplicate File Finder (DupFiles), and Easy Cleaner. All but DupFiles are freeware.

So when TinyApps posted a recommendation for a duplicate file finder, I paid notice.

Duplicate Files Searcher (DFS) - (freeware) - Quickly and powerfully finds duplicate files. Also can calculate MD5 and SHA hashes...if you need.

What are the key features of the Duplicate Files Searcher?

The most important features are:

• Easy to use graphical user interface,
• No limitations on number of files, file size, folders or drives,
• Works with all removable media devices such as floppy disk, CD/DVD ROM, USB devices, etc.
• Manual files selection which gives a user the full control over files to be deleted,
• Byte for byte files comparison. It ensures 100% accuracy.
• Files preview,
• Improved (faster) searching engine,
• Several files comparison methods,
• New report files format.

It runs on Windows, Linux or MacOS. How rare is that?!

The program is actually written in Java. So download the zip file, then unpack it. Make a directory and put the dfsfull.jar file in there. Assuming you have Java SE installed, execute the jar file and you are good to go. There are actually two versions; free and full. The "free" version is a bit more stripped down in the options and capability. The "full" version has more features. Both are (for end-user's sake) free to use.

Clever and tiny.  Good find, TinyApps!

--Claus