Archive: Windows

Ugh.... you hate to see those exception OE messages. This particular one happened on an old Windows 98 machine. (Yes, I know, but they want to keep it in service if possible.) The full details are as…

Internet Explorer 7 is going to be an automatic upgrade through WSUS (Windows Server Update Services) on February 12. This was announced last fall, but is now about to become reality. According to Mi…

Windows users know chkdsk, linux users know fsck... users of each MIGHT have heard of SMART. These are different ways of TESTING hard drives. Well, there's also a utility called TestDisk that looks p…

I've run into a few problems with a windows xp repair install in the last few days that I wanted to detail the problems and what the resolution was. First, it was someone elses laptop needing a hard …

I've had a fun time this week dealing with a STRANGE Vista problem on an HP computer (I doubt it's HP specific, but don't know for certain.) The error goes like this... "A problem has been detected a…

For years I've been using smartmontools on my linux-based machines. What I've absolutely LOVED about it is the advance notice I've had of hard drive failures. Two consecutive Decembers I received an …

and you can't turn it on without an error... Oh boy... last week I first saw this system and it was running less than the minimum amount of memory, so I thought that could be part of the issue. (It c…

You had to know it would be a matter of time. Not long after I wrote about the limitations of Vista's upgrade version I found this. First let me reset. Previous versions of Windows upgrade versions w…

There could be a record number of vulnerabilities addressed next week when Microsoft releases an expected dozen updates for its Windows and Office products. (According to Brian Krebs at the Security …

If you're upgrading to Vista and use an ipod (true Apple branded iPod)... you might want to refrain from hooking the ipod up to the Vista pc. theregister has reported that Apple is sounding the alarm…

Microsoft Vista is now out, the next version of Windows, successor to XP. While Windows XP will continue to receive updates into 2014 there are many that might be eager to upgrade and move to the lat…

I want to make a note of this here... Microsoft has announced that XP Home and Media center editions will get extended support on par with that of XP Pro. Essentially this means security updates for …

In the past when installing an upgrade version of Windows it meant having your original disk handy to prove that you were REALLY eligible for an upgrade license. What this meant is that if you wanted…

Haven't had the chance to try this one firsthand yet, although I've been watching for this. You may be familiar with ies4linux which is a script that uses wine to download/install multiple versions o…

The first thing I should mention is that this months update from Microsoft is the last for XP SP1 users should plan a migration path to SP2 to keep getting updates to XP. Multiple vulnerabilities thi…

Sometimes drives just go bad. Surprise. One recent fresh install of Windows XP had started having real stability problems. On running a chkdsk and looking at the event viewer, it was fairly clear tha…

I've tried to ask myself if I'd trust someone enough to let them run a remote session on my own desktop to solve a problem. I think the answer is "it depends". If you think about it, I do tech suppor…

Well, I've got a nice way of doing "easy" one click (or one cut and paste) light desktop support for windows or linux, one uses ultravnc sc, the other uses x11vnc with a special wrapper script. So, w…

I've got to say, one of the things I really like about linux are the myriad of options for remotely administering a system. SSH is the one I use the most, but for the graphical you have x (especially…

As I said in the earlier posts, I was essentially looking for a "Single click" solution for linux VNC remote desktop support. A solution that doesn't require the remote support client to change firew…

So, the idea is that I wanted something "like" the Ultranvnc Single Click download, only for linux. The main idea being is that if someone is looking for a bit of desktop tech support on linux, we do…

Ok, some time back I'd done a writeup on UltraVNC SC, which is a nice customizable (windows version) VNC server that essentially let's someone doing remote support build their own downloadable .exe t…

"We tried scanning and all that happened was the lamp moved back and forth.... Nothing else happened." That was the description I had and the request to see why the scanner was broken. It hadn't been…

There's a utility called Thumbs that looks like a good quick way to make a cd launch a web documented on autoplay in Windows 95/98/ME/NT/2000/XP/ ...Of course, autoplay under windows is fairly easy t…

To change the Google theme of the afternoon.... Microsoft is due to release their April updates this coming Tuesday (April 11th.) Advance bulletin is here. Four updates affecting Windows, one affecti…

I was doing a remote connect to a machine today and the "send ctrl-alt-del" for some reason didn't work to bring up the task manager, so I had to get to it another way. For those that never noticed (…

I haven't had much time to look into this, but one of the mailservers I administer is typically configured to relay through mail.lig.bellsouth.net, with mail.averyjparker.com as a fallback. Sometime …

F-secure has information on a fairly aggressive new email virus. Their name for it is VB.bi although it's aliases are.... W32.Blackmal.E@mm, WORM_GREW.A, W32/Nyxem-D, Email-Worm.Win32.VB.bi depending…

I've run into this in the last few days too. (In spite of the fact that it's an OLD update (April 13, 2004?) MS04-013.... I think on the last visit (and my first one to this machine) we had probably …

Last week sometime I was doing maintenance on an OLD Windows 95 machine (yes there are some still out there....) and noticed the Antivirus had not updated in a good while. They were using Grisoft's A…

Saw this today.... "Error while aging folder "Inbox" in store "Personal Folders". File access is denied. You do not have the permission required to access the file C:\WINDOWS\Application Data\Microso…

Well, in the article the other day about the Windows wireless problem/(feature that could be exploitable?) there was a mention that the default behaviour for Windows would be changed with the next se…

This sounds like a serious vulnerability. The SecurityFix is reporting on a very serious vulnerability in AOL. The problem affects AOL version 8.0, AOL version 8.0+, and AOL version 9.0 Classic. The …

It seems the WMF patch that was recently released for Windows 2000 and XP (and 2003) has been ported to Microsoft Windows Vista Beta.... This makes it the first security patch for Vista. eweek has an…

There's another patch for those Win98 users that are nervous about the WMF vulnerability that was announced at the tail end of the year. This site has made the patched version of gdi32.dll available …

Brian Krebs has a post today on a Windows wireless networking "feature" which can be somewhat of a security risk. You see, it seems that With wireless networking enabled, Windows remembers the last w…

Good news for Windows XP users (especially XP Home). Microsoft has extended the support period for XP Home and Pro. Originally, security patch related support was expected to end December 31st of thi…

Brian Krebs at the Security Fix has done an interesting study related to how long it takes Microsoft to release a security fix for a problem, starting from the time they are notified of the security …

There's a good post at Spyware Confidential about the removal of the SpyAxe and SpywareStrike pests that are circulating widely these days. There is a good CastleCops Wiki page with Malware removal i…

Microsoft has issued two advisories related to patches coming out today. Both are remote code execution vulnerabilities, the first affects Outlook and Exchange server, the second is related to embedd…

I can't really say I'm surprised, after the big WMF vulnerability of the last couple weeks, I suspected we'd see closer scrutiny of other WMF "vectors".... but..... The SecurityFix is one of the outl…

This hopefully will be my last post on the whole WMF exploit stuff.... It's prompted in part by a comment on one of the articles on Windows 98 and the vulnerability. I realized that I hadn't really b…

Sounds like this patch Tuesday will have a couple of updates in spite of the early release of the WMF vulnerability fix. Thanks to Microsoft for yielding that fix as soon as the testing was done. I w…

Microsoft has released the patch for the WMF vulnerability that's been all over the news early. It was released to http://windowsupdate.microsoft.com ahead of the previously announced January 10th "p…

Since this is a simple tip I'm including it in the basics category. I ran across a pc with a Dell Multimedia Keyboard and they wanted to disable the hotkeys (sound mixer was always popping up because…

Microsoft has updated their security bulletin on the WMF vulnerability to note a couple things. One, they acknowledge that embedded images within a document can trigger the exploit. Previously they s…

Brian Krebs at the SecurityFix today has questions about Microsoft OneCare. In fact, with Microsoft saying that OneCare is "more than just antivirus" you wonder whether that's just marketing speak, o…

I got a first look at Windows Desktop Search today (bundled with MSN Search Toolbar?) I was told that it was new on the system and had not been used. The systems owner didn't know when it was install…

This isn't an earth shattering issue, but as I was looking into some other problems on a Windows XP Pro system, I noticed a HUGE blank space in the Add/Remove programs area of the control panel. It w…

Since there's some interest.... here is a listing of all posts related to the WMF exploit and Windows 98 that have come out in the last week. https://www.averyjparker.com/2006/01/04/lack-of-working-e…

It looks like, the Windows patch (or a beta) for the WMF exploit has been leaked online. It sounds as though Steve Gibson got a hold of a copy and has tested it along side the unofficial patch. All s…

This is something you should consider if you are looking to abandoned a pre-Winxp operating system in favor of a flavor of XP. The product life cycle. In their infinite wisdom, Microsoft has differen…

Yesterday the hexblog, which is the site of the person that wrote the unofficial patch for the WMF exploit, was offline for bandwidth over use. Several mirror sites popped up to host the patch. Today…

The Sunbelt Blog has picked up on a report of some network printing problems with the unofficial WMF exploit patch installed. The first report was on the fulldisclosure list. It is recommended that t…

I want to try to clarify a point. I've spent a couple days trying to get current exploits to work on a Windows 98 SE virtual machine. Not to prove that Windows 98 is safe, but to determine if current…

I didn't exactly expect a parade staged by Microsoft for the writer of the unofficial patch for this WMF vulnerability, but.... eweek tells us that Microsoft says "beware of unofficial WMF patch" It …

The unofficial WMF exploit patch now has multiple locations to download from. They've apparently run into some bandwidth problems at the main site. Sunbeltblog has an alternate download location, San…

If you've visited here in the last few days, you'll have noticed that I've been trying to test the WMF exploit against a Windows 98 Virtual machine since January 1st. I initially started out with a d…

I had hoped to get in another test of Windows 98 with yet another WMF viewer (tried Kodak imaging, and irfanview). So far I haven't seen a way that the WMF exploits can work on Windows 98 SE. I'm run…

The Microsoft security bulletin on the WMF vulnerability has been updated to indicate that Microsoft expects to release an update for the issue in their regular patch release on January 10th. The fir…

There's been an update to the unofficial patch for the WMF (Windows MetaFile) vulnerability. The main change appears to be some options to allow for quiet installation (unattended) to help administra…

I've seen breathless headlines that say "Windows PCs face 'huge' virus threat; Affects every MICROSOFT OS shipped since 1990..." and really would like to try to clarify (again) what the situation is.…

Ok, I wasn't quite satisfied with the results of the tests against the first version of the WMF (Windows Metafile) zero day exploit that's now up to 4 or 5 days or so... Windows 98 is listed as being…

I've spent some more effort on trying to infect Windows 98 SE in a virtual machine with some of the exploit samples I can find. The first attempt was at a website with the .wmf download. No luck infe…

Most of the talk on the WMF zero-day has centered on Windows XP, 2000 and 2003. The unofficial patch is available for those three platforms. Microsoft's (eventual) patch will likely be for those as w…

I'm putting this under the Windows tech support category because I've used this on a boot cd before to do the same for Windows as I'm about to describe for Linux. I need to clean up and organize my h…

Since there's been quite a bit of flux the last couple of days I thought I'd try to "reset" the situation and give a general overview of where we stand now with regards to the recent WMF zero-day exp…

So, I've spent a bit of time talking about flightgear. Here are a couple extra resources that I want to "bookmark" here. There is a Good unofficial how-to here. (Mostly linux flightgear oriented. Als…

This is really the same zero-day wmf vulnerability, but there is a twist. It's been found that Lotus Notes v. 6.x and up are vulnerable to the Windows Meta File (WMF) exploit that's making the rounds…

I notice that the Sunbelt Blog has some instructions up for blocking the zero-day Windows Meta File (WMF) exploit with their newly acquired kerio firewall. (Free or full version.) Either version can …

Sorry, but to get into the guts of what I found in the wake of the WMF exploit, I did leave out another important step in the cleanup process. IF you are trying to clean up an infested machine one of…

I haven't checked to see if these are already on other block lists for the WMF exploit, but the following addresses are advised to be blocked (from f-secure).... toolbarbizbiz toolbarsitebiz toolbart…

One other note from the previous series on WMF exploit infestation cleanup. Among the multiple popups that came when launching internet explorer, most were directed at the site http://60.topnssearch.…

Can I say enough times that after a bad trojan infestation you should format and reinstall? I've cleaned up the infested image that I "sacrificed" to the WMF exploit and as I've said you're pestware …

Browser helper objects (BHO's) are listed in the registry and load with explorer when it runs (Internet Explorer/ File explorer are so closely tied it affects both.) I've used BHOdemon in the past to…

So, I've got most of the baddies cleaned out and I'm not getting popups anymore. No nags on boot, the boot process is quicker, but is it really clean? I found a few files (winlogon.exe, alg.exe in pa…

On the next boot I was greeted with the above message C:\windows\system32\kernels64.exe not found please make sure the path......correct.... blah blah blah. Back to msconfig. Everything there now loo…

At this point, I needed to rename or delete some files that windows would not let me touch. I had this winlogon.exe running from a suspect directory c:\windows\inet20001 and windows wouldn't let me k…

OK, so, I'm busy killing off running processes and fire up MSConfig to try to keep them from coming back on the next boot. To launch msconfig go to start, run... type in msconfig and click ok. The st…

After getting into Task Manager I saw a number of suspicious processes. There were a lot of things running as my user that I didn't recognize. kernels64.exe, vxgame6.exe, vxgame4.exe, mm4.exe, vxh8jk…

The first problem I ran into in cleaning up after my infested Windows XP image was this error message. One of the first things I do in cleaning an infested system is try to kill off running process t…

OK, I mentioned that I infested a virtual machine with the current WMF 0-day exploit. First I should probably clarify. An exploit is a means of getting in to a system. The payload is the software tha…

There's a joke that many people bring out when new Windows viruses hit big.... it goes along the lines of, "download a fix here" and the link points to a knoppix linux livecd download, or a Mandriva …

All in all, what I've documented was a bit over three hours worth of attention to the machine (much more for the full scans, but I didn't have to stand and watch them.) I didn't document a sidetrip t…

Before I get things wrapped up, I like to scan rinse and repeat until the scans come up clean. So, this scan of AVG gives a chance to delete the archive entry I mentioned the first pass it took. And …

Ok - about 22 or 23 critical updates for Windows ME. I'm suspecting it's never visited the Windows update site. While it's going I make sure that the adware scanners and antivirus scanner get to pull…

There are so many "wolves in sheeps clothing" or maybe I should say wolves in sheepdogs clothing... Anyway, so many nasty malware's that pose as protective utilities. Spyaxe, spytrooper, spy sherriff…

All right, now it's time to give ad-aware a spin. I like being able to use several spyware scanners to get full coverage and cleaning. Ad-aware and spybot s&d are usually my first two choices. Realiz…

Ok, another reboot after the BHO cleaning. Things are a good deal more responsive now, less disc swapping going on. (I suspect that those three missing BHO entries may have been causing the slow down…

Ok, it's BHOdemon time... installed from cd and on starting: BHOdemon bhotb-all.html not found, no web connection downloading on other machine. Finally get it to work copying from another machine. Bu…

OK, we're moving on to BHOdemon to take care of the browser helper objects. Unfortunately it looks like BHODemon is not being currently maintained, the developer has had a housefire. I am very sorry,…

So, AVG has been scanning away finding things we've really got a foothold on the system and the malware has a fight on it's hands. It's good to see progress. Up to this point we've had multiple Spool…

Picking up from last time... AVG was failing to install with a peculiar registry error. (Which I didn't see much reference to online.) OK, so here is another fruit of the online search (so many bugs …

This is related to MS05-054... According to Incidents.org it's possible that this will not install (user submission of this). They also have a user submitted workaround... Shinil Hong of SUNY Buffalo…

Ok, the last post got a bit long with the hijackthis log, but I wanted to include the whole picture. I put a few comments in, but thought it might be useful to include the notes I took at the time. F…

I had someone call and start by saying she bet me a dollar I'd never heard of this before.... She said she was doing something (adjusting font size?) and all of a sudden everything on her screen went…

This is the first in a several part series documenting the cleaning of an infected PC. The only real noteworthy item is that it was a dial-up only connection and was rather infested for that. (On par…

Migrating Outlook Express data from one machine to another. Addresses are easy to export... file export Address Book gives a good option to CSV (comma seperated value) output. Which is a nice common …

As a couple earlier posts showed having a log file of what happens when Microsoft Outlook checks mail can be essential to figuring out why something is not happening that should (or why something is …

This is part II, click here for part one of the saga... Okay, so I revisit to install Microsoft Office 2003 SP2 and hope that solves it. Somewhere along this time, I had also found a suggestion of re…