Grand Stream Dreams blog

...soaring up...chasing dreams...what would I do if I caught one...

Mostly Windows Virtualization stuff

Movin’, movin’, movin’, keep them kitties movin’…

Bonus: USB Booting/Prep Tool Updates

Finally, ARS Technica has two great pages on making your USB drive bootable.

(Possibly) Related

Cheers!

--Claus V.

Sync & Backup Tools (freeware)

just because I’m getting a bit tired moving these link-logs down the river…these are some new and oldies but goodies…for reference purposes.

--Claus V.

Get your Big Whata-Microsoft Linkdump Here!

MSDump

CC Photo Credit: by Choctopus on Flickr

Oh Boy....nothing like the smell of a Microsoft Link dump!  Get your shovel 'cause you've got a lot of shoveling to do!

Fixing Those Darn Windows 7 Task Bar icons!

In Dwight's Techblog Linkpost | 11.22.2009 frequent flier David - budalla posed the following question:

...does anybody know how to get my old start menu back? The current Win7 version is as useful as a messy desk to me.

What David was talking about is the awesome (useful/annoying depending on your preferences) Windows 7 taskbar design that has honkin' big icons that have space between them so large you could drive a Microsoft link-dump truck through with room to spare on the sides.

image

I actually think they are quite clever and useful, but I'm a hard-core multi-tasker so I have lots of apps open on my desktop and that wide-spacing just doesn't seem efficient to me.  I want to reclaim the space regardless of the enhanced features they provide.

As a matter of fact I did...

This isn't a MS "supported" solution to enabling an XP/W2K "Classic" start menu but it might be a close approximation using some free third-party applications or a paid solution.

However, turns out there was an even easier solution which involves no assistance from third-part tools, and is pure Windows tweaking, baby!  (Provided by Ronnie Vernon, MVP TechNet forum moderator.

Simply pull off the existing icons and re-configure the "QuickLaunch" toolbar from Vista/XP. (Yes it is still there!)

From his explanation (seeded with screenshots from my system tweaking)

Adding the Quick Launch Toolbar in Windows 7.

Right click the Taskbar and select Toolbars/New Toolbar.

image

In the Choose A Folder window, navigate to:

C:\Users\username\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch.

(Where 'username' is the name of the account you are logged on with)

(Claus's note, as seen below that "AppData" folder is hidden in my configuration.  I just copied/pasted the path above into the folder field, then changed the 'username' to my own (Claus-V) and hit Select Folder.  It found it fine...)

image

Click Select Folder.

This will add the Quick Launch Toolbar to the right side of the Taskbar.

image

Right click the Taskbar and make sure that it is Unlocked.

image

(Claus's note, as seen above, I then had to uncheck mine to unlock it...)

On the Left Side of the Quick Launch Toolbar you will see 3 vertical rows of Dots. This is the Toolbar Handle. Use the mouse to grab that handle and drag the QL toolbar as far to the left as it will go.

image

Next, grab the Handle for the Taskbar Icons and drag it as far to the right as it will go.This should switch the toolbars.

Next, drag the QL toolbar to the left as far as it will go. This should place it next to the Start Button. Right click an empty spot on the QL toolbar and remove the check marks from 'Show Text' and 'Show Title'.

Finally, carefully drag the Taskbar Icons to the left until the QL toolbar is the size you prefer.

image

(Claus's note, now start dragging, dropping and cleaning up the icons on the various task bar and Quick Launch bars...adjust the size, remove title/text if desired, etc.)

image

image

Right click the Taskbar and select 'Lock the Taskbar'.

Done!

image

versus

image

 

 

 

You be the judge... Note: no third-party applications were used or harmed in this Windows 7 task-bar tweak-out.

Related:

Windows 7 Family Pack almost Gone (Limited Time Offer thing...)

Alvis and I had no luck finding a copy of the Windows 7 Family pack in any of the local retailers back in early November 2008. (see Windows 7 Resources – Hot off the DVD Presses! - GSD post).  Fortunately I didn't delay and quickly ordered it from the Microsoft on-line store and got my copy.

Turns out it might now be nigh impossible to find one.

Quoting from Paul's post:

Unfortunately, that's just now becoming obvious to potential customers here in the United States, where the Family Pack has apparently completely disappeared. Numerous email messages this week complain that attempts to find the Windows 7 Family Pack online or at brick-and-mortar electronics retailers have proven fruitless, killing plans for planned holiday presents.

As some of us say in Texas..."too bad doodad!"

Cool Alternative Windows Updating Tricks

Just in case...

Multi-Monitor Taskbar Tricks for Windows 7

I love multi-monitors both at work and home.

However, it has always bothered me that the taskbar doesn't get extended or managed by Windows on all additional monitors.  It just makes its appearance on the primary monitor.

Now for XP I've purchased and used Realtime Soft UltraMon for my solution.  It works great and is rock-solid.  I see that in July they released UltraMon™ 3.0.7 Beta which offers Windows 7 compatibility (and maybe some stability issues along with the Aero theme support.  I've got to find my registration key since I have upgraded my XP system to now run Windows 7.  I haven't installed it yet.

In the meantime, thanks to this 3 Useful Programs That Help Manage Multiple Monitors post by MakeUseOf's Tim Lenahan, I've been re-discovering these cool freeware tools (all portable) which can add additional taskbars to various degrees of success under Windows 7 (and XP/Vista as well).

  • ZBar - Perfect!  Supports six styles from Classic to Win7, organizes wallpapers across multiple monitors, and has a hideable clock as well. Only complaint is that some MS Office apps don't cooperate well and may ignore ZBar's attempt to manage them on the correct monitor/taskbar.

  • MultiMon TaskBar - Pretty nice, but the $ pro version has more features.

  • Display Fusion - (less taskbar helper and more multi-monitor wallpaper manager to be honest...)

Related:

Finally for the Hard-Core Sysadmins...

The problem I had was that when you uninstall a printer, you don’t actually uninstall the driver/driver package associated with that printer.  If you go ahead and reinstall the printer all over again, (like a network printer) it’ll just use what you’ve got installed on your system and you’re hosed.

SO WHAT TO DO IF YOU HAVE A CORRUPTED PRINTER DRIVER/PACKAGE
Basically, in order to remove a corrupted Printer Driver from Windows 7, you have to do the following:

  1. Run MMC from START—> RUN.
  2. Click File –> Add Remove Snap In
  3. Select Print Management
  4. Click the “Add Local server” button
  5. Click “Drivers” in the Print Management –> Print Servers –> YOURMACHINE (local) hierarchy
  6. Right click the Printer Driver/Package you want removed.

Whew!

--Claus V.

Minor manual tweaking of freeCommander

I've used a lot of alternative windows file managers in my time.  There's nothing at all wrong with the default Windows Explorer tool.

However, I like having a dual-pane view, additional utilities at the ready, and multi-tab support to jockey multiple windows and file/copy/move actions I conduct.

So although I've shared posts containing other file managers, copiers, and sync utilities, I keep returning to the one that will rule them all:

FreeCommander - freeware file manager

I'll leave it to you to hop over to that page to read about all the features it provides, for free, in both an installable and "portable" version.  Suffice it to say, most tech folks I introduce it to are very pleased.  Sure there are others that probably work better as alternative windows file managers for the non-technical crowds (home users) such as Xenon File Manager Portable or UltraExplorer. Or for someone looking for a "high-end" solution there is Q-Dir 3.95 which comes in both x64 and x32 release versions.

Marek Jasinski, the genius behind this tool works hard to keep it updated and periodically provides updates for download.  It has always been stable and dependable to me.

However, while poking around a bit in the program's folder, I noted that while most of the executable and dll packages aren't "self-updatable" there seemed to be some compression-related ones that might be a bit old and could possibly be swapped out with newer versions.  freeCommander comes with an integrated zip/rar management feature to make it very easy to view and extract the contents of archive files:

  • Supported archive formats: ZIP and CAB ( read and write), RAR (read)
  • Files can be compressed
  • Archives can be unpacked
  • Creation of self-extracting files is possible (ZIP)
  • The intern file viewer also works in archive files
  • Files can be also searched in  directories and drives
  • Search for file contents (text) is possible
  • Search in archives (ZIP, CAB, RAR) is possible

Now, I'm no coder, and it is very likely that Marek might code the main executable for freeCommander with these particular dll versions in mind.  That said, my experiment with replacing them hasn't seemed to broken anything (yet) though I make no claims it won't and that doing so will provide you any enhanced performance or benefit.

What I found was...

As I said I had my attention drawn to the following compression-related files in the 2009.02 version.

  • DelZip179.dll  - file version 1.79.11.1 - dated 04/20/2008 (DelphiZip)
  • dzSFXus.bin - file version dated 10/23/2002
  • UnRar.dll - file version 3.41.0.306 - dated 11/2/2004

Now Marek is a stand up guy as he includes all the following related attributions and credit information in his "Help - About" program information box.

I've got no experience or clue on how Marek compiles his application from all these different sources, but I figured if I can at least find the three particular dll files noted above and swap them out with newer versions, I might be doing something.

To that end I found:

  • WinRAR archiver offered their UnRAR.dll.  I just unpacked the exe into a "temp" folder by running the file and found the unrar.dll file right there at the folder root. It checks in as version 3.90.100.227 dated 08/16/2009.  I renamed the original file and then copied this newer one in.

DelZip179.dll and dzSFXus.bin are part of the DelphiZip - ZipMaster package. 

  • I quickly finally found a package that contained DelZip179.dll in a format that was easy to access: zmstr1791024.zip.  unzip, find, rename the old, replace with the new.

It took me a while longer to figure out and find the dzSFXus.bin replacement. 

  • However you can either use the not-UPX compressed SFX_STD.zip source package or the UPX compressed SFX_BIN.zip source.  The STD package has a newer one "04/15/2008" while the BIN package is dated "09/19/2005" for what it's worth.

(In case you are curious, it seems the dzSFXus.bin file is used to create self-extracting archives.)

So is this going to make things better for freeCommander users?

Ummm probably not.

Will it make a mud-hole of Marek's hard coding work?  Quite possibly.

But if you are curious, brave, and have to see if the latest is better, then you might want to give it a try.

At least until Marek lets us know that this might cause the planets to destabilize from their current orbital paths and fling them into the sun.

Claus V.

Hmmm. So that '403-thing' WAS a real problem...

Friday morning I was to be found doing some application installations on a VIP's Windows XP system; my boss's.

I installed the updated release versions of MS Visio and Project without any hiccups.

Then I went to run "Microsoft Updates" (as configured on the system) to see if these apps had any associated patches to be applied.

Only I got a bright red "403" page error code when it attempted to reach the update servers.

So I tried again, and got the same result.  Browsing to other web-sites showed the network and Internet access was working fine.

So I just popped onto the sidebar and changed the setting for Updates to use "Windows Updates" instead.  Easy enough to do.

I re-launched Windows Updates and it worked finding the server without any issues (but no Office updates, naturally).

So, for kicks, I re-enabled Microsoft Updates and this time it connected, found, and installed the Visio/Project patches and fixes without the 403 error.

I shrugged it off and "weird" but didn't think anything of it.

Only later did I find this post:

Seems others were running into the issue as well.  So it wasn't just me.

The comments from the post generated quite a lot of feedback and theorizing.  More than one posted the method I had used as well to get things unstuck and working again.

While I've not been able to find hardly any material on this "burp" on the Blog-O-Sphere or Microsoft site, one of the comments as posted by Craig D seems to offer the most plausible explanation at this juncture:

This appears to be from someone at Microsoft posted to the microsoft.public.windowsupdate newsgroup...

Eddie Bowers [MSFT]

This was caused by a bad DNS record that prevented older clients from being able to resolve to the correct address to SelfUpdate ( Upgrade to the latest Update client. ) This has been fixed, but it will take a while to propagate to all DNS servers. The newer clients use a different url, so they are not affected. This is why updating the client manually avoids the problem. The links to the latest clients are at: http://support.microsoft.com/kb/949104

-Eddie

You can see the full context of this suggested solution at

The full KB as referenced is KB949104 -  How to obtain the latest version of the Windows Update Agent to help manage updates on a computer

I'm not sure what is more scary: that I just kept on solutioning the problem without even thinking about it or that outdated Windows/Microsoft Update clients can prevent installation of updates and potentially lead to headaches, wasted time in troubleshooting, or people giving up and just leaving their systems un-patched.

Thoughts?

--Claus V.

Free Windows GREP tools – I’m Excited!

Back in August ‘09, Keydet89 posed the following question in his Windows Incident Response blog post “Goin’ commando”…

Anyway, I think that is would be a great place to start throwing up information, discussion and links to free and open-source tools that folks are using for analyzing various files or formats. This can include general stuff (such as, does anyone have a good, free grep utility for Windows that doesn't use cygwin?)

Harlan then followed that post with a roundup of new free tools and utilities.  He had also previously shared a  number of freely offered blog posts on, well, free utilities that might benefit both the Windows forensic examiner (and sysadmins as well).

Anyway…I think his was a rhetorical question regarding the Windows grep utility, but I responded in the comments about my own personal freeware grep favorite…

  • BareGrep - Free grep for Windows – Bare Metal Software.  Great tool for advanced and complex system and file searching for only 246 kB in size but very fast and very advanced for the most demanding system-inspecting needs.  Simply amazing.  Oh yes. It’s a single non-installing exe file and fully portable. Works great on XP through Windows 7 systems.  I’ve used it with great success to narrow my analysis on a few incident response assignments.  It really saved the day.

Since then I have found and collected a few more freeware grep tools. Most are GUI-based but a few are command-line.  Take your pick.

  • File Hound 3.08 - (freeware) – JimmyTheFork.com.  An updated version of his “Hound” grep tool.  I spotted it mentioned over in this DonationCoder thread Hound: a grep-alike that searches inside PDFs.  For a sample of the GUI see this Hound screenshot link.  Fully portable, download, unzip and run the exe.  I particularly like the fact that it is more intuitive to use and identify the result locations than the uber-powerful BareGrep utility.
  • Windows Grep - (freeware) – brilliant app which ran great “portably” on my Windows 7 system.  The GUI interface is very pleasant and modern (in a no-frills way).  What stood out the strongest to me was the interactive “wizard” that runs first. It nicely guides n00bies through the basic steps of setting up a search pattern, a location, and other parameters before kicking off the search.  Don’t be fooled. It’s got some advanced searching power for the experts to tap as well. The results are wonderfully displayed in an index format and the preview pane below highlights all the findings for very fast analysis.  Good job Huw Millington! Most excellent tool.
  • PRGrep - (freeware) – Another surprisingly well crafted GUI-based grep tool for Windows. Again, it seems to be portable.  Not quite as user-friendly for the uninitiated, anyone who does grep work will pick its functions up quickly.  Searching was fast and like Windows Grep, the display hits are nicely detailed and highlighted in the lower pane.  It can plug into MS Office for Word/Excel file reading.  I particularly liked the “old-school” format which makes copy/paste activity a breeze. PRGrep documentation is outstanding.
  • GREP for Windows - A very flexible grep for windows – (freeware) - opbarns.com O. Patrick Barns did an 2006 update to Tim Charron’s "GREP for Windows" port. He cleaned up some bugs in that version as seem to relate to subdirectory searching with the "-S” argument.  Yep.  CLI only with this one, baby.
  • Grep for Windows and GREP for Windows both of which seem to be the original CLI ports by Tim Charron of the GNU grep 2.0 allowing for sub-directory searching.  Examples of syntax provided on the pages.
  • GREP Command for Windows XP - Windows XP and DOS – Malektips.com – Tips to use of QGREP command.  Note: it does require extraction from Windows 2003 Resource Kit.  Syntax and expression usage documented there wonderfully as well.  More info on the Win2003RK here.  I’m guessing that if it works on XP, it should do OK on Vista and Windows 7 as well.

Curious News on Future Windows Resource Kits

Note that according to information and references in this Resource Kit – Wikipedia article…

In 2007 and 2008 respectively, Microsoft released the Windows Vista and Windows Server 2008 Resource Kits. Microsoft has also released resource kits for Group Policy, Windows security, Active Directory, Terminal Services and IIS 7. The Windows Vista Resource Kit ships with several sample VBScripts and few PowerShell scripts.

The Windows 7 Resource Kit was released on 14 September 2009 [3]. Microsoft has announced that new unsupported resource kit tools will not be provided for current and future operating systems [4], however the PowerShell team has released a Resource Kit PowerShell Pack [5], a collection of PowerShell modules that adds over 700 scripts to those already present in Windows 7.

References

[3]  Windows 7 Resource Kit: Microsoft Press blog

[4]  Are Resource Kits Dead? NOPE!

[5]  Introducing the Windows 7 Resource Kit PowerShell Pack

To be clear; the Resource Kits are alive and well, but it looks like the traditional “unsupported” tools and utilities that came with them, beloved by sysadmins world-wide, are now an endangered species.

See how it works?

Ask a question, get a slew of cool free utilities for the sysadmin and forensic pros alike!

Cheers!

--Claus V.

Brief Adobe Update News

Clean Briefs

In case you missed it (or your commonly installed Windows Adobe products did at least), this past week or so a few security issues got patched in updates to Adobe’s Flash and Air products.

Read more about it in the apsb09-19 bulletin from adobe.

The reason behind it are 7 vulnerabilities: CVE-2009-3794, CVE-2009-3796, CVE-2009-3797, CVE-2009-3798, CVE-2009-3799, CVE-2009-3800 and, CVE-2009-3951 of which 6 lead to arbitrary code execution and the last one is a windows-only issue leading to unauthorized information disclosure, related to CVE-2008-4820.

Additional information in post updates suggests that Adobe will be abandoning Adobe Flash 9 pretty much as it marches forward with version 10.

While Adobe Reader will (depending on configuration) offer a reminder you have an update to apply, Flash and Air do no such thing in my Windows sysadmin experiences.  You just have to pay attention and know to update.

For those wishing linkage for some strange reason, find the latest version direct from Adobe here:

For an alternative (and trusted alternative) I prefer to get my off-line update packages for Adobe from FileHippo.com.

Next-Gen Adobe Flash/Air Beta’s out

You may or may not also be aware of the fact that Adobe has publically available “Beta” versions of Air and Flash out.  I’ve been using these on all my systems with no ill effects.  Performance seems just fine, if not a bit better than the stable “current” release levels of the products.

For the curious you can get them directly from the Adobe Labs Homepage

Or from FileHippo.com as well.

Redaction Fail

Did I do that?

Yes, you did.

In unrelated, related news to Adobe appears someone(s) from deep within the bowels of the TSA is(are) now emptying their bowels due to an unfortunate Adobe Acrobat document redaction FAIL.

Which apparently all could possibly have been avoided had the l33t TSA cyberteam used an updated version of Adobe Acrobat Professional…

…or maybe just bothered to read one of the following other sister-agencies “redaction for dummies” guides…

More Redaction Resources and How-To’s 

  • Redacting with Confidence: How to Safely Publish Sanitized Reports Converted From Word to PDF (PDF) - National Security Agency
  • Redaction of Information – USCourts.gov
  • Redaction of Confidential Information in a Document (PDF) – NASA.gov
  •  Without a trace -- Government Computer News

    Speaking of hiding/finding Data in PDFs…

    I wonder what our resident forensics expert on Adobe PDF documents makes of the situation…

    Goodness knows he’s the expert in all things hidden and exposed in PDF files!

    This wonderful cruise-ship jaunt by the TSA might be causing a new wave of web-accessible PDF searches and examinations of redacted PDF documents for fun and entertainment.

    And yet, I wonder if we aren’t all coming out wiser citizens in some way…

    So with that in mind I say, “Thanks, TSA.”  I really do believe you’ve taught us some valuable security lessons in the name of public policy and operational transparency redaction methodology.

    --Claus V.