Aaron Tiensivu's Blog

Nightly Test Tools - force older extensions to work with newer ‘untested’ builds with a few mouse clicks

AdBlock Plus - one of the best ad blockers you can embed into Firefox, and it is free

AdBlock Filterset.G Updater – auto updates AdBlock Plus definitions

NoScript – Easily pick and choose websites you want to allow to run JavaScript and/or Flash – might be more hassle than it is worth for most people, but it is a good way of avoiding exploit code on compromised websites.

Tinyurl – take long e-mail-unfriendly web links and change them into the form of something like http://tinyurl.com/blah123

You might have to bump the version number on the Tinyurl plug-in for it to work with 2.0.

My post last night was wrong apparently. IE 7 still beat it out the door but considering how long it took between IE 6 and IE 7, I don't think it is a fair comparison.

Grab if from the source, here.

If you are running Firefox 2.0 RC3, you are most likely already running the final release of Firefox 2.0. If there are showstopper bugs found, they will most likely post an updated version. I've been running the branch builds for a couple months now and overall 2.0 is very solid.

That is only scratching the surface of the overall power of this cool scripting language. It looks like it originally started out as an automation tool to automagically click dialog boxes for you in a scripted way. One of the example scripts installs WinZip without any user interaction.

Version 3 has morphed into a more BASIC-ish language. One of the best aspects is that you can easily make GUI dialog boxes and neat automation tricks that are hard or impossible to implement in native VBScript.

You can also compile your scripts into self contained EXE files which is perfect for login scripts and/or application deployment scripts.

You can read more about it and download the application here.

Originally spotted here, but I remember 'playing around' with older versions in the past.

Thankfully there is a hotfix out for it already that will most likely be pushed down WSUS before IE 7 gets pushed down in November.

I haven't seen it firsthand but it looks very easy to reproduce.

Go here for the hotfix - thankfully you do not have to call into PSS for it.

I have an older than dirt Kensington USB Bluetooth dongle that is actually a rebranded / relabeled MSI Bluetooth dongle. Due to the way WIDCOMM originally did licensing and firmware, it is easier getting an organ from the organ donation list than it is to get updated drivers and firmware for most Bluetooth devices.

For whatever reason that I haven't looked into yet, the dongle isn't automatically discovered correctly like most newer BT dongles with the default XP SP2/Vista BT support.

In an effort to get something working under Vista, I ended up pointing Vista to my original XP inf directory for initial BT support of the actual dongle to get rid of the 'Unknown device'. To avoid 30 or 40 'unsigned driver' warnings, I edited the local group policy to 'ignore' the fact that the drivers might be unsigned. Sure, not best practice, but I don't mind bending the rules on my home desktop machine. If I break it, I'm the one that has to fix it anyway.

I ran the WIDCOMM setup in XP SP2 compatibility mode and it installed everything correctly as far as I can tell. There are a few sections of the programs that have quirky display problems, but I just wanted some base functionality with this old dongle until I decide to get a newer USB 2.0 Class 1 Bluetooth dongle.

At least I don't have to suffer with the Toshiba Bluetooth stack that installs 40 COM devices on initial install, even if you are only going to use one COM port. A lot of programs still don't handle anything above COM8 correctly.

An unpatched Toshiba BT stack is also easy to crash if you have your system discoverable and in range of someone with exploit code. Sure, not very common in the real world, but given how difficult it is to get updated Bluetooth stacks from vendors, I am sure most people are still running the older versions.

I am hoping Broadcom, who bought WIDCOMM, will do something like what Agere did with their software modems. They released a 'generic' driver for their chips that might not have all the features of the original OEM drivers, but you can at least download and get basic functionality if you lose your original CDs.

There is a recommended hotfix KB article for Windows 2003 RTM that was published before SP1 came out, located here

It looks like there is a more recent KB article that is specific for Windows 2003 SP1, located here.

You will want to use the right KB for the right service pack level, which most likely is SP1.

People with a single-line calling plan, or a Family SharePlan, with monthly access bills of $79.99 or more are qualified to join this program. You also have to have 3 months of uninterrupted service, but anyone that has been a customer of theirs for an extended period of time should already be at that point.

Right now you end up getting:

1. A new primary phone every one year instead of new every two years. This is the most attractive benefit to me.

2. Free address book transfers. This isn't a selling point to me because I typically backup and my address books from my computer, but I'm not a typical cellular user.

3. 25% off accessories and free shipping from the online store. I typically get my accessories off
eBay so this isn't a selling point for me but it could be for others.

You can apply and get to the special program page by going here.

Programs, such as decoders and CD burning software, sometimes register ‘filters’ that load either before or after the cd-rom subsystem in Windows.

Sometimes when uninstalling software, they will remove the filter that was registered but leave behind the reference to the filter in the registry.

End result: Yellow exclamation point on every CD and DVD-ROM on the system.

Brute force fix:
Run regedit and drill down to this location:
[HKLM\SYSTEM\CurrentControlSet\Control\Class\
{4D36E965-E325-11CE-BFC1-08002BE10318}]
Export the contents of this location to a registry file backup (right click entry->Export), if you want a backup.
Delete the keys “UpperFilters” and “LowerFilters”

You might have to reinstall CD burning software or DVD decoders, but it is better than a non working drive.

You can also delete the “0000”, “0001”, “0002”, “0003” subtrees if you want Windows to rescan/reload the related CD-ROM drivers. You might have to re-enable digital audio on the CD/DVD-ROM afterwards.

More elegant fix:
Go to the same location and if you know what filter file is missing, just remove the reference to it from either ‘UpperFilters’ or ‘LowerFilters’.

MS’s documentation on this problem:
KB 314060

Sometimes it is specifically related to a filter called GearAspiWDM by Gear Software. It usually comes bundled with software, like iTunes. It has also been known to blue screen 64-bit versions of Windows from time to time too. There are trojans out that register themselves as GearAspiWDM, unfortunately.

Here is Gear software's guide to removing GearAspiWDM if you suspect that filter is the cause of your CD-ROM/DVD problem.

Looks like they are ramping up Grand Rapids for a November launch. I am really curious just how north and how west the coverage area will reach because that is where our house is located, relative to downtown Grand Rapids.

I'm excited! I really hope our house has coverage.

I was on the fence whether to put this in 'Gaming' or 'Spyware'. I chose 'Spyware' for now. I am, at best, a casual gamer from time to time on my PC and on the X-Box. I typically will pick up a title after it has dropped in price quite a bit and there have been a few patches put out since RTM.

Sure, you don't get the latest games but you end up with a nice 'cheap' way of having fun with last year's big hits, and you most likely have a video card that supports all the high end features of the game that was 'bleeding edge' in the past.

If this current trend of putting ads inside games and using tracking software to detect which ads you view more becomes more popular, I might end up not buying the newer titles. "Vote" with your dollars. It would be nice if there was a $25 version with ads and a $50 without. I don't plan on picking up BF 2142 due to this.

I think what bothers me the most is that they are 'backporting' the IGA software into patches of already existing games. For instance, in the release notes of Battlefield 2 v1.45, there is mention of adding support for "IGA server/client".

Read more about Battlefield 2142's bundled "IGA" client software here.

Also, if you move the affected mailboxes back to the original server, Outlook no longer crashes.
If this is the case, check to see if the Guid-Replid cache is the root cause.

Exchange 2003 SP1 has Guid-Replid caching disabled by default.
Exchange 2003 SP2 has Guid-Replid caching enabled by default.
Exchange 2003 SP2 plus KB 922617 has Guid-Replid caching disabled by default.

You can achieve the same results as the KB 922617 fix by manually disabling the Guid-Replid cache for each information store. Details on how to do that are documented in the KB.

Here is the reason why the Guid-Replid cache sometimes has incorrect contents (taken from the mentioned KB):

This problem occurs because of a difference between the ReplidMap table in the memory on the server and the ReplidMap table in the Jet database. This difference causes a stack overflow that causes Outlook 2003 to crash. When Outlook 2003 constructs an entry identifier for an item, Outlook 2003 combines a GUID together with the item counter for the item. The GUID is determined by using an index for the item. In this case, Outlook 2003 uses different methods to request the entry identifier. These different methods return different entry identifiers. One entry identifier contains data that was returned from the Jet database. The other entry identifier contains data that was returned from the memory cache.

Juliana has suddenly turned into a 'Deal or No Deal' fan. We were watching it tonight and a lady was debating whether or not to take the deal, so Juliana kept yelling at the screen, "No deal!"

It was cute and funny all at once.

Originally spotted here.

If you have a non-expired subscription to Norton Anti-Virus 2006 and/or Norton Internet Security 2006, you can download Norton Anti-Virus 2007 and/or Norton Internet Security 2007.

I'm hoping NAV 2007 and NIS 2007 are a little less bloated and intrusive than older versions.
It is good to see that NAV 2007 has root-kit detection ability.

Lately, I've been more of a fan of NOD32 for a good lightweight but effective anti-virus system.

This past week I've talked about XML-RPC a bit in relation to this blog and the software that it runs. Although I have always seen a decent amount of XML-RPC exploit attempts in the web logs, they seem to be on the rise lately.

It might be just a fluke but it makes me wonder overall. One of the more interesting ones tries to make a "..." directory in your global tmp directory, grab a file from an exploited/rooted website, set it to be executable, then launch it as a pseudo-httpd.

I'm working on trying to contact the people running "http://xinad.dog-on-line.com" to get the exploit code taken off their site. I won't mention the full URL because it would be easy to grab this static linked executable and setup more compromised websites with it. You might want to block traffic from there in the meantime.

All in all, it just increases my love for mod_security.

For the curious, this is what 'file' has to say about the file the exploit tries to download:

"skript-kiddies-r-us: ELF 32-bit LSB executable, Intel 80386, version 1, statically linked, corrupted section header size"

I'll probably run it thru gdb on a VM to see what it does, or take the easy way and see what strace shows in a VM that is isolated from any network.