Archive for September, 2007

Sep 14

I’m writing this article, because many people don’t have the luxury of a server and therefore work on a p2p network. So now you have setup user accounts for all the users on all the computers in your p2p network and everything works great. Users can access files shares and network printers, but every 42 days it stops working due to passwords expiring.

Here is how you disable passwords from expiring:

  • Open Control Panel, Administrative Tools
  • Open the Local Security Policy snap-in

Local Security Policy

  • In the tree view in the left side, navigate to Security Settings -> Account Policies -> Password Policy
  • In the right side, select Maximum Password Age and change the default value of 42 to 0. A value of 0 means that the passwords will not expire.

Maximum password age Properties

  • Click OK, close the Local Security Snap-in and Control Panel
  • Passwords are now set to not expire


Have you ever wanted to see a list of all messages in a folder that are either unread or flagged for follow up?  Well… If you’re like me then you probably receive 100 + e-mails a day and just can’t read them all at once.

Here is a nifty filter that you can create in Outlook to accomplish this:

  • Make sure that you are in a mail folder (such as Inbox)
  • Go to view menu -> current view -> define views
  • Select “Unread messages in the folder”Click Copy, Enter an appropriate name such as “Unread and/or flagged messages” and leave other settings as is
  • Now select the newly created viewClick modify, then Filter
  • Go to SQL tab, check the tick box “Edit these criteria directly. All other tabs will be unavailable”
  • Paste the following into the text box:
  •  ("urn:schemas:httpmail:read" = 0) OR ("http://schemas.microsoft.com/mapi/proptag/0x10900003" > 1)
  • Click OK, OK and Close

You can now select this view in any folder you please.

This filter should show all unread messages and any message flagged for follow up that has not been completed yet.

I have not tested this extensively but have been using it for a while now and all seems to be in order with the filter.


Spyware vs Virii

posted by Sam Ravenscroft
Sep 4

Spyware and viruses are both forms of unwanted or malicious software, sometimes called “malware.” You need to protect yourself from both.

What’s the difference?

Spyware (sometimes called adware) collects information about you without appropriate notice and consent.
A computer virus spreads software, usually malicious in nature, from computer to computer.

Spyware can get installed on your computer in a number of ways. One way is through a virus. Another way is for it to be secretly downloaded and installed with other software you’ve chosen to install.

In short, spyware is a specific type of unwanted software that secretly collects your information.

A virus is a specific way software can be secretly distributed, often by e-mail or instant messaging.

Both spyware and viruses can cause damage to your computer or cause you to lose important data.

To help protect against spyware, try Super Anti-Spyware.

To help protect against viruses, try Avast (a good free-for-personal-use anti-virus) or software from another antivirus provider.


HOW TO: Debug Memory Dumps

posted by Sam Ravenscroft
Sep 4

When you get a stop error (Blue Screen of Death or BSOD), your computer generates a small file or memory dump usually referred to as a minidump. This BLOG post will explain to you how to analyse these minidump files. This may shed some light on the problem in terms of what caused a particular stop error. It may also give you the driver file name if the stop error was caused by a faulty or incorrectly installed driver.

Your first step is to download and install the Microsoft Debugging Tools found here: http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Once you have downloaded and installed these tools, go to start, all programs, Debugging Tools For Windows, Windbg. Once you open Windbg, you will presented with a blank screen. Click on File, Symbol File Path. Here you will enter the symbols path. Symbols are needed to effectively debug.

The path will be:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Enter in this path and click OK. Now, go to File, Save Workspace so that your symbols path is saved for future use. Now what you want to do is locate your memory dumps. They are usually located in %systemroot%/minidump (in general C:/windows/minidump).

If you notice, they are usually named the date, and then a -*number* to indicate the order of minidumps that day. My example is called Mini061904-01.dmp .

Inside of Windbg, go to File, Open Crash Dump and load the file. You will get a message to save base workspace information. Choose no.

Now you will get a debugging screen. Now it takes a little bit to run it, as the symbols have to be downloaded as they are needed. Then you will see information such as:

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini061904-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp2.030422-1633
Kernel base = 0x804d4000 PsLoadedModuleList = 0x80543530
Debug session time: Sat Jun 19 19:06:57 2004
System Uptime: 0 days 1:03:36.951

Loading Kernel Symbols
……………………………………………………………………………………………………………………
Loading unloaded module list
……….
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 86427532, {1db, 2, 3, b} <–This is your stop code

Unable to load image pavdrv51.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for pavdrv51.sys
*** ERROR: Module load completed but symbols could not be loaded for pavdrv51.sys
Probably caused by : pavdrv51.sys ( pavdrv51+7fc0 )

Followup: MachineOwner
———

Now, we can already see what it was most likely caused by, in my case it was pavdrv51.sys, which is a Panda AV file.

If we want to get further in depth, we can use the command, !analyze -v at the kd> prompt to delve more info about the error:

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Unknown bugcheck code (86427532)
Unknown bugcheck description <–Its unknown, and not listed on the MS KB at all.

Arguments:
Arg1: 000001db
Arg2: 00000002
Arg3: 00000003
Arg4: 0000000b

Debugging Details:
——————

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x86427532

LAST_CONTROL_TRANSFER: from f4198fc0 to 804f4103

STACK_TEXT:
f41f0964 f4198fc0 86427532 000001db 00000002 nt!KeBugCheckEx+0x19
WARNING: Stack unwind information not available. Following frames may be wrong.
f41f0ba0 f419920b 864db520 f419ccf0 00000000 pavdrv51+0x7fc0
f41f0c34 804ea221 865b8910 864a52c0 806ad190 pavdrv51+0x820b
f41f0c44 8055d0fe 864a5330 86305028 864a52c0 nt!IopfCallDriver+0x31
f41f0c58 8055de46 865b8910 864a52c0 86305028 nt!IopSynchronousServiceTail+0x5e
f41f0d00 80556cea 000000a4 00000000 00000000 nt!IopXxxControlFile+0x5c2
f41f0d34 8052d571 000000a4 00000000 00000000 nt!NtDeviceIoControlFile+0x28
f41f0d34 7ffe0304 000000a4 00000000 00000000 nt!KiSystemService+0xc4
00cdff70 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

FOLLOWUP_IP:
pavdrv51+7fc0
f4198fc0 ?? ???

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: pavdrv51+7fc0

MODULE_NAME: pavdrv51

IMAGE_NAME: pavdrv51.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e8c072b

STACK_COMMAND: kb

BUCKET_ID: 0x86427532_pavdrv51+7fc0

Followup: MachineOwner
———

Update: After the intial run of the debug process, you can use the command !analyze -v to gather more information.

Now that may be more infor than you need. This tutorial only covers minidumps, however, if needed, you could change your memory dump options to do a complete dump. This is useful, however, very cumbersome, as the file generated will be the same size as your amount of ram.

Note: Make absolutely sure that your symbol path is correct. If it isn’t, then you will get symbol errors and not likely be able to debug the dump to get the info you desire.

Author note: This article source is from a posting found on Majorgeeks.com’s forums.