Wednesday, July 22, 2009

Windows XP SP3 plus Internet Explorer 8 plus Microsoft Update equals malicious add-on (DEP) error

Yesterday I installed a netbook from scratch. Everything went fine.

After installing XP SP3 and IE8 I wanted to switch Windows Update to Microsoft Update. Currently this PC has no Office installed but I wanted to make sure that I don’t miss an update if I ever decide to install it.

Okay, clicked on Microsoft Update inside Windows Update and IE8 stalled. After a few moments I get an Data Execution Prevention error and IE was telling me that an malicious add-on was the cause of this. WTF!?!?

After trying to fix this unsuccessfully, I though that goggling might be an good idea.

Bingo, shortly after I came across a discussion about this on Microsoft Answers. Once more the solution Microsoft has declared as “answer” was not the answer, but a user named Valeyard had the solution:

Inside Tools – Internet Options – Advanced (Security section) disable/uncheck the option Enable memory protection to help mitigate online attacks.

Did that, restart the PC and Microsoft Update worked just fine.

Tuesday, July 21, 2009

Backup Exec 12.5: Error "The Backup Exec Server Service detected a schema version mismatch."

You need to love Symantec...

I just did an update from Backup Exec 12.0 to 12.5. Since the last update (11 to 12.0) failed with a version schema error, I though this time I will wait until at least SP1 is available.

No guess what? Software installation okay, restarted the server and here we go again: The Backup Exec Server Service detected a schema version mismatch. ÜBERFAIL SYMANTEC!

Fortunately, the fix is nearly the same as the last time. Using SQL Server Management Studio, open the following files and execute them. Please remember to switch the database (normally it will say MASTER inside the tool bar) to the BEDB database before executing any of those.

#1: C:\Program Files\Symantec\Backup Exec\betopcat.sql
#2: C:\Program Files\Symantec\Backup Exec\dbupgrade12.0.sql
#3: C:\Program Files\Symantec\Backup Exec\dbupgrade12.0-viewandsp.sql

After that, everything should be fine.


Appendix:

To: Product manager of Backup Exec
From: TeX HeX
Subject: Whoever is in charge for the schema upgrade process within BE...

Fire him!

'nuff said.

Monday, July 20, 2009

Trine or Bust!

If you haven't bought TRINE so far, you're missing something really cool.

I bought my copy on Sunday and playing it sense then. It's a side-scrolling action/puzzle game and it's just a h*** lot of fun.

You can get it for XBOX 360, PS3 and PC (using Steam).

Friday, July 17, 2009

Hexagon v3: Building my new PC

Sorry for the lack of updates in the last time, but first I needed to get X-Setup Pro 9.2 out of the door and after that I had my three weeks summer holiday.

Soon after I got my new BMW K1300S which causes me to drive around like crazy. If you are interested, have a look at my tracks.

Back to computer, I have a new project: My new custom build PC called Hexagon v3. See the next post for the introduction.

Hexagon v3: Part 1 - Components

This is a post about my new custom build PC. See the other posts as well:

Part 1 – Main Components
Part 2 – Case fans
Part 3 – Case assembly
Part 4 – Full assembly
Part 5 – Over clocking

 

My custom PCs are always named HEXAGON or OCTAGON (that’s because there are some weeks where I use them both and Windows does not like equally named computers within the same network). Each new build gets an version number because I’m a programmer and I like version numbers :-).  I’m writing this on OCTAGON v2, so the new PC will be HEXAGON v3.

Hexagon v3 Main Components

image

CPU: Intel Core i7 920 (Bloomfield)

I like the features it has like the integrated memory controller (although this idea is stolen from AMD) with the triple channel interface. As it looks like, you can overclock the 920 very good so I hope I can each 3.2 GHz with it. I know that new Core i7 “Lynnfield” are on their way, but they will no longer have the triple channel for the memory.

 

image Main board: Gigabyte GA-EX58-UD4P 

UPDATE As it seems this is EOL, replaced with Gigabyte GA-EX58-UD5

X58 chipset (not that you have a choice for the i7…), with Intel Controller Hub v10 RAID (ICH10R). I plan to use RAID 1+0 (Mirroring and Stripping) and the ICH10R will allow me just that. Also, it comes with EasyTune a software normally designed to over clock from Windows but I want to use it to read the current temperatures, voltages etc. directly from the board. It has Dual Bios so if flashing the production BIOS fails, you can still access the board. Great if you were stupid enough to flash a board during a storm…

 

image CPU Cooler: Scythe Kabuto

A top blower cooler, which should help cooling the components around the CPU. With a 120mm fan and a airflow of about 74 CFM (cubic feet per minute) it should operate silent but also keep the CPU cool.

 

imagePSU: Cooler Master Silent Pro M600

Very silent, very good efficiency in low to medium workloads and very good protection against surges, bursts etc. Its 600 watts should be enough since I don’t plane to build a SLI system (two or more graphic cards). If you want build a pure gaming PC with SLI, there are better PSUs for that.

 

image Memory: Patriot Viper Series DDR3 6GB (3 x 2GB) PC3-12800 Low Latency DIMM Kit (PVT36G1600LLK)

It is on the list of supported memory modules from Gigabyte and DDR3-1600 MHz speed will give me enough bandwidth when I try to overclock the CPU. And if overclocking fails: They look good too.

 

image Hard disks: Samsung EcoGreen F2 HD103SI (four times)

932 GB is more than I need, but it’s good to know that I never ever get the “HD full” message again. Beside this, this is a 5400 rpm (rounds per minute) drive and still has a performance of 105-121 MB/sec. This looked to me like the ideal compromise between silent operation and good performance. The switch between slower/silent and faster/louder will be explained in a different post.

 

image Case: Antec Twelve Hundred

This case has three 120 mm fan on the front, two 120 mm on the back and a 200 mm fan on the top. This should allow a very good cooling and (with good fans) a very silent operation. If you think I choose it because of the “cool” blue fans it has: No, since I will replace all (except one) of them.

Saturday, April 18, 2009

Xteq GetOSVersion 3.1 available

We have just updated Xteq GetOSVersion (XQGetOSVer) to Version 3.1, now supporting also Windows 7.

XQGetOSVer returns a number for each detected OS (Windows 95 up to Windows Server 2008 and Windows 7) and can therefore easily be used for batch files where you want to execute special commands depending on the OS in use. It is released as freeware, so you can use it right away.

Thursday, April 16, 2009

Removing Live Search from Internet Explorer 8

This week, we had to prepare an Internet Explorer 8 rollout at a customers side. This customer had very strict requirements which Accelerators, Links and Search providers should be installed.

We thought this should be no problem with the Internet Explorer Administration Kit (IEAK) so we created a package with it. We added the search providers, accelerators and links the customer wanted to have and imported them with IEAK to the package we wanted to created while also activating the option that no default items should be added.

Using VMWare Workstation we then tested our package (did I mentioned which great invention Snapshots are?) and everything looked quite good except that the search box beside the address bar still showed Live Search (not as default, but anyway) like this:

After several tests we are sure this wasn't a failure inside the package, but instead some "by design" issue. Tracking this down inside the registry we found that IE8 get's the list of Search providers from
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes.
However, it also checks
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes
and if it finds a search provider there that is not already shown, it will simply display it as well. And Live Search did come from this HKLM key.

We resolved this issue by NOT adding any search provider inside the package and executing two batch files after the installation of IE.

IESearchProvider_UserSet.bat will remove Live Search from the HKCU SearchScopes, add Google (from IESearchProvider_GoogleSearch_User.reg) and make this the default.

IESearchProvider_ComputerSet.bat will remove Live Search from the HKLM SearchScopes, add Google (from IESearchProvider_GoogleSearch_Computer.reg) and make this the default.

Both scripts work identically, except one check HKCU and the other HKLM. Both check if the Google search provider is already installed (we have created our own GUID for this) and if not it will be added, set as the default and finally deleting the Live search provider.

We have added these commands to the Internet Explorer GPO (..UserSet.bat to the user scripts, ...ComputerSet to the computer scripts). And don't worry: This script will work even if IE8 is not rolled out, IE7 can use the Google search provider as well.

You can download all files here.

Tuesday, April 7, 2009

A script for fixing WMI problems

The last two months, I was helping a client to get his network running smoothly again. One of the topics were strange errors within various applications and problems with machines that did not received any update from the central Windows Server Update Services.

To cut a long story short, this all was caused by the WMI (Windows Management Instrumentation) service not working correctly. One very often rolled out image was broken in that area so 70% of all computers had a broken WMI installation.

After some research, I created a WMI Fixer batch file that was able to fix the WMI installation of nearly all machines (>400), except three we were forced to reinstall.

I took the idea from a script of David H. Lipman from this forum post, added some checking logic and also added some code from the WMI Isn't Working page.

Enjoy!

 

@cls
echo off
Rem
Rem Original by David H. Lipman:
http://www.pcreview.co.uk/forums/thread-1898592.php
Rem See also: http://www.microsoft.com/technet/scriptcenter/topics/help/wmi.mspx
Rem

SET WMIRoot=%windir%\system32\wbem
SET Rep_Bad=Repository_bad

echo WMI Fixer Batch v1.2
echo Copyright (C) 2008 Xteq Systems
echo
http://www.xteq.com/
echo.

echo Setting TEMP as current directory
cd /d %TEMP%

if exist %WMIRoot% goto Stop_Services
echo WMI doesn't seem to be installed here! Starting WMICore.exe...
wmicore /s
echo Creating folder WBEM 
mkdir %WMIROOT%

:Stop_Services
echo Trying to stop service...
net stop winmgmt /y

echo Using kill switch to make sure WMI has stopped...
winmgmt /kill

echo Switching to %WMIRoot%
cd /d %WMIRoot%

echo Checking if folder %Rep_Bad% exists and delete it if necessary
if exist %Rep_Bad% rd %Rep_Bad% /s /q

echo Moving current Repository to %Rep_Bad%..
rename Repository %Rep_Bad%

echo Registering all DLL files...
echo on
@for %%i in (*.dll) do RegSvr32 -s %%i
@echo off

echo Registering all EXE files...
for %%i in (*.exe) do call :FixSrv %%i
REM for %%i in (*.mof,*.mfl) do Mofcomp %%i
Rem not used

net start winmgmt
echo Done!
goto Ende

:FixSrv
if /I (%1) == (mofcomp.exe) goto SkipSrv
if /I (%1) == (wmic.exe) goto SkipSrv
if /I (%1) == (wbemcntl.exe) goto SkipSrv
if /I (%1) == (wbemtest.exe) goto SkipSrv

echo on
%1 /RegServer
@echo off
:SkipSrv
goto LongTail

:Ende

pause
exit 0

:LongTail

Wednesday, March 4, 2009

Creating a self-signed certificate for SSL

In case you want to secure an internal web server with an SSL certificate you normally can get a certificate from your PKI Administrator.

However, if you only want to test something a self-signed certificate will also do the trick. The only drawback: Since it's self-signed, user will get a certificate warning when connecting to the server. For test environment however, this should be okay.

I'm using the MAKECERT.EXE command from Visual Studio for this. The command to create the cert is as follows:

"%ProgramFiles%\Microsoft Visual Studio 8\SDK\v2.0\Bin\makecert" -r -pe -n "CN=my-server.corp.acme.com" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12



@echo.

@echo Now start mmc.exe, add the snap-in "Certificates" and

@echo acceess the certificate store of the local computer.

@echo Below "My certificates" the newly create certifcate will be located!

@echo.



pause


Once this command has completed, open MMC.EXE, add the "Certificates" snap-in, select "Local computer" as the scope and the newly created certificate will be inside the "My certificates" folder.

Enjoy!

Thursday, February 26, 2009

Adobe Flash Player Update

Once again, there is a security hole in Adobe Flash and everyone should update to version 10.0.22.87 (open Flash Player Version Display in case you want to know the version of your Flash Player).

Home users can easily go to the Get Flash page from Adobe and update their player. No big deal.

However, in a company with more than 500 computers, users are normally not allowed to install any software and any ActiveX/XPI download is blocked. Means: All these users can't update their flash player; it must be installed by the IT.

Normally this isn't a big problem at all since the Flash player for Internet Explorer is just an OCX file that you can easily replace. Starting with version 10, Adobe patches the security ACL for this file and denies the user EVERYONE the access to write the attributes for the OCX. Before they do this, they set the attributes of the file to READ-ONLY.

Boink, you can't copy the new OCX file because it's marked READ-ONLY. ATTRIB –R does also not help, because the ACL on the file prevent you from doing this. To make a long story short: In order to update Adobe Flash manually you need to perform the following steps.

  • Get a new Flash OCX from Adobe. Easiest way possible is to use one machine that is directly connected to the internet and update Flash from the Get Flash Page page.
  • Copy the Flash OCX from C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx to a network share where all machines have access to.
  • Use the following batch file which will first delete the old Flash OCX, then patch the ACLs on the file, which will allow us to change the attributes using ATTRIB (remove READ-ONLY) which ultimately allows us to copy the OCX file.

SET FOLDER=%SYSTEMROOT%\system32\Macromed\Flash

SET OLDFILE1=%FOLDER%\Flash10a.ocx

SET NEWFILE=%~dp0flash10b.ocx
SET NEWFILE_DEST=%FOLDER%\Flash10b.ocx


IF NOT EXIST %FOLDER%. GOTO ENDE


IF EXIST %OLDFILE% DEL %OLDFILE1%

CACLS %NEWFILE_DEST% /E /R Everyone
CACLS %NEWFILE_DEST% /E /R Jeder
echo j|CACLS %NEWFILE_DEST% /E /G Users:F
echo y|CACLS %NEWFILE_DEST% /E /G Users:F
echo j|CACLS %NEWFILE_DEST% /E /G Benutzer:F
echo y|CACLS %NEWFILE_DEST% /E /G Benutzer:F

ATTRIB -R %NEWFILE_DEST%

COPY %NEWFILE% %NEWFILE_DEST% /Y /V

regsvr32.exe %NEWFILE_DEST% /S

:ende


Please note: This script will not install Flash, it will just update it. And it only updates Flash for Internet Explorer, not for Firefox or any other Browser. That every call to CACLS is duplicated is simply due to the fact that we also have German machines which expect "J" for JA instead of "Y" for YES.

Wednesday, February 4, 2009

.Net DateTime vs. TickCount compare operations

Yesterday, a friend of mine called me. He is writing a small program for a client and this program should execute simple operations at a given time. These operations don't take very long, but there will be a lot of checks in a second to make sure that the operation starts (nearly) exactly at the given time.

My friend has concerns that a simple "TriggerDate>DateTime.UtcNow" would take to long so he started to use Environment.Ticks. The Ticks operation is for sure faster, because this is only a simple addition and comparsion. However, the ticks will go from Int.MinValue to Int.MaxValue in about 49 days, when the counter will flip back to Int.MinValue. This caused him a lot of headache.

I first tried to improve his code, when I realized I first need to determine how much slower is a DateTime comparison. So I wrote the following small test code:

private void CheckDateTime()
{
DateTime dtStart = dtNow new TimeSpan(0, 0, 5);
long iCount = 0;

DateTime dtNow = DateTime.UtcNow;

for (; DateTime.UtcNow < dtStart; iCount )
{
}
PrintResult(dtNow, iCount);

}

private void CheckTicks()
{
int iTick = Environment.TickCount & int.MaxValue;
int iTickStart = iTick (5 * 1000);

long iCount = 0;

DateTime dtNow = DateTime.UtcNow;

for (; (Environment.TickCount & int.MaxValue) < iTickStart; iCount )
{
}
PrintResult(dtNow, iCount);

}

private void PrintResult(DateTime starttime, long Operations)
{
DateTime dtNewNow = DateTime.UtcNow;

TimeSpan elapsed = starttime - dtNewNow;

textBox1.Text = "Time: " elapsed.TotalSeconds.ToString() "\r\n";
textBox1.Text = "Operations: " Operations.ToString() "\r\n";

}


The result: On a standard 1.8 GHz Intel Core 2 machine (E2160), I had 192 million DateTime comparisons in about 5 seconds and 593 million TickCount comparisons. This means: My computer is able to do a whopping 39 millions DateTime comparisons/second and 120 million TickCount comparisons/second.

Conclusion: Yes, DateTime is slower than checking Ticks, but given these figures you really don't need to care about this difference.

Monday, February 2, 2009

Calculating when an integer identity column will be exhausted

Last week, we had an interesting discussion with a client which data type an identity column on a table should have. We are working with this client on a redesign of an in-house LOB.

In particular, we were discussing one table that we expecting to have one to two new rows per second each day. The customer wanted to define the identity as bigint, while we said that integer (int) is enough and faster for sure. What would you think how long it takes until an integer column as identity will "explode" on this table? Two Month? Three Years?


Well, if we calculate with three changes per second it would actually take 23 years!


In case you find this Excel file useful, you can download it here.

Friday, January 30, 2009

IF EXIST for directories

Sometimes you simply need to use batch files, although they are something from the past. In a current project, a custom made service wanted to copy a given file using a batch file. This didn't worked on all machines, because the customer has started to roll out MUI installations where the userprofile folder differs:

Default Windows XP (German) profile folder: C:\Dokumente und Einstellungen\
Default Windows XP (MUI) profile folder: C:\Document and Settings\

The solution (seems) rather simple:

IF EXIST "%SYSTEMDRIVE%\Dokumente und Einstellungen" GOTO DEUTSCH

Well, this doesn't work because IF EXIST can only check for files, but not for folders. The trick is to append "\." at the end because every folder contains this "virtual file". Therefore, the batch would look like this:

IF EXIST "%SYSTEMDRIVE%\Dokumente und Einstellungen\." GOTO DEUTSCH

GOTO ENGLISH





:DEUTSCH

echo German XP

goto ende



:ENGLISH

echo English or MUI XP

goto ende



:ende

pause

Wednesday, January 21, 2009

DHCP Error: Service provider could not loaded or initialized

I just had to fix a Windows XP machine that displayed the following error message in event log:

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1006
Description:
Your computer was unable to automatically configure the IP parameters for the Network Card with the network address XXXXXXX. The following error occurred during configuration: The requested service provider could not be loaded or initialized.

The computer did not receive any DHCP address and instead always used a automatically assigned one (169.x.x.x). Trying ipconfig /renew also resulted in the exact same message:

An error occurred while renewing interface Local Area Connection. The requested service provider could not loaded or initialized.

This has happened after the removal of an UMTS (3G) Network card. The solution is rather simple: Just enter

netsh winsock reset catalog (More information)

inside a command prompt After that command, the computer was back to normal.

Monday, January 12, 2009

Amazon A9 gone mad

Normally Amazon finds what I'm looking for. But searching for a "Fritz! Box", a router with WLAN, VoIP options etc. in Black (schwarz in German) resulted in these three results.

The first result one is okay, result two is not really what I was searching for but the last result is really insane: Swimmies!

Tuesday, January 6, 2009

Please replace the non-existent hard drive

I just love HP ProLiant Servers. I think I have set up nearly 100 of those in my carrier, and exactly one really failed every (main board broken). You get great support and even new drivers for servers that are out of production for three years.

However, the following message I received yesterday was just so funny:



BTW: Yes I know the message comes from the fact that the drive I added had still some array information on it. But it's funny anyway.

Monday, December 22, 2008

RPO and RTO

As soon as you start to deal with backup strategies, you will come across two abbreviations you need to deal with: RTO and RPO.

Recovery Time Objective (RTO) simply means the time in minutes until a crashed system is up and running again. For example, if your backup server is able to restore your entire file server within 60 minutes, you have a RTO of 60.

However, this does not say anything about if the data you have restored were from one hour ago, yesterday or from last year. This is defined by the Recovery Point Objective (RPO).

A quick example: You save your file server every night at 20:00 (8pm). One day, all data on this server is lost at 11:00 (11am). You then do the restore and everything is up and running again at 13:00 (1pm).

In this example, you had an Recovery Time Objective (RTO) of 120 minutes (11:00 - 13:00). The Recovery Point Objective (RPO) was however 15 hours (20:00 - 11:00).

Dealing with these values can be quite challenging, but sometimes the biggest problem is not to confuse RTO with RPO.

I simply remember RTO as "Ready to gO" (after a crash) so RPO means how old the backup can be.

Friday, December 19, 2008

Fixing the local Live Mesh client

In case you are also playing with Live Mesh from Microsoft, you might end up that the synchronization between your local Live Mesh client and the server goes havoc.

In my case, I didn't had any folders in my mesh but my local client still showed several folders as being available inside the mesh. Trying to delete them from the "Live Mesh Folders" resulted in this nice error message:

Request to MOE failed with status code
404 Resource not found

If this happens to you, simply should down the Live Mesh client, then search the your computer where MOE.exe is located. On my Vista box, it was C:\Users\TeX HeX\AppData\Local\Microsoft\Live Mesh\GacBase\.

Inside that folder, you will find a folder called Store. Simply delete it and start the client again. Although it will have forgotten all settings, the "Zombie" folders are gone as well.

BTW: In case the client does not accept a folder inside the "Synchronize folder with this computer" (Error 400): Check if the folder is not on a removable medium (USB Stick, SD Card). Live mesh seems to accept hard drives only at this time.

Tuesday, November 18, 2008

Fable 2 bug collection

Don't get me wrong: Fable II is a great game and I enjoyed playing it. However, sometimes the engine just fails badly. But it funny anyhow....

Grilled chicken


Flying dead body


Dog wayfinding (sort of)


Fancy lady twins

10.000G - Finally

After playing for three years, I was finally able to pass 10K of "G" points on XBOX Live. Yeah!