Optimization for running VMWare VMs from a USB or other slow storage device

I love VMWare. Great product, innovative company. Recently had a minor problem after upgrading from Workstation 5.0 to 5.5, and wound up searching VMWare's knowledge base. Though I wasn't looking for this type of information at the time, I ran across an article that details a change one can make to a VM's configuration (.vmx) file that might improve performance. I haven't tried this yet, but plan on it the next time I have to move my VMs off of my laptop HD to an external HD (or *GULP* a network drive - yeah, yeah - I know).

Basically, VMWare uses a file in the VM's directory as a memory swap file. USB devices read and write data more slowly than internal HDs. So, VMWare uses a swap file on the USB device, and performance suffers. The suggested fix is to add the following setting to the VM's .vmx file:

mainMem.useNamedFile=FALSE

This tells VMWare to use the host system's HD to store the swap data.

The VMWare KB article is "Virtual Machine on USB or Other Slow Storage Device Runs Slowly".

"A principle terrain must be truth to aquire the state of a physical printer"

I've always liked this kind of thing. Over at Channel 9 on MSDN, they've got a "Knowledge Base Machine Translation Examples" wiki. The articles are RE-machine-translated back to English, so they're perhaps a bit worse than they would be if they'd only been machine-translated once.
Still, statements like the following are good fun:

A principle terrain must be truth to aquire the state of a physical printer

You show error 17803, if you execute a SORT- on a computer which has physical RAM multiple GB from SQL Server possesses,, or a CREATE INDEX operation on a computer,, which has physical RAM multiple GB from SQL Server possesses.

You engineers slogan are researching a resolution for this problem, which was denoted from user like you.

If it's an internal error, why am I seeing it? 42

I don't know that this needs much commentary. Name distorted to protect the guilty.

.NET Framework 2.0 Configuration Tool, Part 2

See part 1 or part 3 of this topic...


OK... Last week Shawn Farkas (MS) blogged in the ".Net Security Blog" about "Which Package are the Security Tools In?" for the .NET Framework 2.0. In that post, he states they're in the SDK package, which was discussed previously. No direct reason is given, but in one comment an individual notes that GACUTIL is also not part of the redistributable package as was the case with the .NET Framework 1.1. To this, Shawn replies that "GAC administration is not an end-user scenario". One can consider that similar reasoning was applied to the moving of the .NET Framework 2.0 Configuration Tool from the redistributable package to the SDK. Still, the tools are at the least handy for troubleshooting and I can easily envision many cases where I will be wishing I had them available without having to install the SDK on another system.

Diagnosing DCOM Problems

Looks like Windows XP SP2 and Windows Server 2003 (possibly only with SP1?) have added capabilities for logging information about DCOM activation failures and call failures. The document "Changes to Functionality in Microsoft Windows XP Service Pack 2" at http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6-8364-685b84158c78&displaylang=en contains information about (among many other things!) the registry settings required to control the additional logging:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"ActivationFailureLoggingLevel"=dword:00000001
"CallFailureLoggingLevel"=dword:00000001

Setting the values to 0 turns the logging off. For the change(s) to take affect, the DCOM server needs to be restarted. This may require rebooting the system, depending on what the DCOM server is.

The settings cause the following types of messages to be logged to the System event log.

The machine wide limit settings do not grant Remote Access permission for COM Server applications to the user NT AUTHORITY\ANONYMOUS LOGON SID
(S-1-5-7). This security permission can be modified using the Component Services administrative tool.

The machine wide limit settings do not grant Remote Activation permission for COM Server applications to the user NameSamCompatible SID ({sid}). This security permission can be modified using the Component Services administrative tool.

This allows one to determine what permissions need to be added to what accounts.

A knowledge base article that also documents these registry settings is:

Programs that use DCOM do not work correctly after you install Microsoft Windows Server 2003 Service Pack 1

.NET Framework 2.0 Configuration Tool

See part 2 or part 3 of this topic...

ACK! What was Microsoft thinking? The .NET Framework 2.0 configuration tool (MSCORCFG.MSC Management Console) doesn't ship as part of the .NET Framework. Rather, it comes with the .NET Framework 2.0 SDK.

http://msdn2.microsoft.com/en-us/library/2bc0cxhc.aspx

In the .NET Framework versions 1.0 and 1.1, Mscorcfg.msc is installed with the .NET Framework redistributable package. Starting with the .NET Framework 2.0, Mscorcfg.msc is installed with the .NET Framework SDK.

This is a change from the .NET Framework 1.0 and 1.1, where the installation of the Framework put shortcuts in "Administrative Tools" for "Microsoft .NET Framework 1.1 Configuration" and "Microsoft .NET Framework 1.1 Wizards" for the .NET Framework 1.1, and similarly named tools for 1.0.
Sure, there are command-line tools that one can use to do much of the same things, but why remove the UI? The only thing I can think of is that if something's not there, someone can't play with it. But even if the Framework install lays down mscorcfg.msc, it wouldn't have to install a shortcut to it - that right there would probably keep 99% of the people away from the program. If someone needed it and knew it was there, they could browse to it and run it.

Seems odd. I hope to be able to do a bit more digging to find out why this tool isn't included as part of the base Framework install.

Process Explorer 10!

A new version of Process Explorer from Sysinternals was released! Version 10.02 is a major upgrade and has a bunch of new features. Details and download (FREE!) are at:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

Can't wait for Process Monitor!

"Protecting against Pointer Subterfuge"

Michael Howard has a good post about "Protecting against Pointer Subterfuge" and he introduces some functions that are new to Windows XP SP2 and Windows Server 2003 SP1:
EncodePointer and DecodePointer
EncodeSystemPointer and DecodeSystemPointer

"Root Kit" by "Patch Me Up"

Whoa.
This is over the top.
Words can't do it justice.
You just have to see it.
http://video.google.com/videoplay?docid=9151435244001559688
Insane.

#import - undocumented attribute "no_function_mapping"

I've been working with a rather complex library of 3rd party COM components. One type-library is imported and there are a total of about 3,000 methods. As a result of what I presume to be the 3rd party not adhering to one of "The Rules of COM 101" ("published interfaces are immutable"), I'm kind of in a situation where I need to modify the code generated by the #import (the .tli file, at least).

I #imported the type-library with about 10 attributes to generate the .tlh and .tli files. Then I commented out the #import directive and just #included the .tlh, which in turn #includes the tli. In my case, I needed to modify the .tli so that instead of using the hard-wired DISPIDs that the compiler brought in with the #import, IDispatch::GetIDsOfNames is called to determine the DISPID at runtime. Of course, doing this more than once per program execution isn't efficient, so I wound up creating a local static DISPID variable to hold onto the value, and then a local static bool initialized to false to be the flag that indicates if the DISPID needs to be determined or not. To be thread safe, I entered a critical section prior to testing the bool, and leave the critical section immediately after determining that I've got the DISPID (either in this run, or in a previous one).

One attribute that came in handy in the #import is an undocumented one, "no_function_mapping". This attribute is mentioned in the MS KB article "Description of the no_function_mapping compiler directive and the implementation_key compiler directive in Visual C++ .NET or in Visual C++ 2005". Basically, the "no_function_mapping" attribute is used to disable the "implementation_key" compiler directive, which is used when a type-library has more than 1000 methods. In my case, I didn't need the "implementation_key" (in fact, it kind of cluttered the code) but apparently in other cases it actually causes compiler errors (documented in the KB article).

I don't usually advocate changing compiler-generated code but in this case I made an exception as I plan on thoroughly documenting what I did as well as WHY I did it, and how the idea can be carried forward should additional or newer methods in the 3rd party library be required.

Kill 'em all!

Thanks, Visual Studio .NET 2003!

Good thing it's only the life of a process at stake...

I love the "Corrected Source" Code here...

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wcepbguide5/html/wce50grfPREfastWarning253.asp

This is golden:

Example
    Defective Source
        MmSecureVirtualMemory(NULL, 0, 0);

    Corrected Source
        // use something else

Connect to the console session on a server with Remote Desktop Client

Remote Desktop is a great feature, but sometimes you want to get to the console session on a remote system (rather than another, new session). The Terminal Services Console connection program (mstsc.exe) accepts some command line parameters, one of which is "console". This parameter allows you to connect to the console session on a server. If you run "mstsc /?", the "Usage" dialog displays, detailing more options.

Free GSX Server?

Rumor has it that VMWare may soon start giving away their "lower-end" server virtualization product, GSX Server, for free. A pretty bold move, to be sure, but I think that it well serve them well. If people like GSX server they may be more inclined to upgrade to the higher-end product, ESX server, which doesn't require a host operating system.

A new kind of password

http://clam.rutgers.edu/~lsobrado/graphicalpassword/
GraphicalPassword requires the .NET Framework 1.1. It's experimental, but an interesting concept. Your password is made up of specific icons. Many icons are presented and the idea is to find yours and click somewhere inside the perimeter created by extending imaginary lines out from your icons.

A corresponding article:
http://rutgersscholar.rutgers.edu/volume04/sobrbirg/sobrbirg.htm

Windows Kernel Patch Protection

Microsoft has a FAQ on Kernel Patch Protection for x64-based platforms running Windows Server 2003 Service Pack 1 and later.
http://www.microsoft.com/whdc/driver/kernel/64bitpatch_FAQ.mspx

COM+ 1.5 and 1.0

Ran into this today. Not horribly noteworthy but it can bite you if you blindly click through the COM+ application export wizard.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;873192
"You receive an "Error registering COM+ application" error message when you install an application proxy in COM+ 1.0"

"The Save application in COM+ 1.0 format – some properties may be lost option on the Application Export Information page must be enabled if you want to export your application proxy for COM+ 1.0. "

Windows XP and Windows Server 2003 run COM+ 1.5 and Windows 2000 runs COM+ 1.0.

Error installing Security Bulletin MS06-003

I was having a difficult time getting the security update that addresses the vulnerability referenced in Microsoft security bulletin MS06-003 (Vulnerability in TNEF Decoding in Microsoft Outlook and Microsoft Exchange Could Allow Remote Code Execution (902412)) to install. The event viewer showed the following:
Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 1024
Date: 1/10/2006
Time: 2:00:52 PM
User: DOMAIN\USERNAME
Computer: COMPNAME
Description:
Product: Microsoft Office Small Business Edition 2003 - Update 'Security Update for Outlook 2003 (KB892843): OLKINTLff' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support:
http://go.microsoft.com/fwlink/?LinkId=23127

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 39 31 43 41 30 34 30 {91CA040
0008: 39 2d 36 30 30 30 2d 31 9-6000-1
0010: 31 44 33 2d 38 43 46 45 1D3-8CFE
0018: 2d 30 31 35 30 30 34 38 -0150048
0020: 33 38 33 43 39 7d 20 7b 383C9} {
0028: 38 31 43 46 46 37 39 45 81CFF79E
0030: 2d 30 34 45 36 2d 34 31 -04E6-41
0038: 42 43 2d 42 34 46 41 2d BC-B4FA-
0040: 44 32 46 46 34 44 45 35 D2FF4DE5
0048: 38 41 31 35 7d 20 31 36 8A15} 16
0050: 30 33 03

I did some troubleshooting. Ultimately, the problem wound up being that the "Office Source Engine" service had been disabled. Re-enabling the service allowed me to apply the patch successfully.

Error 1603, referenced in the event log message, is "Fatal error during installation."

Helpful.

Office Depot: A Dish Best Served Coldly

I had a bad experience with Office Depot.

This all may seem kind of piddly, but it's frustrating and quite frankly shouldn't have happened.

I've been around the block when it comes to technology deals. I tend to be rather frugal with my purchases. I take advantage of rebates. I'm persistent and will not let a rebate go unclaimed. So when I saw a KDS XF-9S 19in CRT monitor for $137.80 with a $100 rebate, my interest was piqued. I reviewed the rebate form (http://forms.young-america.com/31565_OD4802033-011106.pdf), and it seemed to be acceptable, although I didn't like the idea of waiting 60-90 days. Even better, Office Depot had a coupon for $30 off of an order of $150 or more. So for $12.20 more, I could save another $30. I added the monitor to the cart, and saw that others that had purchased the monitor had also purchased monitor wipes for $7.99, and screen cleaner for $4.99. This would add $12.98, bringing the order to $150.78. I added these items to the cart as well. With the coupon applied, the total would be $120.78, and after rebate everything would cost $20.78. Not bad, I thought.

So I had the shopping cart up with the three items and the coupon in it. Under the coupon was a phrase:"Coupon discounts will be applied during checkout. Click Here to see if you met your coupons criteria." The "Click Here" was a hyperlink. When I clicked on it, it indeed told me that the coupon was valid. From the shopping cart page, I clicked the "Checkout" button. From there, I entered my billing information and reviewed the order summary. The $30 coupon had been split up so that a portion of the $30 applied to each item. This was fine, as the Total was $120.78. I reviewed the rebate form one more time and didn't see anything extraordinary so I clicked the "PLACE ORDER" button that had "This will complete your order." under it.

I was taken to a "Thank you" page that summarized the order... for a total of $159.07. It looked like the coupon hadn't been applied! And tax had been added AFTER I was presented with a Total that I agreed to. I can handle sales tax I guess, though it SHOULD have been presented at the time of the order CONFIRMATION, rather than AFTER THE ORDER WAS PLACED. But there was no indication that the coupon was removed. So I had agreed to charges of $120.78, and was going to be charged $159.07. I didn't like where this was heading.

I called Office Depot's number. The people, while nice enough, insisted that they don't do coupons for technology items. I asked why the coupon showed up on their website, and I was told that third-parties often take advantage of their website and put bogus coupons on it. This seemed absurd, and I pressed the issue, especially since their OWN website VALIDATED THE COUPON and APPLIED THE COUPON TO THE ORDER TOTAL prior to submission. "After you submit the order, invalid coupons are removed." Where on EARTH does that seem like a good idea? And again, their website told me that coupon was, in fact, valid. Ultimately, I wound up cancelling the order, and requesting that they scrub all information pertaining to me and my order from all of their systems. If Office Depot can't even handle PROCESSING COUPONS in 2006, how on EARTH can I trust them to safeguard my personal information, including credit-card info? The woman I was speaking with started telling me things that I thought were a tad bit inappropriate to be disclosing, when I pressed her on this. She told me they did all kinds of things to ensure security, etc. But she went on to say that orders over a certain amount (she disclosed the amount) were processed more closely with the credit card company so fraud attempts would be detected. It's probably nothing, but if they're giving that kind of information out about their policies... I was urged to email "complaints@officedepot.com" with my concerns.

I inspected the coupon I used a bit more, too.
The coupon is comprised of 4 different images. Guess what? All images reside at www.officedepot.com. They are:
http://www.officedepot.com/images/promo/pages/30_Off_Coupon_Page.gif
http://www.officedepot.com/images/promo/pages/20_Off_Coupon_Page_09.gif
http://www.officedepot.com/images/promo/pages/20_Off_Coupon_Page_10.gif
http://www.officedepot.com/images/promo/pages/20_Off_Coupon_Page_13.gif

So apparently some third-party hacked OfficeDepot.com, posted some official-looking graphics, and modified a web page at officedepot.com to pull all the graphics together. Then, the bandit posted the URL all over the Internet.

The ONLY THING that Office Depot has going for them is the fact that the customer service people were quite polite. I don't think they were necessarily trying to deceive me. Rather, I suspect some significant communications problems within the organization. And some bad programming on the part of the developers of OfficeDepot.com.

Exporting and importing groups with Avant Browser

I use Avant Browser on multple systems. While it offers the ability to import groups, it appears to only supoprt "CaptorGroup files" (*.cgp). And there's no built-in way to export a group or groups. Sometimes, I need to get groups from one system onto another. Since Avant Browser stores groups in a "groups.dat" file located in <%userprofile%\Application Data\Avant Browser\>, I can just grab the group or groups I need out of groups.dat, save them to an intermediate file, ensure that the "G" value is unique for the target system, and append the group or groups to the groups.dat file on the target system.

A sample section from groups.dat looks like the following. The aforementioned "G" value is "G10" below.
[G10]
Title=GroupName
NAME1=Url Name 1
LINK1=http://www.website1.com/index.htm
NAME2=Url Name 2
LINK2=http://www.website2.com/index.htm

Avant Browser

For a little over a month now, I've been using "Avant Browser" - a "wrapper" of sorts around Internet Explorer. I saw it, got curious, and tried it. I suppose Firefox can do much of the same (or more, depending on extensions), but I just like the way Avant Browser does things. One thing I really find useful is the "Groups" function - take a bunch of websites, throw them in a Group, and then you can open one or all of the sites in the group. It's a bit like "Favorites, evolved". I used to set up batch files that would spawn 20-30 web pages each in its own instance of iexplore.exe. That was slow and tedious to maintain. Avant Browser makes it easy. There are plenty of other features as well, but I'm sure it's been covered in depth elsewhere. It works, and that's all there is to it.

Rootkits in 2005

James Butler and Sherri Sparks have some articles on SecurityFocus.com about Windows Rootkits...

Windows rootkits in 2005, part one
http://www.securityfocus.com/infocus/1850

Windows rootkits in 2005, part two
http://www.securityfocus.com/infocus/1851

Wrong file, ASP.NET. Thanks anyways.

The other day, on a test server, ASP.NET was giving the following message:

Description: An error occurred during the compilation of a resource required to service this request. Please review the following specific error details and modify your source code appropriately.

Compiler Error Message: CS0016: Could not write to output file 'c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\somepath\10d62725\cb6c7d34\k_kdx1bc.dll' -- 'Access is denied. '

Of course, it wasn't quite that simple. There was no problem accessing that folder, as FILEMON from Sysinternals verified when I set the filter to "Temporary ASP.NET Files". So I then set the filter to CSC.EXE, and noted that it was failing with ACCESS DENIED on C:\Windows\Temp\RES6.TMP running under NT AUTHORITY\NETWORK SERVICE. In the C:\Windows folder, there was a TEMP folder, and a TEMP.DELETETHIS folder. The ACL on the TEMP.DELETETHIS folder had an ACE for NETWORK SERVICE, but the ACL on the TEMP folder did not. The creation date of the new TEMP folder was roughly 1 week ago. So it appears that the installation of ASP.NET added an ACE on the original TEMP folder that would allow ASP.NET / NETWORK SERVICE to do what it needed to do. However, when someone decided they wanted a new TEMP folder on the server, the new TEMP folder inherited the permissions from WINDOWS and as such an ACE for NETWORK SERVICE was not placed on the new folder. Renaming TEMP to TEMP.HOLD and renaming TEMP.DELETETHIS back to TEMP solved the problem. Definitely an argument for better change control on the servers, as well as potentially further restricting access. But much of that is beyond my control...

At any rate... the first hit in a google for CS0016 takes you to the MSKB which almost nails it on the head, but in this case winds up kind of bending the nail so you have to take the hammer and try to pound the nail upright again, and then... er... nevermind.

An Assembly is a Page?

I spent the better part of the day chasing down what was ultimately a check-box in Internet Explorer's Advanced options. Blech.

The problem was that IE was failing to load a user control, and not being very helpful in determining why the control wouldn't load.

The control would load properly using HTTP, but would fail under HTTPS. Sysinternals' Filemon and Regmon showed no anomalous behavior. Debugging with cordbg wasn't particularly useful - the information wasn't really pointing me anywhere. The IEHOST log file (http://support.microsoft.com/?kbid=313892) didn't provide much more than the fusion log, which contained:
*** Assembly Binder Log Entry (xx/yy/zzzz @ aa:bb:cc QM) ***

The operation failed.Bind result: hr = 0x80070002. The system cannot find the file specified.

Assembly manager loaded from: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll
Running under executable C:\Program Files\Internet Explorer\iexplore.exe
--- A detailed error log follows.

=== Pre-bind state information ===
LOG: Where-ref bind. Location = https://localhost/path/assemblyname.dll
LOG: Appbase = https://localhost
LOG: Initial PrivatePath = bin
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = NULL
Calling assembly : (Unknown).
===

LOG: Processing DEVPATH.
LOG: Policy not being applied to reference at this time (private, custom, partial, or location-based assembly bind).
LOG: Attempting download of new URL https://localhost/path/assemblyname.dll
LOG: All probing URLs attempted and failed.

And yet the IIS log was showing that the assembly was being requested and returned successfully to the client.

Eventually, I encountered the following KB article:"How to run a user control assembly that is hosted on Internet Information Services (IIS) in Internet Explorer"
http://support.microsoft.com/?kbid=892466
which states:

"To successfully download a user control under these conditions, the client setting for the Do not save encrypted pages to disk setting must be cleared."

Simply clearing that check box allowed IE to download and instantiate the control.

Grumble.

Linksys - Linksux?

Linksys won't replace my BEFCMU10 cable modem even though Tech Support led me on with talk of a 1-time replacement (out of warranty replacement). The modem is nearly 3 years old, but why even mention the 1-time replacement deal if it's only something they do for 30 days after the one-year warranty expires? Linksys seemed very disorganized - like customer service didn't know what tech support was doing, and vice versa. Not impressed. Also not impressed when I asked the best way to dispose of the modem. Though she later admitted she didn't know what was in the modem, she suggested that I should just put it out with the garbage.

http://forums.cable-modem.net/index.php?action=vthread&forum=1&topic=253

Hmmm... Cisco. Doesn't Cisco own Linksys?
"Ultimate disposal of this product should be handled according to all national laws and regulations"

From Motorola SB5100 manual:
"Recycling your Motorola Equipment
Please do not dispose of this product with your residential or commercial waste. Some countries or regions, such as the European Union, have set up systems to collect and recycle electrical and electronic waste items. Contact your local authorities for information about practices established for your region. If collection systems are not available, call Motorola Customer Service for assistance."

Apparently, Linksys makes cable modems that are environmentally friendly.

Yeah, right.

Free Visual Studio Express until Nov. 7, 2006

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=126606&SiteID=1
Microsoft has made the Visual Studio 2005 Express editions free for one year!
From the above link are links available to download:
Visual Web Developer 2005 Express
Visual Basic 2005 Express
Visual C# 2005 Express
Visual C++ 2005 Express
Visual J# 2005 Express
SQL Server Express

Download them before November 7, 2006, and they're free to use forever.

Very Bad Things...

Whoa... Ran across this a while ago, and again just this AM. But the first time I saw it was too late.
"When you restart a computer that is running Windows Server 2003 or Windows 2000 Server, the computer stops responding, or the "Applying computer settings" screen appears for longer than you expect"
http://support.microsoft.com/?kbid=905716

Ran into a system where we could not install a service using the Win32 API CreateService (API would hang). We were also unable to delete a service using DeleteService. Tried various techniques to troubleshoot the problem, but the system wasn't even able to shutdown gracefully. Thought there might be a virus so we had the admin of the system run a scan. Nothing turned up. Wound up trying INSTSRV from the Resource Kit. That too would hang. But I used Dr. Watson to get a memory dump of the process and analyzed it in WinDBG to verify that it, too, was hanging in CreateService. We thought that perhaps there was something installed on the system that was causing some sort of a conflict, so we tried to stop a number of services on the system. Amazingly, none of the services would stop - they would get into a state of "Stopping", and stay there. Customer said they had other problems with the system, too, and were considering replacing it. So we didn't do anything more with the system. But one of the services I noted on the system that would have problems from time to time was "APCPBEAgent" (referenced in the above KB article) - it would sometimes remain in a state of "Starting" for 5+ minutes. I suspect that the problems with the system were a direct result of the issue outlined in the KB article.

CAUSE
This problem occurs because of a problem with version 6.x of APC PowerChute Business Edition Software. APC has issued the following official statement about this issue:

The APC 6.x software uses Sun Microsystems Java Cryptography Extension(JCE) 1.2.1 Package. The digital certificate that was used to sign the JCE 1.2.1 jar files expired on July 27, 2005. Because of this, the system causes the above detailed symptoms.

Yuck.

Nematodes

http://www.eweek.com/article2/0,1895,1867317,00.asp

Interesting story on a potential "alternative" use of computer worms for "good" rather than evil.

"He [Dave Aitel] said nematodes can be automatically created from available vulnerability information and even showed off a new programming language to create the worms."

Not sure this is the way of the future, but...

Sony in a DRM pickle?

http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
Looks like Mark Russinovich (Sysinternals) has found a DRM protection scheme that hides itself using techniques commonly exhibited by rootkits. There are a number of interesting issues raised around this matter...

Unexpected behavior with FindFirstFile...

Recently, a developer was experiencing some odd behavior with MFC's CFileFind class. It seems that it was returning files that didn't match the wildcard pattern specified. The code was something like:
CFileFind finder;
BOOL bWorking = finder.FindFile( "0011????????.xxx" );
while( bWorking )
{
        bWorking = finder.FindNextFile();
        // ...
}

CFileFind uses the Win32 functions FindFirstFile and FindNextFile. After working with various variations on filenames that (to some extent) match the specified pattern, I was able to determine that files with a name of 00117777.xxx were being matched. OK... the doc on MSDN for FindFirstFile MSDN states:
The search includes the long and short file names.

This gave me an idea. I created about 1000 files in the same directory, with a name generated from a format string like 4454%08x, and tested with my sample program. I got some hits in the search for 0011????????.xxx! Turns out, Windows was creating 8.3 filenames for these files, and the generated 8.3 filenames were like 0011d4~1.xxx. The "false positives" were files which had short file names that matched the desired pattern.

The developer is unable to rely solely on the results of the FindNextFile call, and he has to do a sanity check to make sure that every file that CFileCind indicates is a match, is truly what he's looking for.