A "BlueScreen" control for ASP.NET???

I noticed the following post by "LennyBacon":
"Please Wait - Building a WaitScreen control for ASP.NET "

I had to read the title three times before I realized it wasn't a "BlueScreen control for ASP.NET".

Hey - that's maybe not such a bad idea - a BSOD .NET System.Web.UI.UserControl class! Something in the vein of Sysinternals' "BlueScreen Screen Saver" perhaps...

A project for a rainy day, I suppose...

USB Support in VMWare

This is probably covered in all kinds of documentation - release notes, read-me's, etc. While VMWare does support USB devices, it appears that only USB 1.1 is supported in the guest despite the fact that the host may support USB 2.0. VMWare KB article "Performance of Isochronous USB Devices in Workstation 5 Windows Virtual Machines" alludes to this...

I don't use USB devices with VMWare that much, but it's good that VMWare supports USB even if it's only 1.1.

"Insufficient System Resources Exist to Complete the API"

[Microsoft has made the fix for this problem generally available. More info here...]

My primary system is a laptop. My schedule typically doesn't offer the ability to have long "computing" sessions. Rather, I get 10 minutes here, 15 minutes there, etc. As such, I find hibernation to be indispensable. Open the lid, hit the button, and in under a minute, I'm back to where I last left off. After upgrading from 512 MB RAM to 1280 MB, I started having problems hibernating - I would close the lid on the laptop and if I walked by it several minutes later the power light would be slowly fading on and off, indicating that the computer was in "standby" rather than hibernating. Resuming the system would yield a black exclamation point inside of a yellow triangle in the Systray, with a bubble stating "Insufficient resources exist to complete the API."

Of course, this was less than useful. What API? What type of system resources? One could surmise the API to be PowrProf's SetSuspendState, but what about the resources? Process Explorer didn't show any process to be using anything more than one would expect it to (no NP pool hogs, no apparent handle leaks, etc). After this happened, "hibernate" would not be available as a "shut down" option. Only after rebooting would the option to hibernate become available again. And hibernate would work for a few days after a reboot. But then the little yellow triangle would pop up, and I'd have to reboot to get the hibernation function working again.

I finally got frustrated enough by this to start looking around on the Internet for people with similar problems. I ran into two discussions (here and here) about the problem, and the scenarios described often had several similarities to my scenario. Among them:

• dealing with a "large" quantity of RAM (>512 MB)
• using "large"/hoggish programs (Outlook, VMWare, Visual Studio .NET, etc)

After weeding deep enough through the discussions, I found a link to a Microsoft Knowledge Base article - "The computer occasionally does not hibernate and you receive an "Insufficient System Resources Exist to Complete the API" error message in Windows XP with Service Pack 2, in Windows XP Tablet PC Edition 2005, or in Windows XP Media Center Edition 2005".

The article exactly described my problem, and indicates the presence of a hotfix. The downside:

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows XP service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix.

Of course, I'm severely affected by this problem. The batteries drain faster when the computer doesn't hibernate. Many people have stuffed their computer into bags / cases, thinking that they were hibernating. Imagine their surprise to find the system ready to cook eggs when they take the computer out of the bag, because the system was on (in "standby"), enclosed in a padded, tight case.

So, it looks like I'll have to try to get the patch from MS PSS. We'll see what happens...

Installing .NET Assemblies into the GAC

Junfeng Zhang has a good description of GAC Assembly Trace References. I find it interesting that an assembly that has been placed in the GAC by Windows Installer cannot be removed unless the application that placed the assembly in the GAC is uninstalled. If one tries to remove an assembly from the GAC that was installed by Windows Installer with GACUTIL (gacutil -u assemblyname), GACUTIL reports:

Unable to uninstall: assembly is required by one or more applications
Pending references:
SCHEME: <WINDOWS_INSTALLER> ID: <MSI> DESCRIPTION : <Windows Installer>

Number of items uninstalled = 0
Number of failures = 0

If one uses the Explorer Shell Extension for %windir%\Assembly, it
reports:

Assembly 'assemblyname' could not be uninstalled because it is required by other applications.

Troubleshooting SetupAPI.log

I've been tasked with creating an installation program that handles installing some drivers in anticipation that a certain piece of hardware will be connected to the computer. The objective is to automate as much of the driver installation and subsequent driver selection as possible, with the ideal goal being that the user doesn't have to do anything other than run the program and then connect the device.

Should be pretty simple. But given that I'm not versed in the Windows Installer technology, and InstallShield is as foreign as Baklava to me... Let's just say that I'm learning a lot. The initial cut of drivers (from a 3rd party, also responsible for the device) wasn't signed so there wasn't much I could do on XP / Server 2003 to make the process totally automated. But I got things as streamlined as possible. Then, out of the blue, and kind of in a fit of irony, we "magically" got signed drivers. The changes to the installation procedures were moderate (new files, new file names, fewer drivers, etc). But the recommended installation steps (provided by the 3rd party) were more tedious. After much trial and error, I've got things to the point again that there is nothing that the user needs to do other than run the program and plug the device in. The only problem is that the results are inconsistent - sometimes the driver appears to be associated with the device successfully, sometimes Windows says that I HAVE to reboot to get the driver / device working... and sometimes Windows says that there _may_ be a problem with the device. So it could be goofy drivers, or it could be a faulty device, or it could be...

All this led me down a path where I needed to know far more about the driver installation process than I suspected I would have to. But I found a great document at Microsoft's web site - "Troubleshooting Device Installation with the SetupAPI Log File". It's chock full of vitamins and information. I didn't have time to digest the full document, but I immediately noted the section "Appendix A: Setting the SetupAPI Logging Level". I skimmed and found that I could set [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogLevel] to 0x2000FFFF. This will specify "that everything should be logged and that the log file should not be flushed to disk after each message is written" (to %windir%\setupapi.log). So I set the registry value and ran the installation program, and plugged the device in. Windows detected the device, found the driver, did it's magic... and reported that Windows needed to be rebooted (desipte the fact that I could begin using the device immediately). I opened setupapi.log and indeed all kinds of stuff was logged, including an entry toward the end that indicated the system would need to be rebooted because of an "unknown reason". The following excerpt is from the setupapi.log:

@ 15:40:40.775 #V282 Add Service: Modified existing service "SERVICENAME".
@ 15:40:40.785 #T214 Install Device: Writing driver descriptive registry settings.
@ 15:40:40.785 #T216 Install Device: Restarting device.
@ 15:40:40.955 #T217 Install Device: Restarting device completed.
@ 15:40:40.985 #W165 Device "USB\VID_XXXX&PID_XXXX\XXXXXXXXXXXXX" required reboot: Device not started (unknown reason).
@ 15:40:40.985 #T222 Install Device: Calling 'RUNONCE'/'GRPCONV' items.
@ 15:40:40.995 #I121 Device install of "USB\VID_XXXX&PID_XXXX\XXXXXXXXXXXXX" finished successfully.
@ 15:40:40.995 #T201 Install Device: End.
@ 15:40:40.995 #V156 Completed default installer.
@ 15:40:40.995 #V166 Device install function: DIF_NEWDEVICEWIZARD_FINISHINSTALL.
@ 15:40:41.005 #V155 Executing default installer.
@ 15:40:41.005 #V156 Completed default installer.

So either the driver's goofy or the device has issues. We don't really have control over either of them (3rd party), so there's not much that can be done in this particular case. But at least it seems I'm able to accomplish the ideal scenario if the device and the drivers behave properly.

Another interesting tidbit from the "Troubleshooting Device Installation with the SetupAPI Log File" document, again relating the the "LogLevel" registry setting:

Caution
Do not use 0xFFFFFFFF. This level turns on all logging, which results in an unreadable log file and some very slow installations.

Optimization for running VMWare VMs from a USB or other slow storage device

I love VMWare. Great product, innovative company. Recently had a minor problem after upgrading from Workstation 5.0 to 5.5, and wound up searching VMWare's knowledge base. Though I wasn't looking for this type of information at the time, I ran across an article that details a change one can make to a VM's configuration (.vmx) file that might improve performance. I haven't tried this yet, but plan on it the next time I have to move my VMs off of my laptop HD to an external HD (or *GULP* a network drive - yeah, yeah - I know).

Basically, VMWare uses a file in the VM's directory as a memory swap file. USB devices read and write data more slowly than internal HDs. So, VMWare uses a swap file on the USB device, and performance suffers. The suggested fix is to add the following setting to the VM's .vmx file:

mainMem.useNamedFile=FALSE

This tells VMWare to use the host system's HD to store the swap data.

The VMWare KB article is "Virtual Machine on USB or Other Slow Storage Device Runs Slowly".

"A principle terrain must be truth to aquire the state of a physical printer"

I've always liked this kind of thing. Over at Channel 9 on MSDN, they've got a "Knowledge Base Machine Translation Examples" wiki. The articles are RE-machine-translated back to English, so they're perhaps a bit worse than they would be if they'd only been machine-translated once.
Still, statements like the following are good fun:

A principle terrain must be truth to aquire the state of a physical printer

You show error 17803, if you execute a SORT- on a computer which has physical RAM multiple GB from SQL Server possesses,, or a CREATE INDEX operation on a computer,, which has physical RAM multiple GB from SQL Server possesses.

You engineers slogan are researching a resolution for this problem, which was denoted from user like you.

If it's an internal error, why am I seeing it? 42

I don't know that this needs much commentary. Name distorted to protect the guilty.

.NET Framework 2.0 Configuration Tool, Part 2

See part 1 or part 3 of this topic...


OK... Last week Shawn Farkas (MS) blogged in the ".Net Security Blog" about "Which Package are the Security Tools In?" for the .NET Framework 2.0. In that post, he states they're in the SDK package, which was discussed previously. No direct reason is given, but in one comment an individual notes that GACUTIL is also not part of the redistributable package as was the case with the .NET Framework 1.1. To this, Shawn replies that "GAC administration is not an end-user scenario". One can consider that similar reasoning was applied to the moving of the .NET Framework 2.0 Configuration Tool from the redistributable package to the SDK. Still, the tools are at the least handy for troubleshooting and I can easily envision many cases where I will be wishing I had them available without having to install the SDK on another system.

Diagnosing DCOM Problems

Looks like Windows XP SP2 and Windows Server 2003 (possibly only with SP1?) have added capabilities for logging information about DCOM activation failures and call failures. The document "Changes to Functionality in Microsoft Windows XP Service Pack 2" at http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6-8364-685b84158c78&displaylang=en contains information about (among many other things!) the registry settings required to control the additional logging:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"ActivationFailureLoggingLevel"=dword:00000001
"CallFailureLoggingLevel"=dword:00000001

Setting the values to 0 turns the logging off. For the change(s) to take affect, the DCOM server needs to be restarted. This may require rebooting the system, depending on what the DCOM server is.

The settings cause the following types of messages to be logged to the System event log.

The machine wide limit settings do not grant Remote Access permission for COM Server applications to the user NT AUTHORITY\ANONYMOUS LOGON SID
(S-1-5-7). This security permission can be modified using the Component Services administrative tool.

The machine wide limit settings do not grant Remote Activation permission for COM Server applications to the user NameSamCompatible SID ({sid}). This security permission can be modified using the Component Services administrative tool.

This allows one to determine what permissions need to be added to what accounts.

A knowledge base article that also documents these registry settings is:

Programs that use DCOM do not work correctly after you install Microsoft Windows Server 2003 Service Pack 1

.NET Framework 2.0 Configuration Tool

See part 2 or part 3 of this topic...

ACK! What was Microsoft thinking? The .NET Framework 2.0 configuration tool (MSCORCFG.MSC Management Console) doesn't ship as part of the .NET Framework. Rather, it comes with the .NET Framework 2.0 SDK.

http://msdn2.microsoft.com/en-us/library/2bc0cxhc.aspx

In the .NET Framework versions 1.0 and 1.1, Mscorcfg.msc is installed with the .NET Framework redistributable package. Starting with the .NET Framework 2.0, Mscorcfg.msc is installed with the .NET Framework SDK.

This is a change from the .NET Framework 1.0 and 1.1, where the installation of the Framework put shortcuts in "Administrative Tools" for "Microsoft .NET Framework 1.1 Configuration" and "Microsoft .NET Framework 1.1 Wizards" for the .NET Framework 1.1, and similarly named tools for 1.0.
Sure, there are command-line tools that one can use to do much of the same things, but why remove the UI? The only thing I can think of is that if something's not there, someone can't play with it. But even if the Framework install lays down mscorcfg.msc, it wouldn't have to install a shortcut to it - that right there would probably keep 99% of the people away from the program. If someone needed it and knew it was there, they could browse to it and run it.

Seems odd. I hope to be able to do a bit more digging to find out why this tool isn't included as part of the base Framework install.

Process Explorer 10!

A new version of Process Explorer from Sysinternals was released! Version 10.02 is a major upgrade and has a bunch of new features. Details and download (FREE!) are at:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

Can't wait for Process Monitor!

"Protecting against Pointer Subterfuge"

Michael Howard has a good post about "Protecting against Pointer Subterfuge" and he introduces some functions that are new to Windows XP SP2 and Windows Server 2003 SP1:
EncodePointer and DecodePointer
EncodeSystemPointer and DecodeSystemPointer

"Root Kit" by "Patch Me Up"

Whoa.
This is over the top.
Words can't do it justice.
You just have to see it.
http://video.google.com/videoplay?docid=9151435244001559688
Insane.

#import - undocumented attribute "no_function_mapping"

I've been working with a rather complex library of 3rd party COM components. One type-library is imported and there are a total of about 3,000 methods. As a result of what I presume to be the 3rd party not adhering to one of "The Rules of COM 101" ("published interfaces are immutable"), I'm kind of in a situation where I need to modify the code generated by the #import (the .tli file, at least).

I #imported the type-library with about 10 attributes to generate the .tlh and .tli files. Then I commented out the #import directive and just #included the .tlh, which in turn #includes the tli. In my case, I needed to modify the .tli so that instead of using the hard-wired DISPIDs that the compiler brought in with the #import, IDispatch::GetIDsOfNames is called to determine the DISPID at runtime. Of course, doing this more than once per program execution isn't efficient, so I wound up creating a local static DISPID variable to hold onto the value, and then a local static bool initialized to false to be the flag that indicates if the DISPID needs to be determined or not. To be thread safe, I entered a critical section prior to testing the bool, and leave the critical section immediately after determining that I've got the DISPID (either in this run, or in a previous one).

One attribute that came in handy in the #import is an undocumented one, "no_function_mapping". This attribute is mentioned in the MS KB article "Description of the no_function_mapping compiler directive and the implementation_key compiler directive in Visual C++ .NET or in Visual C++ 2005". Basically, the "no_function_mapping" attribute is used to disable the "implementation_key" compiler directive, which is used when a type-library has more than 1000 methods. In my case, I didn't need the "implementation_key" (in fact, it kind of cluttered the code) but apparently in other cases it actually causes compiler errors (documented in the KB article).

I don't usually advocate changing compiler-generated code but in this case I made an exception as I plan on thoroughly documenting what I did as well as WHY I did it, and how the idea can be carried forward should additional or newer methods in the 3rd party library be required.

Kill 'em all!

Thanks, Visual Studio .NET 2003!

Good thing it's only the life of a process at stake...

I love the "Corrected Source" Code here...

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wcepbguide5/html/wce50grfPREfastWarning253.asp

This is golden:

Example
    Defective Source
        MmSecureVirtualMemory(NULL, 0, 0);

    Corrected Source
        // use something else

Connect to the console session on a server with Remote Desktop Client

Remote Desktop is a great feature, but sometimes you want to get to the console session on a remote system (rather than another, new session). The Terminal Services Console connection program (mstsc.exe) accepts some command line parameters, one of which is "console". This parameter allows you to connect to the console session on a server. If you run "mstsc /?", the "Usage" dialog displays, detailing more options.

Free GSX Server?

Rumor has it that VMWare may soon start giving away their "lower-end" server virtualization product, GSX Server, for free. A pretty bold move, to be sure, but I think that it well serve them well. If people like GSX server they may be more inclined to upgrade to the higher-end product, ESX server, which doesn't require a host operating system.

A new kind of password

http://clam.rutgers.edu/~lsobrado/graphicalpassword/
GraphicalPassword requires the .NET Framework 1.1. It's experimental, but an interesting concept. Your password is made up of specific icons. Many icons are presented and the idea is to find yours and click somewhere inside the perimeter created by extending imaginary lines out from your icons.

A corresponding article:
http://rutgersscholar.rutgers.edu/volume04/sobrbirg/sobrbirg.htm

Windows Kernel Patch Protection

Microsoft has a FAQ on Kernel Patch Protection for x64-based platforms running Windows Server 2003 Service Pack 1 and later.
http://www.microsoft.com/whdc/driver/kernel/64bitpatch_FAQ.mspx

COM+ 1.5 and 1.0

Ran into this today. Not horribly noteworthy but it can bite you if you blindly click through the COM+ application export wizard.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;873192
"You receive an "Error registering COM+ application" error message when you install an application proxy in COM+ 1.0"

"The Save application in COM+ 1.0 format – some properties may be lost option on the Application Export Information page must be enabled if you want to export your application proxy for COM+ 1.0. "

Windows XP and Windows Server 2003 run COM+ 1.5 and Windows 2000 runs COM+ 1.0.

Error installing Security Bulletin MS06-003

I was having a difficult time getting the security update that addresses the vulnerability referenced in Microsoft security bulletin MS06-003 (Vulnerability in TNEF Decoding in Microsoft Outlook and Microsoft Exchange Could Allow Remote Code Execution (902412)) to install. The event viewer showed the following:
Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 1024
Date: 1/10/2006
Time: 2:00:52 PM
User: DOMAIN\USERNAME
Computer: COMPNAME
Description:
Product: Microsoft Office Small Business Edition 2003 - Update 'Security Update for Outlook 2003 (KB892843): OLKINTLff' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support:
http://go.microsoft.com/fwlink/?LinkId=23127

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 39 31 43 41 30 34 30 {91CA040
0008: 39 2d 36 30 30 30 2d 31 9-6000-1
0010: 31 44 33 2d 38 43 46 45 1D3-8CFE
0018: 2d 30 31 35 30 30 34 38 -0150048
0020: 33 38 33 43 39 7d 20 7b 383C9} {
0028: 38 31 43 46 46 37 39 45 81CFF79E
0030: 2d 30 34 45 36 2d 34 31 -04E6-41
0038: 42 43 2d 42 34 46 41 2d BC-B4FA-
0040: 44 32 46 46 34 44 45 35 D2FF4DE5
0048: 38 41 31 35 7d 20 31 36 8A15} 16
0050: 30 33 03

I did some troubleshooting. Ultimately, the problem wound up being that the "Office Source Engine" service had been disabled. Re-enabling the service allowed me to apply the patch successfully.

Error 1603, referenced in the event log message, is "Fatal error during installation."

Helpful.

Office Depot: A Dish Best Served Coldly

I had a bad experience with Office Depot.

This all may seem kind of piddly, but it's frustrating and quite frankly shouldn't have happened.

I've been around the block when it comes to technology deals. I tend to be rather frugal with my purchases. I take advantage of rebates. I'm persistent and will not let a rebate go unclaimed. So when I saw a KDS XF-9S 19in CRT monitor for $137.80 with a $100 rebate, my interest was piqued. I reviewed the rebate form (http://forms.young-america.com/31565_OD4802033-011106.pdf), and it seemed to be acceptable, although I didn't like the idea of waiting 60-90 days. Even better, Office Depot had a coupon for $30 off of an order of $150 or more. So for $12.20 more, I could save another $30. I added the monitor to the cart, and saw that others that had purchased the monitor had also purchased monitor wipes for $7.99, and screen cleaner for $4.99. This would add $12.98, bringing the order to $150.78. I added these items to the cart as well. With the coupon applied, the total would be $120.78, and after rebate everything would cost $20.78. Not bad, I thought.

So I had the shopping cart up with the three items and the coupon in it. Under the coupon was a phrase:"Coupon discounts will be applied during checkout. Click Here to see if you met your coupons criteria." The "Click Here" was a hyperlink. When I clicked on it, it indeed told me that the coupon was valid. From the shopping cart page, I clicked the "Checkout" button. From there, I entered my billing information and reviewed the order summary. The $30 coupon had been split up so that a portion of the $30 applied to each item. This was fine, as the Total was $120.78. I reviewed the rebate form one more time and didn't see anything extraordinary so I clicked the "PLACE ORDER" button that had "This will complete your order." under it.

I was taken to a "Thank you" page that summarized the order... for a total of $159.07. It looked like the coupon hadn't been applied! And tax had been added AFTER I was presented with a Total that I agreed to. I can handle sales tax I guess, though it SHOULD have been presented at the time of the order CONFIRMATION, rather than AFTER THE ORDER WAS PLACED. But there was no indication that the coupon was removed. So I had agreed to charges of $120.78, and was going to be charged $159.07. I didn't like where this was heading.

I called Office Depot's number. The people, while nice enough, insisted that they don't do coupons for technology items. I asked why the coupon showed up on their website, and I was told that third-parties often take advantage of their website and put bogus coupons on it. This seemed absurd, and I pressed the issue, especially since their OWN website VALIDATED THE COUPON and APPLIED THE COUPON TO THE ORDER TOTAL prior to submission. "After you submit the order, invalid coupons are removed." Where on EARTH does that seem like a good idea? And again, their website told me that coupon was, in fact, valid. Ultimately, I wound up cancelling the order, and requesting that they scrub all information pertaining to me and my order from all of their systems. If Office Depot can't even handle PROCESSING COUPONS in 2006, how on EARTH can I trust them to safeguard my personal information, including credit-card info? The woman I was speaking with started telling me things that I thought were a tad bit inappropriate to be disclosing, when I pressed her on this. She told me they did all kinds of things to ensure security, etc. But she went on to say that orders over a certain amount (she disclosed the amount) were processed more closely with the credit card company so fraud attempts would be detected. It's probably nothing, but if they're giving that kind of information out about their policies... I was urged to email "complaints@officedepot.com" with my concerns.

I inspected the coupon I used a bit more, too.
The coupon is comprised of 4 different images. Guess what? All images reside at www.officedepot.com. They are:
http://www.officedepot.com/images/promo/pages/30_Off_Coupon_Page.gif
http://www.officedepot.com/images/promo/pages/20_Off_Coupon_Page_09.gif
http://www.officedepot.com/images/promo/pages/20_Off_Coupon_Page_10.gif
http://www.officedepot.com/images/promo/pages/20_Off_Coupon_Page_13.gif

So apparently some third-party hacked OfficeDepot.com, posted some official-looking graphics, and modified a web page at officedepot.com to pull all the graphics together. Then, the bandit posted the URL all over the Internet.

The ONLY THING that Office Depot has going for them is the fact that the customer service people were quite polite. I don't think they were necessarily trying to deceive me. Rather, I suspect some significant communications problems within the organization. And some bad programming on the part of the developers of OfficeDepot.com.

Exporting and importing groups with Avant Browser

I use Avant Browser on multple systems. While it offers the ability to import groups, it appears to only supoprt "CaptorGroup files" (*.cgp). And there's no built-in way to export a group or groups. Sometimes, I need to get groups from one system onto another. Since Avant Browser stores groups in a "groups.dat" file located in <%userprofile%\Application Data\Avant Browser\>, I can just grab the group or groups I need out of groups.dat, save them to an intermediate file, ensure that the "G" value is unique for the target system, and append the group or groups to the groups.dat file on the target system.

A sample section from groups.dat looks like the following. The aforementioned "G" value is "G10" below.
[G10]
Title=GroupName
NAME1=Url Name 1
LINK1=http://www.website1.com/index.htm
NAME2=Url Name 2
LINK2=http://www.website2.com/index.htm

Avant Browser

For a little over a month now, I've been using "Avant Browser" - a "wrapper" of sorts around Internet Explorer. I saw it, got curious, and tried it. I suppose Firefox can do much of the same (or more, depending on extensions), but I just like the way Avant Browser does things. One thing I really find useful is the "Groups" function - take a bunch of websites, throw them in a Group, and then you can open one or all of the sites in the group. It's a bit like "Favorites, evolved". I used to set up batch files that would spawn 20-30 web pages each in its own instance of iexplore.exe. That was slow and tedious to maintain. Avant Browser makes it easy. There are plenty of other features as well, but I'm sure it's been covered in depth elsewhere. It works, and that's all there is to it.

Rootkits in 2005

James Butler and Sherri Sparks have some articles on SecurityFocus.com about Windows Rootkits...

Windows rootkits in 2005, part one
http://www.securityfocus.com/infocus/1850

Windows rootkits in 2005, part two
http://www.securityfocus.com/infocus/1851

Wrong file, ASP.NET. Thanks anyways.

The other day, on a test server, ASP.NET was giving the following message:

Description: An error occurred during the compilation of a resource required to service this request. Please review the following specific error details and modify your source code appropriately.

Compiler Error Message: CS0016: Could not write to output file 'c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\somepath\10d62725\cb6c7d34\k_kdx1bc.dll' -- 'Access is denied. '

Of course, it wasn't quite that simple. There was no problem accessing that folder, as FILEMON from Sysinternals verified when I set the filter to "Temporary ASP.NET Files". So I then set the filter to CSC.EXE, and noted that it was failing with ACCESS DENIED on C:\Windows\Temp\RES6.TMP running under NT AUTHORITY\NETWORK SERVICE. In the C:\Windows folder, there was a TEMP folder, and a TEMP.DELETETHIS folder. The ACL on the TEMP.DELETETHIS folder had an ACE for NETWORK SERVICE, but the ACL on the TEMP folder did not. The creation date of the new TEMP folder was roughly 1 week ago. So it appears that the installation of ASP.NET added an ACE on the original TEMP folder that would allow ASP.NET / NETWORK SERVICE to do what it needed to do. However, when someone decided they wanted a new TEMP folder on the server, the new TEMP folder inherited the permissions from WINDOWS and as such an ACE for NETWORK SERVICE was not placed on the new folder. Renaming TEMP to TEMP.HOLD and renaming TEMP.DELETETHIS back to TEMP solved the problem. Definitely an argument for better change control on the servers, as well as potentially further restricting access. But much of that is beyond my control...

At any rate... the first hit in a google for CS0016 takes you to the MSKB which almost nails it on the head, but in this case winds up kind of bending the nail so you have to take the hammer and try to pound the nail upright again, and then... er... nevermind.

An Assembly is a Page?

I spent the better part of the day chasing down what was ultimately a check-box in Internet Explorer's Advanced options. Blech.

The problem was that IE was failing to load a user control, and not being very helpful in determining why the control wouldn't load.

The control would load properly using HTTP, but would fail under HTTPS. Sysinternals' Filemon and Regmon showed no anomalous behavior. Debugging with cordbg wasn't particularly useful - the information wasn't really pointing me anywhere. The IEHOST log file (http://support.microsoft.com/?kbid=313892) didn't provide much more than the fusion log, which contained:
*** Assembly Binder Log Entry (xx/yy/zzzz @ aa:bb:cc QM) ***

The operation failed.Bind result: hr = 0x80070002. The system cannot find the file specified.

Assembly manager loaded from: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll
Running under executable C:\Program Files\Internet Explorer\iexplore.exe
--- A detailed error log follows.

=== Pre-bind state information ===
LOG: Where-ref bind. Location = https://localhost/path/assemblyname.dll
LOG: Appbase = https://localhost
LOG: Initial PrivatePath = bin
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = NULL
Calling assembly : (Unknown).
===

LOG: Processing DEVPATH.
LOG: Policy not being applied to reference at this time (private, custom, partial, or location-based assembly bind).
LOG: Attempting download of new URL https://localhost/path/assemblyname.dll
LOG: All probing URLs attempted and failed.

And yet the IIS log was showing that the assembly was being requested and returned successfully to the client.

Eventually, I encountered the following KB article:"How to run a user control assembly that is hosted on Internet Information Services (IIS) in Internet Explorer"
http://support.microsoft.com/?kbid=892466
which states:

"To successfully download a user control under these conditions, the client setting for the Do not save encrypted pages to disk setting must be cleared."

Simply clearing that check box allowed IE to download and instantiate the control.

Grumble.

Linksys - Linksux?

Linksys won't replace my BEFCMU10 cable modem even though Tech Support led me on with talk of a 1-time replacement (out of warranty replacement). The modem is nearly 3 years old, but why even mention the 1-time replacement deal if it's only something they do for 30 days after the one-year warranty expires? Linksys seemed very disorganized - like customer service didn't know what tech support was doing, and vice versa. Not impressed. Also not impressed when I asked the best way to dispose of the modem. Though she later admitted she didn't know what was in the modem, she suggested that I should just put it out with the garbage.

http://forums.cable-modem.net/index.php?action=vthread&forum=1&topic=253

Hmmm... Cisco. Doesn't Cisco own Linksys?
"Ultimate disposal of this product should be handled according to all national laws and regulations"

From Motorola SB5100 manual:
"Recycling your Motorola Equipment
Please do not dispose of this product with your residential or commercial waste. Some countries or regions, such as the European Union, have set up systems to collect and recycle electrical and electronic waste items. Contact your local authorities for information about practices established for your region. If collection systems are not available, call Motorola Customer Service for assistance."

Apparently, Linksys makes cable modems that are environmentally friendly.

Yeah, right.