Format Factory Media Converter is a terrific tool for converting file formats

I’ve had a need at various times to convert files from AVI to MPEG, WMV to MPG, MPG to MOV, and today, WMV to MPEG4.  Format Factory’s Media Converter does this FOR FREE!

Today I needed to convert a WMV file to MPEG4 for iPhone.  Besides all the formats listed above, it lets you convert from “All to Mobile Device.”  I picked the iPhone as the device and the file converted perfectly.

I’ve been using Media Converter for years and I love it.

http://www.formatoz.com

Advertisement

Gray “X’s” when navigating network shares

I had a user getting grey X’s when accessing a network share.  I tried some of the standard fixes including trying to get to other mapped drives, the internet, logoff-logon.  Nothing worked.  I started searching and found this post from SevenForums.  I tried it and it worked…

Windows 7 Imaging Product Key Error Message

I am using Microsofts imaging (Imagex.exe) tools to set up Windows 7 Machines.  I have switched between Enterprise and Professional versions of Windows 7.  It turns out the imaging tools don’t like that.

If you get error “the product key entered does not match any of the Windows images available for installation” Go to the ei.cfg file in installation files and change the version from Enterprise to Professional or other way around.

Blackberry Trackball Repair in NYC

I came across an article in Business Week today about the nightmare that is the Blackberry trackball.  They are the #1 problem that leads to device replacements in my experience.  According to Business Week, market research firm iSuppli predicts the trackball will be gone by 2013.  I like the sound of that.  But for now, if you’ve got a track ball problem in NYC, you might want to visit Tony Nafchti of fixyourberry.com.

I went head to head with a version of the “Internet Security 2010” virus. (SMSS32.exe)

My machine got infected with a version of the “Internet Security 2010” virus.  It was a nasty little critter.  I’ve seen it a bunch of times over the years.  It keeps getting smarter and smarter.  It used be possible to remove it by killing the process it started and deleting the files.  Now, there’s a lot more steps.  

The virus came from clicking on a link on a mainstream website.  McAfee popped up right away and said it caught two files (warning.html and IS2010.exe).  Unfortunately that didn’t matter.  The virus installed itself and McAfee proved once again that it’s a useless piece of crap.  Here’s what I did to get rid of it.

I first tried getting “Task Manager” to pop up.  That wouldn’t work.  I checked the folder that the virus created in program files (c:\Program Files\Internet Security 2010).  It was empty.  That’s probably because the IS2010 file was deleted by McAfee.  I shut the machine down and restarted.  The “Task Manager” item was grayed out.  I tried launching it by typing in taskmgr.exe.  Windows popped up a message stating that Task Manager was disabled.  I knew that it was something I could fix in the local group policy editor.  I ran gpedit.msc and enabled it.  Instructions are here.

Method 4:  Using Group Policy Editor – for Windows XP Professional

• Click Start, Run, type gpedit.msc and click OK.
• Navigate to this branch:

User Configuration / Administrative Templates / System / Ctrl+Alt+Delete Options / Remove Task Manager

• Double-click the Remove Task Manager option.
• Set the policy to Not Configured.

It says that you can set it to “Not Configured.”  In my case it was already set that way.  I set it to “Disabled.”  I had to reboot the machine a couple times before the virus was cleaned up.  Task Manager was disabled every time.  Switching between “Not Configured” and “Disabled” seems to be good enough.

I then tried to run Task Manager.  The virus itself would pop up an error saying that’s not allowed.  I found instructions saying that if I hit cntl-shift-esc over and over Task Manager will pop up.  That worked!!!

Follow these instructions to continue:

1. Open Task Manager by continually pressing Ctrl+Shift+Esc.
2. Navigate to the Processes tab.
3. Locate for the processes called IS2010.exe, winlogon86.exe, winupdate86.exe and 41.exe. End their processes one at a time by click the End Process button at the bottom left hand corner of Task Manager and click Yes.
4. Continue with the instructions listed below to remove Internet Security 2010 completely.

I didn’t have any of those files running in Task Manager, Processes, so I looked for those files in c:\Windows\System32.  I found some of the files there and deleted them.  I also saw a file called “winlogon32.exe.”  It didn’t look right, so I checked it out.  I found out that file was a virus, so I deleted it.  Big Mistake….Sorta.  I decided to install MalwareBytes and then reboot in Safe Mode to run it.  I rebooted into safe mode.  I logged into the machine.  It accepted the password and tried to load my profile, but it would just log itself right out.  I suspected that it had something to do with the file I deleted.  I tried to login in normal mode and had the same problem.  I found this site saying that the problem was either with the userinit.exe file or the registry entry that points to it. 

1. C:\WINNT\system32\userinit.exe , this file is corrupt or invalid or infected.
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit, This registry key is tempered by virus/spyware.

At this point I’m stuck with a machine that’s infected and I can’t log into it.  I tried to use an XP disk to repair it, but my drive is encrypted, so the repair disk couldn’t see the hard drive.  The other suggestion the site gave was accessing the registry from a remote machine.  That WORKED!!!  I went to another machine and ran regedit.  I then clicked on “File, Connect Network Registry” and inserted the name of my machine.  I was able to connect.  If the name doesn’t work for you, try the IP address.  I found that the registry key and it was incorrect. 

I found: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon | Userinit = “C:\WINDOWS\system32\winlogon32.exe”

I changed it to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon | Userinit = “C:\WINDOWS\system32\userinit.exe”

I rebooted and it worked.

So I got logged back into the machine.  At this point I had pinpointed most of the files that were causing the problem.  I knew not to mess with the winlogon file just yet.  I also know I needed to get MalwareBytes running ASAP.  I decided to run Task Manager again to see if I could find and kill “winlogon32.exe.”  Something better happened.  I hit cntl-shift-esc a few times to get Task Manager up.  The virus pops up an error saying something about the administrator disabling Task Manager.  Do not close the error!  I noticed that the error message was loaded as an “Application” in Task Manager.  I had a feeling that the application would lead me back to the “process” and it did.  I right clicked on the application and selected “Go to process.”  That took me to a file I previously hadn’t noticed called SMSS32.exe.  And that’s the key to this whole ridiculous incident.  I searched Google for SMSS32.exe and found this post from McAfee.  I killed the process and the virus finally stopped.  I then ran MalwareBytes.  It found a bunch of infected files and registry entries.  Here are the results:

Malwarebytes’ Anti-Malware 1.44
Database version: 3680
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.11

2/2/2010
mbam-log-2010-02-02 (16-16-43).txt

Scan type: Full Scan (C:\|)
Objects scanned: 268870
Time elapsed: 59 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 12
Folders Infected: 1
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\helper32.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\winlogon32.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\InternetSecurity2010 (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.IE5\C2XSPTAA\SetupIS2010[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BAD358BA-17F3-4527-AB8D-40D9BEF7514D}\RP533\A0065516.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BAD358BA-17F3-4527-AB8D-40D9BEF7514D}\RP533\A0066516.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BAD358BA-17F3-4527-AB8D-40D9BEF7514D}\RP533\A0071545.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\IS15.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\helper32.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\Winlogon32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\%username%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\%username%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\%username%\Start Menu\Internet Security 2010.lnk (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\41.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Here’s what I learned.  I’m posting this before the removal instructions because there are so many versions of this virus that your version of the virus might be different than mine.

• This version didn’t hijack my browser or search results.  That allowed me to easily download MalwareBytes.  I’ve seen other versions hijack the browser or search results.
• This version didn’t mess with the MalwareBytes installer.  Some versions of the virus will not run the installer.  You can run it if you rename it to something else.  (From mbam-setup.exe to somethingelse.exe).
• This version disabled Task Manager instead of just hijacking it.
• The core to this virus is still a process that can be killed in task manager.
• I’ve seen versions mess with Safe Mode.  One time I had to use “Last Known Good” to allow me to log into the machine.
• I’ve seen it prevent regedit from running.

Here are my instructions on dealing with this.  Their usefulness will vary depending on what you’re dealing with.

1. Don’t panic
2. Don’t reboot if you can avoid it because of the winlogon32.exe issue.
3. Right click the task bar and try to run task manager.  If that doesn’t work, hit control-shift-escape a few times until Task Manager comes up.  If Task Manager is disabled, type in gpedit.msc.  Navigatio to User Configuration / Administrative Templates / System / Ctrl+Alt+Delete Options / Remove Task Manager.  Double-click the Remove Task Manager option. Set the policy to Not Configured or Disabled.
4. Run Task Manager using the control-shift-escape method.  Don’t close any errors that pop up.
5. Go to Applications and look for any applications that look like they are the virus.  The application comes from the warning message, so it’s important to leave the warning message up.  In my case it was called “Warning.”
6. Right click on it and select “go to process.”
7. This will take you to the process that’s running the virus.  In my case it was SMSS32.exe.  Kill the process.
8. Download MalwareBytes and run it.
9. MalwareBytes should clean this thing up and you should be able to go on with your life.  If it doesn’t, then you either have a different version of the virus, or you missed a step, or something else is going on.

I hope this post helps people that are dealing with this virus.  Please post any questions and I’ll try to help.  I just cannot understand how the anti-virus companies can’t prevent people from getting infected.  I know of people using supposedly updated versions of McAfee and Kaspersky get infected.  I’m not surprised about McAfee.  It’s always been bloated garbage.  Good luck!

http://bytes.com/topic/windows/answers/752011-xp-logs-off-immediately-after-log/2#post3384974

http://www.bleepingcomputer.com/tutorials/tutorial44.html

http://community.mcafee.com/thread/20943

http://majorgeeks.com/download.php?det=5756

Duplicate Machine SID’s are not an issue except when they are an issue.

I came across an article on InfoWorld about a blog post from a Microsoft tech regarding Windows Machine SID’s and the myths that surround them.  The InfoWorld article is mostly fluff, but the blog post is well worth the read.  Basically, machines that are imaged without being sysprepped usually have the same machine SID’s.  It’s long been believed that this is a security issue.  It turns out that’s not the case.  Machines can be on the same network with the same SID”s if the machine is not already connected to a domain, not going to be promoted to a Domain Controller, and if there isn’t an application that reacts badly to it.  (The example given is applications that use the Machine SID as their own ID’s.)  The bottom line is that machines SHOULD BE SYSPREPED to prevent any known and unknown issues.  Also, Microsoft will not support machines that don’t have unique SID’s.  Sysprep is easy to run.  Don’t slack off just because it might not cause a problem.

The reason that I began considering NewSID for retirement is that, although people generally reported success with it on Windows Vista, I hadn’t fully tested it myself and I got occasional reports that some Windows component would fail after NewSID was used. When I set out to look into the reports I took a step back to understand how duplicate SIDs could cause problems, a belief that I had taken on faith like everyone else. The more I thought about it, the more I became convinced that machine SID duplication – having multiple computers with the same machine SID – doesn’t pose any problem, security or otherwise. I took my conclusion to the Windows security and deployment teams and no one could come up with a scenario where two systems with the same machine SID, whether in a Workgroup or a Domain, would cause an issue. At that point the decision to retire NewSID became obvious.

I realize that the news that it’s okay to have duplicate machine SIDs comes as a surprise to many, especially since changing SIDs on imaged systems has been a fundamental principle of image deployment since Windows NT’s inception. This blog post debunks the myth with facts by first describing the machine SID, explaining how Windows uses SIDs, and then showing that – with one exception – Windows never exposes a machine SID outside its computer, proving that it’s okay to have systems with the same machine SID. Note that Sysprep resets other machine-specific state that, if duplicated, can cause problems for certain applications like Windows Server Update Services (WSUS), so MIcrosoft’s support policy will still require cloned systems to be made unique with Sysprep.

You can read the full article here.

You should also read this follow-up post by Microsoft tech Aaron Margosis that explains the difference between Machine SID’s and Domain SID’s.  The key statement in his post: “So while it’s OK to clone a system before it joins a domain, doing so after it joins a domain (and is assigned a domain computer account and a corresponding domain SID) will cause problems.”

Where do the candidates stand on technology? Most of them won’t tell you.

It’s extremely important for IT guys and gals to understand where the candidates stand on technology issues.  I am going to link to each of their technology pages here.  Overall, I am disappointed with the lack of focus on technology.  The Democrats are much better than the Republicans.  All of the Democrats except Kucinich make a mention of technology or “innovation.”  Barack Obama is the only candidate to feature technology as an issue on his website.  Mitt Romney is the only Republican to have information about technology on his website, but it’s not an issues page.  I linked to it anyway.  Have a look:

Democrats

• Barack Obama: http://www.barackobama.com/issues/technology (Includes speech at Google)
• John Edwards: http://www.johnedwards.com/issues/innovation  (A few sparse comments) 
• Hillary Clinton: http://www.hillaryclinton.com/feature/innovation (Only a couple paragraphs)
• Dennis Kucinich: I can’t find anything obvious or through search.

Republicans

• Mitt Romney: http://www.mittromney.com/News/In-The-News/TechCrunch (Interview with TechCrunch) 
• Rudolph Giuliani: I can’t find anything obvious or through search.  Did somebody say 9/11?
• Mike Huckabee: I can’t find anything obvious or through search.
• Duncan Hunter: I can’t find anything obvious or through search.
• John McCain: I can’t find anything obvious or through search.
• Ron Paul: I can’t find anything obvious or through search.
• Fred Thompson: I can’t find anything obvious or through search.

Based on whether the candidates feature technology, Obama and Romney are the leaders for their party.  Obama is the only candidate to feature technology as an issue, so he is the leader.  If you can find information that should be added, let me know.

If you’re looking for a Blackberry alternative, look here:

Tom Yager of InfoWorld did an exhaustive review of the Blackberry 8300 and 8800, as well as several alternatives.  This is a great resource for anyone considering an alternative to Blackberry.

The Image Resizer Powertoy is very useful.

I constantly need to resize pictures and images for blogging or email purposes.  A colleague showed me a useful Microsoft Powertoy that’s going to save me lots of time.  The Image Resizer Powertoy is a simple installable program that integrates itself in the right click menus.  All you have to do is right click on an image and select “Resize Image.”  A menu pops up asking for the desired size.  Make your selection and the resized image is dropped in the same location.