IIS Hacks | Server and System Administration

Add Defragment to the Shell menu in Windows 7 / Vista

Chris Stinson — Wed, 10 Mar 2010 16:19:38 +0000

I find adding common tasks to the shell menu a great timesaver when I am running between stations. It is also easier to direct users to simply “right-click” on something rather than walk them through a maze of menus…or even have them find the “run” box.

Click Start -> type “regedit” in the Search command box.
Navigate to HKEY_CLASSES_ROOT\Drive\shell.
Right-click on “shell” and select New -> Key. Name it “runas” and set the default value to “Defragment”.
Right-click on “runas” and select New -> Key. Name it “command” and set the default value to “defrag %1 -v“.
If you ever wish to remove this functionality, just delete the “runas” key.

You can also paste the following into Notepad and save it as: RightClickDefragment.reg or you can download the zipped RightClickDefragment.reg here. Double-click on the .reg file and click “yes” when asked to enter it into the registry.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Drive\shell\runas]
@=”Defragment”

[HKEY_CLASSES_ROOT\Drive\shell\runas\command]
@=”defrag %1 -v”

CHM / HTML Help feature cannot be displayed in some programs

Chris Stinson — Mon, 08 Mar 2010 15:46:53 +0000

Although this particular problem has been around for some time, I am surprised at how many times I am asked about the solution. Many programs use an HTML help system that requires Internet Explorer and ActiveX to run (CHM – Compiled HTML Help). After security updates 896358 and 890175, some HTML content outside of the “local machine” zone was disabled. This would affect many network based programs or programs that connect to an outside server for HELP files. When accessing the Help system, an error saying “Page Cannot Be Displayed” would show up. Luckily the fix is easy.

In Notepad, copy and paste the code you need and name it “htmlhelpfix.reg” Then double-click on the file and click “YES” when it asks if you want to enter it into the registry.

Enable Local Machine, Local Intranet and Trusted Site Zones to display ActiveX HTML Help. This is the most commonly referred to fix – this is probably the one you want. You can also download the zipped htmlhelpfix.reg file here.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
“MaxAllowedZone”=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
“MaxAllowedZone”=dword:00000002

Enable Local Machine Zones to display ActiveX HTML Help. This is the default entry, you can use it to reset.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
“MaxAllowedZone”=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
“MaxAllowedZone”=dword:00000000

Enable Local Machine and Local Intranet Zones to display ActiveX HTML Help.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
“MaxAllowedZone”=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
“MaxAllowedZone”=dword:00000001

Enable Local Machine, Local Intranet, Trusted Site and Internet Zones to display ActiveX HTML Help.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
“MaxAllowedZone”=dword:00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
“MaxAllowedZone”=dword:00000003

Enable Local Machine, Local Intranet, Trusted Site, Internet and Restricted Zones to display ActiveX HTML Help. NOT RECOMMENDED!

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
“MaxAllowedZone”=dword:00000004

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
“MaxAllowedZone”=dword:00000004

Install the Windows Recovery Console in the Boot list

Chris Stinson — Mon, 01 Mar 2010 02:11:04 +0000

The Windows Recovery Console is required to fix many startup issues caused by malware, viruses, and corrupt system files. The Recovery Console can be booted from the Windows Setup disc, but many machines (including Netbooks) do not have CD drives or easy access to the Windows Setup disc.

Below are the instructions to install the Recovery Console on any Windows XP machine as a boot list option. You will no longer need physical access to the Windows Setup disc (except to install initially) when things go wrong.

Insert the Windows XP setup disc.
Click Start -> Run and type: “%windir%\i386\winnt32.exe /cmdcons“
Click YES on the Windows Setup box to install the Recovery Console.

Setup will attempt to connect to the Internet to update any setup files from the disc. Press ESC to interrupt the setup and use the files on the disc only.
Once the Recovery Console is installed a confirmation box will pop up. Click OK.

Some Windows XP passwords will not be recognized by the Recovery Console. To remove the password requirement, modify the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Setup\RecoveryConsole
Set the DWORD SecurityLevel value to 1.

Windows XP shuts down after login – PC-OFF.BAT

Chris Stinson — Thu, 25 Feb 2010 00:47:22 +0000

The PC-OFF.BAT virus loads a shutdown script when logging onto Windows XP. A few seconds after logging in, Windows will shutdown. This also affects safe mode. The countdown timer is set to only a few seconds, not allowing the user to enter “shutdown – a” in the run box. You may not even see the emergency shutdown dialog before you are automatically shutdown.

In order to remove the files, you’ll need the Windows XP CD. Other options include putting the hard drive into another computer, or using a LiveCD (BartPE or Linux) to remove the files.

Remove the files from your hard drive using the Windows XP CD

Insert the Windows XP disc into the CDROM. You may need to adjust your BIOS settings to boot the CDROM first.
When the “Welcome to Setup” screen appears, press “R.”
Select the installation you wish to access (there should be only one option for most systems).
Enter the administrator password when asked.
Once at the Recovery Prompt, press ENTER after typing the following command: chdir c:\windows
Press ENTER after typing the following command: del bar311.exe
Press ENTER after typing the following command: del password_viewer.exe
Press ENTER after typing the following command: del photo.zip.exe
Press ENTER after typing the following command: del pc-off.bat
Press ENTER after typing the following command: exit
Remove the Windows XP disc and restart your computer.

Once pc-off.bat is removed from the Windows directory, you’ll be able to logon to Windows without it shutting down immediately. There are still remnants left over in the registry though – best to clean those up.

Go to Start -> Run and type “regedit” and press ENTER.
Go to HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon and find the key: “Userinit=C:\WINDOWS\system32\userinit.exe,xxxxxx.exe” where xxxxxx.exe is bar311.exe, photo.zip.exe or password_viewer.exe.
Delete bar311.exe, photo.zip.exe or password_viewer.exe from the key, but be sure to leave userinit.exe! If you delete that, you will be unable to logon to Windows.
Go to HKEY_CURRENT_USER \software\microsoft\windows\currentversion\explorer\advanced and set the following key values: “Hidden=dword:00000001 (1)” “HideFileExt=Dword:00000000 (0)” “ShowSupperHidden=Dword:00000001 (1)”
Go to HKEY_CURRENT_USER \software\microsoft\Command Processor and find the key: “autorun=c:\windows\pc-off.bat” and remove “c:\windows\pc-off.bat”

Blue Screen (BSOD) with MS Patch 977165 caused by Alureon Rootkit

Chris Stinson — Tue, 23 Feb 2010 01:34:18 +0000

February’s Patch Tuesday was eventful to say the least. Many have noticed that Patch #977165 (Security Bulletin MS10-015) causes a blue screen on some systems (Stop Error: PAGE_FAULT_IN_NONPAGED_AREA). While the initial outrage was directed at Microsoft for a shoddy patch, eventually it was found that the Alureon Rootkit was the cause of the blue screen after KB977165 was installed.

But don’t worry! – the makers of the Alureon Rootkit have actually updated it and patched the flaw! Hurray!

For everyone else there are two options:

Use a LiveCD to scan your hard drive for the rootkit and remove it. This will resolve the issue. Try Knoppix STD (http://www.knoppix-std.org/) or BartPE (http://www.nu2.nu/pebuilder/).
Remove MS10-015 (977165) from your system.

How to remove Security Bulletin MS10-015 (977165) from your system

Insert the Windows XP disc into the CDROM. You may need to adjust your BIOS settings to boot the CDROM first.
When the “Welcome to Setup” screen appears, press “R.”
Select the installation you wish to access (there should be only one option for most systems).
Enter the administrator password when asked.
Once at the Recovery Prompt, press ENTER after typing the following command: CHDIR $NtUninstallKB977165$\spuninst
Press ENTER after typing the following: BATCH spuninst.txt
Press ENTER after typing the following: systemroot
Press ENTER after typing the following: exit
Remove the Windows XP CD and restart.