Author Archive for KW – Page 43

Windows Live Mail to Outlook 2010

I have a customer who’s been trying to use Windows Live Mail (WLM) 2011 for the past 6 months, but keeps running into issues and problems in using it. So today I installed Outlook 2010 onto his computer, and began the process of exporting his email and contacts from WLM to Outlook. Several things I discovered during this process.

1. I exported the WLM account settings to an IAF file, but then discovered that Outlook 2010 does not recognize/support importing an IAF file for setting up an email account. The reason I was trying to do this was because we did not know the user’s email/account password! So, what does one do? A quick search of the Internet uncovers an online IAF decoder program! It worked like a champ. It displayed the entire contents of the IAF file included POP and SMTP URL’s, user name AND password, ports used, and more. I was then able to proceed and create the user’s mail account in Outlook 2010.

2. Next I was ready to export the email in the WLM inbox, but when I went to do so, I thought it was strange that it never prompted me for a file name or file location to store the export file. I naturally assumed it was going to create a PST file. Lo and behold, there was no need to ask for a filename, as WLM directly imported the contents of the mailbox into Outlook 2010. Very nice!

Note: to transfer mail boxes, click on File > Export Mail > Email Messages > click Select Microsoft Exchange (even if you are only using standalone Outlook!) > Next > OK > click Selected Folders > and then select mailbox to be transfered.

3. Then I was ready to transfer over Contacts. WLM creates a CSV file when exporting contacts. Be sure to click on the mapping button and map the first name and email address. For some reason those are not selected automatically.

 

SAS False Positive with LogMeIn

I’m connected to a workstation remotely via LogMeIn to do some cleanup work. I download and run SuperAntiSypware (SAS). It reports that it finds two issues:

Security.HiJack[ImageFileExecutionOptions]
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE
 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHSHELL.EXE#Debugger

Searching the Internet suggests that these are false positives. But why? Finally I find the answer on the Experts-Exchange website: SAS will only flag these two registry keys when LogMeIn is running!

So, if you are running SAS via a LogMeIn session, and it flags these two registry keys, you can safely uncheck them.

WHS HPServiceManager Warning

I have many HP MediaSmart and Data Vault servers installed in businesses to backup client workstations. They do an excellent job and have made me look like a hero more than once!

On several units, however, I will see HPServiceManager warnings showing up in the event log every 5 seconds! (see screenshot to the right).

Thanks to Alex Kuretz, I finally found a possible solution to eliminate these events.

Run the following command from a command prompt from the Home Server console. then reboot the server: lodctr /R

Please note that the HPServiceManager warning can be caused by several different issues, and running lodctr /R may not fix every one of them. Another suggestion is to run a chkdsk on all the drives.

 

False Positive on Win32/Hotbar

While reviewing systems after a three day vacation, I noticed that Microsoft Security Essentials (MSE) had identified a potential Adware:Win32/Hotbar issue on several machines (see below). Upon further research, I discovered that MSE was flagging it’s own signature update as a threat! Click here for explanation.

Adware:Win32/Hotbar
Category: Adware
Description: This program has potentially unwanted behavior.

Recommended action: Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software.

Security Essentials detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the Allow action and click Apply actions. If this option is not available, log on as administrator or ask the security administrator for help.

Items:
file:C:\Windows\Temp\05CF9286-54A9-4EBA-83E0-696343501064-Sigs\98110B50-5C07-4433-AC63-E73247E812BAmpasdlta.vdm.new.temp  <– These are Microsoft Security Essentials own virus
file:C:\Windows\Temp\05CF9286-54A9-4EBA-83E0-696343501064-Sigs\98110B50-5C07-4433-AC63-E73247E812BAmpasdlta.vdm.old.temp    <– definition files being flagged as suspect malware!

 

Use Group Policy to add Trusted Sites to IE

Recently I had to add several URL’s as trusted sites to Internet Explorer (IE) for a doctor’s office for a new software application they were implementing. I had two options: (1) go to every workstation and add the URL’s, or (2) add the URL’s once via Group Policy from the server (SBS 2008), and let the server do the work! I chose option #2.

WARNING: It is advisable to warn you that modifying Group Policies is similar to modifying Windows Registry settings — you can quickly take down the system you are working on if you don’t know what you are doing. There are several great articles and books on working with Group Policy. Most will recommend creating a Test OU first, and use a set of selected users/computers to test your group policy changes first.

If you are not comfortable with Group Policies (and I will admit that I fall into that category!), here are the specific steps I followed to deploy (with thanks to a Spicework forum post on this topic):

Step 1: From the SBS console, click Start > Administrative Tools > Group Policy Management (GPM)

Step 2: Drill down Forest > Domain > your domain > My Business > Users > SBS Users

Step 3: Right click on SBS Users, then click on ‘Create a GPO in this domain, and link it here..’

Step 4: Give your new group policy object (GPO) a name, such as ‘IE Trusted Sites’

Step 5: Right click on your new GPO to edit it, and drill down User Configuration > Windows Settings > Internet Explorer Maintenance > Security

Step 6: In the right hand pane, right click on ‘Security Zones and Content Rating’ and then click Properties

Step 7: Click on the radio button to select ‘Import the current security zones and privacy settings’, then click ‘Modify Settings’

Step 8: The Internet Properties window displays. Click Security tab > Trusted Sites and then click the Sites button.

Step 9. Add your URL(s) to be trusted, and then close

Cleanup WSUS Database

WSUS (Microsoft’s Windows Server Update Services) allows you to manage and release updates to your servers and workstations on YOUR schedule. This is an important step in managing your customers’ systems. I prefer to test new Microsoft updates on my own test & in-house servers and workstations before introducing them into customer’s production systems. Over time, however, you may find that your WSUS database and files are taking up more and more disk space.

WSUS provides an easy to use management tool in SBS 2008 and SBS 2011 that reduces this disk space by deleting outdated or superseeded updates that WSUS has collected. The tool is called the WSUS Server Cleanup Wizard. It’s recommended to run this tool at least monthly. Many MVP’s run it weekly via a scheduled script task.

To access and run the wizard, go to Start > Administrative Tools > Windows Server Update Services, then click on Option, then the Server Cleanup Wizard. You will then be presented a list of 5 choices of items to be cleaned up. 

Fair warning: if you are running the WSUS Cleanup Wizard for the first time on a server that has been in production for months or years, the wizard may run for a VERY LONG TIME!

If so, my advice is to run each cleanup option separately, starting with the last choice first (superseeded updates), and finishing up with unused updates/revisions last, Why? Because the unused updates/revision item takes the longest to run, and you may in fact thing that the cleanup wizard is broken, and try to abort it.

Free Workstation Search Utility

I’m sorry, Microsoft, but the build in Search utility (especially in Windows XP) just doesn’t always work. I’m not one to just look for a third party app, but in this particular case, I had a customer needing to search for the proverbial “needle in a haystack” against a large folder of generated data files.

I happily came across Mythicsoft FileLocator Lite and it was the right solution for the right problem at the right price (free!).

Unlike most file locator programs, it does NOT create and maintain an indexing file, but you would be surprised at how fast it is!

Eliminate Compress Old Files during Disk Cleanup

If you are running Windows Vista or Windows 7, this post is not for you.

However, if you are running Windows XP, when you run Disk Cleanup (My Computer, right click on a disk drive, then click Properties), you may see a message “Scanning: compress old files”. Back in the day so very small disak drives, this may have been a somewhat useful option. More importantly, it takes a long time for this scanning process to complete.

My recommendation is not to compress old files. And with a quick registery edit, you can disable this option so it does not run when you do a disk clean up, and no reboot of your workstation is required.

  1. From a command propmpt, type  regedit and press enter.
  2. Drill down HKEY_LOCAL_MACHINE > Software > Microsoft > Windows > CurrentVersion > Explorer > VolumeCaches > Compress old files
  3. In the right pane double click the {Default} key and the Edit String window will display. The Value Data field will contain a long 32 character string, similar to:  {B50F5260-0C21-11D2-AB56-00A0C9082678}  (see screenshot).
  4. Delete the entire 32 character string in the Value Data field, then click OK, and close the Regedit window.

That’s it! Now, when you run disk cleanup, you will no longer get the  ‘Scanning: compress old files’.

 

Remove U3 from SanDisk Cruzer

You may still have some SanDisk Cruzer USB thumb drives around that have a pre-configured U3 partition.

When you insert these thumb drives, it mounts not one, but two removable drives: a U3 CD-Drive and the removable disk. For some reason that seems to annoy or bother some people.

Getting rid of the U3 partition is not hard, but you cannot do it simply by trying to delete or reformat the USB stick. Simply go to the SanDisk web site and download the Laun chPad Removal file containing their U3 Uninstaller Tool, unzip the file and run it.

It will automatically locate your Cruzer thumb drive, give you the option to backup/restore any data on the thumb drive, and then delete the U3 partition. You may want to reformat the thumb drive, especially if you want it to be an NTFS file system.

Facebook virus issues

I had a customer contact me this evening. Apparently his Facebook account, his wife’s and one of his kids is sending out an email with a link for a video. The email purports to be from Facebook (notifications+kr4mqwsrx55a@facebookmail.com) with a subject line of “John shared a link on your Wall”.  I’ve never had to tackle any such Facebook related spam until now.

Suggestion number 1: CHANGE YOUR FACEBOOK PASSWORD IMMEDIATELY!

Suggestion number 2: If you still think it may be malware on your computer, run MalwareBytes or SuperAntiSpyware or both!