While trying to re-install Office 2007 after a couple failed updates and then corruption (still using Win7 beta – my own fault I guess) I got an error 1402 “Can’t open key [blah blah]“, even after I had completely removed Office (another nightmare).  After spending 4 hours searching for how to fix key permissions, running the subinacl script (which resulted in me doing a system restore) – I found the fix!

1. Right click on the stubborn key, then click permissions.  For me it was: [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\[your USERSSID]\Components\BE1FB738077DBE490AF18C3B9B1A1EE8\00002109A20000000100000000F01FEC
2. Now, you might have got an error telling you that it’s view only or something – this might work for you, it might not.
3. Click the Advanced button to take you into the special permissions pages.
4. UnCheck “Include inheritable permissions….” and click Apply then Ok. (MS says to click Apply first then click OK, Dan)
5. Go back into that Advanced special permissions page and this time, CHECK that same box “Include inheritable permissions….” and click Apply then Ok
6. As soon as I did this and clicked Ok, in the Group/Username Security permissions box for the stubborn key I saw all the names that should have been there.  Voila.

Sometimes software is buggy. Sometimes really good software is buggy. Sometimes it’s not the software that’s buggy, but the system configuration that’s really causing the problem. Sometimes, you’ve worked with a client for too long and you just want a decent work around. Yesterday, I had that dilemma. “Find the source of the problem, or find an adequate work around.”

The problem was, every time you’d open an Office application, Word/Excel/PPT/Outlook – it would take a good 45-60seconds to load. The system was new enough that the response time should have been closer to 2-3seconds. After some investigating, it seems that several people have complained about this and that the quick fix or work around is to install an office addon or plugin.

So, the easy way to do this is to:

• Go to Windows Update
• Click custom
• under optional, select Office Live Addin

Continue your way through the updates – when you’re done, reboot the system and voila. Office should open much faster for you.

OOoh Ooh! Quick tip, to install LAMP after you’ve already installed Ubuntu/Server/Kubuntu/Ebuntu…

Just open Terminal and type:

After that finishes, reboot your system or type sudo /etc/init.d/apache2 restart and you'll have a functioning install of apache, MySQL and PHP!

Another command that does the same thing is sudo apt-get install lamp-server^. Make sure you use the caret.

Today I ran into an interesting issue with a Vista laptop that wouldn’t create a system restore point.  After some checking I noticed that the VSS Service had been disabled for some reason, but re-enabling it did not resolve the issue.  I kept getting a System Protection error: There is not enough space on the disk. 0x80070070 Well, I had upgraded this drive not 3 months back and knew that there was plenty of space available… but that got me thinking – there’s a recovery partition on this drive, I wonder if that’s full. Sure enough, the user had copied some files onto it thinking it was a ‘Recovery Drive’ as in backup. Normally this wouldn’t have been a huge deal except that when I imaged the drive, I only left about 200mb of free space. For those of you that don’t know, Windows requires at least 50mb of free space on each connected hard drive for System Restore to function at all! So if you have a ‘recovery’ partition with no space left, check your System Restore status or expand the partition to allow the service to run.

So the other day, I was working on a Dell system that kept BSOD’n and I noticed that the BIOS was A01. That usually means, “update me please for to have better computer”.  Popped on over to Dell’s support page and sure enough – BIOS Rev A15 was out.

So I downloaded the installer and tried to run it, but no luck.  I kept getting a message about it not being able to find WinFlash.sys

After googling, I found that I was not alone – turns out that occasionally the Dell BIOS service get’s corrupted and actually prevents updates.  For me the fix was to remove it by opening Regedit and deleting:

HKLM\System\ControlSet001\Services - Delete DELLBIOS folder

After a reboot I was able to run the BIOS exe no prob.  Another thing I could have done was copy the exe to a DOS boot disk and run it from DOS.  But I wanted to know why… and that usually ends up in random posts like this.

To reset the password:

1. Go to the <installed drive>\Program Files\Trend Micro\Security server\PCCSRV\Private directory.
2. Find and open the ofcserver.ini file using your favorite text editor.
3. Look for the MasterPwd= parameter under the [INI_SERVER_SECTION] section.
4. Replace the MasterPwd= value with 70 (The existing password is encrypted) .
5. Save and close the ofcserver.ini file.
6. Go to Services in the Windows Control Panel and Restart TM Security server Master Service.
7. Log into the Security dashboard and type 1 as the password

Voila. You can now log in.

Originally taken from TechByBucky.blogspot.com

Basically, this happens when you replace the battery in your car – or cut power to the stereo too many times. It locks you out! Not fun… and if you forgot the security code you setup when you installed the deck (or the damn installer didn’t write it down for you *cough*cartoys*cough*) then you’re basically SOL without knowing this handy little work around.

To reset the code do the following:

1) Turn on the car.
2) The faceplate rotates out and the CODE – - – - prompt appears.
3) Press >>| and Auto keys simultaneously on the faceplate and hold for 4 seconds. (If the faceplate rotates back into the console push on the upper left top edge of the faceplate and it will flip back around. Press the Eject button and then try it again.)
4) The screen will still say CODE, but the – - – - will disappear! When this happens press the 5 key on the remote twice and it enters a K on the display on the faceplate. Hit the >>| key on the faceplate.
5) Press the 2 key on the remote three times and it enters a C on the display on the faceplate. Hit the >>| key on the faceplate.
6) Press the 2 key on the remote once and it enters an A on the display on the faceplate. Hit the >>| key on the faceplate.
7) Press the 7 key on the remote twice and it enters an R on the display on the faceplate. Hit the >>| key on the faceplate. The radio goes into All Off mode and you are set! Hit the SRC button on the faceplate to select CD, Radio, etc.

I can confirm that this works on a KDC – x789 – pressing >>| and Auto at the same time for 3 seconds.

If you need the ‘better’ manual, it can be found here:

http://www.eserviceinfo.com/downloadsm/29917/Kenwood_KDC-8021,%20KDC-M9021,%20KDC-X859.html

I’ll be compiling a list, over time, of how to do hard reset’s on smartphones. I’ll try to honor requests

Samsung:

• i760:  Use the stylus to push the red reset button and hold the silver button in the middle of the nav pad at the same time. Release the reset button FIRST followed by the silver button. It should say “clearing data”

I got an email from my boss today regarding how some threats are evolving:
Found one today that creates a file called c:\windows\system32\desot.exe.

It then sets the “exefile” handler in the registry HKCR\exefile\shell\open\command \ (Default) from its original value of “%1” %*  to a new value of “C:\Windows\System32\Desot.exe “%1” %*, effectively running every program through desot.exe for approval.

Symptoms: HJT, ComboFix, MalwareBytes would not even launch.  Deleting desot.exe alone causes EVERY .exe file to give a “please specify the program used to launch .exe files” box, effectively killing the system when the virus is removed (assuming you don’t know where to look to reset the setting, which by the way Regedit won’t run.  So the fix was to unerase desot.exe, run regedit, fix the exefile command, then delete desot.exe and everything worked again.  I would assume the filename will probably change over time, but just be aware that this tactic exists.