launching interactive command-prompts on remote systems

Today I decide to introduce a useful tool called PSEXEC and its capabilities to you so you can easily manage your remote and enterprise network as an administrator...

Utilities like Telnet and remote control programs like Symantec's PC Anywhere let you execute programs on remote systems, but they can be a pain to set up and require that you install client software on the remote systems that you wish to access. PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.
Download it from:
http://www.sysinternals.com/Files/PsExec.zip
Just copy PsExec onto your executable path. Typing "psexec" displays its usage syntax.
PsExec works on NT 4.0, Win2K, Windows XP and Server 2003 including x64 versions of Windows.

Do not use this as an abuse tool such as attack or so on if you read my blog as a technical man not voodoo.This is the only gift that you may give me.So good.

Another security hole found in Excel

A hole in Microsoft Excel has been identified that could allow attackers to take control of a computer, a security group said Thursday--the third vulnerability affecting the popular spreadsheet program to surface in less than a month ...

The flaw is due to a memory corruption error that occurs when handling or repairing a document containing overly long styles, the French Security Incident Response Team said in an advisory.
The flaw, which affects Excel 2000, 2002 and 2003 and Office 2000, XP and 2003, "could be exploited by attackers to execute arbitrary commands by convincing a user to open and repair a specially crafted Excel file," the advisory said.
A Microsoft representative said the company is investigating reports of a new vulnerability in Excel and was not aware of any attacks related to it.
"In order for this attack to be carried out, a user must first open a malicious Excel document that is sent as an e-mail attachment or otherwise provided to them by an attacker," the representative said in an e-mail. "Opening the Excel document out of e-mail will prompt the user to be careful about opening the attachment."
The vulnerability affects only users of Japanese, Korean or Chinese language versions of Excel, the Microsoft representative said.
Customers who believe they are affected can get more information on Microsoft's security Web site. For more information about protecting a computer from threats, Microsoft has this site.
Excel hackers have been busy. On June 16, experts warned about a hole that was exploited in at least one targeted cyberattack. About two weeks ago, an Excel hole was discovered that could crash the program after a malicious file is opened.

By Elinor Mills, CNET News.com
Published on ZDNet News: July 6, 2006, 6:15 PM PT

Send me your site/blog to link

Dear my site's visitors

If you want, you can send me your site or blog URL to link in my page.

----------------
Good Luck!

Boot Speed-up Utility

Recently, when I was working on systems boot-up performance & so on, I've found BootVis, used it in my laptop pc; I found it useful ...

BootVis Publisher's Description
Bootvis.exe is a performance tracing and visualization tool that Microsoft designed to help PC system designers and software developers identify performance issues for boot/resume timing while developing new PC products or supporting software.

Download it from:
http://www.soft32.com/download_19687.html

Windows XP Tips & Tricks - Part 3

1. Common Control Panel Applets:
The follow are some common Control Panel Applets that are located in the \windows\system32 directory.If you find yourself using any of these frequently, then you can simply make shortcuts to them on your desktop.
appwiz.cpl --> Add/Remove Programs
desk.cpl --> Display Properties
firewall.cpl --> Firewall Settings
inetcpl.cpl --> Internet Options
mmsys.cpl --> Sound and Audio
ncpa.cpl --> Network Connections
nusrmgr.cpl --> User Accounts
powercfg.cpl --> Power Options
sysdm.cpl --> System Properties
wscui.cpl --> Security Center
wuaucpl.cpl --> Automatic Updates Configuration

2. Windows Explorer Opens Search Companion Rather than the Folder:
If the Windows Explorer opens up the Search Companion rather than opening up the actual folder, the default setting for opening a folder is changed.
To correct this:
1. Start Regedit
2. Go to HKEY_CLASSES_ROOT \ Directory \ shell and HKEY_CLASSES_ROOT \ Drive \ shell]
3. Edit the default value to be explorer or none

3. System32 Folder Opens When Logging On:
If the System32 folder shows on the desktop, there may be an invalid entry in the Registry
1. Start Regedit
2. Go to both:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
3. Double check that the values do not have incorrect, incomplete, or blank entries

4. Not Viewing Zip Files as Folders:
If you want to turn of WindowsXP showing Zip files as folders,just run:
regsvr32 /u zipfldr.dll

5. Setting Capslock, Numlock, Scroll Lock:
If you want to set the startup state for any or all of these keys, you just need to edit the registry. 1. Start Regedit
2. Go to HKEY_CURRENT_USER \ Control Panel \ Keyboard
3. Open InitialKeyboardIndicators
4. Change the value to one of the following numbers
0 - All Keys off
1 - Caps Lock on
2 - Num Lock on
3 - Caps Lock and Num Lock on
4 - Scroll Lock on
5 - Caps Lock and Scroll Lock on
6 - Num Lock and Scroll Lock on
7 - Caps Lock, Num Lock, and Scroll Lock on
5. Log off and back on again

6. DOS Tips in XP:
Windows XP cmd tip (DOS isn’t dead... it just smells funny) Some command-line folder creation examples:
To create multiple folders at once, add them directly to the "md" command:
C:\> md this is a test
To create a folder several folders deep, use:
C:\> md this\is\a\test
Creating a folder with a long name requires the double-quote at the beginning:
C:\> md "this is a test
Bonus tip: Windows XP supports the forward slash "/" as a folder divider. Unix/Linux users: don't let the DOS environment get you down. Use a Unix-style CD command to change your present working directory:
C:\> cd Windows/system32/drivers/etc

Submitted by Bob and Tina

7. Restoring Desktop Icon to the Quicklaunch Bar:
If you mistakenly deleted the icon for the Desktop on the Quicklaunch toolbar

Go to C:\Documents and Settings\user_name\Application Data\Microsoft\Internet Explorer\Quick Launch(where user_name is replaced by your login name)

Create a Text file called ShowDesktop.SCF with the following contents:
[Shell
]Command=2
IconFile=explorer.exe,3
[Taskbar]Command=ToggleDesktop

8. Configure for Auto-Logon:
If you are the only person using the computer and what to have it automatically log you on,
1. Start / Run / "control userpasswords2" - no quotes
2. Uncheck User must enter a user name and password to use this computer

9. Disable Remembering Folder Settings:
If XP does not remember your folder settings, delete or rename the following registry keys:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU][HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags]

10. Disable Explorer Thumbnail View:
If you want disable the Explorer's ability to show the Thumbnail View:
1. Start Regedit
2. Go to HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced 3. Change ClassicViewState to 1

11. Preventing Applications from Stealing the Focus:
To prevent applications from stealing the focus from the window you are working:
1. Start Regedit
2. Go to HKEY_CURRENT_USER \ Control Panel \ Desktop
3. Edit the key ForegroundLockTimeout
4. Give it a value of 00030d40

12. Disable Passport Pop-Up:
Normally, WindowsXP will prompt you 10 times that You Need a Passport to use WindowsXP Internet communication features.
To disable this:
1. Start Regedit
2. Go to HKEY_CURRENT_USER \ Software \ Microsoft \ MessengerService
3. Edit the binary key PassportBalloon
4. Give it a value of 0A (0A 00 00 00)

Microsoft Excel Vulnerability

Original release date: June 16, 2006
Last revised: --
Source: US-CERT

Systems Affected
* Microsoft Excel 2003
* Microsoft Excel XP (2002)
* Microsoft Excel for Mac
Microsoft Excel is included with Microsoft Office. Other versions of
Excel, and other Office programs may be affected or act as attack
vectors.

Overview
An unspecified vulnerability in Microsoft Excel could allow an
attacker to execute arbitrary code on a vulnerable system.

I. Description
Microsoft Excel contains an unspecified vulnerability. Opening a
specially crafted Excel document, including documents hosted on web
sites or attached to email messages, could trigger the vulnerability.
Office documents can contain embedded objects. For example, a
malicious Excel document could be embedded in an Word or PowerPoint
document. Office documents other than Excel documents could be used as
attack vectors.
For more information, please see Vulnerability Note VU#802324.

II. Impact
By convincing a user to open a specially crafted Excel document, an
attacker could execute arbitrary code on a vulnerable system. If the
user has administrative privileges, the attacker could gain complete
control of the system.

III. Solution
At the time of writing, there is no complete solution available.
Consider the following workarounds:
Do not open untrusted Excel documents
Do not open unfamiliar or unexpected Excel or other Office documents,
including those received as email attachments or hosted on a web site.
Please see Cyber Security Tip ST04-010 for more information.
Do not rely on file extension filtering
In most cases, Windows will call Excel to open a document even if the
document has an unknown file extension. For example, if document.x1s
(note the digit "1") contains the correct file header information,
Windows will open document.x1s with Excel.

Windows XP Tips & Tricks - Part 2

1. Renaming Multiple Files in a Directory:
If you want to rename multiple files in the same directory:
1. Using the Windows Explorer, select all the files you want to rename
2. Press F2 or right click and select Rename
3. Enter the prefix for the name you want
4. This will automatically rename the rest of the files Newname (1).jpg, Newname (2).jpg etc.
5. Make sure you include the extension if you have the Explorer configured to show them.

2. Speeding Up Network Browsing:
There are a lot of things which can negatively impact how fast XP will browse network shares. One has been previously covered regarding browsing to Win9x computers.
Other things you can try, especially when there is slow browsing to network shares with a lot of files:
1. Remove current shortcuts in My Network Places
2. Change the registry so shared folders on remote computers are not automatically added to My Network Places when you even open a document from that shared folder
1. Start Regedit
2. Create a DWORD value:
3. HKEY_Current_User \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoRecentDocsNetHood to 1.
4. I have also seen setting the following help as well.HKEY_Current_User \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ UseDesktopIniCache to 1.

3. Increase the amount of data is buffered at one time to send to a client. On the computer with the shared directory:
1. Start Regedit
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
3. Create a DWORD Key called SizReqBuf
4. Give it a value of Hex FFFF

3. Make Pictures Smaller Unavailable:
When you try and send pictures through e-mail, you should normally be given the option to make them smaller. If this option is not available, a DLL file may need to be registered.
1. Start
2. Run
3. regsvr32 shimgvw.dll

4. Creating a Suspend Shortcut:
If you would like to create an icon to suspend your computer,
1. Right click on the Desktop
2. New / Shortcut
3. Enter in rundll32.exe PowrProf.dll, SetSuspendState
4. Give it whatever name you want
Now when you click on that shortcut, your computer will shutdown and suspend

5. Determining Which Services are Associated with SVCHOST:
Since so many critical services are run with each svchost,You can see which ones are being used by opening a cmd prompt and running:
tasklist /svc /fi "imagename eq svchost.exe"
Note: This is available only with XP Pro

6. Identify Faulty Device Drivers:
If you are having problems with lockups, blue screens, or can only get to safe mode,often the problem is due to a faulty device driver.
One way to help identify them is through the use of the Verfier program
1. Start / Run / Verifier
2. Keep the default of Create Standard Settings
3. Select the type of drivers you want to confirm
4. A list of drivers to be verified on the next boot will be shown.
5. Reboot
6. If your computer stops with a blue screen, you should get an error message with the problem driver
7. To turn off the Verifier, run verifier /reset

7. Viewing Installed Drivers
If you want to see a list of installed drivers, you can run the driverquery programThere are a lot of available switches to view different types of information.On use can be to export to a CSV file for viewing in ExcelAn example would then be:
Driverquery /v /fo csv > drivers.csv

8. Guest Only Network Access
If you try and connect to an XP computer and are shown a logins screen with only the computername/Guest,You may need to change one of the Local Security Policies:
1. Got to Control Panel - Administrative Tools
2. Go to Local Policies - Security Options
3. Check teh Network access: Sharing and security model for local accounts
4. Set it to Classic - local users authenticate as themselves

9. Not Displaying Previous Network Share Shortcuts:
By default, when you go to Network Places, it will scan and show shortcuts to previous network shares.To turn this off and remove any current shortcuts
1. Open up the Windows Explorer
2. Go to Tools / Folder Options / View
3. The top section should be Files and Folders
4. Uncheck Automatically search for network folders and printers
5. Then go into Network Neighborhood Select all the previous netowork connections Delete them
Next time you look at the Network Neighborhood, they should not repopulate

10. Hiding a XP Computer from Network Neighborhood:
If you want to share files from a XP computer, yet want to remove it from showing up in the Network Neighborhood,
Run net config server /hidden:yes

--------------
Good Luck!