Support of avast! 4.8 is being discontinued, as we all know. However, on some (early Pentium 4 and older Pentium III) computers, particularly those that only run a specific task, we don’t want (or need) to upgrade to avast! 5 (which may slow down these older machines).
Finally, after some searching we found that the process asw5Noti.exe or awsw5Not2.exe was running whenever the annoying avast! upgrade notification pop-up is on the screen.
In order to rename these files and disable them from popping up, go into the avast! Program Settings (located in the System Tray icon)
select the Troubleshooting tab
and check “Disable avast! self defense mode”
click OK and you may be prompted with a confirmation screen:
click YES.
Now open up a “Command Prompt” window and type the following:
cd “%ProgramFiles%\Alwil Software\Avast4″
ren asw5Not?.exe *.exe.DISABLED
If you do not get any errors, then the files were successfully renamed; effectively disabled.
You should then turn back on the “avast! self defense mode” by removing the check you did in the steps above.
Hope this helps everyone who is using an older computer and does not want to be continually annoyed by the avast! upgrade notification screen.
NOTE: on faster computers, it is strongly recommended that you upgrade to avast! 5 for complete protection.
.
©2012 Johnny Chin. All Rights Reserved.
Support of avast! 4.8 is being discontinued, as we all know. However, on some (early Pentium 4 and older Pentium III) computers, particularly those that only run a specific task, we don’t want (or need) to upgrade to avast! 5 (which may slow down these older machines).
Finally, after some searching we found that the process asw5Noti.exe or awsw5Not2.exe was running whenever the annoying avast! upgrade notification pop-up is on the screen.
In order to rename these files and disable them from popping up, go into the avast! Program Settings (located in the System Tray icon)
select the Troubleshooting tab
and check “Disable avast! self defense mode”
click OK and you may be prompted with a confirmation screen:
click YES.
Now open up a “Command Prompt” window and type the following:
cd “%ProgramFiles%\Alwil Software\Avast4″
ren asw5Not?.exe *.exe.DISABLED
If you do not get any errors, then the files were successfully renamed; effectively disabled.
You should then turn back on the “avast! self defense mode” by removing the check you did in the steps above.
Hope this helps everyone who is using an older computer and does not want to be continually annoyed by the avast! upgrade notification screen.
NOTE: on faster computers, it is strongly recommended that you upgrade to avast! 5 for complete protection.
.
clicking search page links,
results in randomly redirected URL pages
svchost.exe and rundll32.exe used to load malware/spyware DLL
Today, for the second time in a month, I was asked to help remove a spyware/malware from a computer running Windows XP SP3. In both cases, the symptoms were identical. The user immediately noticed something was wrong because their web browser started to behave oddly. Here is what happened:
- Open the web browser of choice (IE or Firefox or Opera) and load a search portal (Google, MSN or Yahoo) site
- type in something to search (“winter coat”)
- on the results page, if you right-click on a link and “open in new tab/window”, the page opens and immediately gets redirected to some other random page (usually some other portal site)
- HOWEVER, if you right-click on a link and select “copy shortcut”, then MANUALLY open a tab and paste the link, the page opens just fine
The first time this happened (Feb. 3, 2010), it was on a friend’s computer and he is a veteran IT person (network system administrator for 10+ years). He keeps his computer very secure, usually.
We checked the usual system settings (network settings, proxy settings, “odd” programs running, etc.). We ran the usual anti-spyware and anti-virus scans, call came back clean as usual.
Avast AntiVirus – clean
ClamAV – clean
HiJackThis – normal
MalwareBytes – clean
Spybot SD – clean
However, running the SysInternals utility, PROCEXP.EXE, I happened to notice this line:
C:\WINDOWS\system32\rundll32.exe “C:\WINDOWS\system32\efsadub.dll”,DWLGXPLFFX
which was running as a sub-process under svchost.exe (C:\WINDOWS\system32\svchost.exe -k netsvcs).
The file “C:\WINDOWS\system32\efsadub.dll” (notice the “b” in the filename) had its special bits set as “read-only”, “hidden” and “system”. When we try to change the attributes, we get “Access Denied” (even from an Administrator account). Hell, we even tried to access this in Safe-Mode Command Prompt Only, we get the same error. We could not rename the file either, obviously.
I was finally able to change the attributes and rename the file after running “
For the VirusTotal analysis report on the file “efsadub.dll“, goto:
http://www.virustotal.com/analisis/b1ff584a9b490418a159ab4afe85ae1802e4c4634c942756640a4411467ef25d-1264975725
Today (March 5, 2010), a client called and his computer had the same symptoms. Again, I checked the usual suspects (running programs, etc.) and performed the usual scans (anti-virus, anti-malware, etc.). They all came back “clean”. However, I did notice that the signatures were slightly dated (about a month old). When I tried to update them, error messages resulted. MalwareBytes gave an error and hung in a loop. Symantec Anti-Virus LiveUpdates just failed.
ClamAV – clean
MalwareBytes – clean
Symantec Anti-Virus – clean
I then ran the PROCEXP.EXE utility from SysInternals. There were no odd DLLs loaded like the last time. Hmm… so this is not exactly the same as last time.
Since this had to be a malware that loaded at startup, I decided to check the System Services. I then noticed an “odd” service running named “Server WebCheckChannelAgent Performance Folder Provisioning Icon Driver CPL”, with a short-name of “srvoko6”. I tried to disable it and it kept resetting to “Automatic”.
Looking at the properties of this service, revealed that it was loading via “%SYSTEM%\svchost.exe –k netsvc6”. I searched the web on the terms “srvoko6” and “netsvc6”, I came across this site:
http://www.threatexpert.com/report.aspx?md5=c801bd4576fc95cb03e918950edd21a1
which mentions the “ok6o.dll” and “ok6o.sys” files. So I searched for those files, and found them (they were not hidden). Trying to rename them worked, but they were immediately recreated by the malware.
NOTE: the above ThreatExpert site reports that this service was also named “Office Workstation Remote”. This tells me that the service display name can vary.
Instead, I used “CACLS.EXE” to change access permissions to these files so that nobody (or system service) was allowed to access them. Rebooted the computer and verified that the malware was no longer actively running. This time, I was able to successfully disable the service and renamed the “ok6o.dll” and “ok6o.sys” files.
I was then able to restore permissions to those files and delete them. Updated signatures for MalwareBytes and Symantec Anti-Virus, followed by a complete system scan. This time those programs found the installer stub files “C:\WINDOWS\bill103.exe” and “C:\WINDOWS\rdr_1267369102.exe” (which most likely are random filenames the initial download script created).
For the VirusTotal analysis on the file “o6ko.dll“, goto:
http://www.virustotal.com/analisis/7d6d2edc4eac763bc687e578008474dc85245b1e55d5ca5ae958d220f4802fbf-1267641995
For the VirusTotal analysis on the file “o6ko.sys“, goto:
http://www.virustotal.com/analisis/d599b5fb31b6387ff7e540fabb655bbde0990ce9db1e6f1918bec6ac21d43278-1267374431
As you can see from the VirusTotal analysis reports, not all anti-virus scanners detect or flag these files. So, for most of these malware/spyware, it still requires manual detection and removal.
STRONG WARNING: be very careful of websites that tells you do download an executable to remove the malware/spyware. If you are not familiar with the website, DO NOT download and run the program, it can possibly install another piece of malwayre/spyware onto your computer. It is best to call a professional (or at least someone who knows with 100% certainty what they are doing) to clean your computer.
NOTICE: when renaming files and changing attributes or permissions, it is strongly advised that you do those via command-line commands in the “Command Prompt” window. If the malware/spyware is attached to the Windows Explorer process and/or its handles, it can intercept your mouse-click commands, making it seem like you did what you wanted to, but in reality the malware/spyware actually created another copy of itself with a different name and reinstalled itself using those new copies. The “Command Prompt” method is the most secure way of doing this work; however it is a lot of typing.
Feel free to post comments below if you need help or have recommendations.
©2012 Johnny Chin. All Rights Reserved.
clicking search page links,
results in randomly redirected URL pages
svchost.exe and rundll32.exe used to load malware/spyware DLL
Today, for the second time in a month, I was asked to help remove a spyware/malware from a computer running Windows XP SP3. In both cases, the symptoms were identical. The user immediately noticed something was wrong because their web browser started to behave oddly. Here is what happened:
- Open the web browser of choice (IE or Firefox or Opera) and load a search portal (Google, MSN or Yahoo) site
- type in something to search (“winter coat”)
- on the results page, if you right-click on a link and “open in new tab/window”, the page opens and immediately gets redirected to some other random page (usually some other portal site)
- HOWEVER, if you right-click on a link and select “copy shortcut”, then MANUALLY open a tab and paste the link, the page opens just fine
The first time this happened (Feb. 3, 2010), it was on a friend’s computer and he is a veteran IT person (network system administrator for 10+ years). He keeps his computer very secure, usually.
We checked the usual system settings (network settings, proxy settings, “odd” programs running, etc.). We ran the usual anti-spyware and anti-virus scans, call came back clean as usual.
Avast AntiVirus – clean
ClamAV – clean
HiJackThis – normal
MalwareBytes – clean
Spybot SD – clean
However, running the SysInternals utility, PROCEXP.EXE, I happened to notice this line:
C:\WINDOWS\system32\rundll32.exe “C:\WINDOWS\system32\efsadub.dll”,DWLGXPLFFX
which was running as a sub-process under svchost.exe (C:\WINDOWS\system32\svchost.exe -k netsvcs).
The file “C:\WINDOWS\system32\efsadub.dll” (notice the “b” in the filename) had its special bits set as “read-only”, “hidden” and “system”. When we try to change the attributes, we get “Access Denied” (even from an Administrator account). Hell, we even tried to access this in Safe-Mode Command Prompt Only, we get the same error. We could not rename the file either, obviously.
I was finally able to change the attributes and rename the file after running “
For the VirusTotal analysis report on the file “efsadub.dll“, goto:
http://www.virustotal.com/analisis/b1ff584a9b490418a159ab4afe85ae1802e4c4634c942756640a4411467ef25d-1264975725
Today (March 5, 2010), a client called and his computer had the same symptoms. Again, I checked the usual suspects (running programs, etc.) and performed the usual scans (anti-virus, anti-malware, etc.). They all came back “clean”. However, I did notice that the signatures were slightly dated (about a month old). When I tried to update them, error messages resulted. MalwareBytes gave an error and hung in a loop. Symantec Anti-Virus LiveUpdates just failed.
ClamAV – clean
MalwareBytes – clean
Symantec Anti-Virus – clean
I then ran the PROCEXP.EXE utility from SysInternals. There were no odd DLLs loaded like the last time. Hmm… so this is not exactly the same as last time.
Since this had to be a malware that loaded at startup, I decided to check the System Services. I then noticed an “odd” service running named “Server WebCheckChannelAgent Performance Folder Provisioning Icon Driver CPL”, with a short-name of “srvoko6”. I tried to disable it and it kept resetting to “Automatic”.
Looking at the properties of this service, revealed that it was loading via “%SYSTEM%\svchost.exe –k netsvc6”. I searched the web on the terms “srvoko6” and “netsvc6”, I came across this site:
http://www.threatexpert.com/report.aspx?md5=c801bd4576fc95cb03e918950edd21a1
which mentions the “ok6o.dll” and “ok6o.sys” files. So I searched for those files, and found them (they were not hidden). Trying to rename them worked, but they were immediately recreated by the malware.
NOTE: the above ThreatExpert site reports that this service was also named “Office Workstation Remote”. This tells me that the service display name can vary.
Instead, I used “CACLS.EXE” to change access permissions to these files so that nobody (or system service) was allowed to access them. Rebooted the computer and verified that the malware was no longer actively running. This time, I was able to successfully disable the service and renamed the “ok6o.dll” and “ok6o.sys” files.
I was then able to restore permissions to those files and delete them. Updated signatures for MalwareBytes and Symantec Anti-Virus, followed by a complete system scan. This time those programs found the installer stub files “C:\WINDOWS\bill103.exe” and “C:\WINDOWS\rdr_1267369102.exe” (which most likely are random filenames the initial download script created).
For the VirusTotal analysis on the file “o6ko.dll“, goto:
http://www.virustotal.com/analisis/7d6d2edc4eac763bc687e578008474dc85245b1e55d5ca5ae958d220f4802fbf-1267641995
For the VirusTotal analysis on the file “o6ko.sys“, goto:
http://www.virustotal.com/analisis/d599b5fb31b6387ff7e540fabb655bbde0990ce9db1e6f1918bec6ac21d43278-1267374431
As you can see from the VirusTotal analysis reports, not all anti-virus scanners detect or flag these files. So, for most of these malware/spyware, it still requires manual detection and removal.
STRONG WARNING: be very careful of websites that tells you do download an executable to remove the malware/spyware. If you are not familiar with the website, DO NOT download and run the program, it can possibly install another piece of malwayre/spyware onto your computer. It is best to call a professional (or at least someone who knows with 100% certainty what they are doing) to clean your computer.
NOTICE: when renaming files and changing attributes or permissions, it is strongly advised that you do those via command-line commands in the “Command Prompt” window. If the malware/spyware is attached to the Windows Explorer process and/or its handles, it can intercept your mouse-click commands, making it seem like you did what you wanted to, but in reality the malware/spyware actually created another copy of itself with a different name and reinstalled itself using those new copies. The “Command Prompt” method is the most secure way of doing this work; however it is a lot of typing.
Feel free to post comments below if you need help or have recommendations.
Well, RIMM / Blackberry broke the Google MAIL Messages Integration in their BIS service, but the GMAIL plug-in works as described (and that is GREAT). Here is what I found.
If you have a working GMAIL account on your Blackberry, think twice before proceeding. 
Once you’ve re-add the GMAIL account using the default Blackberry method (fill in the e-mail address and password, then Blackberry figures out the rest). So this mode is what some service providers are calling “G-IMAP”. Also, this seems the only option if you are adding the accounts from the handset itself. Once you have “synced up” (activated) the account, your GMAIL INBOX messages can be found in the “email address” icon and the Blackberry Messages (which is what it should do). However, your GMAIL ARCHIVED messages (those that “skip the inbox” via a GMAIL filter automatically) will also show in your Blackberry Messages (all messages folder, the “M” button), which is NOT what it is suppose to do. That is a problem for me, as I have a lot of e-mail that I filter away from the INBOX and do not want to see on my Blackberry.
So, I decided to try setting up the account and force it to use the old IMAP setting. To do this you must be adding the e-mail account from the BIS web interface from your service provider; go to add another e-mail to the Blackberry, but this time, I leave the password field blank so that it would now ask me for the server settings. On the next screen, put in “imap.gmail.com” for you server settings. Again, Blackberry figures out the rest of the settings. Let us now call this “IMAP” setup, which it is (and it does NOT use the new Blackberry GMAIL plug-in). However, Blackberry decides that for this particular IMAP server (imap.gmail.com), it should check “All Mail” and not the “INBOX” folder. Once again, we face the same situation with GMAIL ARCHIVED messages showing up in the “Messages” folder on the Blackberry.
Now, for a work around. For the “IMAP” setting configuration we just did, we can go and change the IMAP server name to “gmail-imap.l.google.com” (which is a CNAME for “imap.gmail.com”). Save your settings. Your GMAIL account is now back to the way it should work (before Blackberry decided to make its non-standard changes and break the GMAIL integration). 
NOTE: this does not use the Blackberry GMAIL plug-in, so in order to “mark as spam” or “change labels” you need to install the Google GMail App.
I’ve spent over 4 hours on the phone today explaining first to T-Mobile, then to a RIMM Blackberry customer service, then a Blackberry tech at RIMM, and then finally another RIMM Blackberry tech who had “access to a RIMM Blackberry Analysis:”. They kept saying it was my Blackberry configuration that was wrong, like my BIS Filters were set incorrectly (which were set correctly) and that my “Service Book IDs” were incorrect causing the problem. To top it off, they say that because I kept deleting the account and recreating it, my “Service Book IDs” will keep changing and resulting in blah blah blah.
Finally, I got him (Don) to agree to try it out on a handset himself. So Don was adventurous and said he had no problems with his GMAIL working on his Blackberry. He went ahead and deleted his GMAIL account from his Blackberry and recreated it. Then he want to his GMAIL account and created a filter (for all messages with Subject:archive, “skip the inbox” and “marked as read”). Now I had him send a test message with the subject “archive” from another account to his GMAIL account. He now saw that archived message showed up in his Blackberry Messages “as opened”, which should not have happened. He said “Ah, I see what you are talking about now” and went to talk to an Analyst.
So now Don tells me, it seems to be an isolated case with my account and that he would look into it further. Gave me a case number and said that I should call back in a few days for status updates. What!?!?! I told him that he should “Google” it and see how many other cases of this problem there are. He said he would keep the ticket open for the next 5 days. Oh my goodness, Research In Motion really wants some more bad press?
Damn, must we provide them the code too? All they have to do is fix their “special code” (probably one conditional statement) which pertains to “imap.gmail.com” and no other servers. Most likely they have something that says if the IMAP server is “imap.gmail.com” then check “All Mail” folder instead of letting it check the standard “INBOX” folder like all other IMAP servers it checks.
If you have experienced this issue with your Blackberry, please add a comment below and/or a URL to your forum posts.
©2012 Johnny Chin. All Rights Reserved.
Well, RIMM / Blackberry broke the Google MAIL Messages Integration in their BIS service, but the GMAIL plug-in works as described (and that is GREAT). Here is what I found.
If you have a working GMAIL account on your Blackberry, think twice before proceeding.
Once you’ve re-add the GMAIL account using the default Blackberry method (fill in the e-mail address and password, then Blackberry figures out the rest). So this mode is what some service providers are calling “G-IMAP”. Also, this seems the only option if you are adding the accounts from the handset itself. Once you have “synced up” (activated) the account, your GMAIL INBOX messages can be found in the “email address” icon and the Blackberry Messages (which is what it should do). However, your GMAIL ARCHIVED messages (those that “skip the inbox” via a GMAIL filter automatically) will also show in your Blackberry Messages (all messages folder, the “M” button), which is NOT what it is suppose to do. That is a problem for me, as I have a lot of e-mail that I filter away from the INBOX and do not want to see on my Blackberry.
So, I decided to try setting up the account and force it to use the old IMAP setting. To do this you must be adding the e-mail account from the BIS web interface from your service provider; go to add another e-mail to the Blackberry, but this time, I leave the password field blank so that it would now ask me for the server settings. On the next screen, put in “imap.gmail.com” for you server settings. Again, Blackberry figures out the rest of the settings. Let us now call this “IMAP” setup, which it is (and it does NOT use the new Blackberry GMAIL plug-in). However, Blackberry decides that for this particular IMAP server (imap.gmail.com), it should check “All Mail” and not the “INBOX” folder. Once again, we face the same situation with GMAIL ARCHIVED messages showing up in the “Messages” folder on the Blackberry.
Now, for a work around. For the “IMAP” setting configuration we just did, we can go and change the IMAP server name to “gmail-imap.l.google.com” (which is a CNAME for “imap.gmail.com”). Save your settings. Your GMAIL account is now back to the way it should work (before Blackberry decided to make its non-standard changes and break the GMAIL integration). NOTE: this does not use the Blackberry GMAIL plug-in, so in order to “mark as spam” or “change labels” you need to install the Google GMail App.
I’ve spent over 4 hours on the phone today explaining first to T-Mobile, then to a RIMM Blackberry customer service, then a Blackberry tech at RIMM, and then finally another RIMM Blackberry tech who had “access to a RIMM Blackberry Analysis:”. They kept saying it was my Blackberry configuration that was wrong, like my BIS Filters were set incorrectly (which were set correctly) and that my “Service Book IDs” were incorrect causing the problem. To top it off, they say that because I kept deleting the account and recreating it, my “Service Book IDs” will keep changing and resulting in blah blah blah.
Finally, I got him (Don) to agree to try it out on a handset himself. So Don was adventurous and said he had no problems with his GMAIL working on his Blackberry. He went ahead and deleted his GMAIL account from his Blackberry and recreated it. Then he want to his GMAIL account and created a filter (for all messages with Subject:archive, “skip the inbox” and “marked as read”). Now I had him send a test message with the subject “archive” from another account to his GMAIL account. He now saw that archived message showed up in his Blackberry Messages “as opened”, which should not have happened. He said “Ah, I see what you are talking about now” and went to talk to an Analyst.
So now Don tells me, it seems to be an isolated case with my account and that he would look into it further. Gave me a case number and said that I should call back in a few days for status updates. What!?!?! I told him that he should “Google” it and see how many other cases of this problem there are. He said he would keep the ticket open for the next 5 days. Oh my goodness, Research In Motion really wants some more bad press?
Damn, must we provide them the code too? All they have to do is fix their “special code” (probably one conditional statement) which pertains to “imap.gmail.com” and no other servers. Most likely they have something that says if the IMAP server is “imap.gmail.com” then check “All Mail” folder instead of letting it check the standard “INBOX” folder like all other IMAP servers it checks.
If you have experienced this issue with your Blackberry, please add a comment below and/or a URL to your forum posts.
References:
http://cbs2.com/national/predator.drones.hacked.2.1375262.html
http://online.wsj.com/video/news-hub-was-us-intelligence-compromised/A0CDCC4B-0DB5-4C0E-A41C-FC2C16CA3BE7.html
I cannot believe the video feeds are NOT encrypted! In this day and age, what is the Department of Defense thinking?
©2012 Johnny Chin. All Rights Reserved.
References:
http://cbs2.com/national/predator.drones.hacked.2.1375262.html
http://online.wsj.com/video/news-hub-was-us-intelligence-compromised/A0CDCC4B-0DB5-4C0E-A41C-FC2C16CA3BE7.html
I cannot believe the video feeds are NOT encrypted! In this day and age, what is the Department of Defense thinking?
Avast tonight released their updated VPS 091203-0 signature file which has been causing a lot of grief to everyone around the world with false-positives for the trojan/worm Win32:Delf-MZG[Trj].
The only fix for now is to disable updates and go back to a previous signature file that is not “bad”.
Luckily I have another machine which has not yet taken down this update, so I saved the 400.vps file from C:\Program Files\Alwil Software\Avast4\DATA into my USB key. I then copied this older version of the 400.vps file onto the computer with bad 091203-0 VPS signature file. I placed it into C:\ for easy access later (because we will be using the Command Prompt, so everything would be typed).
Now on the computer with the bad VPS signature file,
disable the Avast updates by setting it to “Manual”.
Reboot the computer (assuming Windows XP) into
and type the following:
cd “C:\Program Files\Alwil Software\Avast4\DATA”
ren 400.vps 400.vps.091203-0.bad
copy C:\400.vps
(this is why I recommended putting it in C:\ above, less typing)
Then reboot the computer back to Normal mode.
Your Avast VPS signatures should now be reverted to the older version.
Good luck!
Update: December 3, 2009 8:25AM EST
Avast released an updated signature file (VPS 091203-1) that is suppose to resolve the bug. Goto http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=377
.
©2012 Johnny Chin. All Rights Reserved.
Avast tonight released their updated VPS 091203-0 signature file which has been causing a lot of grief to everyone around the world with false-positives for the trojan/worm Win32:Delf-MZG[Trj].
The only fix for now is to disable updates and go back to a previous signature file that is not “bad”.
Luckily I have another machine which has not yet taken down this update, so I saved the 400.vps file from C:\Program Files\Alwil Software\Avast4\DATA into my USB key. I then copied this older version of the 400.vps file onto the computer with bad 091203-0 VPS signature file. I placed it into C:\ for easy access later (because we will be using the Command Prompt, so everything would be typed).
Now on the computer with the bad VPS signature file,
disable the Avast updates by setting it to “Manual”.
Reboot the computer (assuming Windows XP) into
and type the following:
cd “C:\Program Files\Alwil Software\Avast4\DATA”
ren 400.vps 400.vps.091203-0.bad
copy C:\400.vps
(this is why I recommended putting it in C:\ above, less typing)
Then reboot the computer back to Normal mode.
Your Avast VPS signatures should now be reverted to the older version.
Good luck!
Update: December 3, 2009 8:25AM EST
Avast released an updated signature file (VPS 091203-1) that is suppose to resolve the bug. Goto http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=377
.
While enjoying Thanksgiving with family and friends this weekend, I was asked how to fix LimeWire? It would run but it kept saying it was “not connected”.
Well, a quick Internet search all turned up with suggestions on uninstalling and reinstalling LimeWire. This is great if you have the installer to the version that was installed on the machine readily available. In my friend’s case, that was not the case. Besides, he didn’t want to redo all of his settings (tweaks) which has been working great for years.
While tinkering around on his laptop, I started to think it would be a quick fix if I could make LimeWire re-download the list of current peers. Hopefully do this without losing all of the other LimeWire settings.
So here is the QUICK FIX, all WITHOUT losing the other LimeWire settings:
Exit out of LimeWire completely and make sure it is NOT running.
In Windows (I am sure there is a comparable equivalent on the Mac and Linux),
open the folder
(on some older profiles, it maybe in
Delete the file gnutella.net.
Restart LimeWire and it should download a new peers list.
The file gnutella.net is automatically recreated when you exit LimeWire.
NOTE: this worked for my friend’s LimeWire Pro v4.12.3; so it may or may not work with other versions. If it works or does not work for you please leave me a comment with your LimeWire version, so the info can help others.
I hope this little bit of information helps you.
©2012 Johnny Chin. All Rights Reserved.
While enjoying Thanksgiving with family and friends this weekend, I was asked how to fix LimeWire? It would run but it kept saying it was “not connected”.
Well, a quick Internet search all turned up with suggestions on uninstalling and reinstalling LimeWire. This is great if you have the installer to the version that was installed on the machine readily available. In my friend’s case, that was not the case. Besides, he didn’t want to redo all of his settings (tweaks) which has been working great for years.
While tinkering around on his laptop, I started to think it would be a quick fix if I could make LimeWire re-download the list of current peers. Hopefully do this without losing all of the other LimeWire settings.
So here is the QUICK FIX, all WITHOUT losing the other LimeWire settings:
Exit out of LimeWire completely and make sure it is NOT running.
In Windows (I am sure there is a comparable equivalent on the Mac and Linux),
open the folder
(on some older profiles, it maybe in
Delete the file gnutella.net.
Restart LimeWire and it should download a new peers list.
The file gnutella.net is automatically recreated when you exit LimeWire.
NOTE: this worked for my friend’s LimeWire Pro v4.12.3; so it may or may not work with other versions. If it works or does not work for you please leave me a comment with your LimeWire version, so the info can help others.
I hope this little bit of information helps you.
Using TCPview, I noticed that I had a lot of TCP connections opened to cpe-24-29-138-176.nyc.res.rr.com. That struck me as very odd. I thought I had spyware loaded on my computer or something, and that bug was phoning-home.
Upon further investigation, I find that whenever I reloaded a NewEgg page, especially if it was a page with lots of images, several of these TCP sessions would open up again. So I decided to look at the source code of the NewEgg page.
Doing a NSLOOKUP on the hostname c1.neweggimages.com gave me a very interesting result.
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 24.29.138.176, 24.29.138.186
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
The IP addresses 24.29.138.176 and 24.19.138.186, both are residential RoadRunner cable modem dynamic IPs according to NYC RoadRunner; reverse resolving to cpe-24-29-138-176.nyc.res.rr.com and cpe-24-29-138-186.nyc.res.rr.com, respectively. 
It struck me very odd that Akamai would use such home-grade dynamic broadband connections to provide their expensive edge-of-network services.
A few minutes later, I did another NSLOOKUP and the IPs changed, as it should with the Akamai service to spread the traffic around their servers.
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 209.107.209.91, 209.107.209.122
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 77.67.91.72, 77.67.91.122
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
And as I am writing this blog entry, c1.neweggimages.com now resolves to:
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 24.29.138.172, 24.29.138.162
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
Once again traffic routed back onto RoadRunner residential service in NYC (reverse resolving to cpe-24-29-138-172.nyc.res.rr.com and cpe-24-29-138-162.nyc.res.rr.com). Looks like Akamai is using a lot of residential IPs within the NYC RoadRunner network.
As a result, some of these residential IPs do not work all the time, causing the NewEgg (and now BUY.COM) pages not to load and just hang.
Would you pay Akamai to basically host your images at someone’s home using a cable modem?
I know I would not pay premium dollars to get stuff hosted at a home. I like the redundancy of a data center.
©2012 Johnny Chin. All Rights Reserved.
Using TCPview, I noticed that I had a lot of TCP connections opened to cpe-24-29-138-176.nyc.res.rr.com. That struck me as very odd. I thought I had spyware loaded on my computer or something, and that bug was phoning-home.
Upon further investigation, I find that whenever I reloaded a NewEgg page, especially if it was a page with lots of images, several of these TCP sessions would open up again. So I decided to look at the source code of the NewEgg page.
Doing a NSLOOKUP on the hostname c1.neweggimages.com gave me a very interesting result.
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 24.29.138.176, 24.29.138.186
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
The IP addresses 24.29.138.176 and 24.19.138.186, both are residential RoadRunner cable modem dynamic IPs according to NYC RoadRunner; reverse resolving to cpe-24-29-138-176.nyc.res.rr.com and cpe-24-29-138-186.nyc.res.rr.com, respectively. It struck me very odd that Akamai would use such home-grade dynamic broadband connections to provide their expensive edge-of-network services.
A few minutes later, I did another NSLOOKUP and the IPs changed, as it should with the Akamai service to spread the traffic around their servers.
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 209.107.209.91, 209.107.209.122
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 77.67.91.72, 77.67.91.122
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
And as I am writing this blog entry, c1.neweggimages.com now resolves to:
Non-authoritative answer:
Name: a200.g.akamai.net
Addresses: 24.29.138.172, 24.29.138.162
Aliases: c1.neweggimages.com, images10.newegg.com.edgesuite.net
Once again traffic routed back onto RoadRunner residential service in NYC (reverse resolving to cpe-24-29-138-172.nyc.res.rr.com and cpe-24-29-138-162.nyc.res.rr.com). Looks like Akamai is using a lot of residential IPs within the NYC RoadRunner network.
As a result, some of these residential IPs do not work all the time, causing the NewEgg (and now BUY.COM) pages not to load and just hang.
Would you pay Akamai to basically host your images at someone’s home using a cable modem?
I know I would not pay premium dollars to get stuff hosted at a home. I like the redundancy of a data center.
I just upgraded to Firefox 3.5 and realized that Microsoft snuck in (spyware-like installation, without user acknowledgment) an extension to Firefox 3.0 that is not compatible with Firefox 3.5, that extension is the Microsoft .NET Framework Assistant 1.0.
Microsoft has released a newer version of that extension, version 1.1, which is compatible with Firefox 3.5. However, Firefox 3.5 cannot automatically update to it, you have to do it manually and can be found here:
https://addons.mozilla.org/en-US/firefox/addon/9449
Well … being that I want to use Firefox and stay away from Microsoft’s browser and plug-ins, I wanted to find a way to remove the Microsoft .NET Framework Assistant 1.0 extension, since you cannot just click “Uninstall” like all the other extensions I have in Firefox. Besides, why would I want to keep an extension installed that I did not install myself? Would you knowingly keep a piece of spyware running on your computer? Heck no!
So digging around, I found clues on how to remove it. Here is a script that I wrote to remove the extension from the computer and remove it from Firefox. However, I still had to manually remove the additional information Microsoft added to the Firefox UserAgent header.
@echo off
echo Removing dotNET Assistant Extension files …
rd /s “%windir%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension”
echo.
echo Removing dotNET extension from registry …
REG.EXE DELETE “HKLM\SOFTWARE\Mozilla\Firefox\Extensions” /v “{20a82645-c095-46ed-80e3-08825760534b}” /f
echo.
echo.
echo MUST manually remove the UserAgent setting from each Firefox profile …
echo.
echo you can manually delete this line from each prefs.js:
echo user_pref(“general.useragent.extra.microsoftdotnet”, “(.NET CLR 3.5.30729)”);
echo.
echo or do it from “about:config” within Firefox
echo.
However, this code did NOT work for all of my workstations. I found that in those cases I needed to manually remove an entry from the registry, so I created this .REG file:
REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
“{20a82645-c095-46ed-80e3-08825760534b}”=-
Finally, to remove the added text from the UserAgent header in Firefox.
One way to do this is to simply open the prefs.js for your Firefox profile and remove the line which reads:
user_pref(“general.useragent.extra.microsoftdotnet”, “(.NET CLR 3.5.30729)”);
Or you can … in Firefox, type “about:config” into the URL box and you should see this:
Now in the filter box, type “useragent” and you should see something like this:
Right-click on the “general.useragent.extra.microsoftdotnet” line brings up a menu, select “Reset”.
Now close out of Firefox completely and restart it. You are now done.
Reference: http://support.microsoft.com/kb/963707
©2012 Johnny Chin. All Rights Reserved.
I just upgraded to Firefox 3.5 and realized that Microsoft snuck in (spyware-like installation, without user acknowledgment) an extension to Firefox 3.0 that is not compatible with Firefox 3.5, that extension is the Microsoft .NET Framework Assistant 1.0.
Microsoft has released a newer version of that extension, version 1.1, which is compatible with Firefox 3.5. However, Firefox 3.5 cannot automatically update to it, you have to do it manually and can be found here:
https://addons.mozilla.org/en-US/firefox/addon/9449
Well … being that I want to use Firefox and stay away from Microsoft’s browser and plug-ins, I wanted to find a way to remove the Microsoft .NET Framework Assistant 1.0 extension, since you cannot just click “Uninstall” like all the other extensions I have in Firefox. Besides, why would I want to keep an extension installed that I did not install myself? Would you knowingly keep a piece of spyware running on your computer? Heck no!
So digging around, I found clues on how to remove it. Here is a script that I wrote to remove the extension from the computer and remove it from Firefox. However, I still had to manually remove the additional information Microsoft added to the Firefox UserAgent header.
@echo off
echo Removing dotNET Assistant Extension files …
rd /s “%windir%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension”
echo.
echo Removing dotNET extension from registry …
REG.EXE DELETE “HKLM\SOFTWARE\Mozilla\Firefox\Extensions” /v “{20a82645-c095-46ed-80e3-08825760534b}” /f
echo.
echo.
echo MUST manually remove the UserAgent setting from each Firefox profile …
echo.
echo you can manually delete this line from each prefs.js:
echo user_pref(“general.useragent.extra.microsoftdotnet”, “(.NET CLR 3.5.30729)”);
echo.
echo or do it from “about:config” within Firefox
echo.
However, this code did NOT work for all of my workstations. I found that in those cases I needed to manually remove an entry from the registry, so I created this .REG file:
REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
“{20a82645-c095-46ed-80e3-08825760534b}”=-
Finally, to remove the added text from the UserAgent header in Firefox.
One way to do this is to simply open the prefs.js for your Firefox profile and remove the line which reads:
user_pref(“general.useragent.extra.microsoftdotnet”, “(.NET CLR 3.5.30729)”);
Or you can … in Firefox, type “about:config” into the URL box and you should see this:
Now in the filter box, type “useragent” and you should see something like this:
Right-click on the “general.useragent.extra.microsoftdotnet” line brings up a menu, select “Reset”.
Now close out of Firefox completely and restart it. You are now done.
Reference: http://support.microsoft.com/kb/963707
Blind Search – the search engine taste test
You should give it a try. It may be interesting to see how branding affects perceived search engine results.
NOTE: the programmer is working for Microsoft, but claims this side project has nothing to do with Microsoft. Hmmm… I wonder why bing.com is one of the search engines it queries. The other two being Google and Yahoo.
©2012 Johnny Chin. All Rights Reserved.
Blind Search – the search engine taste test
You should give it a try. It may be interesting to see how branding affects perceived search engine results.
NOTE: the programmer is working for Microsoft, but claims this side project has nothing to do with Microsoft. Hmmm… I wonder why bing.com is one of the search engines it queries. The other two being Google and Yahoo.
Then goto http://adblockplus.org/en/subscriptions and add the following lists (at the bottom of the list):
- EasyPrivacy+EasyList
- Malware Domains
- MySpace Junk Filters
©2012 Johnny Chin. All Rights Reserved.
Then goto http://adblockplus.org/en/subscriptions and add the following lists (at the bottom of the list):
- EasyPrivacy+EasyList
- Malware Domains
- MySpace Junk Filters
Watch this 80 minute video. It is worth every minute of it. It blows your mind as to what Google is doing. Top it off, they are going to make this thing open-source and make it available for free for everyone to use. For more information on the Google Wave API, goto http://code.google.com/apis/wave/.
The self-created text UI (user interface) that they showed during the last 10 minutes of the video is awesome! I just love the efficientcy of text UIs, it gets the job done (of course not for photos or other visually/graphically required stuff).
Personally, I would love to be able to develop this new Google wave platform. Cannot wait until it is opened to everyone.
Real-time message conversations, better than threaded. Not just e-mail like or IM-like, but it is like a textual and visual conference via your browser and the Internet. It shares photos in real-time. It links (actually integrates) to social networking sites. It can do so much integration it makes wave the new Office suite. Microsoft look out!
Their translation robot is great, especially for multilingual companies. The spell checking extension robot is so good that I think that it would make people even worse spellers. Now this is really something that would tap the power of high-speed broadband and fast processing computers to good uses.
©2012 Johnny Chin. All Rights Reserved.
Watch this 80 minute video. It is worth every minute of it. It blows your mind as to what Google is doing. Top it off, they are going to make this thing open-source and make it available for free for everyone to use. For more information on the Google Wave API, goto http://code.google.com/apis/wave/.
The self-created text UI (user interface) that they showed during the last 10 minutes of the video is awesome! I just love the efficientcy of text UIs, it gets the job done (of course not for photos or other visually/graphically required stuff).
Personally, I would love to be able to develop this new Google wave platform. Cannot wait until it is opened to everyone.
Real-time message conversations, better than threaded. Not just e-mail like or IM-like, but it is like a textual and visual conference via your browser and the Internet. It shares photos in real-time. It links (actually integrates) to social networking sites. It can do so much integration it makes wave the new Office suite. Microsoft look out!
Their translation robot is great, especially for multilingual companies. The spell checking extension robot is so good that I think that it would make people even worse spellers. Now this is really something that would tap the power of high-speed broadband and fast processing computers to good uses.
Why does Microsoft make it so difficult to find the links to download Internet Explorer 8 as a standalone installer? It use to be at the bottom of the stub-installer download page. Well after some digging, I found them and here are direct links to the standalone off-line installers of the release version of Internet Explorer 8.
Download links below are for the United States English version of Internet Explorer 8. Click on a link below to download for the operating system of your choice:
- Windows XP (32-bit)
- Windows XP (64-bit)
- Windows Vista (32-bit)
- Windows Vista 64-bit
- Windows Server 2003 (32-bit)
- Windows Server 2003 64-bit
- Windows Server 2008 (32-bit)
- Windows Server 2008 64-bit
If you want to download a localized versions of IE8 (other languages, etc), you can download them from here.
I needed these standalone installers for a client who wanted to upgrade all their workstations to Internet Explorer 8. 
Personally, I still prefer to use Mozilla Firefox.
©2012 Johnny Chin. All Rights Reserved.
Why does Microsoft make it so difficult to find the links to download Internet Explorer 8 as a standalone installer? It use to be at the bottom of the stub-installer download page. Well after some digging, I found them and here are direct links to the standalone off-line installers of the release version of Internet Explorer 8.
Download links below are for the United States English version of Internet Explorer 8. Click on a link below to download for the operating system of your choice:
- Windows XP (32-bit)
- Windows XP (64-bit)
- Windows Vista (32-bit)
- Windows Vista 64-bit
- Windows Server 2003 (32-bit)
- Windows Server 2003 64-bit
- Windows Server 2008 (32-bit)
- Windows Server 2008 64-bit
If you want to download a localized versions of IE8 (other languages, etc), you can download them from here.
I needed these standalone installers for a client who wanted to upgrade all their workstations to Internet Explorer 8. Personally, I still prefer to use Mozilla Firefox.
©2012 Johnny Chin. All Rights Reserved.
Just the thought of Google’s search technology and current relevant content (stuff people are Twitter’ng about) could mean a mega-advertising revenue stream for Google. I think if Google buys Twitter, we can possible see Google serving up ads in our Twitter feeds. It would be on of the most immediate direct-to-consumer model for marketing relevant ads. I predict that if this happens, the Google (NASDAQ:GOOG) would jump on the news.
©2012 Johnny Chin. All Rights Reserved.
Just the thought of Google’s search technology and current relevant content (stuff people are Twitter’ng about) could mean a mega-advertising revenue stream for Google. I think if Google buys Twitter, we can possible see Google serving up ads in our Twitter feeds. It would be on of the most immediate direct-to-consumer model for marketing relevant ads. I predict that if this happens, the Google (NASDAQ:GOOG) would jump on the news.
©2012 Johnny Chin. All Rights Reserved.