Rootkit Inspection

Check these utilities out:

1. GMER
2. Microsoft Rootkit Revealer - by SysInternal
   
3. IceSword

How to find out window environment values another way

Normally, you would show the System Properties window.



Method 1 - Navigate via MyComputer
Right click on the My computer -> Properties -> Goto Advanced tab -> Click on Environment Variables. Then see Temp = %USERPROFILE%\Local Settings\Temp


Method 2 - msinfo32
Type msinfo32 in the run command.


Method 3 - Dos command
Open command prompt by typing in cmd. type the following:
echo %path%

Method 4 - Powershell tool
Open powershell and type
4.1) $env:path // show envrionmen vairable ("path")
4.2) [Environment]::GetEnvironmentVariable("path")


How to show all environment vairables in powershell
Get-Item $env:* or env:*

Save and restore Powershell history session

Use this command to store powershell session history into xml file
Get-History | Export-Clixml "c:\scripts\my_history.xml"

Use this to restore Powershell history from file.
Import-Clixml "C:\PowershellSession.xml" |Add-History

How to show the list of command history?
h or Get-History

How can i find out the alias for Get-History?
Get-Alias -Definition Get-History



What to do if I have duplicate command in the history?
We wish to have a unique entry per command. Edit the window properties and check 'Discard Old Duplicates'.

Set command window to powershell background

The colour for powershell window background RGB(1,36,86). You can set your command window to the same colour.

Shortcut key to show Window system properties

Try [WindowKey] + break.

Alternatively, type sysdm.cpl in run.

How to hide vista users at Welcome screen

1. Type regedit to run Registry Editor
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList.
3. Create folder for SpecialAccounts or UserList in the registry order above if it's not found. Right click on the Winlogon folder in registry editor and select new folder to create the folder.
4. Create a new DWORD(32 bits for 32bits vista os) key with value 0 (as default) under UserList registry folder. Name the key as the vista login you would like to hide.
5. For example, if your vista login name is Belacan. Then the new key should be belacan (case in-sensitive).
   
6. The DWORD value 0 indicates hiding. You can set the value to 1 if you would like to show it in the future.
   

Disable Vista 'Need your permission to continue'

Whenever a user performs what window think it potentially risky operation, the following message is displayed to warn and asked for confirmation.



How to disable it?

1. Open control panel, type user account in the search box.
2. Click on 'Turn User Account Control (UAC) on or off.
3. Uncheck the the tickbox and restart window.
4. Voila. No more annoying pop-up.
   

Window Azure

Window Azure is the new buzzword recently from Microsoft. It's just a platform to host and run application at Microsoft data centres. Thus, cutting the needs to maintain and invest in your own hardware.

Load balancing, workflow, SQL data services , Live/Active Directory authentication are part of the hosting package. There is 5 services that developers can develop application on that run in the cloud - Live Services, .Net Services, SQL Services, SharePoint and Microsoft CRM.



Microsoft Definition:
The Azure™ Services Platform (Azure) is an internet-scale cloud services platform hosted in Microsoft data centers, which provides an operating system and a set of developer services that can be used individually or together.

The other benefit is scale-as-you-go. Imagine you develop an apps and released to production (deployed to Azure Services Platform). The customer response is surging and your site can't cope with the traffic.

If the apps is hosted in Window Azure platform, a flip of switch ( change of config file instance properties from 1 -> 200) will enable your app instances to increase to what is specified.



However, cloud computing is not new. Companies such as Google (Google App Engine), Amazon (Amazon S3 and Web Services) and IBM (Blue Cloud) have been offering their services for some time.


Further references:
http://www.microsoft.com/azure/windowsazurefordevelopers/Default.aspx?path=AzureWhitePapers

Azure .Net service
http://msdn.microsoft.com/en-us/azure/netservices.aspx

Crash Dump Analysis

My window crashes recently and left me a 171Mb Memory.dmp file at c:\windows. I decided to find out more about what happened. Windbg download from here.

Open WinDbg and load the symbol server from the link below: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Open Crash Dump/Ctrtl+D and open c:\windows\memory.dmp.



To be continued .... (quite busy recently)

C# Delegate put in use

A deeper look into delegate use just blown me away. It make the code so modular and clean that the old way of passing in object and dependencies changes issues is resolved.

What is delegate?
Delegate is a type that can associate with any method with compatible signature. It's like pointer to function.

Delegate declaration and usage

1. Declare: delegate signature(parameters)

public delegate void ProcessBookDelegate(Book book);

2. Instantiate delegate instance and associate with handler method
bookDB.ProcessPaperbackBooks(PrintTitle);
bookDB.ProcessPaperbackBooks(totaller.AddBookToTotal);

3. Subscriber method and Invoke: SubscriberMethod(delegate name)

public void ProcessPaperbackBooks(ProcessBookDelegate processBook)
{
processBook(mybook);
}

The above example in details. What the code achieved is call different method via a common method (depending on the which method is associated with the delegate)
http://msdn.microsoft.com/en-us/library/ms173176.aspx


What are the type of delegates?

1. Covariance - delegates can be used with methods that have return types that are derived from the return type in the delegate signature. In other words, the delegate signature can returns type of base class or inherited type.
   
2. Contravariance - subscriber can use the same delegate to handle different method as long as the delegate signature base type is the same. A muticasting example, Base class - Vehicle has children class Truck and Car. Subscriber class - .OnTheMove += Truck.Move + Car.Move.
   

Examples:

1. Object type is passed in at run-time.

public delegate void Del(T item);
public void Notify(int i) { }

Del<int> d2 = Notify;

Further reading:
MSDN Delegate reference guide
http://msdn.microsoft.com/en-us/library/ms173174.aspx

Simple Direct Examples
http://www.akadia.com/services/dotnet_delegates_and_events.html