Slashdot Mirror

Tell me you've never gotten a sharing violation when using Windows.

Describe to me under what circumstances you would want to avoid reading from a file by two processes at once

Tell me you haven't rebooted when installing software.

That's not the point. The problem is that *developers don't*. They plop a zero in that field and don't worry about it.

On *IX, you blow away a file, and the OS refcounts the thing. It doesn't break any applications currently using the file -- the file just doesn't have a directory entry any more, and when the last application using a file goes away, so does the file.

I could be wrong, but I doubt that Process Explorer will let me kill off said handles from a remote system (and certainly not if the access is from a different account...I might even have to go sit in front of the file server to run Process Explorer...I'll admit that it could have been handy other times that I've run into issues though, and didn't know about it).

On UNIX, you have to go out of your way to lock the file if you want exclusive access (and even if you do so, the lock is merely advisory -- forced locks are done via the permission system). The default is to *not* have a file locked.

Guess which is a more common problem -- issues caused by files not being locked when they should, or the dreaded "sharing violation"?

Plus, the aforementioned "sharing violation" is why Explorer frequently can't delete directories (in XP this is "fixed" to become a silent failure rather than popping up a messagebox alerting the user that the directory could not be deleted)

It isn't a real-world issue, but it's probably something that the article author heard from some Windows guy who had once run into *IX and been surprised by the way things work.

Are you sure?

1. Except for the fact that you're wrong. MS Office does NOT have anything loading it at startup. This is a FACT. OO.org just has performance issues; admit it!

Ever used this?

The win32 api is not the system call interface in NT. The native api is. When you call a function from win32 it must be translated into a native api function. It is much simpler than win32 but more complex than unix's syscall api. NT has something sorta similar to jail: different sessions each have a seperate directory of objects.

The NT object manager is sort of like the virtual filesystem in Linux. Every device is named under the \Device object directory. For example, win32 has a symbolic link from "C:" to "\Device\HarddiskPartition1" which links the drive name to the actual device. Every object has a seperate ACL, and every session has a seperate directory, so C: in one session could be connected to something totally different in another session, or nothing at all.

Still, processess can get to anything in the object manager, if they go around win32 and have access in the object's ACL.
For more information, check out the winobj tool from Sysinternals, or one of their articles about the Windows NT native api.

• Trend Micro Damage Cleanup - Free, Effective at catching a multitude of viruses and malware (Detects some spyware as trojans or adware)
• Spybot Search & Destroy
• Ad-Aware
• CWShredder - Kills CoolWebSearch variants
• HijackThis! - Powerful general tool for cleaning up what the others miss
• LSPFix - to fix broken LSPs that interfere with Windows' TCP/IP stack

...generally you had to re-install to get good performance again

I've actually had good luck with SysInternal's Page Defrag program for getting back that "fresh from the install" feeling. Defrags both the paging files and the registry files.

Actually you can go to http://www.sysinternals.com/ntw2k/freeware/ntfsdos pro.shtml and download their utility. It is a DOS boot disk with ntfs support. Slap a second drive in the machine and copy away. Ive used it a few times and it works rather well.

Though I don't have a Win2K machine handy to test right now, I don't believe it's normal for that port to be open for no reason. I can verify that neither my WinXP PC and my Win2003 server have it open, and I don't recall it ever being opened on Win2K.

Are you running Win2K Professional? Do you have the RRAS service running? Have you tried any diagnostic tools like TCPView to isolate the process? Up to date virus scan and adware scans? Any communication on that port? Any odd processes in TaskManager? If you shutdown background tasks, does that port remain open? Oh, and since you seem to be lacking in ability, how did you come to the conclusion that port was open?

..,no one has taken the time to document how nor post the solution where it can be found.

The solution is simple. Stop the process listening on that port. I don't think anyone needs to write a HOWTO on that. And seeing that I haven't heard of anyone else complaining about this (nor seen it myself), I'm inlcined to believe it's something unique to your setup - not Windows.

I have found that most security issues that abound in the Wide World of Windows occur because those in the know, do not.

I think, phnork, that you may want to hold off on your anti-MS diatribe until you find what the issue actually is. Dollars to doughnuts it's your fault, not MS.

• #1. Get FlashDesktops, you have to pay for it, but it is utterly wonderful. Multiple desktops on windows as fast as Xwindows.
  http://flashdesktops.com/
• #2. Get UxUtils, NATIVE ports of lots of great unix apps.
  http://unxutils.sourceforge.net/
• #3. Get The Bat!, it is a wonderful email client, fast, simple, can be totally driven by keyboard. http://www.ritlabs.com/en/products/thebat/
• #4. Get FireFox, it is a wonderful browser on linux AND windows (I actually prefer the windows version). http://www.mozilla.org/products/firefox/
• #5. Get gVim, vim is great on linux, great on windows too! http://www.vim.org/
• #6. Get OpenOffice, great on both platforms. http://www.openoffice.org/
• #7. Get WinSCP, a wonderful SCP/SFTP client for windows. http://winscp.sourceforge.net/eng/
• #8. Get Putty (and friends), wonderful ssh client and other utils. http://www.chiark.greenend.org.uk/~sgtatham/putty/
• #9. Get everything from sysinternals, a ton of wonderful stuff here, too much to mention, but will let you track every file access, every registry write, every debugging message. Look around, it gives you control of your box like you expect on a *nix. Ton of great command line tools too. http://www.sysinternals.com/
• #10. ClearTweak, a tool to let you customize your ClearType settings (a must for LCDs). http://www.ioisland.com/cleartweak/
• #11. Daemon Tools, lets you mount up to 4 ISO's as drives, and can emulate security protection. http://www.daemon-tools.cc/portal/portal.php
• #12. Memstat XP, lets you monitor memory usage in tray, small and simple. http://memstat.sourceforge.net/
• #13. NetMeter, lets you monitor network usage in the tray, small and simple. http://readerror.gmxhome.de/
• #14. TrayMeter, lets you monitor cpu usage in the tray, small and simple. http://www.thmundt.com/traymeter/
• #15. TweakUI, get control over some things you might want (like hover-to-focus, autologin, other). http://www.microsoft.com/windowsxp/pro/downloads/p owertoys.asp
• #16. WinRoll, lets you roll up windows just like in lots of windows managers on linux. http://www.palma.com.au/winroll/
• #17. XP Log Reader, lets you watch the XP firewall logs. http://www.winxpcentral.com/windowsxp/fwlog.php
• #18. WinRAR, unzip anything you want, supports tar.gz, zip, rar, arc, and much more. http://www.rarlab.com/
• #19. Beyond Compare, best tool for comparing directories or files, great for syncing backups. http://www.scootersoftware.com/
• #20. Nero, the best CD writer for windows. http://www.nero.com/us/index.html
• #21. WinDVD, watch movies! http://www.intervideo.com/jsp/Home.jsp
• #22. WinImage, create images from CDs, very

Then why, when I create a shortcut in Explorer.exe of Windows 2000 or Windows XP, do I get an ordinary file whose name ends in .lnk rather than a junction? And can the junction utility link to a file rather than to a folder?

NTFS supports links (and no I dont' mean shortcuts either) but Microsoft never really made public tools.

For example, here's one tool at Sysinternals that does directory symlinks. Before Win2k went gold, there was an MSJ article that discussed how to write your own version of "ln" for NTFS. Since I'm AC and not karma whoring, you can dig it up yourself ;)

Sysinternal's Blue Screen Saver

Now emulates startup screens too!

All anyone seems to be pointing to is the source tree listing in a text file. Wow.

Such a listing for XP has been available on the Sysinternals site for years:

XP Source Tree

Sysinternals has the layout of the XP source based on information in the checked builds. (Yes, it runs very slow)

Not quite true. See here (scroll to the "Junction" header)

You might want to add this to your arsenal as a quick and easy way to see what can be run on startup.

Autoruns from Sysinternals (freeware)

Does this help? Sync is a free program that assures that all information in the cache is written to disk.

However, the volume must not be mounted when you remove the hardware. Try running CHKDSK against the drive letter you want to remove. If it tells you that something is using the drive, make sure that nothing is: 1) installed from the drive, 2) or thinks it is using something on the drive. That includes open DOS windows. Also, it might help if the Firewire drive is formatted as FAT32. I've seen instances where NTFS will think that something has gone wrong when it hasn't, and will try to repair something that isn't damaged, but rolling back to an earlier disk image.

I'm not saying you are wrong about data loss; I don't have enough experience.

GDI is a subset of Win32; the native (executive) api does not handle graphics functions. Historically (before nt4) GDI was implemented entirely out-of-process by csrsrv.dll in csrss.exe (the win32 subsystem server). But starting with nt4, most of win32 moved into kernel mode (supposedly for speed) in win32k.sys, and the kernel itself became more dependent on win32. Here is a link to more information.

Use Handle from Sysinternals. There may be something similar in the Resource Kits.

Symlinks. They aren't hard to implement. But Windows doesn't support them (shortcuts don't count because they don't work transparently or at a filesystem level). Cygwin helps with this (fairly well, actually), but only for cygwin applications.

NTFS does infact support symbolic links and also mounting a NTFS partition the same way as you can do with the mount tool.

There is no mention of symlinks in the GUI (they appear as normal directories and there is no UI option to create them). cmd.exe's dir command shows symlinks differently than a directory though.

The Windows 2000 Resource Kit has a few tools that can mount a partition on a mount point. System Internals have also released a utility called junction that can do the equivilant of symbolic links.

Don't use Explorer to remove a junction point though, the naive SHFileOperation function deletes all contained files and directories before deleting the symlink. As with dir, rmdir in cmd.exe works correctly with symbolic links.

There's filemon too, http://www.sysinternals.com/ntw2k/source/filemon.s html

Sysinternals is cool.

I just discovered this the other day...

The registry key
HKEY_CURRENT_USER\Control Panel\Desktop\WaitToKillAppTimeout
(And if it isn't that one, just search the registry for 'WaitToKillAppTimeout')

is defaulted at I think 5000ms. Changing this to 0 gives you back that "shot to the head" effect.

Also, others have mentioned the desire for lsof or other such things...

go checkout SysInternals. They have tons of freeware monitor file handles , processes, threades, memory, DLL Accesses, port accesses, disk accesses, ...

Process Explorer

Give Process Explorer a try. It even allows you to close the offending open handle without killing the process if you are feeling lucky.

pstools from sysinternals will give you something very much like kill -9

...which I might have correctly linked to, had I previewed my post.

New SID

You might try giving them access to the registry. Also there are two programs that lets you peek at what a program is doing to the file/registry.

http://www.sysinternals.com/ntw2k/utilities.shtml

BR

And those not responding processes that Windows can't close are fun too, like if the Visual Studio .NET IDE crashes, I've ran into situations where you can't close it from the task manager, it's still there and using 99% cpu if you log off and log back on, and you must flip the switch to shut down your PC.

Also exciting are the local Access Denied messages you sometimes get when logged in as Administrator, which can get in your way when trying to close a misbehaving process.

I can't stress enough how badly you want to download PStools

This will allow you to view hidden processes that Windows does not normally expose to the task manager, and kill just about anything, even the normal "access denied" processes.

Every windows admin needs this.

I'll also recommend Microsoft Baseline Security Analyzer, which lets you check computers for "common misconfigurations", i.e. missing patches, trivial passwords, etc.

Also, if you are a *nix guy, put a GNU/Linux or *BSD box on your network. If nothing else, just for tools like nmap etc. While most of it is available for Win32 too, it's so much eazier to just apt-get what you need instead of hunting for an outdated, buggy Win32 binary.

Interestingly, if you're looking to repair unbootable NT/2k/XP partitions (or blag the SAM file by booting off a DOS floppy), the read-only version works on all versions of NT I've tried it on. Unfortunately, due to the reliance on the Windows ntfs.sys in the read-write version, one boot disk can't access all NT types (even actually amongst service packs). Both are still available afaik, at sysinternals.com

They have an NTFS for Win95/98 product which provides access to NTFS disks from Win95/98. The limitations are that they don't provide the NTFS security model support (i.e. all files are accessible) and they dont support the encrypting file system.

See here for details.

SysInternals used the same technique in NTFS for Windows98 a long time ago.

While I love the idea, I'm puzzled why it took this long for the Linux community to catch up...

Administrator may not have SYSTEM level access, but he has the privilege to promote himself to it. Process Explorer, for example, promotes itself to system level access, and can subsequently kill everything. Try killing LSASS.EXE, it's fun.

Install it on your computer at work if you have the permissions

Actually, to follow up to myself, NTFS's hardlinks more closely match POSIX hardlinks than symlinks. They also refer only to files, not directories.

For directories, NTFS supports a generic reparse point mechanism, that allows developers to add this sort of functionality. One out-of-the-box supported reparse point is a Junction. No out-of-the-box tool to create them, unfortunately.

Have you tried Junction? It allows you to link a directory on one drive to another drive and directory. "For example, if the directory D:\SYMLINK specified C:\WINNT\SYSTEM32 as its target, then an application accessing D:\SYMLINK\DRIVERS would in reality be accessing C:\WINNT\SYSTEM32\DRIVERS". I'm pretty sure I've read about people using this to mount network drives on their local drives (and also CDs onto hard disks - which generally confuses installers no end).

This is Windows 2000 Sysprep Tool 1.1. The latest version is 2.0, apparently. This is not available on the Internet, apparently.

Sysprep only 1) changes the SID, and 2) sometimes helps with IDE drivers. Sysprep does NOT make backups, as some seem to imply.

I haven't used it, but judging from Microsoft's documentation, NewSID from Sysinternals may be better. Microsoft says that SIDs can become unsynchronized so that Sysprep cannot fix them.

Win2K's version of NTFS supports directory symbolic links, where a directory serves as a symbolic link to another directory on the computer. For example, if the directory D:\SYMLINK specified C:\WINNT\SYSTEM32 as its target, then an application accessing D:\SYMLINK\DRIVERS would in reality be accessing C:\WINNT\SYSTEM32\DRIVERS. Directory symbolic links are known as NTFS junctions in Win2K. Unfortunately, Win2K comes with no tools for creating junctions - you have to purchase the Win2K Resource Kit, which comes the linkd program for creating junctions. I therefore decided to write my own junction-creating tool: Junction. Junction not only allows you to create NTFS junctions, it allows you to see if files or directories are actually reparse points. Reparse points are the mechanism on which NTFS junctions are based, and they are used by Win2K's Remote Storage Service (RSS), as well as volume mount points.

We got caught out by Welchia by someone kindly connecting an infected laptop directly into the network behind the firewalling. Ironically this was possible due to a mistake in SMS package deployment (was done hastily - my fault).

My solution was to deploy honeypot windows machines running snort which reported into a central SQL server database.

Using Windows scripting host, I then wrote a script that ran periodically on a network management workstation which queried the database, creamed off the last machine that was an infector and using the wonderful free PS Tools from Sysinternals automatically determined what OS the machine was running (PSInfo), updated its antivirus signatures (PSExec), de-wormed the machine using the Symantec "FixWelch" utility (again using PSExec), decided if the machine was up to service pack spec (data from PSInfo) and if not service packed it (PSExec) then applyed the patches to prevent re-infection (PSExec).

All worked a treat.

I'm kind of glad we got hit because as a result I can now insist machines get patched (previously people would complain about a "box on the screen" (SMS installer)) while also being able to remove machine admin rights across the board and ban any machines that are not ours from being connected on pain of a disciplinary offence.

A lot of work but ultimately, I WIN. MOO HAR HAR!!

We got caught out by Welchia by someone kindly connecting an infected laptop directly into the network behind the firewalling. Ironically this was possible due to a mistake in SMS package deployment (was done hastily - my fault).

My solution was to deploy honeypot windows machines running snort which reported into a central SQL server database.

Using Windows scripting host, I then wrote a script that ran periodically on a network management workstation which queried the database, creamed off the last machine that was an infector and using the wonderful free PS Tools from Sysinternals automatically determined what OS the machine was running (PSInfo), updated its antivirus signatures (PSExec), de-wormed the machine using the Symantec "FixWelch" utility (again using PSExec), decided if the machine was up to service pack spec (data from PSInfo) and if not service packed it (PSExec) then applyed the patches to prevent re-infection (PSExec).

All worked a treat.

I'm kind of glad we got hit because as a result I can now insist machines get patched (previously people would complain about a "box on the screen" (SMS installer)) while also being able to remove machine admin rights across the board and ban any machines that are not ours from being connected on pain of a disciplinary offence.

A lot of work but ultimately, I WIN. MOO HAR HAR!!

It is as much a technical legacy as a mental legacy. For example, many setup programs tell you to shut down all other programs before installing, and tell you to reboot when the install is done. This isn't necessary, and savvy windows users know this. Also, with NT/2K/XP/2K3 it's often sufficient to restart a service rather than the system when installing stuff that actually *does* get into the internals. It works somewhat crummier than /etc/init.d scripts (though it does handle dependencies, yay), but even so.

The "file in use" problem does exist however, and it is completely braindead. In fact, I've seen this error multiple times relating to files that were put there by *virusses* rather than the OS. Interestingly, it's usually sufficient to drop down to a CMD.EXE prompt to DEL files that are supposedly "in use". ATTRIB is also a useful command, even in NT/2K/XP. I believe this is down mostly to the crapfulness that is explorer.exe, rather than to the OS per se.

Also, checkout pslist and pskill from http://www.sysinternals.com/ - these tools will kill processes that the "Task Manager" won't. Again, including virusses/trojans! (the cygwin ps and kill tools probably will work just as well).

I use SMS for the bulk of the machines. I scan afterwards to see if any were unplugged, turned off, etc. If so, I use psexec from sysinternals to remotely execute it on any unpatched machines.

A less flexable, and much less expensive solution is microsoft's SUS

Money is indeed a very good reason, or rather, the lack of it. It impels those of us working in UK government departments (or local government, in my case) to adopt free and open source solutions simply so we can do our work effectively. MRTG, Nagios, KiXtart, and SysInternal's PSTools are all tools in my arsenal, and because they were free I just went and used them. No management financial decisions were needed, so a lack of budget couldn't get in the way of us doing our job properly.

The problem is that many in IT in the UK Civil Service (why do thay call it that, it's neither civil nor a service these days?) wear their Microsoft / Oracle / whatever they were brought up on blinkers, and feel / are way out of their depth when it comes to IT which involves more than point and click.

What the Office of Government Commerce is trying to remind Central and Local Government is that their solutions should be cost-effective.

For too long those in central and local government here have have taken tax incomes for granted. It's not like the real world where if you screw up your business goes under. The money flows in no matter how wasteful you are. It's worse than that, actually, for if you do a good job and shrink your expenditure, your budgets get cut, whilst habitual overspenders get their budgets increased. Crazy, huh?

Last time I checked it was still "experimental" "dangerous" "data loss" blah blah blah.

How about NTFS support that you can really use. I want to be able to treat an NTFS partition no differently than an ext2 partition. Also, the whining about it's undocumented and "Microsoft keeps changing the spec" hasn't affected these guys any. They managed to figure it out on their own and created a company to sell their DOS version and several other versions with full NTFS read and write support. It has been available for years.

Last time I checked it was still "experimental" "dangerous" "data loss" blah blah blah.

How about NTFS support that you can really use. I want to be able to treat an NTFS partition no differently than an ext2 partition. Also, the whining about it's undocumented and "Microsoft keeps changing the spec" hasn't affected these guys any. They managed to figure it out on their own and created a company to sell their DOS version and several other versions with full NTFS read and write support. It has been available for years.

Mozilla Firebird
Proxomitron filtering proxy
WinKey Killer (Other free apps on this somewhat dated site)
IrfanView
SysInternals monitoring apps

Other have already mentioned Cygwin, AVG, Anti-Vir and Ad-Aware. Still use an older version of Kerio Personal Firewall before it became shareware.

...are the SysInternals tools just in case I want to be serious about what the box is doing, and the Textpad editor in case I want to be serious about editing.

And it's never a bad idea to have the Microsoft Baseline Security Analyzer handy.

Mind you, this is not a registry thing because you actually need code to run it. With this, caps lock will go uppercase, and CTRL will release the lock.

Get Filemon and Regmon from sysinternals.

Set the filter to highlight ACCESS_DENIED (in Filemon) and ACCDND (? I think) (in Regmon). Run any program you want, and see what it does wrong.

Some programs are irreperably stupid. Others like trillian are relatively isolated.

The way I run trillian is that I set the "users/" directory ACL to Users rw-. And you will be able to run it as non admin.

I run SecureCRT and VShell too, I don't know for earlier version, but for later versions they run perfectly fine too. If you have issues, do the above method, and find out what they are trying to access.

Btw, if you get access denied's in the registry, you can change the ACL for a key as well using regedt32.exe in Win NT/2k, and regedit.exe in WinXP.

All part of sensible configuration. Granted, normal users wouldn't be able to figure this out, but normal users wouldn't use SecureCRT either.