Event Type: Error
Event Source: DataAccessLayer
Event Category: None
Event ID: 26308
Date:  3/11/2010
Time:  11:30:01 AM
User:  N/A
Computer:
Description:
Query notification processing failed due to a sql exception.

System.Data.SqlClient.SqlException: A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 – The semaphore timeout period has expired.)
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlCommand.CheckThrowSNIException()
at System.Data.SqlClient.SqlCommand.InternalEndExecuteReader(IAsyncResult asyncResult, String endMethod)
at System.Data.SqlClient.SqlCommand.EndExecuteReader(IAsyncResult asyncResult)
at Microsoft.EnterpriseManagement.Mom.DataAccess.QueryNotificationManager.HandleNotifications(Object state)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Health Service Modules
Event Category: Data Warehouse
Event ID: 31569
Date:  3/11/2010
Time:  11:30:03 AM
User:  N/A
Computer:
Description:
Report deployment process failed to request management pack list from Data Warehouse. The operation will be retried.Exception ‘InvalidConnectionException’: ExecuteScalar requires an open and available Connection. The connection’s current state is closed.

One or more workflows were affected by this.

Workflow name: Microsoft.SystemCenter.DataWarehouse.Deployment.Report
Instance name:
Instance ID: {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
Management group:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:30:39 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectDiscoveryData
Instance    :
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:30:39 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectAlerts
Instance    :
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:30:39 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectPerformanceData
Instance    : yksc1s3.ehit.org
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:31:18 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectEventData
Instance    :
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:31:18 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectSignatureData
Instance    : yksc1s3.ehit.org
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Warning

Event Source:   OpsMgr Connector

Event Category:            None

Event ID:          20058

Date:                2/6/2010

Time:                2:00:17 PM

User:                N/A

Computer:

Description:

The Root Connector has received bad packets which have been dropped. It received 8374 such packet(s) in the last five minutes

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Does your Windows machine feel more sluggish than usual? Are you getting little notifications on your taskbar that “You may not be protected”? You may have spyware or malware running a muck on your pc. Malware is getting increasingly crafty and find new places to hide and make it very difficult to get rid of. Some malware even disables your anti-virus protection to avoid being detected. The best way to deal with spyware and malware is stop them from running so anti-virus and anti-spyware programs can better clean your machine. Here are a few steps and places to check to stop spyware and malware before you run a scan.

1. Boot into Safe Mode

Booting into safe mode starts the computer with a minimum set of programs and drivers, which means some Spyware won’t run either. Restart the computer and hit the F8 key repeatedly before Windows starts. Choose Safe Mode when presented with a menu.

2. Log in as administrator

Don’t login with your normal user name. Your profile will automatically run some programs that you are not aware of and that includes malware. Once you have cleaned up you machine a bit you can then login with your account to finish cleaning. If you computer automatically logs in, Click start and Log Off. After you are at the logon screen, hit Ctlr+Alt+Del twice to bring up the user dialog box. Type in administrator and hit Enter since the password should be blank. If this doesn’t work, just login with you account. We’ll still get’em.

3. Edit or Replace your host file windows\system32\drivers\etc\hosts file

This file bypasses DNS and can be used by malware to redirect you to a malicious website. When you type citibank.com it could be taking you to a site that looks like citibank but isn’t. Unless you have a good reason to have any data in this file it is better to delete the contents of the file. Go to Windows\system32\drivers\etc\ and double click on the hosts file. Choose notepad as the program to open this with. Highlight and delete the information in this file and save it.

4. Check the corners of you registry.

Before editing the registry you should save a backup of it. http://support.microsoft.com/kb/322756

Note: you need to log in to each user account on the computer and check the HKEY_CURRENT_USER registry key for each user since it will be different for each user that logs in or you risk getting infected again after that user logs on.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
“Program”=”c:\runfolder\program.exe”

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
“Program”=”c:\runfolder\program.exe”

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“Program”=”c:\runfolder\program.exe”

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
“Program”=”c:\runfolder\program.exe”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Program”=”c:\runfolder\program.exe”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
“Program”=”c:\runfolder\program.exe”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
“Program”=”c:\runfolder\program.exe”

These reg keys will run programs. The key should have a default value of Value “%1 %*”, if this is changed to “program.exe %1 %*”, the program.exe will be executed EVERYTIME an exe/pif/com/bat/hta is executed.

[HKEY_CLASSES_ROOT\exefile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\piffile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @=”\”%1\” %*”

Explorer start-up:

Explorer runs your start menu and desktop and start every time you start windows. Check to see if the registry is pointing to explorer.exe or if it is pointed to another executable.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell

Active-X Component:

This key starts the program that it has in its path BEFORE the explorer.exe file and any other program starts in your computer, so if you can understand why your antivirus can’t detect the virus when you boot up. It could even kill your antivirus software before your antivirus starts up.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]
StubPath=C:\PathToFile\Filename.exe

5. Start Up

Here are the many places where programs get run at startup. Look at each item carefully. Find the name and path of the program that is being run. If you do not recognize it, search for it on the web to see if it is legit.

Look in the following folders and check that the registry entry to verify that they pointing to the default location listed

C:\windows\start menu\programs\startup

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup=”C:\windows\start menu\programs\startup”

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup=”C:\windows\start menu\programs\startup”

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
“Common Startup”=”C:\windows\start menu\programs\startup”

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
“Common Startup”=”C:\windows\start menu\programs\startup”

6. Windows Scheduler:

Scheduled Tasks are a place where normally you can set a program or command to run at a certain time or every 5 minutes, so it’s a good place to check.

Go to Start-> Accessories-> System Tools-> Task Scheduler

Some tasks don’t show up in the GUI so in a command prompt type: “at”

Press enter.  You should see a list of tasks that are in the Task Scheduler GUI and some that may not.

7. Batch files

Open the following files in notepad and look for any odd programs that are listed. You can comment out the program by putting REM at the start of the line so it will be ignored.

c:\windows\winstart.bat

c:\Autoexec.bat

Removing  Spyware and viruses

After checking all these dark corners of you computer and removing any potentially malicious programs from starting, you are giving you anti-virus and anti-spyware software the best chance to find and remove the malware.

AVG Free is a good free Antivirus program that detects many types of malware as well as viruses. Three effective anti-spyware programs are Spybot Search & Destroy, Malware Bytes, and AdAware. One pass of each of theses programs will clear your system of any unwanted processes slowing your machine down. Good Luck.

A few days ago the fan on one of the XFX nVidia GeForce 8800GS Alpha Dog cards in my gaming rig died. There are a pair of them in a SLI configuration and when the fan died on one, it overheated and shut down the system. As a safe gaurd, the system would not turn on with the bad card installed.

At first I thought it was the power supply. I got a RMA on the Ultra 650W power supply and got a 750W upgrade. After replacing the PS, the system would still not even post. So as part of troubleshooting, I stripped the system down to minimum components (No hard drive, single memory stick, one video card). The system booted with one video card installed, and started beeping at me with the other card installed.

I contacted XFX to get my 1 year old video card replaced/fixed. I an RMA for the card and XFX determined it was a faulty card. No sooner that I got the email from XFX about the faultly card, the other card went bad. I actually heard the fan come to a screeching halt. XFX informed me that they no longer make the 8800GS card and offered me a free upgrade to the GeForce 9800GT! Before they even knew the second card went south, XFX offered a free RMA upgrade to a 9800GT for the second card since they were in an SLI configuration. So kudos to XFX for standing behind their products and offering great service.

Online Backup

This method is becoming increasingly popular way of  backing up data over the internet. An article I wrote shows how to be your own online backup provider.
Full backup

A full backup, which Microsoft calls a normal backup, backs up every selected file, regardless of the status of the archive bit. When the backup completes, the backup software turns off the archive bit for every file that was backed up. Note that “full” is a misnomer because a full backup backs up only the files you have selected, which may be as little as one directory or even a single file, so in that sense Microsoft’s terminology is actually more accurate. Given the choice, full backup is the method to use because all files are on one tape, which makes it much easier to retrieve files from tape when necessary. Relative to partial backups, full backups also increase redundancy because all files are on all tapes. That means that if one tape fails, you may still be able to retrieve a given file from another tape.
Differential backup

A differential backup is a partial backup that copies a selected file to tape only if the archive bit for that file is turned on, indicating that it has changed since the last full backup. A differential backup leaves the archive bits unchanged on the files it copies. Accordingly, any differential backup set contains all files that have changed since the last full backup. A differential backup set run soon after a full backup will contain relatively few files. One run soon before the next full backup is due will contain many files, including those contained on all previous differential backup sets since the last full backup. When you use differential backup, a complete backup set comprises only two tapes or tape sets: the tape that contains the last full backup and the tape that contains the most recent differential backup.
Incremental backup

An incremental backup is another form of partial backup. Like differential backups, Incremental Backups copy a selected file to tape only if the archive bit for that file is turned on. Unlike the differential backup, however, the incremental backup clears the archive bits for the files it backs up. An incremental backup set therefore contains only files that have changed since the last full backup or the last incremental backup. If you run an incremental backup daily, files changed on Monday are on the Monday tape, files changed on Tuesday are on the Tuesday tape, and so forth. When you use an incremental backup scheme, a complete backup set comprises the tape that contains the last full backup and all of the tapes that contain every incremental backup done since the last normal backup. The only advantages of incremental backups are that they minimize backup time and keep multiple versions of files that change frequently. The disadvantages are that backed-up files are scattered across multiple tapes, making it difficult to locate any particular file you need to restore, and that there is no redundancy. That is, each file is stored only on one tape.

Backup Media

Another consideration is which media to save you data on. The popular media formats are:

Tape
Optical Drive (DVD, BluRay)
Hard Disk

Hard disk backup seem to becoming more popular because the price of disk is falling and it is the fastest method. Tape has been around for a while and is a durable media and can store a large amount of data. The problem I see with both disk and tape is that they are both subject to magnetic fields. Optical drives such as DVD and BluRay writers don’t store as much data on a single media but in my opinion is the most durable for long term storage. Although the argument can be made that all you need is the last backup to restore the data, but I like to keep a few versions just in case.

Whichever method of backup or whichever media you use, backup often to save yourself a headache.

Enter the online backups. Companies like Mozy and Carbonite provide online backups over the internet. The tutorial here will help you setup your own online backup to another server over the internet so your data will be easily recoverable in the event of a disaster.

You need a:

• FTP Server ( Filezilla Server for Windows Users)
• Server or workstation with internet access
• Enough storage to hold your data
• Areca Backup ( Open Source backup software)
• Domain or DynDNS address
• Reasonably fast Internet Connection (Cable / DSL / FiOS)

Set up:

Install the FTP server:
FTP is a cross platform application that is easy to setup and manage and is a standard protocol used heavily on the internet for transferring data.
Create directory where you want to backup your data to on a large enough hard drive on a server or workstation.

• Run the Filezilla Server setup
• Create an FTP user account / Password

Set a password for the user

Add a home directory. This will be where the data backup are stored.

Verify FTP works by using an FTP client to connect to the FTP server using the account that was just setup to confirm that FTP and the user account is working properly.

Setup Port forwarding:

• DynDNS
• Router Port forward 21
• Test Connectivity from remote
• Verify FTP works

Get a dynamic DNS Name if you don’t have a static IP.

1. Now to get to your computer you can use the IP the ISP has assigned you. Problem: Your ISP will more than likely use DHCP to assign you an IP so at any given time you may not know your current IP. Solution: Dynamic DNS! Go to http://dyndns.org or http://tzo.com or http://deerfield.com or any other dynamic DNS site. In this example, I use DynDNS.org.
2. Sign up for an account (free) and create a host name that you will use to reference you computer. Ex. homepc.homeip.net (one of the several subnets available).Create a new host entry under Host Services. The site will automatically detect the IP that you are currently accessing the site from so sign in from the place you want to connect to. I.e. your house.

This will maintain your current IP info as a global internet address. When every your IP changes you will need to login into DynDNS and update the IP registed. Newer routers have a Dynamic DNS feature which will let you automatically update DynDNS whenever your IP changes. The other option is to use a DNS Update client that automatically updates your register IP from your PC. These clients are available on the DynDNS site.

Set up your firewall

For this example I am using a Linksys router. If you are using a software firewall like Zone Alarm or anther hardware firewall / router please consult your user manual.

1. Login to your router (usually http://192.168.1.1). Click on Applications & Gaming under the Port Range Forward.

On older an older Linksys it would be under Advanced tab then the Forwarding tab. You will see a similar page.

1. In the application box put FTP. Put 21 in both the Start and End box. Choose Both for the protocol. For the IP address enter the IP of the computer that you will be using for the FTP Server.
2. To check if the port is now open go to go to http://www.grc.com and click on the Shields Up link or click https://grc.com/x/ne.dll?bh0bkyd2 . This will let you scan your router/firewall port from an external source.
3. When you get to the Shields Up page, enter 21 in the box and click “User Specified Custom Port Probe. You will also see some other options such as Scan Common Ports and All Service Ports feel free to experiment.

If the ports show up as Stealth then either you mis-configured your router or your ISP is blocking these ports. In most cases, you will see the ports listed as Closed.

If you see ports listed as OPEN this means some service / application responded to the port probe request! You will see how this work later.

Areca Backup Setup

Areca is an open source backup program for windows and linux that allows to easily backup and restore your data. The reason I choose Areca is because it provides the ability to not only backup to local networks but over FTP. Install this software on the computer you want to backup.

• Install Areca Backup

1. Edit – New Group

2. Edit.. New Target…

In the Main section, enter a target name. Choose FTP / FTPS Repository. Leave all other options default. Then click the Select button next to the FTP / FTPS Repository

3. Enter the DynDSN name you choose earlier in this article and enter it in the Remote Host field. Leave the port 21. Enter a backlash (/) for the Remote directory, unless you want the backups to be stored in another directory.
Note: If your ISP blocks incoming port 21 you may need to change the port.

4. Under the Source tab, choose the Directory button

Test Backup

Final Notes:

The reason I used Areca is because it can be configured to use FTP.  FTP is well known, and you can setup a folder structure to organize different backups.  It can also be setup to use FTPS for secure connection. Using the concepts outlined, you could setup another software to backup over the internet.

1. Pre-processing: Removal of background clutter and noise.
2. Segmentation: Splitting the image into regions which each contain a single character.
3. Classification: Identifying the character in each region.

The captchas are being  made increasing more difficult for a human to read.  In the very near future, a program will have an easier time solving the puzzle than humans will and the point of this additional security measure would be nullified.

Google has realized this and is trying a different and much needed approach. The new captcha method will require users to choose the correct orientation of a picture or which picture is a cat, rather than decipher a word. This method effective as it is difficult for a program to determine what should be right side up or the difference between a cat and a dog. Other methods make you solve a math problem or answer a common knowledge question.

This makes much more sense to me than trying to figure out what the letters in the box are. The issue with these methods is the inability for visually impaired people to use these systems.  Such CAPTCHAs may make a site incompatible with Section 508 in the United States.  In order to comply with this regulation the site  should allow blind users to get around the captcha, for example, by permitting users to opt for an audio or sound CAPTCHA. It will be only a matter of time before the hackers try finding vulnerabilities in the audio captcha. Perhaps answering a question that a human would know and that can be provided in audio format is a way of providing security and accessibility.