Event Type: Error
Event Source: DataAccessLayer
Event Category: None
Event ID: 26308
Date:  3/11/2010
Time:  11:30:01 AM
User:  N/A
Computer:
Description:
Query notification processing failed due to a sql exception.

System.Data.SqlClient.SqlException: A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 – The semaphore timeout period has expired.)
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlCommand.CheckThrowSNIException()
at System.Data.SqlClient.SqlCommand.InternalEndExecuteReader(IAsyncResult asyncResult, String endMethod)
at System.Data.SqlClient.SqlCommand.EndExecuteReader(IAsyncResult asyncResult)
at Microsoft.EnterpriseManagement.Mom.DataAccess.QueryNotificationManager.HandleNotifications(Object state)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Health Service Modules
Event Category: Data Warehouse
Event ID: 31569
Date:  3/11/2010
Time:  11:30:03 AM
User:  N/A
Computer:
Description:
Report deployment process failed to request management pack list from Data Warehouse. The operation will be retried.Exception ‘InvalidConnectionException’: ExecuteScalar requires an open and available Connection. The connection’s current state is closed.

One or more workflows were affected by this.

Workflow name: Microsoft.SystemCenter.DataWarehouse.Deployment.Report
Instance name:
Instance ID: {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
Management group:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:30:39 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectDiscoveryData
Instance    :
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:30:39 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectAlerts
Instance    :
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:30:39 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectPerformanceData
Instance    : yksc1s3.ehit.org
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:31:18 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectEventData
Instance    :
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: HealthService
Event Category: None
Event ID: 2115
Date:  3/11/2010
Time:  11:31:18 AM
User:  N/A
Computer:
Description:
A Bind Data Source in Management Group  has posted items to the workflow, but has not received a response in 61 seconds.  This indicates a performance or functional problem with the workflow.
Workflow Id : Microsoft.SystemCenter.CollectSignatureData
Instance    : yksc1s3.ehit.org
Instance Id : {A18674C9-F1A9-98DA-3B94-DD88EAE278FB}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The upgrade was successful according to the status page. The router restarted and my web browser refreshed to the administration page that I was on before. Here’s where things got interesting.

I noticed that after the upgrade my the firmware version on the router was 1.01.6 and not 1.02.7 as I expected. I thought that this was strange. “Did I download the wrong firmware file?”, I thought. So I re-downloaded the file and started the firmware upgrade process from the same page, just as I did before.

This is when I noticed the wireless signal strength bars at the bottom of my taskbar were low. Usually they are full. That’s when I realized I was not connected to my router. I was upgrading my neighbor’s router!! Luckily it came back up fine.

The mistake I made was upgrading my firmware via wireless. So when my router restarted, my computer automatically connected to a unsecured wireless connection. Coincidentally, this was the same router I was using and I was the screens that I would have seen on my router.  The lesson learned here is to connect your computer to a wired Ethernet port if you are going to upgrade you router.

Event Type:      Warning

Event Source:   OpsMgr Connector

Event Category:            None

Event ID:          20058

Date:                2/6/2010

Time:                2:00:17 PM

User:                N/A

Computer:

Description:

The Root Connector has received bad packets which have been dropped. It received 8374 such packet(s) in the last five minutes

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Does your Windows machine feel more sluggish than usual? Are you getting little notifications on your taskbar that “You may not be protected”? You may have spyware or malware running a muck on your pc. Malware is getting increasingly crafty and find new places to hide and make it very difficult to get rid of. Some malware even disables your anti-virus protection to avoid being detected. The best way to deal with spyware and malware is stop them from running so anti-virus and anti-spyware programs can better clean your machine. Here are a few steps and places to check to stop spyware and malware before you run a scan.

1. Boot into Safe Mode

Booting into safe mode starts the computer with a minimum set of programs and drivers, which means some Spyware won’t run either. Restart the computer and hit the F8 key repeatedly before Windows starts. Choose Safe Mode when presented with a menu.

2. Log in as administrator

Don’t login with your normal user name. Your profile will automatically run some programs that you are not aware of and that includes malware. Once you have cleaned up you machine a bit you can then login with your account to finish cleaning. If you computer automatically logs in, Click start and Log Off. After you are at the logon screen, hit Ctlr+Alt+Del twice to bring up the user dialog box. Type in administrator and hit Enter since the password should be blank. If this doesn’t work, just login with you account. We’ll still get’em.

3. Edit or Replace your host file windows\system32\drivers\etc\hosts file

This file bypasses DNS and can be used by malware to redirect you to a malicious website. When you type citibank.com it could be taking you to a site that looks like citibank but isn’t. Unless you have a good reason to have any data in this file it is better to delete the contents of the file. Go to Windows\system32\drivers\etc\ and double click on the hosts file. Choose notepad as the program to open this with. Highlight and delete the information in this file and save it.

4. Check the corners of you registry.

Before editing the registry you should save a backup of it. http://support.microsoft.com/kb/322756

Note: you need to log in to each user account on the computer and check the HKEY_CURRENT_USER registry key for each user since it will be different for each user that logs in or you risk getting infected again after that user logs on.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
“Program”=”c:\runfolder\program.exe”

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
“Program”=”c:\runfolder\program.exe”

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“Program”=”c:\runfolder\program.exe”

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
“Program”=”c:\runfolder\program.exe”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Program”=”c:\runfolder\program.exe”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
“Program”=”c:\runfolder\program.exe”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
“Program”=”c:\runfolder\program.exe”

These reg keys will run programs. The key should have a default value of Value “%1 %*”, if this is changed to “program.exe %1 %*”, the program.exe will be executed EVERYTIME an exe/pif/com/bat/hta is executed.

[HKEY_CLASSES_ROOT\exefile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\piffile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @=”\”%1\” %*”

Explorer start-up:

Explorer runs your start menu and desktop and start every time you start windows. Check to see if the registry is pointing to explorer.exe or if it is pointed to another executable.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell

Active-X Component:

This key starts the program that it has in its path BEFORE the explorer.exe file and any other program starts in your computer, so if you can understand why your antivirus can’t detect the virus when you boot up. It could even kill your antivirus software before your antivirus starts up.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]
StubPath=C:\PathToFile\Filename.exe

5. Start Up

Here are the many places where programs get run at startup. Look at each item carefully. Find the name and path of the program that is being run. If you do not recognize it, search for it on the web to see if it is legit.

Look in the following folders and check that the registry entry to verify that they pointing to the default location listed

C:\windows\start menu\programs\startup

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup=”C:\windows\start menu\programs\startup”

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup=”C:\windows\start menu\programs\startup”

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
“Common Startup”=”C:\windows\start menu\programs\startup”

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
“Common Startup”=”C:\windows\start menu\programs\startup”

6. Windows Scheduler:

Scheduled Tasks are a place where normally you can set a program or command to run at a certain time or every 5 minutes, so it’s a good place to check.

Go to Start-> Accessories-> System Tools-> Task Scheduler

Some tasks don’t show up in the GUI so in a command prompt type: “at”

Press enter.  You should see a list of tasks that are in the Task Scheduler GUI and some that may not.

7. Batch files

Open the following files in notepad and look for any odd programs that are listed. You can comment out the program by putting REM at the start of the line so it will be ignored.

c:\windows\winstart.bat

c:\Autoexec.bat

Removing  Spyware and viruses

After checking all these dark corners of you computer and removing any potentially malicious programs from starting, you are giving you anti-virus and anti-spyware software the best chance to find and remove the malware.

AVG Free is a good free Antivirus program that detects many types of malware as well as viruses. Three effective anti-spyware programs are Spybot Search & Destroy, Malware Bytes, and AdAware. One pass of each of theses programs will clear your system of any unwanted processes slowing your machine down. Good Luck.

Enter the online backups. Companies like Mozy and Carbonite provide online backups over the internet. The tutorial here will help you setup your own online backup to another server over the internet so your data will be easily recoverable in the event of a disaster.

You need a:

• FTP Server ( Filezilla Server for Windows Users)
• Server or workstation with internet access
• Enough storage to hold your data
• Areca Backup ( Open Source backup software)
• Domain or DynDNS address
• Reasonably fast Internet Connection (Cable / DSL / FiOS)

Set up:

Install the FTP server:
FTP is a cross platform application that is easy to setup and manage and is a standard protocol used heavily on the internet for transferring data.
Create directory where you want to backup your data to on a large enough hard drive on a server or workstation.

• Run the Filezilla Server setup
• Create an FTP user account / Password

Set a password for the user

Add a home directory. This will be where the data backup are stored.

Verify FTP works by using an FTP client to connect to the FTP server using the account that was just setup to confirm that FTP and the user account is working properly.

Setup Port forwarding:

• DynDNS
• Router Port forward 21
• Test Connectivity from remote
• Verify FTP works

Get a dynamic DNS Name if you don’t have a static IP.

1. Now to get to your computer you can use the IP the ISP has assigned you. Problem: Your ISP will more than likely use DHCP to assign you an IP so at any given time you may not know your current IP. Solution: Dynamic DNS! Go to http://dyndns.org or http://tzo.com or http://deerfield.com or any other dynamic DNS site. In this example, I use DynDNS.org.
2. Sign up for an account (free) and create a host name that you will use to reference you computer. Ex. homepc.homeip.net (one of the several subnets available).Create a new host entry under Host Services. The site will automatically detect the IP that you are currently accessing the site from so sign in from the place you want to connect to. I.e. your house.

This will maintain your current IP info as a global internet address. When every your IP changes you will need to login into DynDNS and update the IP registed. Newer routers have a Dynamic DNS feature which will let you automatically update DynDNS whenever your IP changes. The other option is to use a DNS Update client that automatically updates your register IP from your PC. These clients are available on the DynDNS site.

Set up your firewall

For this example I am using a Linksys router. If you are using a software firewall like Zone Alarm or anther hardware firewall / router please consult your user manual.

1. Login to your router (usually http://192.168.1.1). Click on Applications & Gaming under the Port Range Forward.

On older an older Linksys it would be under Advanced tab then the Forwarding tab. You will see a similar page.

1. In the application box put FTP. Put 21 in both the Start and End box. Choose Both for the protocol. For the IP address enter the IP of the computer that you will be using for the FTP Server.
2. To check if the port is now open go to go to http://www.grc.com and click on the Shields Up link or click https://grc.com/x/ne.dll?bh0bkyd2 . This will let you scan your router/firewall port from an external source.
3. When you get to the Shields Up page, enter 21 in the box and click “User Specified Custom Port Probe. You will also see some other options such as Scan Common Ports and All Service Ports feel free to experiment.

If the ports show up as Stealth then either you mis-configured your router or your ISP is blocking these ports. In most cases, you will see the ports listed as Closed.

If you see ports listed as OPEN this means some service / application responded to the port probe request! You will see how this work later.

Areca Backup Setup

Areca is an open source backup program for windows and linux that allows to easily backup and restore your data. The reason I choose Areca is because it provides the ability to not only backup to local networks but over FTP. Install this software on the computer you want to backup.

• Install Areca Backup

1. Edit – New Group

2. Edit.. New Target…

In the Main section, enter a target name. Choose FTP / FTPS Repository. Leave all other options default. Then click the Select button next to the FTP / FTPS Repository

3. Enter the DynDSN name you choose earlier in this article and enter it in the Remote Host field. Leave the port 21. Enter a backlash (/) for the Remote directory, unless you want the backups to be stored in another directory.
Note: If your ISP blocks incoming port 21 you may need to change the port.

4. Under the Source tab, choose the Directory button

Test Backup

Final Notes:

The reason I used Areca is because it can be configured to use FTP.  FTP is well known, and you can setup a folder structure to organize different backups.  It can also be setup to use FTPS for secure connection. Using the concepts outlined, you could setup another software to backup over the internet.

I replaced my old APC SmartUPS 620 with an updated model. I had lost the serial cable that allows you to communicate with the UPS via a computer for the old unit. The new unit came with the serial cable and for a while I was looking for the correct pin out so I could build a cable myself. So I wanted to get the pin out documented. The cable is a male to female DB9 cable. Well I got my voltmeter and using the continuity setting I mapped the pinout. It would not be difficult to create this cable. Many of the cables DB9 serial cables I had laying around were female to female and it was hard finding a male end. Hopefully this will help others out there that need this cable and don’t want to pay $30 for it.
UPDATE: I have updated the diagram based on the comments I got on this post. Apparently I counted the male pins incorrectly so I made the correction. Thanks for your feedback.

I was losing internet every day at midnight and it was getting very frustrating. (Especially when I kept getting disconnected during a Raid). As a matter of fact all the computers on the network were losing the internet connection at the same time. Which led me to believe that it was a problem with my Internet Service Provider. I called my ISP (Cablevision) and they verified that everything on their end was fine. Just to make sure it was not my end I connected a PC directly to the cable modem, bypassing the router, and I did not have the problem. I then directed my efforts at my Linksys WRT54G Wireless router. I could not find any settings that suggested a midnight outage. After adjusting many settings, updating firmware, and resetting to factory defaults I was still getting the issue.

As part of my troubleshooting I was running a continuous ping to the google.com and the router address. The command in Windows is “ping IP_Address -t”. I noticed I would drop packets to both the internet and my router. I was using DHCP to get my address from the router. When I gave myself a static address, I did not have the issue. I knew I was dealing with a DHCP issue.

In my Linksys router I found a setting under Setup -> Network Address Server Settings (DHCP) called Client Lease time. There is a decription next to this setting that says “0 means one day”. This is the default. It turns out that my IP addess was being renewed every 24 hours at midnight. I change the setting to 1800 minutes (about a day and a half) and I no longer disconnect at midnight. Another fix to this issue to assign a static IP address to your workstation.

Engadget has some possible leaked photos of the Amazon Kindle 2 e-book reader. I may pick one up when they are out. Imagine having all your heavy textbooks you carried around in school condensed into a light electronic device. Not to mention magazines and newspapers reading during your commute. I do love holding books and flipping pages, but paper books might be going the way of the typewriter.