Comments for Fencepost Software & Consulting

Comment on (Fix) Postfix: Recipient address rejected: Domain not found by Alan

Alan — Tue, 09 Mar 2010 16:32:51 +0000

A quick note based on someone searching for “ESVA 2.0.5.9 download” – to get ESVA 2.0.5.9, download and install the most recent available version from http://www.global-domination.org/ESVA.php (I believe it’s 2.0.5.7), configure it per the instructions, then log back on as root (either at the console or by logging in via SSH and doing “su -” and run the command “esva-update” to convert from 2.0.5.7 to 2.0.5.9.

Comment on (Fix) Postfix: Recipient address rejected: Domain not found by Alan

Alan — Mon, 08 Mar 2010 17:30:58 +0000

Worth checking if you’re getting a “Domain not found” error: at the command line of the Postfix server itself, try `host domainnotresolving.com` – if it doesn’t return anything, then Postfix is going to have the same problem of not being able to confirm that the domain in question exists, so it’s not going to accept the message.

If you’re having this problem and you know that the domain should resolve, try to find out why it’s not doing so. Just putting it in the hosts file may not do the trick – if `host`, `nslookup` or `dig` won’t resolve it, Postfix won’t either.

Comment on Compliment Comments and Spam by manitoito

manitoito — Fri, 11 Dec 2009 21:35:59 +0000

Authentic words, some truthful words man. Totally made my day!!

Edited by Alan: Here’s a perfect example of such a comment, and so appropriately placed. I’ve changed the email address to prevent further posting and removed the website URL from this message.

Comment on (Fix) When DNS and ping Fail but nslookup Works (Windows) by Rich

Rich — Wed, 09 Dec 2009 17:39:27 +0000

Thanks for the info.

I have this problem occasionally on the workstations of our network, where I am unable to ping by hostname or fqdn, but an nslookup works. (xp workstations, windows server 2003 r2 dhcp/dns server)

restarting the workstation’s dns client sorts it, or an ipconfig /renew. In my case netbios is disabled on our network cards and I wonder if ping.exe switches to netbios sometimes, I guess i’d have to re-enable netbios on the network to find out.

The winsock fix doesn’t solve it for me (though I have used winsock fix in the past to fix problems left by malware, successfully)

Thanks, Rich

Comment on Winlogon.exe at 50% or 100% CPU (Fix) by steve

steve — Thu, 03 Dec 2009 13:55:44 +0000

Awesome – it works!!
Been having problems for ages!

Comment on Fix for Outlook 2007 Trying to Load InfoPath (Error 1605) by Alan

Alan — Thu, 03 Dec 2009 03:58:57 +0000

I suspect that opening that configuration page is attempting to do something to check for InfoPath. The checkbox being disabled is probably because of the presence of that registry key – since it’s there, the checkbox has no effect.

You might be able to remove that registry value, delete it, and go see if you can change that setting. You may need to have Outlook completely closed before removing that value for it to be a good test.

Comment on Fix for Outlook 2007 Trying to Load InfoPath (Error 1605) by mikhubb

mikhubb — Tue, 01 Dec 2009 02:25:49 +0000

No I should say sorry, it was me not understanding the HKCU as “HKEY_CURRENT_USER” in the registry.
Anyway, I added the entry and Outlook2007 now starts up WITHOUT the 1605 error and seems to be stable. Yea!!!! Thank you!!!

However, if I now go into the Tools\Options\Other and as soon as I click on Advanced the same 1605 error pops up. I can click OK and get into the Advanced Options and the InfoPath option is GREYED out. (I have print screens if you would like to see them)

Now Outlook seems to be stable and running, but any ideas about correcting that 1605 error when going into the Advanced Options?

Comment on Fix for Outlook 2007 Trying to Load InfoPath (Error 1605) by Alan

Alan — Mon, 30 Nov 2009 04:45:29 +0000

Sorry if I wasn’t clear in the post – the key is HKCUSoftwareMicrosoftOffice12.0OutlookOptionsMail, the value is a DWORD named “DisableInfopathForms”. Set to 1 to disable the forms.
The simpler solution should be in Outlook, go to Tools, Options, Other tab, Advanced Options button, then look for a checkbox to disable InfoPath forms. It’s present, just poorly documented.

Comment on Fix for Outlook 2007 Trying to Load InfoPath (Error 1605) by Mikhubb

Mikhubb — Mon, 30 Nov 2009 00:42:02 +0000

Having exactly the problem you are describing and there definitely don’t seem to be a “real” solutions around so far.
So I am going to get ProcMon and see what it says, but can you tell me the location ProcMon was reporting the error to you at?
Also, I presume you created a registry entry, can you let us know the details of exactly what you created?
I want to see if ProcMon shows me similar information and at least have a good feeling that I am doing the proper fix.
Thanks

Comment on Slow Startup with Multiple ‘Starting’ Services After Malware by Alan

Alan — Tue, 24 Nov 2009 22:25:03 +0000

For those reading this, it’s also been pointed out that the speed issues could have been caused by an out-of-sync RAID array rebuilding in the background. I will confess that I didn’t even check that, though I didn’t see any note of RAID issues in the Event Log.
The RAID array in the system is healthy, with a hot spare, and in the configuration that I expected it to be in (the hot spare is the highest-numbered drive, indicating that it has not been utilized).
I’ll be checking to confirm that the RAID controller in that system does in fact log such events.

Comment on (Fix) “Another Installation is Already In Progress’ installing Office 2007 over Office 2000′ by Alan

Alan — Mon, 09 Nov 2009 16:25:05 +0000

It occurs to me that I didn’t describe how to see what installation is in progress. This is not 100%, but it’s worth a shot and anyone can do it.
1) Get the name of the file from HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress – it’ll almost certainly be something in C:\Windows\Installs, you can just copy the entire string by double-clicking on the entry, then selecting the entire string and copying it.
2) Go to the Start menu, pick Run, type “notepad.exe” and hit Enter
3) In Notepad, go to File, Open, and paste in the file name (with the path) then open the file
4) Look through the unreadable parts looking for references to what program the installer is part of. You may need to turn on word wrap from the Format menu. When you find it you may be looking at what appears to be words with spaces between each letter (e.g. “M i c r o s o f t O f f i c e P r o f e s s i o n a l D i s k 2″) – this is related to how the computer stores information, you don’t need to worry about it.

Comment on (Fix) r3953724.cn Malware/Adware Redirections by Propeller Head

Propeller Head — Fri, 30 Oct 2009 04:25:56 +0000

You’re very welcome guys – glad I could help! 8^)

Comment on (Fix) r3953724.cn Malware/Adware Redirections by Alan

Alan — Fri, 30 Oct 2009 02:42:06 +0000

Agreed, kudos to Propellor Head – I had seen atapi.sys show up on something in a scan – HijackThis perhaps – but hadn’t paid any attention to it because it was in the right place, with the right name, and I was working with CD-based files since I couldn’t download directly.

Comment on (Fix) r3953724.cn Malware/Adware Redirections by Grateful_Reader

Grateful_Reader — Thu, 29 Oct 2009 21:03:10 +0000

Thanks a million, Propeller Head — that did the trick! How the heck did you figure this out?

Mad props, my friend. =)

Comment on (Fix) r3953724.cn Malware/Adware Redirections by Propeller Head

Propeller Head — Thu, 29 Oct 2009 13:30:48 +0000

It’s a rootkit in atapi.sys. I successfully cleaned my infection last night. Use the newest version of ComboFix – it detects and cleans it. Make sure you allow it to install the recovery console if it’s not already resident. Good luck!

Comment on (Fix) r3953724.cn Malware/Adware Redirections by Alan

Alan — Thu, 29 Oct 2009 03:20:37 +0000

I’ve left it with Kaspersky’s boot CD scanning to see if it’ll pick anything up. It doesn’t seem to be actively going out, but when you use the browser it does redirect.
I’ve left a note for the users in the office to not use it, because not all of the redirects are failing – some are going to a variety of hacked sites, which then redirect to advertising or malware (one of those redirects to a malware site was caught by AVG).

Comment on (Fix) r3953724.cn Malware/Adware Redirections by Rod I

Rod I — Thu, 29 Oct 2009 03:01:56 +0000

I have the same issue. For now, I have the local loopback in host file pointed to r3953724.cn to avoid the google redirect.
Malware, CA AV, CA PP not detecting anything. IE Addons disabled as well.

Comment on Winlogon.exe at 50% or 100% CPU (Fix) by Alan

Alan — Tue, 20 Oct 2009 21:25:20 +0000

Glad it was helpful. I expect to do either a more in-depth article or at least a collection of links on ways to track down problems like this. The Sysinternals folks, forums and tools (now at Microsoft) are probably the best place to start for tracking down problems like this.

Comment on Winlogon.exe at 50% or 100% CPU (Fix) by Viebie

Viebie — Tue, 20 Oct 2009 15:25:23 +0000

Thank you Alan, you are a genius!

Comment on Winlogon.exe at 50% or 100% CPU (Fix) by Isaac

Isaac — Thu, 13 Aug 2009 11:19:08 +0000

WOW thank you for the post (and for Google for finding this post).
I have been banging my head against the wall removing hardware, MSIE and any component I have installed recently.
This really did the trick.
Thanks!