Internet Explorer: Verify Internet Explorer security zones

Product: Internet Explorer
Version: Windows 10, 2012, 2016

The default pull down menu is hidden in later version of Windows Server, and Windows 10. This is critical when configuring IE zone by knowing exactly which zone the browser detected.

Use following step to find out the IE zone a specific web page is:
1. Browse to the homepage that you need to identify its IE zone
2. Right-click to the left of the "Home" button in IE
3. It should display a pop up menu with following options:

4. Select "Menu bar" to display the "File" pulldown menu

5. You should see an extra menu bar appear below the Address line, with 1st menu item as "File"

6. Click on File > Properties

7. Following dialog box will appear, and show you the IE zone for this homepage. In this example, it is "Internet" zone, and Protection Mode is "Off"

Windows: How to Disable Auto Startup

Windows: How to Disable Auto Startup of Any Programs

Overview

Windows Version: 95, 98, XP, Vista, 7, 2008, 2008R2, 2012, 2016

Many virus and applications will auto startup during OS boot up.  This includes:

1. 3rd Party Firewall - an upgrade might block internet access, and you would like to temporary disable it
2. virus
3. Freemake upgrade notification
4. Many Chinese ad-base software, e.g. Baofeng Storm Player, LETV, funshion, baidu, 迅雷影音 XMP
5. Antivirus - you doesn't want it running any more to slow down your PC

Following are the areas you can check

1. Start Menu > All Programs > Startup
2. Windows Registry (regedit)
3. Windows Services (services.msc)

Startup Menu

In Windows Start menu, where it will pop up by pressing Windows key on the keyboard, there is a folder called "Startup."  Any application shortcut will startup the program.

To remove it, right click on the shortcut icon, and click "Delete" to remove it.  This will permanently disable it.  You cannot undo it, unless it move it to other folder.

MS Config

Press Windows-R key on the keyboard, and enter "msconfig" to run this utility.

It provides quick and easy access to following which you can disable auto startup of supported programs:

1. Windows Services
2. Windows Registry for auto run programs

The disabled entries will remain on the screen, so you can undo them in future.

Windows Registry

This is the most common location where the auto startup is often configured, and it doesn't allow user to easily remove them

1. HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\
1. Run\
2. RunOnce\
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
1. Run\
2. RunOnce\
3. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
1. Run\
2. RunOnce\

Wow6432Node folder is used by 32-bit applications on 64-bit Windows.  Many 32-bit applications will create the auto run entry under this folder

Camera: Force Change of File Modify Date

Product: EXIFTool

I am very frustrating that when copying the pictures and video from SD card (from camera) to Windows NTFS, the file creation date and last access date are both changed to the current time.

This confused me when I sort the pictures/video using file creation date using Windows Explorer. MS-DOS FAT used to have many utilities which can force file creation date, but in Windows, I found EXIFTool command line program.

It provides many feature which I can set the File Modification Date, Last Access Date, and any EXIF, IPTC, RAW files' value.

Following are some commands which I used

1. Set both file modify date, and last access date
1.1. File's modify date set to date creation in EXIF
1.2. Save the new file to directory chg
1.3. Picture file name is _dsc4816.jpg


exiftool "-DateTimeOriginal>FileModifyDate" -o chg _dsc4816.jpg

2. Adjust all EXIF time by additional 12 hours, due to 12 hr different in the timezone, which not set correctly in the camera when I took the pictures

2.1. Change all pictures resides in directory chg

2.2. Create new files in directory chg2

2.3. Add extra 12 hours to the time values of all meta tag in EXIF

exiftool -AllDates+=12:00 -P -o chg2 chg

3. Display all time related setting for specific file

3.1. File is chg\_dsc5954.jpg

d:\temp\exiftool -time:all chg\_dsc5954.jpg

Genesys GAD Server Tuning - Tomcat

Product: Genesys
Component: Genesys Desktop Server (GAD)
Version: Any version which uses Tomcat

This is generic Tomcat tuning which applicable to any GAD server version. There is nothing specific to Genesys GAD only. Genesys does not use any thing specific like below:
1. No image caching build into the jar program
2. No HTML caching build into the jar program
3. No gzip/deflat compression build into the jar program

In short, the tuning approach indicating here are:
1. Enable image and HTML caching
2. Enable gzip/delat compression in http data stream

Personally I like to use Fiddler to capture the http stream. You can use any utility which can do that to verify the before and after tune result

2 factors outside of Tomcat tuning:
1. network delay or latency
2. remote client latency

Tuning Java JVM memory
File: GAD/bin/GDesktopStarter.ini

Firstly, be aware that most Java version are 32-bit, which limits to about 2 GB of RAM or virtual RAM. This is the sum of all internal thread as well. Using 64-bit Java will remove this limitation (limit will be TB)

Tips #1: Tuning JVM heap memory

Under section [JavaArgs], tune
1. Start up heap memory -Xms, default is 64 MB I believe
2. Maximum heap memory -Xmx, default is 256 MB I believe
3. If GAD server has sufficient CPU, but would like to save RAM/virtual memory, set -Xms to smaller size so that JVM garbage collection will shrink the memory usage dynamically.
4. If would like to minimize JVM garbage collection, set both -Xms and -Xmx to same value
5. In 32-bit Java, -Xmx2G is the max value
6. There is no way to lock Java to physical memory in Windows, so setting -Xms to large value may not provide optimum performance. Refers to Windows documentation for Java with 2 GB heap memory (further reading)


-Xms128M
-Xmx512M

Tips #2: Enable content expiration
If using IIS (even Apache, or WebSphere), launch IIS Manager
1. Right click on "gdesktop" web application to get into properties
2. Click on HTTP Headers
3. Enable checkbox "Enable content expiration"
4. Specify expire after several days. Genesys's document indicated 30 days, but it depends on how frequent GAD patch install. Certainly user can delete browser cache from their PC and force reload of the new content. So if you would like to play safe, 1 day is good

Tips 3: Use IIS, Apache, or any supported web server to serve static page

IIS will be used here. After configured IIS with Tomcat, configure following

File: GAD\conf\jk\uriworkermap.properties

Old:

/gdesktop=$(default.worker)

/gdesktop/*=$(default.worker)

New:

/gdesktop/=$(default.worker)

/gdesktop/*.jsp=$(default.worker)
/gdesktop/*.do=$(default.worker)
/gdesktop/*.dow/*=$(default.worker)

Tips #4: Enable http gzip compression

This will compress HTTP content and will increase overall throughput with reduce network utilization

1. Launch IIS Manager
2. Right click on "Web Sites" folder
4. Click on tab Service
5. Enable "Compress application files"
6. Enable "Compress static files"
7. If there is a disk constraint, set temporary directory size to limit the space usage (for the compressed file)

Tips #5: Monitor GAD server

During peak load, or setup a load test, monitor GAD server's CPU, memory, disk, and network utilization.

If network is bottleneck, either upgrade NIC to faster speed, or enable HTTP compression (see above).

If CPU is bottleneck, either upgrade CPU to faster speed, add more CPU socket, or disable HTTP compression (see above)

If disk is bottleneck, it is most likely not GAD server related. The only reason I can think of is Java JVM memory tuning is too large. Reduce -Xms value to 16 MB or smaller, as well as enable worker process recycle, and shutdown worker processes after idle (for IIS). Apache has idle time out (KeepAliveTimeOut) as well, and MinSpareServers that can tune down to release virtual memory usage

Tips #6: Tomcat server.xml

File: GAD/conf/server.xml

Add following section, line 1 is comment, which can change to anything. This will has max threads of 1,000. Increase it depending on max agents and multiply by 10 (assume GAD has 9 images + 1 jsp). Use Fiddler to confirm how many objects in GAD




maxThreads="1000"
minSpareThreads="1"
maxSpareThreads="150"
enableLookups="false"
redirectPort="8443"
debug="0"
protocol="AJP/1.3"/>


Tips #7: Merge 2 or more network card

In any operating system, e.g. Linux, Windows, HP-UX, they offer NIC merging into 1 logical network card. This will double or 8x the total bandwidth. Please be aware that the network switch and router must support it. Most Cisco and Intel devices support this

This is a cheap and fast way to eliminate network bottleneck. External load balancer is another option with multiple GAD servers installation

Genesys Log Analysis Tips #1: PowerShell

Product: Genesys CTI Suite
OS: Windows
Utility: PowerShell
Objective: Log analysis using filter

Uses following command to analyze all Genesys log and filter following
1. Log file contain name log in the extension
2. Search recursively
3. Filter by "DnStatus Logged out" to quickly tell the log file and line number
4. In additional of that, also display lines containing PlaceId
5. Spool the output to file logout1.txt, with max length 600 character. Default is 120

PS C:\> Get-ChildItem . -include *.log -rec | select-string "DnStatus                  Logged out", PlaceId | Out-File logout1.txt -width 600

Following syntax filter following
1. Line containing text "@ICCS, Status: logged out," where ICCS is T-Server switch name
2. Line also contains "Dn logged in"
3. Output to file logout1.txt, with max length 500

PS C:\> Get-ChildItem . -include "@ICCS, Status: logged out," | select-string "Dn logged in" | Out-File logout1.txt -width 500

Use following command to analyze Genesys GAD log to spool agent logout event with time, Genesys login, PBX login, Genesys place, and PBX extension. GAD log level must be verbose or higher

1. Log file extension is .log
2. Search sub-directory
3. Find "Status: logged out," and interprete comma as part of the search string
4. Further filter the output by "Dn was logged in" to eliminate duplicate lines
5. Spool to file logout3.txt with max length 600 character


PS C:\> Get-ChildItem . -include *.log -rec | select-string "Status: logged out\," | select-string "Dn was logged in" | out-file logout3.txt -width 600

To filter Genesys CPD dialler server's log and focus in specific dialing attempt

First, search the log for the phone number that it dial, and found it is using ThID 4412, and ReqID 397. Filter by using this unique identifier


PS C:\> [string[]](select-string -path .\CPD1.20111007_032122_001.log -pattern "ThID:  4412" | select-string "ReqID:        397" )  | %{$_.substring(95)}
03:40:44.5720 ThID:  4412 ReqID:        397: making a call to '036345376'
03:40:44.5720 ThID:  4412 ReqID:        397: license consumed, 891 in use
03:40:44.5720 ThID:  4412 ReqID:        397: enable Accurate PAMD with PVD
03:40:44.5720 ThID:  4412 ReqID:        397: reusing DM3 data channel: dtiB7T11
03:40:47.5720 ThID:  4412 ReqID:        397: getting DM3 voice channel handle for dtiB7T11
03:40:47.5720 ThID:  4412 ReqID:        397: DM3 voice channel handle for dtiB7T11 is dxxxB18C2
03:40:47.5720 ThID:  4412 ReqID:        397: primary server info: ("name"="ICCS_TSvr","host"="svr03.family.com.my","is-server"="1","client-type"="10","server-type"="1","port"="3060","protocol"="addp","addp-timeout"="30","addp-remote-timeout"="60","addp-trace"="both")
03:40:47.5720 ThID:  4412 ReqID:        397: queue is NULL
03:40:47.5720 ThID:  4412 ReqID:        397: Queue type unknown
03:40:47.6500 ThID:  4412 ReqID:        397: no recording channels available
03:40:47.6500 ThID:  4412 ReqID:        397: invoking gc_MakeCall: dtiB7T11
03:40:47.7900 ThID:  4412 ReqID:        397: event 0x827 received: Current CRN: 0, Event CRN: 101318758, cInfoDM3 CRN:101318758,Event chid:102, cInfoV chid:103 Channel: dtiB7T11, ChannelV: dxxxB18C2
03:40:47.7900 ThID:  4412 ReqID:        397: event 0x827, progress message received: dtiB7T11
03:40:47.7900 ThID:  4412 ReqID:        397: enable pre-connect SIT detection
03:40:47.7900 ThID:  4412 ReqID:        397: initiating pre-connect CPA: dxxxB18C2
03:40:52.3680 ThID:  4412 ReqID:        397: event 0x828 received: Current CRN: 101318758, Event CRN: 101318758, cInfoDM3 CRN: 101318758,Event chid:102, cInfoV chid:103 Channel: dtiB7T11, ChannelV: dxxxB18C2
03:40:52.3680 ThID:  4412 ReqID:        397: event 0x828, progress message received: dtiB7T11
03:40:52.7900 ThID:  4412 ReqID:        397: event 0x822 received: Current CRN: 101318758, Event CRN: 101318758, cInfoDM3 CRN: 101318758,Event chid:102, cInfoV chid:103 Channel: dtiB7T11, ChannelV: dxxxB18C2
03:40:52.7900 ThID:  4412 ReqID:        397: call state connected: dtiB7T11
03:40:52.7900 ThID:  4412 ReqID:        397: dx_stopch() successful: dxxxB18C2, state: 7
03:40:52.8220 ThID:  4412 ReqID:        397: event 0x85 received: Current CRN: 101318758, Event CRN: 0, cInfoDM3 CRN: 101318758,Event chid:103, cInfoV chid:103 Channel: dtiB7T11, ChannelV: dxxxB18C2
03:40:52.8220 ThID:  4412 ReqID:        397: Current CRN: 101318758, Event CRN: 0, cInfoDM3 CRN: 101318758, cInfoV CRN:0, Channel: dxxxB18C2
03:40:52.8220 ThID:  4412 ReqID:        397: CPA result: 12, pre-connect CPA: 1, post-connect CPA: 0, connected: 1
03:40:52.8220 ThID:  4412 ReqID:        397: pre-connect CPA is stopped: dxxxB18C2
03:40:52.8220 ThID:  4412 ReqID:        397: initiating post-connect CPA: dxxxB18C2
03:40:54.3530 ThID:  4412 ReqID:        397: event 0x85 received: Current CRN: 101318758, Event CRN: 0, cInfoDM3 CRN: 101318758,Event chid:103, cInfoV chid:103 Channel: dtiB7T11, ChannelV: dxxxB18C2
03:40:54.3530 ThID:  4412 ReqID:        397: Current CRN: 101318758, Event CRN: 0, cInfoDM3 CRN: 101318758, cInfoV CRN:0, Channel: dxxxB18C2
03:40:54.3530 ThID:  4412 ReqID:        397: CPA result: 10, pre-connect CPA: 0, post-connect CPA: 1, connected: 1
03:40:54.3530 ThID:  4412 ReqID:        397: call connected: dxxxB18C2
03:40:54.3530 ThID:  4412 ReqID:        397: positive voice detection: dxxxB18C2
03:40:54.3530 ThID:  4412 ReqID:        397: gc_MakeCall successful completion: dtiB7T11

Hack Windows Registry

Using another Windows, it is possible to open Windows registry of another hard disk. Plug in the disk that needs to crack. Let's say it is mounted as drive G:

1. Boot into Windows XP, 2000, or 2003
2. Launch regedit.exe
3. Click on HKEY_LOCAL_MACHINE to attach the target registry under it
4. Click File - Load Hive
5. Select the target hard disk, and browse to G:\Windows\system32\config\software (for HKEY_LOCAL_MACHINE)
6. Enter a key name: hacker
7. Now there is a new folder under HKEY_LOCAL_MACHINE\hacker
8. Browse this folder just like HKEY_LOCAL_MACHINE. Modify any entry as require
9. Other files are sam, system

After modified, put the target disk back to the original machine, or boot order, if it is same machine

This procedure is especially useful if wrongly modify a registry, and can't get in

Check Windows uptime

net stats srv

Server Statistics for \\CHEN


Statistics since 7/2/2009 1:20 PM


Sessions accepted 1
Sessions timed-out 0
Sessions errored-out 0

Kilobytes sent 2
Kilobytes received 3

Mean response time (msec) 0

System errors 0
Permission violations 0
Password violations 0

Files accessed 2
Communication devices accessed 0
Print jobs spooled 0

Times buffers exhausted

Big buffers 0
Request buffers 0

The command completed successfully.

Enable Screensaver Tab in Display Properties

Yesterday night my PC attacked by variant of FakeAlert virus. The virus make use of browser to download a self execute downloader, which further download the trojan horse program.

The trojan horse modified wallpaper, screensaver, and disable screensaver tab in Display Properties.

Following is solution to enable screensaver tab in Display Properties:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- NoDispScrSavPage
- 0 is enable the tab, 1 is to disable

This trojan horse can be removed by regular or free antivirus software, so I won't document it here.  Please note that the antivirus software will not restore your wallpaper, screensaver, nor enable screensaver tab