The description for Event ID ( 100 ) in Source ( MySQL ) cannot be found

It seems like the local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. We will have to use a program to edit the mysqld.exe to add the required information.

• Download XN Resource Editor - http://www.wilsonc.demon.co.uk/d10resourceeditor.htm

• Stop the MySql server.

• Locate and backup mysqld.exe – \MySQL Server\bin\mysqld.exe    Make sure to backup!!!!

• In XN Resource Editor open mysqld.exe and you should see both panes blank.

• From the menu select Resource, and then Add Resource. A window will open with a list of options, select Message Table.

mysqld.exe XN Resource Editor

 

• Right click on “Language Natural” and click on Properties. A window will open, change the Language option to English (United States).

Resource Properties

• From the menu select Strings, and then Add String. It will create a default string with a 00000001 id.

• Opinally add the following string :

%1For more information, see Help and Support Center at http://www.mysql.com. 

• Change the ID from ’00000001′ to:

   'C0000064'

• Now Save and exit. Start MySql server now.

When you start a Terminal Services session with a local printer, a redirected print queue is created in the Terminal Services session. All of your settings should be transfer over to the redirected printer, but that is not the case all the time. Some printing models do not support detecting changes to the Device Settings tab for each redirected printer.

The Solution:

The solution is to make the desired change in the Device Settings tab and then change a different setting in another tab, then hit Apply. This is all done inside the terminal session.

Source: http://support.microsoft.com/default.aspx?scid=KB;EN-US;243942

IE History View Screenshot

Each time that you type a URL in the address bar or click on a link in Internet Explorer browser, the URL address is automatically added to the history index file, and this utility reads all information from the history file and displays the list of all URLs that the user has visited in the last few days.

One of the great advantages of IE History View is that it is a portable application and there is no need for installation. The application can be run locally to audit the local computer and all the local users or it can be used to remotely audit a computer in your network.

Remotely view internet activity

Go to File-Select History Folder. This window will open up:

IE History Viewer: Select History Folder

In this window you will need to specify the computer name and the local user account name. It has to be done in this format:

\\COMPUTER\c$\Documents and Settings\USER\Local Settings\History

That should be everything, now you should be able to get a fully detail list of the browsing history of the user.

Let’s not forget to give credit to Nir Sofer the creator of this great utility. Please check his website: http://www.nirsoft.net/utils/iehv.html

Basic

 Windows Key Combos

Other Functions

 * May have a different function, depending on the program.

Microsoft Web Platform Installer

If you are familiar with Cpanel’s Fantastico, this is a similar concept. There are different tools, databases and application that can be install using the Web Platform installer, some include; SQL Server Express and Compact, .NET Framework, ASP.NET, IIS and plenty of web applications like WordPress, Joomla and others.

Many of these issues can be pinpointed by running the WSUS Client Diagnostic Tool and if necessary the Server Diagnostic Tool. Both of these tools can be downloaded here: http://technet.microsoft.com/en-us/windowsserver/bb466192.aspx

WSUS Client Diagnostic Tool

Usually when adding a new computer to your domain, if you have a correct Group Policy set in place you should see that computer show up in the WSUS console. Also if you want to force the issue you can open the command prompt and type the following:

net start wuauserv

wuauclt /detectnow

Active Directory Container

Recently while setting up some new computers, i ran through a problem where some computers were missing in the WSUS console. It was kind of random since some of the computers where showing, while a selected few were missing. I double checked that the computers had properly joined the domain, i ran “gpupdate /f” and they still could not be found.

I decided to check under Active Directory and i found out that my new computers and others that where not showing up in the WSUS console where on the wrong container.

Active Directory Containers

My new computer was in the “Computers” container and after moving it to our “default” container where the original policy was set, i was able to see the computer on WSUS console.

Please note that by default AD has the “Computers” container set and some organizations might create other containers for several reasons. In my case AD was set before i was hired, you might run into the similar issue if you have the related scenario.

Please Note: Before we start, make sure you have the System – Mootools Upgrade module enable. This is usually the main reason many upgrades have failed.

If your Mootools Upgrade module is enable and jUpgrade keeps getting stuck, then try the following:

Go to your Components and click on jUpgrade. Click on the Parameters button. Looks like this: 

Disable the Downloading step by selecting YES in the Skip Download setting.

Now retry the upgrade and at the end you should see this screen:

If you still can’t get pass the download step, you might new to download the upgrade file yourself and upload it in the temp folder located in your Joomla directory.

Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)
    Dim OutApp As Object
    Dim OutMail As Object
    Const SendTo As String = "davidy@Initech.com"

    Set OutApp = CreateObject("Outlook.Application")

    OutApp.Session.Logon
    Set OutMail = OutApp.CreateItem(0)

    With OutMail
        .To = SendTo
        .Subject = ThisWorkbook.Name & " has been amended"
        .Body = " The Workbook has been updated!"
        .Send
    End With

    Set OutMail = Nothing
    Set OutApp = Nothing
End Sub

This Visual basic code sends an email via Outlook every time the workbook has been updated. For this code to fully work you will need to edit your macro settings in Excel.

Edit Macro Security Settings:

Office 2003 – Tools > Macro > Security.
Office 2007 – Click the Microsoft Office Button , and then click Excel Options. In the Trust Center category, click Trust Center Settings, and then click the Macro Settings category.

Macro Security in Excel 2003

To make this VB code work correctly, you will need to set your Macro Security level to Medium or lower.

Inserting the Code:

Simply right click on the worksheet tab and click View Code. This will open the Microsoft Visual Basic screen.

Click View Code to open the Microsoft Visual Basic screen

Once you have the Microsoft VB screen open you can paste the code and begin editing it.

A view of the Microsoft Visual Basic screen

Don’t forget to add your email address and if you would like to, you can customized the message that would be display on the body of the email. Just look at the highlighted parts on the picture above.

If you have any questions feel free to leave a comment below.

Domain Related

Auto Log in Domain – Please edit lines 6-8, change DOMAIN_Name, USERNAME and PASSWORD

DefaultDomainName /t REG_SZ /d DOMAIN_NAME /f
DefaultUserName /t REG_SZ /d USERNAME /f
DefaultPassword /t REG_SZ /d PASSWORD /f

[DOWNLOAD]

Remote Actions

Remotely Shutdown Computers – Must be administrator to be able to run, must configure computer name

shutdown -s -f -m \\computername01 -c "TYPE MESSAGE HERE!"

[DOWNLOAD]

Kill Task + Lock Computer [*] – Configure credentials and the process name.

taskkill /S computername01 /U administrator /P adminpass /IM taskname_whatever.exe
psshutdown -l \\computername01

[DOWNLOAD]

*PsTools is need it to run this batch file. Download here: http://technet.microsoft.com/en-us/sysinternals/bb896649

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks

http://en.wikipedia.org/wiki/SQL_injection

It looks like with this SQL insertion they were able to upload files on to our server using a web base FTP server. It seems like only the d87studios.com sub domain was affected, all of the other sites hosted in this server where OK. But as a safety precaution, everything was wiped clean.

For now i will stick with WordPress and hold off on Joomla until i can look in to this in more detail. Please note that I’m not blaming Joomla for what happen, it is my job to check on the logs and keep track of this website.

I learn my lesson!

After fixing this issue on the server I’m surprise that i still get hits to the location on the server where the phishing site was.

<— Take a look at the screenshot of the log.

Misery loves company…

It looks like we are not alone, after going trough my RSS feed i found this article by the F-Secure Weblog which reports on a phishing site that was found on a Sony server. Ouch!!

http://www.f-secure.com/weblog/archives/00002160.html

Image credit: gone phishing by ~Fruitisbad