Procedure is simple:

• install backup server on another machine
• configure backup location
• stop the service
• copy all files from old server to new server in configured backup location
• copy C:\Document and Settings\All Users\Application Data\Acronis\Backup server dir to another server overwriting the another one
• start the service
• check if everything is ok with Management Console

But (there is always at least one but) deleting of the mailboxes was including automatically deleting of user accounts on domain so in other words no one could log in on the domain or their own computers connected to domain.

Exploring MSDN and Google for solutions I have learned yesterday that deletion of objects on AD is not meaning that they are deleted directly, it’s rather that they are moved to a side for a quite long time until being deleted. So as it means that they are not deleted, restore should be easy, and it was (thinking on all possible scenarios).

There is one program called ADRestore.net which you can find on this link.

On the link above you can download program and see it in action, so in the end I have succeeded to restore all accounts with help of it.

NOTE: Restoring of the objects does not mean that all of its properties and parameters will be restored with it, so you will need to review them and fix as needed, generate new passwords and so on.

The fix is very simple, just delete sf_sdf.dll file from C:\Snort\lib\snort_dynamicpreprocessor directory and start snort again.

Update of snort is very simple and it can be described in few simple steps which can be used for fresh install as well:

• download Snort 2.8.6 from the www.snort.org site
• download WinPcap 4.1.1 from the www.winpcap.org
• install both of them on the target machine
• download the latest community rules from www.snort.org (you need to register and log in to be able to download them)
• extract rules to C:\Snort overwriting existing files and open Snort.conf file in the etc map
• find line nr. 155 and replace it to this dynamicpreprocessor directory C:\Snort\lib\snort_dynamicpreprocessor
• then replace line 158 to this dynamicengine C:\Snort\lib\snort_dynamicengine\sf_engine.dll
• and then comment out line 161 if you don’t have dynamic rules #dynamicdetection directory /usr/local/lib/snort_dynamicrules
• now when you are done if you are not using IPV6 delete sf_sdf.dll file from C:\Snort\lib\snort_dynamicpreprocessor to avoid this error
• start Snort to test it
• start Snort as service if test is OK

Snort® is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.

Installation of Snort on Windows is pretty simple.

First, you need to download and install few things. For Snort to be able to act as sniffer and IDS it needs Windows Packet Capture Library which is WinPcap. The stable latest version on the site is 4.1.1 and you can download it here.

Now when we have WinPcap installed the next step will be to download Snort. The latest version for Windows is 2.8.5.1 and you can download it here. Installation shouldn’t be a problem, if you need IPv6 support and logging to Microsoft SQL or Oracle database then you need to select proper radio and check boxes and if don’t then just go next and next to the end and that’s it. Default installation directory is C:\Snort so remember it because it will be our working dir all the time.

So we have installed WinPcap and Snort but we are not finished with installation yet. We have one more thing to download and install. The Snort rules. These rules are those small files that tells Snort what it should search for in captured packages and how to identify them, as a threat, information disclosure or something else. For us to be able to download Snort rules we have to be registered on Snort site. Registration is free and rules are one month old for free users, for those who need the latest threats detected at the same moment when they are published to the community I suggest to buy VRT subscription so you will have the latest rules directly as they are announced. So now we will download snortrules-snapshot-2.8.tar.gz rules archive file.  When you open archive file you will get following structure:

Snort rules

Copy all four directories over those in C:\Snort replacing contents that already exists on the hard drive.

Now when we are done with easy part we need to configure Snort to run. Because these rules are written for unixoid systems we need to change some things in the main config file C:\Snort\etc\snort.conf so that Snort can start at all.

Here are the things that you need to edit to be able to run snort:

Find lines 269 and 270. These lines will not allow Snort to start, at least not on Windows because Snort detects the second one as double config detection line so we need to change this.

Change from this:

config detection: search-method ac-bnfa
config detection: max_queue_events 5

To this:

config detection: search-method ac-bnfa max_queue_events 5

Now, the next thing that we need to change is lines where we say to Snort where to find dynamic preprocessor files. On lines from 298 to 303 change this:

dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_dce2_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_dns_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ssl_preproc.so

To this:

dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_dce2.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_dcerpc.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_dns.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_ftptelnet.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_smtp.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_ssh.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_ssl.dll

Next thing to change is line 324 on which we have dynamic engine path, so change it from this:

dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so

To this:

dynamicengine C:\Snort\lib\snort_dynamicengine\sf_engine.dll

I don’t know why, maybe some mistake, but lines bellow should be commented out by default, but they were not so we have to comment them out. Because we are not VRT subscriber and don’t have any dynamic detection files we need to coment lines from 339 to 354, so change this:

dynamicdetection file /usr/local/lib/snort_dynamicrules/bad-traffic.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/chat.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/dos.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/exploit.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/imap.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/misc.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/multimedia.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/netbios.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/nntp.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/p2p.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/smtp.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/sql.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/web-client.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/web-misc.so

To this:

#dynamicdetection file /usr/local/lib/snort_dynamicrules/bad-traffic.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/chat.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/dos.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/exploit.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/imap.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/misc.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/multimedia.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/netbios.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/nntp.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/p2p.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/smtp.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/sql.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/web-client.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/web-misc.so

Now we need to trim a bit SSH preprocessor to work on Windows as it is different from Linux one, so find line 753 and change this:

preprocessor ssh: server_ports { 22 } \
max_client_bytes 19600 \
max_encrypted_packets 20 \
disable_srvoverflow \
disable_protomismatch \
disable_badmsgdir

To this:

preprocessor ssh: server_ports { 22 } \
max_client_bytes 19600 \
max_encrypted_packets 20

Now we are good to go. We can test snort easily from the command line. So now go on Start->Run and type cmd following by enter key. Now in command prompt type following commands:

c: and then enter key

cd c:\snort\bin and then enter key

snort -v -c C:\snort\etc\snort.conf -l C:\snort\log -K ascii and then enter key

So now we have entered Snort directory and started Snort on command line. You will first see Snort starting and parsing config file snort.conf and then you will see lot of output when Snort start sniffing and controlling packages on the network. If it finds any package that is not regular network traffic it will save info about it in c:\Snort\Log\alert.ids file. Simple output of one captured packet looks like this:

[**] [1:254:7] DNS SPOOF query response with TTL of 1 min. and no authority [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
12/22-12:19:12.577553 192.168.137.206:53 -> 192.168.137.10:55153
UDP TTL:128 TOS:0×0 ID:5399 IpLen:20 DgmLen:79
Len: 51

Now to explain what we have here. The first line says what type of attack is it, the second line says what classification is it and what priority does it have, and the last three lines are data about the attack, attacker IP, your IP, destination and source ports and so on.

snort /service /install -c C:\Snort\etc\snort.conf -l C:\Snort\log -K ascii

1. Install MacPorts
2. In Terminal type sudo port selfupdate, to fetch the latest repository contents
3. Run sudo port install wine to install all things needed for Wine. You can ignore error at the end regarding Wine version.
4. Install Git in terminal sudo port install git-core
5. Fetch the lattest source from winehq with git,  git clone git://source.winehq.org/git/wine.git ~/wine-git
6. Enter to the ~/wine-git directory and run ./configure, ./make, ./make dep and ./make install commands

That’s it. Wine is now installed on your machine.

This brings me to the problem that I have lot of folders with lot of images without any order. This has begun to frustrate me, so I started to write program that will sort them based on exif in respective folders, but one night while reading DPreview forum I have founded link to one program that can do exactly what I want on the way I want.

The program is called DIM or Digital Image Mover. It’s exactly what it’s name says, image mover from one place to another. It doesn’t do anything more, just move/copy images from one place to another in the respective folders that are created by the date template that you provide.

Program is written in Java so it works on all platforms that have support for JRE – Java Runtime Enviroment and so far I have tested it on Mac OS and Windows without any problems.

It has support for all major raw files (NEF, CR2, CRW), jpeg, tiff, png and so on.

Here is a link to the site of the Alan Light who is author of the program, where you can find the latest version (4.0 at the moment), download it and send donation to author of the program.

Then I run ipconfig command that showed to me lot of Tunnel adapters that were disconnected and created automatically by Vista.

So to have painful installation of new cluster I have disabled IPV6 protocol totally.

Here is solution:

• start run with win key + r or by start menu
• regedit
• go to HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters
• add new dword (32bit) value DisableComponents with value 1
• restart
• enjoy

The program is called Mirror and is written by Dominik Jain and you can download it here. The latest version is 1.43.

It works very simple like it should, you enter source and destinations dir and that’s it. If you want only to test it w/o any actions taken just add -d (d for demonstration).

Of course it has possibility to enter file mask or regular expressions as well and it’s only 172kb in size.

On his site you can find few more tools and utils that he wrote.

Here is the backup link just in case Mirror 1.43 (19).

I have searched a bit to find if it is possible to have it on XP because Vista sucks but is’t only available for Tablet PCs.

Luckily there are free solutions and replacements on the Internet.

Program is called Gadwin PrintScreen and it’s freeware.

When you install it you get a small tray icon and it’s automatically activated with Print Screen key.

In program options you can configure where to save output files, what type of picture they are going to be, resizing options and so on.

You can download program on this link.

BEFORE you begin, restore your iPod Touch clean to it’s factory state.
As with every other tutorial you need the C++ redistributable and LIBusb.

1. Download unofficialsn0w 2.0 for Windows from here Download

2. Get the 2.2.1 iPod Touch Firmware HERE

3. Rename the 2.2.1 ipsw to OriginalFW, or OriginalFW.ipsw IF you have file extensions visible, and place it in /IPSW

4. Run IPSW.bat (It will take a while)

5.
a.Right click on the jb.ispw and either open with Winrar or 7.zip

b.Go into Firmware\all_flash\all_flash.n72ap.production\

c. Delete the LLB file.(optional since it will be replaced by the new one)

d. Replace (by dragging) with the LLB file that’s in the same folder as the jb.ipsw.

e. Exit, continue to step 6

6. Place your iPod Touch 2G into DFU mode, plug it in and run RUNME.exe

7. Shift + Restore to JB.ipsw in iTunes and your done!!!

Although I have done all that is written there, during flashing I would receive error and iPod would stay in recovery mode.

Then I have found one small program – QuickFreedom – Untethered GUI that has created firmware for me that I could flash latter with iTunes and jailbreak my iPod. So if you have problems with first solution try the program and also if you want to change boot logos you can do it with this program. For original firmware you can use one that you have downloaded from link above.

Some notes.

Note 1.

You will need libusb for first solution (and I think for second one as well) and you can download it here.

Note 2.

Entering DFU mode is not that simple as someone would say it is. Here are steps to enter it:

• Power off iPod.
• Press and hold power and home buttons.
• Ipod will start and then it will shut down again. When this happens release power button and hold home button for 15-20 seconds.
• You will have blank black screen and it means that you have entered in DFU mode.

Error that I was getting was PEER_DELETE-IKE_DELETE_UNSPECIFIED. I tried to find some with similar problem on Google but that wasn’t successful either.

So the only thing to do was to install Windows from scratch and begin from start again with elimination of software.

After a while I have found that new version of Thinkpad Fingerprint Software 5.8 was cause of my agony. It took me almost 2 days to find this error but reverting on older version 5.6 solved the problem.

I hope that this will help someone with similar problem like I had.

1. open notepad
2. write this line in it Forfiles -p “c:\temp” -s -m *.log -d -14 -c “Cmd /C del @FILE”
3. save file and then change it extension from .txt to .bat

So here we have batch file created that will do following:

• find all .log files in c:\temp path
• older than 14 days
• and delete them

Here is small explanation of the command line:

• -p “full path” is used to specify exact path to the destination dir, it can be c:\ or c:\temp
• -s says to forfiles that it will go recursive into subdirs
• -m *.ext creates filter for files of the .ext extension, it can be *.* as well
• -d 7 says to forfiles to filter files from output above to match current date minus number of days
• -c “command” executes command on files that are returned from output of forfiles command
• cmd /c command is saying to cmd that is command prompt to execute command and terminate itself

Now to test this batch file you can delete or comment out command part so you will get output from forfiles only without deleting of the files. Also you can use move command instead of del to move logfiles to another location.

If everything works like it should open Start->Control panel->Scheduled tasks and create new task to executes every day or in any time frame that you want.

In error logs there is message:

Running: ScheduleActionAction at: 7d8/8/19 b:c:2a
Complete: ScheduleActionAction at: 7d8/8/19 b:c:2b, returned true
Skipped: InstallASAction.11
Waiting for actions from remote setup(s)
Breaking wait state and aborting package due to cancel code received: 642
Remote setup(s) are ready
Notify package action is determined: 642
Error Code: 0x800700e9 (233)
Windows Error Text: No process is on the other end of the pipe.

Source File Name: remotemessagelib\overlappedpipelistener.cpp
Compiler Timestamp: Fri Jul 29 01:13:51 2005
Function Name: sqls::OverlappedPipeListener::writePipe
Source Line Number: 294

Fix for this error is simple. Log out any users on another node in cluster and that’s it. So simple.

Note: You can copy/paste all commands written here although they are not inline, they will be when you paste them to shell or file.

For this I needed to have:

• Fully functional Linux machine ( I had already installed Ubuntu 8.04 server )
• Postfix – default installation will do
• Mail Scanner – free package that you can get on MailScanner home page
• SpamAssassin – free antispam solution
• Clam AV – free antivirus

Before of installing anything we will fetch the latest list of packages from Ubuntu repositories with command:

aptitude update

Now before installation of a Mail Scanner we need to install some packages with command:

aptitude install libconvert-tnef-perl libdbd-sqlite3-perl libfilesys-df-perl libmailtools-perl libmime-tools-perl libmime-perl libnet-cidr-perl libsys-syslog-perl libio-stringy-perl libfile-temp-perl libole-storage-lite-perl libarchive-zip-perl postfix clamav clamav-daemon libsys-hostname-long-perl libnet-cidr-lite-perl spamassassin

Answer with Y when asked to install dependencies for these packages. During the installation of postfix you will get simple menu in which you need to select Internet site and write your full host name with domain.

Because whole configuration of Postfix is being done via main.cf and master.cf files we need to change some values in them. Open main.cf and add/edit following lines to look like this:

myhostname = ubuntu.sp.local
mydomain = sp.local
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain $mydomain
mynetwork_style = host
relay_domains = lab.net
transport_maps = hash:/etc/postfix/transport
append_at_myorigin = no
local_recipient_maps =
header_checks = regexp:/etc/postfix/header_checks

Now open /etc/postfix/transport and add your forwarding domains in it. For multiple domains go to new row by same principle.

sp.local smtp:[192.168.1.5]

This ip 192.168.1.5 is IP of my Exchange server, not of my Linux machine and sp.local is the name of my domain, replace IP and domain name with yours. After this editing we need to create hash of the transport file and to restart Postfix.

postmap /etc/postfix/transport
/etc/init.d/postfix restart

Now you can control if Postfix is working like it should and if it transports mail. If everything works stop it so that we can configure other options in it and because it needs to be started after MailScanner.

/etc/init.d/postfix stop

Next step would be to unpack and install the latest version of Mail Scanner because Ubuntu 8.04 still doesn’t have the latest version in the repositories. You can get the latest version of Mail Scanner here. Because we will compile it we need .tar.gz version.

wget http://mailscanner.info/files/4/tar/MailScanner-install-4.71.10-1.tar.gz
tar zxvf MailScanner-install-4.71.10-1.tar.gz
cd MailScanner-install-4.71.10
./install.sh

You will see lot of output when you run ./install.sh because it will check which Perl modules do you have installed and install those that are missing, but as installation says:

Do not worry too much about errors from the next command.
It is quite likely that some of the Perl modules are
already installed on your system.

When install.sh is done you will get message to enter some lines in crontab to automatize jobs. Type crontab -e and enter following lines in crontab (:w to write and exit if you are using Vi editor ctrl+x for Pico).

37 5 * * * /opt/MailScanner/bin/update_phishing_sites
07 * * * * /opt/MailScanner/bin/update_bad_phishing_sites
58 23 * * * /opt/MailScanner/bin/clean.quarantine
42 * * * * /opt/MailScanner/bin/update_virus_scanners
3,23,43 * * * * /opt/MailScanner/bin/check_mailscanner

Now we need to edit /etc/default/spamassassin file and to enable SpamAssassin daemon. Open this file with editor and change these lines:

ENABLED=0 to ENABLED=1
CRON=0 to CRON=1

Now we have enabled SpamAssassin as a daemon and enabled it to update daily via cron. It’s time to start it for the first time.

/etc/init.d/spamassassin start

Next step would be to edit MailScanner.conf. Find following lines and edit them to look like this:

Run As User = postfix
Run As Group = postfix
MTA = postfix
Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming
Virus Scanners = clamav
Spam List = SBL+XBL
SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin

Now we will run MailScanner with command:

/opt/MailScanner/bin/check_mailscanner

It will automatically go to background. Now we need to tell Postfix to wait with forwarding of mails while they are checked against spam and antivirus definitions. We will need to edit file /etc/postfix/header_checks and to add following line because without it nothing will work.

/^Received:/ HOLD

Now we need to restart Postfix with command:

/etc/init.d/postfix start

I have got interesting output when I once killed MailScanner process that really make me laugh.

11818 ? Ss 0:00 MailScanner: killing children, bwahaha!
11819 ? Z 0:01 [MailScanner] <defunct>
11862 ? Z 0:01 [MailScanner] <defunct>
11905 ? Z 0:01 [MailScanner] <defunct>
11948 ? Z 0:01 [MailScanner] <defunct>
11991 ? Z 0:01 [MailScanner] <defunct>
12038 ? Ss 0:00 MailScanner: killing children, bwahaha!
12039 ? Z 0:01 [MailScanner] <defunct>
12083 ? Z 0:01 [MailScanner] <defunct>
12126 ? Z 0:01 [MailScanner] <defunct>
12169 ? Z 0:01 [MailScanner] <defunct>
12212 ? Z 0:01 [MailScanner] <defunct>

LOL, they have a good sense of humor.

So if everything is working correctly you should receive now mails with small footer text:

–
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

You can control message delivery with command:

tail -f /var/log/syslog

There you will see scrolling text like:

Sep 11 10:14:14 ubuntu postfix/smtpd[13220]: connect from web54408.mail.yahoo.com[206.190.49.138]
Sep 11 10:14:14 ubuntu postfix/smtpd[13220]: CE433E643: client=web54408.mail.yahoo.com[206.190.49.138]
Sep 11 10:14:15 ubuntu postfix/cleanup[13222]: CE433E643: hold: header Received: from web54408.mail.yahoo.com (web54408.mail.yahoo.com [206.190.49.138])??by ubuntu.sp.local (Postfix) with SMTP id CE433E643??for <mymail@mydomain>; Thu, 11 Sep 2008 10:14:14 -0400 (EDT) from web54408.mail.yahoo.com[206.190.49.138]; from=<my_yahoo_mail@yahoo.com> to=<mymail@mydomain.com> proto=SMTP helo=<web54408.mail.yahoo.com>
Sep 11 10:14:15 ubuntu postfix/cleanup[13222]: CE433E643: message-id=<225121.37413.qm@web54408.mail.yahoo.com>
Sep 11 10:14:15 ubuntu postfix/smtpd[13220]: disconnect from web54408.mail.yahoo.com[206.190.49.138]
Sep 11 10:14:15 ubuntu MailScanner[13211]: New Batch: Scanning 1 messages, 2392 bytes
Sep 11 10:14:16 ubuntu MailScanner[13211]: Virus and Content Scanning: Starting
Sep 11 10:14:20 ubuntu MailScanner[13211]: Requeue: CE433E643.352A5 to 424A5E650
Sep 11 10:14:20 ubuntu postfix/qmgr[13003]: 424A5E650: from=<my_yahoo_mail@yahoo.com>, size=1712, nrcpt=1 (queue active)
Sep 11 10:14:20 ubuntu postfix/smtp[13245]: 424A5E650: to=<mymail@mydomain.com>, relay=192.168.1.5[192.168.1.5]:25, delay=5.6, delays=5.5/0.01/0/0.15, dsn=2.6.0, status=sent (250 2.6.0 <225121.37413.qm@web54408.mail.yahoo.com> Queued mail for delivery)
Sep 11 10:14:20 ubuntu postfix/qmgr[13003]: 424A5E650: removed
Sep 11 10:14:20 ubuntu MailScanner[13211]: Uninfected: Delivered 1 messages

This means that MailScanner is scanning messages against spam and viruses.

Now the latest step would be to create RC script to start MailScanner on boot and before Postfix. Here you can read/download file mailscanner.txt file which you will use to create new /etc/init.d/mailscanner file.

This script is slightly modified original init script for MailScanner from Ubuntu. Next step would be to change permissions to the file and to create symlinks with commands:

chmod 755 /etc/init.d/mailscanner
cd /etc/rc0.d/
ln -s ../init.d/mailscanner K20mailscanner

cd /etc/rc1.d/
ln -s ../init.d/mailscanner K20mailscanner

cd /etc/rc2.d/
ln -s ../init.d/mailscanner S20mailscanner

cd /etc/rc3.d/
ln -s ../init.d/mailscanner S20mailscanner

cd /etc/rc4.d/
ln -s ../init.d/mailscanner S20mailscanner

cd /etc/rc5.d/
ln -s ../init.d/mailscanner S20mailscanner

cd /etc/rc6.d/
ln -s ../init.d/mailscanner K20mailscanner

So now we need to test everything with commands:

/etc/init.d/postfix stop
/etc/init.d/mailscanner start
/etc/init.d/postfix start

Notes:

If SpamAssassin doesn’t detect some of your messages as spam although they are spam you can easy manually learn it to detect that and other similar messages as spam. Follow next few steps:

1. Find that message and save it to text file including headers and content
2. Transfer file to your linux machine
3. From the directory where you have transfered file run command: spamassassin –spam < your_text_file

Things that I missed in Desktops were:

• you couln’t move opened programs between desktops
• Firefox and Winamp (possible some other programs too) wouldn’t work on other desktop if they are allready opened on one
• desktop backgrounds would disapeer

New program that I found is called Vista/XP virtual desktop manager. Some of the options that it provide are:

• Full screen desktop/window manager/preview with full drag and drop managing
• Desktop switch indicator
• An infinite number of desktops
• Watch the windows move in real time as you drag them around in the window manager
• Multiple monitor support
• Window menus
• Tray icons for each desktop
• Per-desktop backgrounds
• Configurable colors, fade speeds, hotkeys, etc.
• Uses Vista’s live thumbnails
• XP support
• And much more!

You can find more info about program and download it on this link.

Here are some screenshoots.

Because lately I (among other users) have begun to receive large number of spam on e-mail server of the company where I work, I have decided to implement SpamAssassin which is primary made for Linux.

I have searched little bit on the net how to do it and found ESA Sink written by Christopher G. Lewis. It works on the principle that SpamAssasin is working in serial mode (it scans one message at a time) and ESA Sink take incoming message from Exchange, outputs it to file, run that file through SpamAssasin and returns it to Exchange if it is OK.

Installation and configuration of everything is not that much complicated. It can be divided in following steps:

1. Download and install the latest version of Active Perl from Active State
2. Download NMake from Microsoft and after extracting move files to c:\perl\bin
3. Download ESA Sink from Chris’s site
4. After installation of ESA Sink you will get ExchangeSpamassassin.ini file opened
5. Check config file values, change if necessary, I have changed MaxMsgSizeKB from -1 to 2048 = 2MB and leave it opened for later as well as installation
6. Now start command prompt, Start->Run->Cmd and enter ppm to start Perl Package Manager
7. If you receive message that ppm is not recognizable type set path=%path%;c:\perl\bin\ and then ppm
8. Now in PPM press Ctrl+1 to see list of available perl modules for installation
9. Type Net-Dns in search field and when you get this package in list click with right mouse button on it and select install
10. Now we will do same thing for IO-Socket-INET6, IP-Country and Mail-SPF
11. Now press Ctrl+Enter to install these packages and when it is done you can close PPM
12. Download the latest version of SpamAssassin and unzip it to c:\Mail-SpamAssassin-3.2.5 (3.2.5=current version that you are downloading, in my case 3.2.5)
13. In the command prompt now type cd c:\Mail-SpamAssassin-3.2.5
14. Type following command: perl makefile.pl and answer questions before compiling
15. Now we need to run nmake, so just type nmake /i (/i means that we want nmake to compile application ignoring errors)
16. After compiling we need to run nmake /i install to install compiled files
17. Unset read-only attribute from c:\perl\site\bin\spamassassin.bat file
18. Now to test SpamAssassin we will enter in command prompt to directory C:\Mail-SpamAssassin-3.2.5\t\data\spam and execute command spamassassin -D < 001
19. If you see lot of text on your command prompt it means that SpamAssassin works like it should and on the end of output you should find scoring for content of file 001
20. Now we will return to .ini file from ESA setup and change line SpamAssassin_Batch_File to points to the location of our spamassassin.bat file which is c:\perl\site\bin\spamassassin.bat
21. Save and close file and finish the ESA installation
22. At the end of the installation you will leave checkbox to run ESA install script and click Finish button
23. Small command prompt window will come and leave as soon as ESA is installed
24. Now to see if it is working properly you can check C:\ESA\Ham or C:\ESA\Spam directories for files and you can send e-mail to yourself as well, if everything works you should find SpamAssassin information in header of the e-mail
25. To be sure that you don’t have any errors you can check C:\ESA\Log directory in which you should find log file with errors

This configuration works OK on servers that don’t receive more than 1500-2000 e-mail per day, but I wouldn’t recommend it for higher number of e-mails without very strong machine, because in this configuration SpamAssassin works in serial mode, it process one object at a time and this includes downloading of e-mail to file, control against filters, control against URBL lists and then if everything is ok returning it to server for delivery.

For me it was simple test to see if it will work for us, it didn’t worked because of large number of e-mails that we receive (10 000+ per day) so I will go on solution to create Linux SpamAssassin gateway.

Note: I would recomend creating of small .bat script that will delete .out files older than 7 days to avoid running out of disk on your system disk

So procedure would look like this:

• find wpa.dbl file and save it to some external media (usb disk, floppy, cd, etc.)
• reinstall Windows
• after reinstallation skip registration and activation
• restart pc and on boot pres F8 to enter menu where you can select safe mode
• in safe mode rename existing wpa.dbl file to wpa.dbl.backup and copy old one
• restart
• VOILA!!

So procedure is very simple and if you create your own installation cd with help of Nlite you can include this file too and skip activation after reinstallation.

Note: This file that you have saved can be used only on the PC that it comes from, on others it won’t work.

[Online Tech Tips]

Yesterday they have published a new tool with symbolic name Desktops.

This tool allows you to have up to 4 virtual desktops with separate systrays and programs on them. Even alt+tab combination doesn’t take programs from another virtual desktops so if you have runned program on one virtual desktop you won’t get it with alt+tab on another one.

Best of all, you can guess, it’s free, with size of only 62kb and you can get it here.

Here is a quote from web site of a JkDefrag:

JkDefrag is a disk defragmenter and optimizer for Windows 2000/2003/XP/Vista/2008/X64. Completely automatic and very easy to use, fast, low overhead, with several optimization strategies, and can handle floppies, USB disks, memory sticks, and anything else that looks like a disk to Windows. Included are a Windows version, a commandline version (for scheduling by the task scheduler or for use from administrator scripts), a screensaver version, a DLL library (for use from programming languages), versions for Windows X64, and the complete sources.

Program is very simple, just unzip and run it, no installation, no configuration and what is most important it works well.

On home page of JkDefrag you can download sources, executables and read some more info about it.

Read tips before defragmenting, they will increase speed of defragmentation.

BUT suddenly windows updates stopped working. This means also that Windows Defender could not update as well.

The error that I received was 0×80004002 and in c:\windows\windowsupdate.log I have found that this error was explained with text: Error: 0×80004002. wuauclt handler: failed to spawn COM server.

Some Googling helped and I have found that .dll files that were used by Windows Update were not registered correctly. I think that update of Windows Installer caused this mess because I have used Windows Update after reinstallation until one point where I was trying to download 1 or 2 remaining updates.

Easy fix for this is:

1. Start->Run->cmd

2. paste following and type enter

regsvr32.exe c:\windows\system32\wuweb.dll
regsvr32.exe c:\windows\system32\wups2.dll
regsvr32.exe c:\windows\system32\wups.dll
regsvr32.exe c:\windows\system32\wucltui.dll
regsvr32.exe c:\windows\system32\wuaueng1.dll
regsvr32.exe c:\windows\system32\wuaueng.dll
regsvr32.exe c:\windows\system32\wuapi.dll

3. Update