The Haphazard Blog

I had trouble installing Visual Studio 2010 Professional RC on Windows XP last week. My issue was when I was running the installer, it would start a little bit and then the installation dialog would just exit. Looking at the log files from the installation (located in your user account’s temp folder, usually C:\Documents and Settings\User Account\Local Settings\Temp) didn’t really point to a specific cause.

I was able to install it by using the following command from within the setup folder at the command prompt:

setup /q /full

This ran the installation from the background, but be warned, it will cause your machine to automatically exit applications and reboot. In my case, my machine rebooted twice and after the second time, it was about 30-45 minutes before the installer was done (I could only tell by monitoring the task manager and the setup.exe process along with the constant creation of msiexec.exe processes). Unfortunately, Visual Studio would crash constantly (with no error) when I moused over the Toolbox.

Finally, I came across something on the MSDN boards. I wasn’t having the problem the person who posted the question was having, but this took care of my problem. I also suspect if I did this first, I would’ve been able to use the installer normally. The solution is to disable handwriting support. Since I don’t have a tablet, I didn’t need it (I don’t know why it was enabled in the first place).

1. Open the Control Panel
2. Choose Regional and Language Options
3. Go to the Languages tab
4. Click the Details… button in the Text services and input languages pane
5. Under Installed services under the Settings tab, Remove Handwriting Recognition
6. Click OK
7. Click OK

As I was getting the link to the RC when writing this article I saw there was an important note posted on the site:

Important Note: If you use IntelliSense on a device with UIA 3.0 (e.g., Tablet PC, touch display, some 3rd party applications), be sure to download these two hot fixes before using the RC (KB980610 and KB980920).

Installing those may also prevent the errors while maintaining handwriting recognition support if you need, but I’m not sure. I ignored those downloads at the time because I don’t have a tablet.

In Windows, the My Recent Documents Start Menu item is useful and productive. It allows you to quickly open back up an item you were recently working with. Unfortunately, for some users (like me), it can get filled up with files you don’t want in there. In my case, it’s mostly media files (audio, video, pictures). If your application doesn’t stop the files from showing up there, then it can reduce the effectiveness of recent documents.

I tried to find a way to stop these files from being listed. I found some applications you can run to clean up what is shown and some ideas for simple scripts. But again, you have to manually run them after the fact. Finally after some digging, I found a way to prevent them from being listed in the first place.

I’m going to preface my instructions with Microsoft’s registry warning:

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

I’m going to include an example using the image file format JPG (*.jpg files)

1. Open the windows registry (Start->Run…, regedit, OK).
2. Navigate to HKEY_CLASSES_ROOT.
3. Locate the extension for the file type you don’t want to show up in My Recent Documents (.jpg).
   

   Registry Folder for .jpg

4. There will be a (Default) key that points to the application that handles these files (on my machine, it is jpegfile).
5. Navigate to the value for (Default) within HKEY_CLASSES_ROOT (further down).
   

   Registry Folder for jpegfile

6. Locate the EditFlags key. If it does not exist you can create one (Edit, New, DWORD Value).
7. If the EditFlags Type is REG_DWORD, follow this step and ignore the next step. Change the 3rd value (from the left) from a 0 to a 1. Make sure that the Base is Hexadecimal. In the example above, change the value from 00010000 to 00110000. If it is already a 1, do nothing.
   

   Editing the EditFlags Key (DWORD)

8. If the EditFlags Type is REG_BINARY, follow this step. Change the 5th value (from the left) from a 0 to a 1. Make sure that no extra values are added (there should only be 8 characters). An example would be to change the value from 00 00 01 00 to 00 00 11 00. If it is already a 1, do nothing.
   

   Modifying the EditFlags Key (BINARY)

9. Press OK and exit the registry. (You can repeat this procedure for all the file extensions you wish to keep out of My Recent Documents (e.g. mp3, mpg, avi, wmv, flv, mkv, wav, jpg, gif, bmp, zip, etc.)

This works for Windows XP, Windows Vista and Windows 7. I’m not sure about Windows 2000 and older. Also, for Windows 7, this will also prevent the file from showing up in the Recent or Frequent category of that application’s Jump List.

For the technically minded who want further details on what they are doing, here they are. You are setting a File Attribute Flag, specifically the FTA_NoRecentDocs flag. Because this is the only flag set on that byte, you can simply toggle from 0 to 1. If other flags used this byte, it would become necessary to “OR” all the bits. This is also why you leave all the other values as they were. Finally, the difference between DWORD and BINARY is the position of the least significant byte. In DWORD, the least significant byte comes first. In BINARY, the least significant byte is last.

UPDATE: I have recently discovered that if you upgrade the application or install a new application to handle those files that the registry values could be reset/erased. For example, upgrading Quick Time caused mov and mp4 files to start showing up in My Recent Documents again. So I had to re-do the procedure above. Good thing I wrote it up for future reference. :)

I’ve been using Firefox going back to the days when they had changed the name from Firebird to Firefox. When my PC died, I had to rebuild a new one. I was backing up my Firefox profile at the time, so I only had to restore it. It took a little bit of manual work to do it, but it wasn’t a big deal. However, Firefox now took at least 20 seconds to fully exit (the window would go away, but the process was still running) and often 1 to 2 minutes. This is on top of the huge amounts of memory (physical and virtual) it eats up over prolonged usage.

I decided with my new PC, I would just discard my profile. It has been updated, upgraded and manually maintained through multiple Firefox versions. Add multiple extensions being installed and uninstalled over that time and it is time to start fresh. The one thing I did not want to lose were all my saved passwords. This turned out to be pretty straightforward. After I installed Firefox 3.6 (this method will also work with 3.5, but I’d recommend that whatever version you do this with, make sure the old one and new one are the same), I copied the key3.db and signons.sqlite files from the old profile folder to the new profile folder.

After writing the stuff above, I went to see if I could find a page describing the files that comprise a profile to link that would help people copy over other parts of their profile they want to keep while also having a clean install. You can read it here, and it points out exactly which files you need to move the passwords. There is also a guide on backing up and restoring profiles on that site as well.

The Malware is all gone. It hooked in pretty deeply. It was actually pretty clever. It manages to load a library during boot-up before you even get to the Windows log in screen, and well before your anti-virus software is running. It does not stop there. It then attaches to any/multiple running processes as a thread so nothing looks out of sorts. So you look at the task manager and all the running processes appear legit. I assume that’s why the anti-virus software was clueless. In addition, it discretely disabled the Windows Security Center warnings when your anti-virus software is disabled and hid Windows Updates. (This is how I figured out the problem. I highly recommend Malwarebytes to everyone, it pointed me to the registry entries that were being changed.)

I first used RegMon to watch the registry entries to see what was changing the entries. It was odd that my mail program and explorer were doing it. So I used Process Explorer to see what those programs were up to. After that, Google led me to a program that took care of it once and for all, ComboFix. It’s straight forward to use if you follow the directions. I like that it installs the recovery console as a boot option.

Updated 9/29/2009: I just discovered that ComboFix resets the hosts file. For most, this won’t matter. I added some hosts for testing multiple web applications on different “domains”. It took me a little bit of time to realize why they would not work.

Two Days. That’s all it took for my machine to be compromised by something. I have no idea what it is, or how it got past my anti-virus software. I got it from a legitimate website. I suspect it was an advertisement type of attack. That’s what I get for using Internet Explorer and forgetting to disable the Adobe Acrobat plug-in. My anti-virus software was going nuts warning me and Acrobat launched. I closed it and I thought everything was fine.

A couple hours later popup ads started to spawn like crazy. I managed to close all the windows and kill the process. I did some Googling and found this product called Prevx. I downloaded it and ran it. It detected the problem and said it could fix it. This is where I’m annoyed. All it does is detect the malware. When you want to remove it, it’s time to pay for a subscription. I fully understand the business model, but it’s pretty cold to taunt the user. We found a problem, now pay up to fix it! I imagine this is pretty successful. I can’t believe PC Magazine awarded this software an Editor’s Choice award and doesn’t mention how crippled the “free” version is. To add to the annoyance, you can’t even exit the program easily. I had to kill the process.

I managed to do enough that I haven’t seen any popups, but it’s not gone. If I try to eliminate the DLLs, it becomes active. I’m pretty tired at this point. I’m going to shut down the PC and try to get rid of this in the morning. It is definitely something very hard to remove. I really don’t want to reformat and install Windows again.