Bienvenido! - Willkommen! - Welcome!

Bitácora Técnica de Tux&Cía., Santa Cruz de la Sierra, BO
Bitácora Central: Tux&Cía.
Bitácora de Información Avanzada: Tux&Cía.-Información
May the source be with you!

Saturday, January 24, 2015

error 0x80041003

"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage >99
https://social.msdn.microsoft.com/Forums/windowsserver/en-US/6fcc4447-4d68-4ab8-8ca2-2c0a8bddb584/event-id-10-event-filter-with-query-select-from-instancemodificationevent-within-60-where?forum=winserver2008appcompatabilityandcertification
The actual vbscript for test.vbs can be found in:
http://support.microsoft.com/kb/950375
http://www.msfn.org/board/topic/114389-heres-how-to-fix-wmi-event-id-10-instancemodificationeven/

http://support.microsoft.com/kb/2545227
Click the start orb, enter CMD.EXE, hold CTRL+SHIFT, and press enter.  This will launch an elevated command prompt.  Then, type the following command at the prompt and press enter.  Substitute the actual path to test.vbs in the command.
  cscript.exe "c:\path\to\test.vbs"

Wednesday, January 21, 2015

STOP ERROR 0x0000007A

windbg: http://msdn.microsoft.com/en-us/windows/hardware/gg463009.aspx
===============
http://www.tomshardware.com/answers/id-2223087/kernel-data-inpage-error.html
the KERNEL_DATA_INPAGE_ERROR occurs when memory in the kernel's paged pool is swapped to the hard disk and cannot be read when needed at a later time.

Windows broadly divides memory into three pools:

The kernel non-paged pool

The kernel paged pool

The user paged pool
  The kernel non-paged pool contains memory that must be in memory at all times. This includes all of the memory used to handle interrupts, track thread and process states, and handle deferred procedure calls. Memory allocated to the kernel or drivers from this pool will always remain resident in memory at all times, it will never be swapped out to the hard disk drive and referencing memory in the non-paged pool will never generate a page fault (in fact, PAGE_FAULT_IN_NONPAGED_AREA is another famous BSoD).
  The kernel paged-pool contains kernel memory that can be swapped to a page file or swap file located on a secondary storage medium such as a hard disk drive. If memory is infrequently used, it may be swapped out. If the kernel references memory located in the kernel paged-pool it will generate a page-fault interrupt which will bring it back into the physical memory (note that as I mentioned above, the page-fault interrupt handler operates only on non-paged memory).
  The user paged-pool contains memory that can be allocated to user processes.

To best address your question, imagine a scenario when an application causes a page fault by referencing memory that has been swapped out to a page file that is located on a secondary storage device that has been removed or is inaccessible. That memory can no longer be found, so the application must be terminated as it can no longer proceed.

The same is true when the kernel causes a page fault by referencing memory that has been swapped out to a page file that is located on a secondary storage device that has been removed or is inaccessible. The kernel cannot proceed to a consistent state, so it must terminate and halt the machine.

If you have any removable storage devices, make sure that they are configured as such. If they contain page files (pagefile.sys, swapfile.sys, hiberfile.sys) they may unwittingly be used to store memory and that memory will go with them when they are removed. Your machine will run uninhibited until something references the memory that has now disappeared at which point the referencing task will fail.

Your hard disk drive and SSD may also be failing.  
CHKDSK /R will scan for bad sectors but it won't catch non-deterministic read errors and long-latency events. Check the health of the drive using a vendor supplied S.M.A.R.T monitoring tool.
------------------------------
**if you get a inpage error and do not get a memory dump: Look for a drive disconnection issue**
a common cause of a kernel inpage error would be a disconnection of a drive.
This can be caused by some simple issues, Thermal expansion/contraction of the sata cable can make and break a connection several times a second. You might consider checking the cable connections for your drive with on the sata port.
-There can be bugs in the chipset drivers for the sata port ( update chipset drivers, or change the cable to connect to another Sata chipset if you have 2.
-there can be bugs in the BIOS setup for the electronics on your board (update the BIOS)
- special issues involving solid state drives. where the SSD gets behind on it cleanup routines and takes too long to respond causing windows to reset the port. and the drive does not reconnect.
- sometimes you can enable hotswap in BIOS on the sata port of the drive and it will reconnect (hides the disconnect issue but you don't bugcheck)
- sometimes you have to update the firmware of the SSD because of bugs that cause the drive not to respond correctly (often caused by using image software to install the OS)
- sometimes you can boot your machine into BIOS and leave the SSD drive powered, after 5 mins the cleanup routines in the drive will start and it can fix the errors. (just leave it powered and not in use for a few hours)
[most of the time you will see a event viewer error from the disk subsystem that indicates that the sata port was reset]

You can also get inpage error with some physical problems with the memory sticks (basically, thermal breaks on certain pads where the memory chips connects to the circuit board. The defect is hard to detect because and most people will think it is related to when they first turn on the machine but it occurs due to the heat cycle of the memory stick. (when the board is cool, the circuit contracts and opens a address line (line disconnected therfore wired to 0 logic) drivers are loaded into the memory then the memory chip heats up in 5 to 7 seconds circuit and the connection is made and the address line gets set correctly. This can cause a whole block of memory to move after a device driver was loaded into it.
 Results is memory corruption that only occurs when the memory is cool. And the memtest86 would not find this type of failure.
==========
http://answers.microsoft.com/en-us/windows/forum/windows_7-system/kerneldatainpageerror-every-few-days/650474dd-46e2-42c1-b74b-21413fbaad55
The error code KERNEL_DATA_INPAGE_ERROR STOP: 0x0000007A states that the requested page of kernel data from the paging file could not be read into memory. It appears that there are some issues with the hard disk.
Method 1: I would suggest you to try the steps provided below and check if it helps.
a)       Click on Start, type Command Prompt, right click on it and select to run as administrator.
b)       In command prompt, type chkdsk volume: /f /r and hit enter to check and repair any volume disk errors or bad sectors present on the drive which would be causing this problem.
 ==========
try ssd life  : http://ssd-life.com/

download UBCD, and run memtest86+ for ram (couple of passes)
 http://ubcd.mirror.fusa.be/ubcd511.iso                 
For an SSD - check the manufacturers site for a diagnostic tool, or post the model here
eg, for an intel SSD:
Intel® Solid-State Drive Toolbox
Intel® Solid-State Drive Firmware Update Tool
http://windows.microsoft.com/en-US/windows7/Check-a-drive-for-errors

Monday, December 29, 2014

Hard disk signature collision

http://www.howtohaven.com/system/change-disk-signature.shtml
backup your data first!
by Christopher Heng

How to Fix the Disk Signature Collision Problem in Windows 7

Windows 7 comes with a command line utility called diskpart that can let you view and change the disk signature.
  1. Open a command prompt as administrator. To do this in Windows 7, click the Windows start menu (the round Windows icon on the left bottom corner), type "cmd" (without the quotes), right click the "cmd.exe" item that appears at the top of your menu, and click the line "Run as administrator". Do this even if you are already logged in as administrator, since on Windows 7, administrators run with reduced rights by default.
  2. A black command prompt window will open. In Windows 7, the title bar of the window will tell you that you are running it as Administrator. If it does not, it means you did not do what I just said above. Return and follow the first step, or you will not be able to successfully carry out the rest of this tutorial.
  3. Type "diskpart" (without the quotes) into the window. (Note: for this and the other commands described here, you'll have to hit the ENTER key after you finish typing your commands for them to take effect.)
  4. Microsoft DiskPart will start. When it is ready, it will issue a "DISKPART>" prompt, allowing you to enter your commands.
  5. Type "list disk" (without the quotes). This will list all the disks that are currently mounted (connected to the system). The disk will not have the usual names and labels that you're accustomed to from the Windows Explorer interface, so you will have to recognize them by their sizes.
    Note that "list disk" actually lists the physical disks, and not the partitions that you may have assigned drive letters. This means that if you have 2 physical disks, with 3 partitions on each, so that you have drives C:, D:, E:, F:, G: and H:, "list disk" will only show "Disk 0" and "Disk 1".
  6. To view the signature of a disk, you must first select it. To select a disk, type "select disk x" (without the quotes) where x is the number of the disk from your "list disk" display. When you type (say) "select disk 1", DiskPart will respond by telling you "Disk 1 is now the selected disk".
    Now type "uniqueid disk" (again, without the quotes). DiskPart will respond with the disk's signature, a series of hexadecimal digits (or at least I think it's hexadecimal).
  7. To change the signature to some other number, type "uniqueid disk ID=[NEW SIGNATURE]" (without the quotes) where "[NEW SIGNATURE]" stands for the new identifier you want for the disk (without the square brackets and without the quotes). However, before you do that, you may want to type "help uniqueid disk", which will give you more information on how the command works. You may also want to find out the disk signatures of your other disks on your system before you modify your current one so that you don't cause a new signature collision in trying to solve your current problem. In addition, if you're really not sure how many digits you should give your disk, perhaps try changing only one digit of the current signature (eg, increasing or decreasing it by 1). Remember my disclaimer above: I really don't know what I'm talking about here: do it at your own risk.
  8. To quit DiskPart, type "exit". Incidentally, in case you get lost while running DiskPart, when you are at the "DISKPART>" prompt, you can type "help" to get a list of commands. Typing "help" followed by the command typically gives you more info about that command.
    Once you've quit DiskPart, type "exit" again to quit the Administrator Command Prompt.

But How Do I Know Which Disks Have Colliding Signatures?

When I encountered this problem on my system, I didn't know which of my existing disks had a signature that collided with the one that Windows refused to mount (although I had my suspicions). To solve it, I simply disconnected all my external disks, mounted one, used DiskPart to list its signature, noted the signature somewhere, disconnected it, then mounted the next one and repeated the procedure. With this method, I eventually found out which 2 disks had the same signature, and could change one of them to a different identifier. (For the curious, I simply used the example signature given by DiskPart in its "help uniqueid disk" as the new signature. With my understanding of the situation as shaky as it was, I didn't want to risk giving my disk an invalid signature.)
Copyright © 2009-2012 by Christopher Heng

Thursday, September 4, 2014

Acceso a páginas web de grandes empresas plurinacionales

en cerca de 30-40% de los casos no es posible
Gran parte de las páginas principales de muchas empresas en Bolivia.. (muy claramente impresas en sus membretes, encabezados y tarjetas de visita) son solamente accesibles (si es que existen) si se escribe el famoso e innecesario (para el resto del mundo internetiano) www.
antepuesto a (por ejemplo): plurimulticulti.gob.bo
Muchas están con una simple página indicando que están en construcción (desde hace años)
Y otras tantas indican lo siguiente:

Forbidden

You don't have permission to access / on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Será que muchos "profezionalez diceñadorez y kreadorez de páginaz gueb" no pueden hacer un trabajo aceptable?

Thursday, July 31, 2014

Comodo SW

https://icedragon.comodo.com/
https://www.comodo.com/home/browsers-toolbars/browser.php
http://help.comodo.com/topic-75-1-287-3154-Comodo-Programs-Manager---Introduction.html

http://help.comodo.com/topic-212-1-514-5928-Comodo-Free-Modsecurity-Rules---Introduction.html
http://help.comodo.com/topic-121-1-245-2371-Introduction-to-Comodo-Unite-.html

http://help.comodo.com/topic-170-1-493-5208-Introduction-to-Comodo-Rescue-Disk.html
http://www.blackmoreops.com/2014/02/03/notable-penetration-test-linux-distributions-of-2014/
http://na.mirror.garr.it/mirrors/deft/

Saturday, July 26, 2014

open port 80 to VDR on TP-Link WR741N

http://www.tp-link.us/article/?faqid=470
Customer Scenario
IP Camera<----->TL-WDR4300<---->Internet<------->Office PC
Problem Description
Customer has an IP camera with IP address 192.168.0.100. The web management port of the camera is 80. Camera is set as DMZ host on TL-WDR4300. But when customer wants to check the camera settings by accessing http://wan_ip_of_router but he cannot get through.
Customer then tries to forward port 80 to 192.168.0.100 on Virtual Servers page. The following error message pops up. Thus virtual server entry cannot be added.
“Error code: 25002
The port of the virtual server is conflicting with that of the remote web management. ”
Root cause of the problem
Port 80 is reserved for remote web management page no matter Remote Management feature is enabled or not.
Available Solutions
Solution 1: In this solution you will need to change the Web Management Port of the router.
Step 1
Go to Security - Remote Management page. 
Step 2
Configure Web Management Port different with 80, for example 8080.
Step 3
You can either set the camera as DMZ host or just forward port 80 to your camera on Forwarding -- Virtual Severs page. You will be able to access the camera from internet by visiting http://wan_ip_of_router.
Note: After changing Web Management Port you need to reboot the router to make the change effective. You will need to use http://tplinklogin.net:8080 to access the web management page from local network after reboot.
Solution 2: In this solution you can keep the router’s Web Management Page as it is.

Thursday, July 17, 2014

Too many received headers

This is the mail system at host mailhub20.cotas.com.bo.
I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below.
For further assistance, please send mail to postmaster.
If you do so, please include this problem report. You can delete your own text from the attached returned message.
                   The mail system
<xxxx@cotas.com.bo>: host mail.cotas.com.bo[192.168.2.158] said: 554
    Too many received headers - possible loop (in reply to end of DATA command)
Final-Recipient: rfc822; xxx@cotas.com.bo
Original-Recipient: rfc822;xxx@cotas.com.bo
Action: failed
Status: 5.0.0
Remote-MTA: dns; mail.cotas.com.bo
Diagnostic-Code: smtp; 554 Too many received headers - possible loop
==============
SMTP_Server_Error_and_Status_Codes.pdf
http://www.pcreview.co.uk/forums/messages-bouncing-back-t3221669.html
The 554 error code means the transaction failed between the sending and receiving mail hosts. That occurs during the mail session between those hosts which means the message was never delivered to the recipient's mailbox. Either you (via Outlook, add-ons, or e-mail interrogative software) have mangled the headers or your sending mail host did the mangling. Or the receiving mail host is sending back a poorly worded comment to the 554 error code and something else really happened during the mail session between the mail hosts. One cause is the receiving mail host causes the message to loop back to the sender and gets stuck in a routing loop (adding more headers on each loop) which means the sender's routing tables are screwed up for the recipient's domain. The recieving mail host probably pukes after the header size exceeds something like 32KB and rejects the mail session.
You can't fix that problem. Tell your e-mail provider about the problem. It is possible that the problem is caused by your anti-spam program. I've seen them pad tabs to the end of headers which eventually make too long the length for a header. If it is to just one domain and its mail host then it is probably a problem with your e-mail provider and they'll have to fix it.
------
http://support.microsoft.com/kb/284204/en-us
UnderstandingEmailErrors/ 
Abajo sigue el texto que mando y 
tan sólo NO reciben los usuarios de la central de correos @cotas.com.bo:
Oferta de Servicios Informáticos BRB

Estimado Sr. | Estimada Sra.,
ofrecemos

   - reparación y configuración adecuada de sus PC,
   - configuración de redes funcionales,
   - venta de *equipos para uso empresarial* y
   - otras soluciones especiales (Pseudo-servidores reales***, Política de
   Seguridad de Datos, etc.)
   - Mac-compatibles con RAID
   - NAS con 8-16 TB -guardar y compartir archivos 100% seguro (MS Windows,
   Mac OSX, GNU/Linux, Unix, BSD)
   - Plataformas empresariales (GNU/Linux o Windows)
   - Soluciones bajo una Política de Seguridad de Datos

Siga el siguiente vínculo:
Oferta para Empresarios
 

 Y si quiere leer en un contexto más detallado:
Información general

Estamos seguros de ofrecerle un servicio a la altura de sus expectativas
Si requiere considerar algún caso especial de Seguridad Informática o una
solución adecuada a su empresa, no tenemos ningún inconveniente de visitar
sus oficinas para tratar el tema personalmente con la persona indicada.
Atte.
Carlos E. Bähren
77644057 3281202
cebaehren@gmail.com