Comments for WishMesh http://wishmesh.com Real men don't make backups Fri, 17 Feb 2012 22:04:20 +0000 hourly 1 http://wordpress.org/?v=3.3.1 Comment on Windows 7 64-bit setup / install failed to start with ‘Status: 0xc0000225′ by Kemal http://wishmesh.com/2010/06/windows-7-64-bit-setup-install-failed-to-start-with-status-0xc0000225/comment-page-1/#comment-536 Kemal Fri, 17 Feb 2012 22:04:20 +0000 http://wishmesh.com/?p=344#comment-536 it works ! ... Thanks a lotttttttttttttttt ... it works !
…
Thanks a lotttttttttttttttt
…

]]> Comment on COM, BSTR or _bstr_t is leaking memory by JohnDepth http://wishmesh.com/2011/11/com-bstr-or-_bstr_t-is-leaking-memory/comment-page-1/#comment-534 JohnDepth Thu, 16 Feb 2012 20:16:39 +0000 http://wishmesh.com/?p=832#comment-534 Hmmm.... I usually use deleaker or similar tool in such cases))) Hmmm…. I usually use deleaker or similar tool in such cases)))

]]> Comment on IIS 7.5 error: Handler “PageHandlerFactory-Integrated” has a bad module “ManagedPipelineHandler” in its module list by Bjarte Aune Olsen http://wishmesh.com/2010/08/iis-7-5-error-handler-pagehandlerfactory-integrated-has-a-bad-module-managedpipelinehandler-in-its-module-list/comment-page-2/#comment-532 Bjarte Aune Olsen Mon, 13 Feb 2012 08:43:12 +0000 http://wishmesh.com/?p=399#comment-532 Thanks for sharing, saved me a lot of time. Thanks for sharing, saved me a lot of time.

]]> Comment on Strange HTTP GET requests from IP 150.70.x.x and IP 62.24.x.x by solidcode http://wishmesh.com/2011/07/strange-http-get-requests-from-ip-150-70-x-x-and-ip-62-24-x-x/comment-page-1/#comment-531 solidcode Sun, 12 Feb 2012 05:01:55 +0000 http://wishmesh.com/?p=740#comment-531 Yeah, The cisco router I am connected to appears to have this software installed. The strange thing is, that it doesnt only request the same urls... it appears to be running intrusion scripts on common urls... (my example is phpmyadmin) here is my example; On a new/fresh/5min old Amazon Instance, after I accessed phpmyadmin. The 150.70.x.x range requests my requested URLS (on a linux client) comes back regularly to try the URL again... the scan below is run from 109.106.165.193. I have the server blocking access to all IPs, so the requests end in 403. The intrusion script appears to try various combos. Anyone else seeing this behavoir? Apache Error Log <code> 150.70.172.103 - - [11/Feb/2012:19:53:58 +0000] "GET /phpmyadmin/js/functions.js?ts=1324498093 HTTP/1.0" 403 317 150.70.172.103 - - [11/Feb/2012:19:54:00 +0000] "GET /phpmyadmin/js/pMap.js?ts=1324498093 HTTP/1.0" 403 312 150.70.172.103 - - [11/Feb/2012:19:54:01 +0000] "GET /phpmyadmin/js/sql.js?ts=1324498093 HTTP/1.0" 403 311 188.93.10.56 - - [11/Feb/2012:20:02:43 +0000] "GET / HTTP/1.1" 403 3839 109.106.165.193 - - [11/Feb/2012:20:03:56 +0000] "GET //phpmyadmin/ HTTP/1.1" 403 290 109.106.165.193 - - [11/Feb/2012:20:03:56 +0000] "GET //_phpMyAdmin/ HTTP/1.1" 403 291 109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //pHpMyAdMiN/ HTTP/1.1" 403 290 109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //webdb/ HTTP/1.1" 403 285 109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //wp-phpmyadmin/ HTTP/1.1" 403 293 109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //admn/ HTTP/1.1" 403 284 109.106.165.193 - - [11/Feb/2012:20:04:01 +0000] "GET //MyAdmin/ HTTP/1.1" 403 287 109.106.165.193 - - [11/Feb/2012:20:04:01 +0000] "GET //phpmanager/ HTTP/1.1" 403 290 109.106.165.193 - - [11/Feb/2012:20:04:01 +0000] "GET //backup/phpmyadmin/ HTTP/1.1" 403 297 109.106.165.193 - - [11/Feb/2012:20:04:02 +0000] "GET //backup/phpMyAdmin/ HTTP/1.1" 403 297 109.106.165.193 - - [11/Feb/2012:20:04:11 +0000] "GET //admin/ HTTP/1.1" 403 285 109.106.165.193 - - [11/Feb/2012:20:04:11 +0000] "GET //dbadmin/ HTTP/1.1" 403 287 109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //sql/ HTTP/1.1" 403 283 109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //mysql/ HTTP/1.1" 403 285 109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //myadmin/ HTTP/1.1" 403 287 109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //phpmyadmin2/ HTTP/1.1" 403 291 109.106.165.193 - - [11/Feb/2012:20:04:13 +0000] "GET //phpMyAdmin2/ HTTP/1.1" 403 291 109.106.165.193 - - [11/Feb/2012:20:04:13 +0000] "GET //phpMyAdmin-2/ HTTP/1.1" 403 292 109.106.165.193 - - [11/Feb/2012:20:04:16 +0000] "GET //sqlmanager/ HTTP/1.1" 403 290 109.106.165.193 - - [11/Feb/2012:20:04:23 +0000] "GET //PMA2005/ HTTP/1.1" 403 287 109.106.165.193 - - [11/Feb/2012:20:04:32 +0000] "GET //phpmy-admin/ HTTP/1.1" 403 291 109.106.165.193 - - [11/Feb/2012:20:04:35 +0000] "GET //sqlweb/ HTTP/1.1" 403 286 </code> Yeah, The cisco router I am connected to appears to have this software installed.

The strange thing is, that it doesnt only request the same urls…

it appears to be running intrusion scripts on common urls… (my example is phpmyadmin)

here is my example;
On a new/fresh/5min old Amazon Instance, after I accessed phpmyadmin.

The 150.70.x.x range requests my requested URLS (on a linux client) comes back regularly to try the URL again…
the scan below is run from 109.106.165.193.

I have the server blocking access to all IPs, so the requests end in 403. The intrusion script appears to try various combos.

Anyone else seeing this behavoir?

Apache Error Log

150.70.172.103 - - [11/Feb/2012:19:53:58 +0000] "GET /phpmyadmin/js/functions.js?ts=1324498093 HTTP/1.0" 403 317
150.70.172.103 - - [11/Feb/2012:19:54:00 +0000] "GET /phpmyadmin/js/pMap.js?ts=1324498093 HTTP/1.0" 403 312
150.70.172.103 - - [11/Feb/2012:19:54:01 +0000] "GET /phpmyadmin/js/sql.js?ts=1324498093 HTTP/1.0" 403 311
188.93.10.56 - - [11/Feb/2012:20:02:43 +0000] "GET / HTTP/1.1" 403 3839
109.106.165.193 - - [11/Feb/2012:20:03:56 +0000] "GET //phpmyadmin/ HTTP/1.1" 403 290
109.106.165.193 - - [11/Feb/2012:20:03:56 +0000] "GET //_phpMyAdmin/ HTTP/1.1" 403 291
109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //pHpMyAdMiN/ HTTP/1.1" 403 290
109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //webdb/ HTTP/1.1" 403 285
109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //wp-phpmyadmin/ HTTP/1.1" 403 293
109.106.165.193 - - [11/Feb/2012:20:03:57 +0000] "GET //admn/ HTTP/1.1" 403 284
109.106.165.193 - - [11/Feb/2012:20:04:01 +0000] "GET //MyAdmin/ HTTP/1.1" 403 287
109.106.165.193 - - [11/Feb/2012:20:04:01 +0000] "GET //phpmanager/ HTTP/1.1" 403 290
109.106.165.193 - - [11/Feb/2012:20:04:01 +0000] "GET //backup/phpmyadmin/ HTTP/1.1" 403 297
109.106.165.193 - - [11/Feb/2012:20:04:02 +0000] "GET //backup/phpMyAdmin/ HTTP/1.1" 403 297
109.106.165.193 - - [11/Feb/2012:20:04:11 +0000] "GET //admin/ HTTP/1.1" 403 285
109.106.165.193 - - [11/Feb/2012:20:04:11 +0000] "GET //dbadmin/ HTTP/1.1" 403 287
109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //sql/ HTTP/1.1" 403 283
109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //mysql/ HTTP/1.1" 403 285
109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //myadmin/ HTTP/1.1" 403 287
109.106.165.193 - - [11/Feb/2012:20:04:12 +0000] "GET //phpmyadmin2/ HTTP/1.1" 403 291
109.106.165.193 - - [11/Feb/2012:20:04:13 +0000] "GET //phpMyAdmin2/ HTTP/1.1" 403 291
109.106.165.193 - - [11/Feb/2012:20:04:13 +0000] "GET //phpMyAdmin-2/ HTTP/1.1" 403 292
109.106.165.193 - - [11/Feb/2012:20:04:16 +0000] "GET //sqlmanager/ HTTP/1.1" 403 290
109.106.165.193 - - [11/Feb/2012:20:04:23 +0000] "GET //PMA2005/ HTTP/1.1" 403 287
109.106.165.193 - - [11/Feb/2012:20:04:32 +0000] "GET //phpmy-admin/ HTTP/1.1" 403 291
109.106.165.193 - - [11/Feb/2012:20:04:35 +0000] "GET //sqlweb/ HTTP/1.1" 403 286

]]> Comment on Batch script to test if folder / directory is empty by andy_t http://wishmesh.com/2009/07/batch-script-to-test-if-folder-directory-is-empty/comment-page-1/#comment-530 andy_t Fri, 10 Feb 2012 08:39:13 +0000 http://wishmesh.com/?p=78#comment-530 Yes Maris, you are right there. I was very certain that at least files without extension would fail but interestingly it is listed: <code>C:\Temp>dir *.* /b .test test</code> Yes Maris, you are right there. I was very certain that at least files without extension would fail but interestingly it is listed:

C:\Temp>dir *.* /b
.test
test

]]> Comment on Batch script to test if folder / directory is empty by Maris http://wishmesh.com/2009/07/batch-script-to-test-if-folder-directory-is-empty/comment-page-1/#comment-529 Maris Thu, 09 Feb 2012 16:03:55 +0000 http://wishmesh.com/?p=78#comment-529 andy_t, Thank you for more elegant code! However, I just tested and 'dir *.*' returns files without extension and files without file name, like 'dmp.' and '.svn'. Essentially, *.* and * are equal IMO (at least for dos/cmd commands, they however are not equal for all programs, for example 7-zip, see <a href="http://www.7-zip.org/faq.html" rel="nofollow">http://www.7-zip.org/faq.html</a> about '*.* wildcard'). andy_t,

Thank you for more elegant code!

However, I just tested and ‘dir *.*’ returns files without extension and files without file name, like ‘dmp.’ and ‘.svn’. Essentially, *.* and * are equal IMO (at least for dos/cmd commands, they however are not equal for all programs, for example 7-zip, see http://www.7-zip.org/faq.html about ‘*.* wildcard’).

]]> Comment on Batch script to test if folder / directory is empty by andy_t http://wishmesh.com/2009/07/batch-script-to-test-if-folder-directory-is-empty/comment-page-1/#comment-528 andy_t Thu, 09 Feb 2012 10:38:54 +0000 http://wishmesh.com/?p=78#comment-528 This will certainly fail if you got files in some folder that do NOT have an extension ("dmp") or just an extension but no name (".svn"). This here works on all files, no matter how the name of the file looks like: <code>for /F %%N in ('dir /S/B "c:\test directory\*" ^| find /V /C "::"') do (if %%N EQU 0 rd c:\test directory)</code> This will certainly fail if you got files in some folder that do NOT have an extension (“dmp”) or just an extension but no name (“.svn”).

This here works on all files, no matter how the name of the file looks like:
for /F %%N in ('dir /S/B "c:\test directory\*" ^| find /V /C "::"') do (if %%N EQU 0 rd c:\test directory)

]]> Comment on IIS 7.5 error: Handler “PageHandlerFactory-Integrated” has a bad module “ManagedPipelineHandler” in its module list by Morten http://wishmesh.com/2010/08/iis-7-5-error-handler-pagehandlerfactory-integrated-has-a-bad-module-managedpipelinehandler-in-its-module-list/comment-page-2/#comment-527 Morten Thu, 09 Feb 2012 08:27:21 +0000 http://wishmesh.com/?p=399#comment-527 Worked great! Can't believe MS doesn't check these things :-( Worked great! Can’t believe MS doesn’t check these things :-(

]]> Comment on IIS 7.5 error: Handler “PageHandlerFactory-Integrated” has a bad module “ManagedPipelineHandler” in its module list by David http://wishmesh.com/2010/08/iis-7-5-error-handler-pagehandlerfactory-integrated-has-a-bad-module-managedpipelinehandler-in-its-module-list/comment-page-2/#comment-526 David Wed, 08 Feb 2012 23:42:22 +0000 http://wishmesh.com/?p=399#comment-526 Thanks so much!!! Thanks so much!!!

]]> Comment on Run as administrator missing for shortcuts created by Visual Studio Setup Project by Mohamoud http://wishmesh.com/2010/07/run-as-administrator-missing-for-shortcuts-created-by-visual-studio-setup-project/comment-page-1/#comment-523 Mohamoud Mon, 06 Feb 2012 15:12:00 +0000 http://wishmesh.com/?p=378#comment-523 Changing the DefaultFeature to [TARGETDIR]\your_exe_file.exe worked for me. Thanks for publishing this very simple solution; you've saved me hours of googling around. Mohamoud Changing the DefaultFeature to [TARGETDIR]\your_exe_file.exe worked for me. Thanks for publishing this very simple solution; you’ve saved me hours of googling around.

Mohamoud

]]>