NirBlog

The new versions of SmartSniff and SniffPass utilities allows you to capture network traffic with the version 3.x of Microsoft Network Monitor driver. This feature is especially useful for the users of Windows Vista, Windows 7, and Windows Server 2008, because the old version of Microsoft Network Monitor doesn’t support these operating systems.

Also, Microsoft Network Monitor 3 provide a new feature for Windows Vista/7/2008 users – it allows you to switch your Wifi adapter to ‘Monitor Mode’ (Only if the adapter supports this mode), which means that it can capture the traffic from other wireless networks around your location.

When using this ‘Monitor Mode’ with SmartSniff, it won’t be able to capture the traffic from most of the wireless networks, simply because they are encrypted with WEP/WPA. However,  if there are some unencrypted wireless networks in your area,  SmartSniff will be able to capture and show the content of the transferred TCP/UDP packets.

SmartSniff with Network Monitor 3 driver

Another important feature added into the new version of  SmartSniff/SniffPass is the ‘Promiscuous Mode’ check box for WinPCap driver capture mode. In previous versions, these utilities always turned on the  ‘Promiscuous Mode’, but with many Wifi adapters, the capturing doesn’t work at all when using them in Promiscuous Mode.  Starting from these new version of SmartSniff/SniffPass, the Promiscuous Mode is turned off by default, and you can turn it on in the ‘Capture Options’ window when you need it.

NetRouteView is a new utility that can be used as alternative to the standard route utility (Route.exe) of Windows operating system. It displays the list of all routes on your current network, including the destination, mask, gateway, interface IP address, metric value, type, protocol, age (in seconds), interface name, and the MAC address.

It also allows you to modify, delete, and add new routes to your network adapters.

For more information about this new utility, click here.

NetRouteView

OperaPassView is a new password recovery utility that decrypts the content of the Opera Web browser password file (wand.dat) and displays the list of all Web site passwords stored in this file. You can easily select one or more passwords in the OperaPassView window, and then copy the passwords list to the clipboard and save it into text/html/csv/xml file.

Currently, OperaPassView cannot decrypt the passwords if they encrypted with the master password. I’ll possibly add support for master password in future versions.

For more information about OperaPassView, click here.

OperaPassView

When you search the content of files with Windows search, there are special plug-ins known as “IFilter” that allows Windows to search inside different file formats. For example: If you request to search for a string inside a Word document file (.doc extension),  the “Microsoft Office Filter” component (OffFilt.dll) is used for reading and parsing the Word document.

SearchFilterView is a new utility that allows you to easily view the list of IFilter components installed on your computer, as well as it allows you to add and remove the file extensions that are used for the specified IFilter.

SearchFilterView is available to download from here.

SearchFilterView

AppCrashView is a new utility that allows you to easily watch the application crashes that have been occurred in your system. There is one major drawback for this tool – it currently only works under Windows Vista, Windows 7, and Windows 2008, so most of Windows users cannot use it.  This utility relies  on the .wer files (W.E.R = Windows Error Reporting) created only by  the newer versions of Windows (Windows 7/Vista/2008), and thus older versions of Windows are not supported.

It’s possible that in future versions, I’ll also add support for Windows XP/2000/2003 by using Dr. Watson (Drwtsn32.exe) or other debug component that automatically captures the application crash information.

For more information about AppCrashView utility, click here.

New utility in NirSoft collection, ShellMenuNew, allows you to easily disable and enable menu items that are listed under the ‘New’ submenu of Explorer.

Explorer New Submenu

This utility was not specified in the utilities plans for 2010 that I posted a few weeks ago, simply because I created this utility within a few days without planning to create it before.

You can read more about this utility and download it in this ShellMenuNew web page.

ShellMenuNew

2 disk related utilities added to NirSoft in the last week. The first one, DiskCountersView, displays the system counters of each disk drive in your system, including the total number of read/write operations and the total number of read/write bytes. It also displays general drive information, like disk name, partition number, partition location, and so on.

DiskCountersView

The second utility, DiskSmartView, retrieves the S.M.A.R.T information (S.M.A.R.T = Self-Monitoring, Analysis, and Reporting Technology) from IDE/SATA disks. This information includes the disk model/firmware/serial number, cylinders/heads, power-on hours (POH), internal temperature, disk errors rate, and more. You can use the S.M.A.R.T information retrieved by DiskSmartView to find out whether there is any significant problem in your disk drive.

DiskSmartView

Both utilities are already included in the latest release of NirLauncher package at http://launcher.nirsoft.net

A few months ago, I posted some information about moving to x64 system and explained the problem with creating 64-bit version of OpenedFilesView.
A few users that read my Blog post suggested that I use the trick described in the following  article:  Solving 64-Bit Windows’ “I Only Want Signed Drivers!” Tantrums.
After checking this method, I found out that some information in this article is inaccurate, but in the end I managed to get it work. First, this article suggest to use ‘bcdedit /set testsigning on’ command in order to turn on the mode that allows to load drivers that are not signed by Microsoft. However, this article doesn’t mention that this command takes effect only after system restart.  Also, this article says that I must install the certificate on the computer that I want to load the driver. In fact, I found out that I can load my driver even without installing the certificate, as long as I sign my driver with my dummy signature, and the driver signing test mode is turned on.

Although many users may not want to turn on the driver signing test mode just to use my OpenedFilesView utility, I decided to create unofficial release of OpenFilesView/x64 that can be used when the test mode is on. I also added a few lines of code that automatically offer the user to turn on this test mode when the driver cannot be loaded.

You can download the x64 release of OpenedFilesView from here.

In the first time that you try to run it, OpenedFilesView will ask you if you want to turn on the driver test mode. If you choose ‘Yes’, you’ll have to manually reboot your system in order to start using OpenedFilesView.  After reboot, your system will be loaded in test mode, which allows OpenedFilesView to load the driver and work properly.

Be aware that Windows continue to work in this test mode even after reboot. If you want to turn off this test mode, you can choose ‘Help->Turn Off Test Mode’  in the menu bar of  OpenedFilesView, and then restart the computer.

OpenedFilesView in Windows 7/x64

Each time that you run an application in your system, a Prefetch file (.pf file) which contains information about the files loaded by the application, is created by Windows operating system. The information in the Prefetch file is used for optimizing the loading time of the application in the next time that you run it. These Prefetch files are stored in C:\Windows\Prefetch, starting from Windows XP.
WinPrefetchView is a new utility that allows you to easily watch the content of these .pf files.  By looking in these files, you can learn which files every application is using, and which files are loaded on Windows boot.

For more information about this new utility, click here.

WinPrefetchView

The new version of SearchMyFiles utility provide a new search mode that allows you to easily find duplicate files in your system.  When you switch to the new ‘Duplicates Search’ mode, SearchMyFiles scans the files according to your preferences, like it does in the regular mode, but instead of displaying the list of all files, it only displays the files with identical content.

In order to start using the duplicates search, simply set the Search Mode combo-box in the search options window to ‘Duplicates Search’. It’s also highly recommended to narrow the search by setting time, size or subfolder depth restrictions, because if don’t set additional restrictions, the duplicate search might be very slow.

In the following example (in the screenshot), SearchMyFiles was configured to search for duplicate files under c:\users but only for files that their size is greater than 1000 bytes:

Duplicate Search Options

During the duplicate search, there are 2 stages. In the first stage, SearchMyFiles scans all files and folders according to your selection, but without adding any file to the main window.  The scan in the first stage is only made for collecting the files list, but without reading the files. In the second stage, SearchMyFiles compare all files with equal size, and when it find 2 or more files with identical content, they are added to the duplicates list in the main window.

After the scan is finished, the duplicates list looks like in the following screenshot:

Duplicates Search Result

Each chunk of duplicates files are painted with different color (There are up to 64 different colors) and there is also a ‘Duplicate Number’ column, which allows you to easily sort the list according to the duplicates order.

You can find the latest version of SearchMyFiles utility here.