SmartSniff is a TCP/IP sniffer utility that allows you to capture TCP/IP packets on your network adapter, and view the captured data as sequence of conversations between clients and servers. By making some changes in the ‘Advanced Options’ window, you can use SmartSniff as alternative to CurrPorts utility, and only view the general TCP connections activity on your network adapter, without capturing the data. SmartSniff shows some information that is not available in CurrPorts utility, including number of packets, total transferred data, and current data speed in KB/Sec.
Here’s how to configure SmartSniff to only show general TCP connections activity:
- Open the ‘Advanced Options’ window (Ctrl+O).
- Select the ‘Only Display TCP/IP statistics’ option, so SmartSniff won’t create a large capture file.
- Select the ‘Retrieve process information’ option, so SmartSniff will display the process of every connection, like CurrPorts utility.
- Select the ‘Display only active connections’, so SmartSniff will automatically remove all closed connections from the list.

- Click the ‘Ok’ button in the ‘Advanced Options’ window. In the main window, Select the ‘Hide Lower Pane’ option under the Options menu. The lower pane is not needed when you don’t capture the TCP data.
- Start capture (F5) and watch the TCP connections activity.

Posted by NirSoft on September 20, 2010 at 4:47 am under NirSoft Tips.
7 Comments.
From time to time I receive complaints from people who say that my VideoCacheView utility freezes (hangs) completely without even the ability the kill the process. Yesterday I finally found out what is exactly wrong, after this problem also occurred in my own system.
When a Java applet (and possibly some other components) is loaded into a Web page, it may create one or more pipe handles. These pipe handles caused VideoCacheView to hang while scanning the file handles to find the opened temporary .flv files. So if one or more Web pages with Java applets were opened when VideoCacheView scanned the .flv files, it switched into a ‘Freeze’ status until these Java Web pages were closed.
The new release of VideoCacheView (1.77) should solve this freeze problem. So if you experienced this problem in the past, you can try to download the new version and check if it solves the problem.
Posted by NirSoft on September 12, 2010 at 3:21 am under Utilities Update.
1 Comment.
The new version of NirLauncher package (1.10.x) provides to ability to edit the software groups and shortcuts directly inside the NirLauncher application, which is much easier than editing the package file (.nlp) in a text editor. However, this feature is still in Beta, and there are some things that you cannot do with it. For example: you cannot change the order of software groups (tabs) and they’ll simply appear in the order that you added them.
Here’s some tips about how to use this edit feature:
- In order to enter into edit mode, go to the Options menu, and check the ‘Edit Mode’ menu item.
- After you switched to edit mode, some editing menu items under the ‘Launcher’ menu will be enabled.
- When you in edit mode, you can double-click on every software icon in order to edit the software information (.exe file, help file, description, and so on)
- In order to add new applications, simply select the desired software group, and then drag one or more .exe files from Explorer into the window of NirLauncher. The .exe files must be located under the folder/subfolder of the package file, so the path of the .exe file will be relative.
- You can also use the other options under the Launcher menu to add/edit/remove software groups and to delete unwanted software shortcuts.
- Finally, after making your changes, you can use the ‘Save Package’ option in order to save the changes into the package file.
- Be aware that if you switch into another package when you in edit mode, your changes will be lost.
In addition to this editing feature, I also made some performances improvement, especially when loading a software group in the second time. For example: if you click the ‘All Utilities’ tab, and then click another tab, and then click the ‘All Utilities’ tab again. the second ‘All Utilities’ loading process will be much faster.

Edit software information in NirLauncher

NirLauncher Edit Menu
Posted by NirSoft on September 5, 2010 at 1:23 am under Utilities Update.
12 Comments.
RegFileExport is a new command-line utility for advanced users that allows you to easily extract keys and values from offline Registry file located on external hard-drive and export them into a standard .reg file of Windows. RegFileExport doesn’t load the file into a Registry hive like RegEdit, instead, it directly reads the Registry file and analyzes it.
RegFileExport may also be able to extract keys and values from the Registry file even if the Registry file is corrupted and cannot be loaded by Windows.
For more information about RegFileExport utility, click here.

RegFileExport
Posted by NirSoft on August 29, 2010 at 6:31 am under Utilities Update.
2 Comments.
BlueScreenView utility allows you to watch the blue screen crashes occurred in your system by reading and analyzing the MiniDump files created on every crash by the operating system. The MiniDump files are usually created under C:\WINDOWS\Minidump, unless the path was modified in the system failure settings of Windows.
In most systems, Windows is already configured to create these MiniDump files as the default system failure configuration.
However, if from some reason MiniDump files are not created in your system during a blue screen crash, you should follow the instructions below in order to configure Windows to create them.
For Windows XP:
- Right-click on the ‘My Computer’ icon and choose ‘Properties’. Alternatively, you can also go to Control Panel and open the ‘System’ applet.
- In the opened window, click the ‘Advanced’ tab and then inside the ‘Startup And Recovery’ frame, click the ‘Settings’ button.

System Properties Window
- In the opened ‘Startup And Recovery’ window, there is ‘Write Debugging Information’ section. You should set the combo-box in this section to ‘Small memory dump’, and then click ‘ok’ to confirm the change.

Startup And Recovery
For Windows 7:
- Go to the Control Panel, choose ‘System And Security’, and then click ‘System’, and then click the ‘Advanced System Settings’ link.
- In the opened window, click the ‘Advanced’ tab and then inside the ‘Startup And Recovery’ frame, click the ‘Settings’ button.
- In the opened ‘Startup And Recovery’ window, there is ‘Write Debugging Information’ section. You should set the combo-box in this section to ‘Small memory dump’, and then click ‘ok’ to confirm the change.
You can also make this MiniDump change in the Registry, by setting the following value:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
“CrashDumpEnabled”=dword:00000003
However, be aware that this Registry change affects the system only after reboot.
Posted by NirSoft on July 27, 2010 at 8:32 am under NirSoft Tips.
39 Comments.
Here’s a list of utilities updates made in the last week:
- IPNetInfo and WhosIP: Both of these utilities were fixed to work with the changes made in ARIN WHOIS server.
- Mail PassView: Added ‘Secured’ column, which displays whether the mail server works in a secured connection, and ‘Server Port’ column, which displays the TCP port number on the server, if the server use non-standard port.
- WhatInStartup, MyEventViewer, SpecialFoldersView, and others – Fixed a problem with the xml encoding that appeared in all my Unicode executable files.
- SniffPass: Added x64 build of SniffPass, which allows you to work with Microsoft Network Monitor Driver 3.x on 64-bit version of Windows.
- OutlookAttachView: Added support for embedded message attachments (attachments of another message). These attachments are saved as .msg files that can be opened by Outlook.
- SmartSniff: Added ‘Automatically Scroll Down in Live Mode’ option, which allows you to automatically scroll down to the bottom of the TCP/IP streams list while capturing the network packets.
- NK2Edit: Added ‘NK2 Control Center’ which allows companies to watch the status and the location of Outlook AutoComplete files (NK2) in all computers.
Posted by NirSoft on July 19, 2010 at 8:21 am under Utilities Update.
Comment on this post.
URLStringGrabber is a new utility that scans all opened windows of Internet Explorer and grabs the URLs stored in them, including clickable links, images, script files, CSS files, RSS feeds, and flash (.swf) files.
The URLs list is displayed in table, and you can easily export some of the URLs or the entire URLs list into text, csv, html, or xml file. You can also copy the URLs list into the clipboard and paste them into Excel or other spreadsheet application.
For more information about this new utility, click here.

URLStringGrabber
Posted by NirSoft on July 9, 2010 at 11:42 am under Utilities Update.
6 Comments.
The new version of RouterPassView utility provide a new feature that allows to grab L2TP/PPTP/PPPOE/DDNS passwords from the Web interface of your router. This feature only works with Internet Explorer, as well as it only works for routers that stores the real password inside the password field.
In order to use this feature, follow the instructions below:
- Login into your router Web interface with Internet Explorer, and go to the password page that you wish to recover. This password page may look like this one:

Router Password Page
As you can see in the above screenshot, the password field is filled with bullets, but if this password field really contains the password, RouterPassView will be able to extract it and display it on the main window.
- Go to the File menu, and choose ‘Grab Password From IE Window’ or simply press Ctrl+G
- If the router Web page store the password in the password field, RouterPassView will display the hidden password:

Router Password
Be aware that some routers deliberately store wrong password in this field, and in for these routers, RouterPassView won’t be able to recover your real password.
Posted by NirSoft on June 24, 2010 at 4:34 pm under Utilities Update.
3 Comments.
Starting from the new version of Firefox (3.6.4), all flash objects displayed on a Web site are now loaded inside a separated process (plugin-container.exe), instead of the Firefox process itself. This change is welcomed, because when there is a crash inside a flash object (video, game, advertising, or anything else), it won’t take down Firefox.
This change also caused VideoCacheView to stop working with the temporary flash video files created by Firefox, because VideoCacheView failed to detect the new process. But… This problem is already fixed on version 1.71 of VideoCacheView. So if you got the new version of Firefox (3.6.4), you should also get the latest version of VideoCacheView.

Firefox plugin-container.exe in Process Explorer
Posted by NirSoft on June 24, 2010 at 9:00 am under Utilities Update.
1 Comment.
The latest release of MetarWeather utility allows you to watch the current temperature around the world on the maps of Google Earth.
In order to use this feature:
- Download the latest METAR reports data file from METAR Data Access Web site.
- Open the downloaded METAR file with MetarWeather (Ctrl+F) and wait until the METAR reports are loaded and displayed in the main window.
- Select all (Ctrl+A) the lines and choose the ‘Save As’ option (Ctrl+S)
- In the save dialog-box, choose ‘KML File – Temperature for Google Earth’ as a file type and save the .kml filename
- Finally, from Google Earth, open the created .KML file.
The result should look like the following map:

Google Earth Temperature Map
Posted by NirSoft on June 23, 2010 at 5:33 am under NirSoft Tips.
Comment on this post.