NirBlog

RegFileExport is a new command-line utility for advanced users that allows you to easily extract keys and values from offline Registry file located on external hard-drive and export them into a standard .reg file of Windows.  RegFileExport doesn’t load the file into a Registry hive like RegEdit,  instead, it directly reads the Registry file and analyzes it.

RegFileExport may also be able to extract keys and values from the Registry file even if the Registry file is corrupted and cannot be loaded by Windows.

For more information about RegFileExport utility, click here.

RegFileExport

BlueScreenView utility allows you to watch the blue screen crashes  occurred in your system by reading and analyzing the MiniDump files created on every crash by the operating system. The MiniDump files are usually created under C:\WINDOWS\Minidump, unless the path was modified in the system failure settings of Windows.

In most systems, Windows is already configured to create these MiniDump files as the default system failure configuration.

However, if from some reason MiniDump files are not created in your system during a blue screen crash, you should follow the instructions below in order to configure Windows to create them.

For Windows XP:

1. Right-click on the  ‘My Computer’ icon and choose ‘Properties’. Alternatively, you can also go to Control Panel and open the ‘System’ applet.
2. In the opened window, click the ‘Advanced’ tab and then inside the ‘Startup And Recovery’ frame, click the ‘Settings’ button.
   

   System Properties Window

3. In the opened ‘Startup And Recovery’ window,  there is ‘Write Debugging Information’ section. You should set the combo-box in this section to ‘Small memory dump’, and then click ‘ok’ to confirm the change.
   

   Startup And Recovery

For Windows 7:

1. Go to the Control Panel, choose ‘System And Security’, and then click ‘System’, and then click the ‘Advanced System Settings’ link.
2. In the opened window, click the ‘Advanced’ tab and then inside the ‘Startup And Recovery’ frame, click the ‘Settings’ button.
3. In the opened ‘Startup And Recovery’ window,  there is ‘Write Debugging Information’ section. You should set the combo-box in this section to ‘Small memory dump’, and then click ‘ok’ to confirm the change.

You can also make this MiniDump change in the Registry, by setting the following value:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
“CrashDumpEnabled”=dword:00000003

However, be aware that this Registry change affects the system only after reboot.

Here’s a list of utilities updates made in the last week:

• IPNetInfo and WhosIP: Both of these utilities were fixed to work with the changes made in ARIN WHOIS server.
• Mail PassView: Added ‘Secured’ column, which displays whether the mail server works in a secured connection, and ‘Server Port’ column, which displays the TCP port number on the server, if the server use non-standard port.
• WhatInStartup,  MyEventViewer, SpecialFoldersView, and others – Fixed a problem with the xml encoding that appeared in all my Unicode executable files.
• SniffPass: Added x64 build of SniffPass, which allows you to work with Microsoft Network Monitor Driver 3.x on 64-bit version of Windows.
• OutlookAttachView:  Added support for embedded message attachments (attachments of another message). These attachments are saved as .msg files that can be opened by Outlook.
• SmartSniff: Added ‘Automatically Scroll Down in Live Mode’ option, which allows you to automatically scroll down to the bottom of the TCP/IP streams list while capturing the network packets.
• NK2Edit: Added ‘NK2 Control Center’ which allows companies to watch the status and the location of Outlook AutoComplete files (NK2) in all computers.

URLStringGrabber is a new utility that scans all opened windows of Internet Explorer and grabs the URLs stored in them, including clickable links, images, script files, CSS files, RSS feeds, and flash (.swf) files.

The URLs list is displayed in table, and you can easily export some of the URLs or the entire URLs list into text, csv, html, or xml file. You can also copy the URLs list into the clipboard and paste them into Excel or other spreadsheet application.

For more information about this new utility, click here.

URLStringGrabber

The new version of RouterPassView utility provide a new feature that allows to grab L2TP/PPTP/PPPOE/DDNS passwords from the Web interface of your router. This feature only works with Internet Explorer, as well as it only works for routers that stores the real password inside the password field.

In order to use this feature, follow the instructions below:

1. Login into your router Web interface with Internet Explorer, and go to the password page that you wish to recover. This password page may look like this one:
   

   Router Password Page

   As you can see in the above screenshot, the password field is filled with bullets, but if this password field really contains the password, RouterPassView will be able to extract it and display it on the main window.

2. Go to the File menu, and choose ‘Grab Password From IE Window’ or simply press Ctrl+G
3. If the router Web page store the password in the password field, RouterPassView will display the hidden password:
   

   Router Password

   Be aware that some routers deliberately store wrong password in this field, and in for these routers, RouterPassView won’t be able to recover your real password.

Starting from the new version of Firefox (3.6.4), all  flash objects displayed on a Web site are now loaded inside a separated process (plugin-container.exe), instead of the Firefox process itself. This change is welcomed, because when there is a crash inside a flash object (video, game, advertising, or anything else), it won’t take down Firefox.

This change also caused VideoCacheView to stop working with the temporary flash video files created by Firefox, because VideoCacheView failed to detect the new process. But… This problem is already fixed on version 1.71 of VideoCacheView. So if you got the new version of Firefox (3.6.4), you should also get the latest version of VideoCacheView.

Firefox plugin-container.exe in Process Explorer

The latest release of MetarWeather utility allows you to watch the current  temperature around the world on the maps of Google Earth.

In order to use this feature:

1. Download the latest METAR reports data file from  METAR Data Access Web site.
2. Open the downloaded METAR file with MetarWeather (Ctrl+F) and wait until the METAR reports are loaded and displayed in the main window.
3. Select all (Ctrl+A) the lines and choose the ‘Save As’ option (Ctrl+S)
4. In the save dialog-box, choose ‘KML File – Temperature for Google Earth’ as a file type and save the .kml filename
5. Finally, from Google Earth, open the created .KML file.

The result should look like the following map:

Google Earth Temperature Map

If you forgot or lost the password that you use to connect the Internet (With ADSL, cables, or other ISP account), you still have a chance to recover it, if this password is stored in your Windows operating system or in your router.

Here’s a list of 4 methods to recover your ADSL/ISP password:

1. If you use Windows operating system to connect the Internet (with PPTP, LT2P, or PPPoE), you can use the Dialupass utility to recover your ISP password. When you run this utility, it can instantly recover your password, as long as the password is stored by Windows.
2. If you got an email account from your Internet service provider, and the same password is used for both email account and the Internet connection, you can try to use the Mail PassView utility to recover your ISP password. If this password is stored by popular email software, like Outlook, Outlook Express, or Windows Live Mail, Mail PassView will be able to recover it.
3. If you use a router to connect the Internet, you can try to use RouterPassView utility to recover the password from the configuration file of your router.
   In order to use this utility, you have to logon into your router, go to the backup/restore section, and choose to backup the router configuration into a file. After that, open the created configuration file with RouterPassView utility. If the config file of your router is supported, your password will be recovered instantly.
4. If you use a router to connect the Internet, you can also try to use the AsterWin IE utility. This utility is quite old and was written many years ago in Visual Basic 6, but it still works with the latest version of Internet Explorer.In order to use this tool to recover the ISP password from your router, you should logon into your router, and then go to the router page that contains the ISP or ADSL logon details. after that, run AsterWin IE utility and click the ‘Show Internet Explorer Passwords’ window. This trick will not work for all routers, because some routers deliberately blocked this recovery option, from security reasons.

Most modern routers allow you to backup the configuration of the router into a file, and then restore the configuration from the file when it’s needed.
The backup file of the router usually contains important data like your ISP user name/password, the login password of the router, and wireless network keys.

If you lost your ISP password, your wireless network keys, or the login password of your router, but you have the backup file of the router configuration, RouterPassView utility might help you to recover your lost password.

However, due to large amount of router models available in the market, RouterPassView cannot support all routers. Currently RouterPassView supports a limited set of router models, and support for more routers will be gradually added in future versions.

For more information about the RouterPassView utility, click here.

RouterPassView

Around 8 years ago, I released a utility named ‘FileDate Changer’, which allowed the users to modify the date and time of every file in Windows operating system.  However, this utility has not been updated for very long time and it doesn’t fit the current NirSoft standards.

A new utility named BulkFileChanger is a replacement for my old ‘FileDate Changer’ utility. BulkFileChanger also provides more features than the old tool, including the ability to change the date or time separately (For example, you can set the file time as 09:12:15, but without changing the existing date), add or subtract seconds/minutes/hours/days from the existing file time, change file attributes, and the ability to add files by path and wildcard.

It’s possible that more useful features, like renaming multiple files, will be added in the future versions of BulkFileChanger.

BulkFileChanger