NirBlog

WinDefThreatsView is a new tool for Windows 10 that displays the list of all threats detected by Windows Defender Antivirus.  For every threat, the following information is displayed: Filename, Threat Name, Severity, Process Name, Initial Detect Time, Status Change Time, Remediation Time, Threat ID, Threat Status, Default Threat Action, and more…

WinDefThreatsView  also allows you to quickly set the default action (Allow, Quarantine, Clean, Remove, Block, or No Action) for multiple threats at once. You can use this tool on your local computer and you can also get the  threats  list from a remote computer on your network.

You can download the WinDefThreatsView  tool from this Web page.

The new version of PropertySystemView tool (Version 1.05) allows you to easily view the properties of file directly from Windows Explorer.
In order to use this feature, run PropertySystemView.exe, go to the Options menu and then select then ‘Explorer Context Menu’ option:

After the ‘Explorer Context Menu’ option is selected, you can right click on any file in Windows Explorer and then choose the ‘PropertySystemView’ menu item:

After you choose the ‘PropertySystemView’ menu item, the PropertySystemView window is opened with the selected file:

InstalledAppView is a new tool that displays the list of Windows 10 apps installed on your system.  InstalledAppView displays the App name, App version, Registry Name, Registry Modified Time,  Install Folder,  Uninstall Command, and more.  You can view the installed apps on your local machine, on remote network computer , and on external disk plugged to your computer.
InstalledAppView also allows you to open the install folder in Windows Explorer, view the AppxManifest.xml and AppxBlockMap.xml files, uninstall apps, and more.

You can download this new tool from this Web page.

Starting from version 1.20 of AdvancedRun tool, you can easily run a program as TrustedInstaller. In order to do it, simply select ‘TrustedInstaller’ in the ‘Run As’ Combo-Box and then press the Run button.
You can also run a program as TrustedInstaller from command-line, by specifying /RunAs 8 in the run command. For example, the following command will execute RegEdit of Windows as  TrustedInstaller:

AdvancedRun.exe /EXEFilename “c:\windows\regedit.exe” /RunAs 8 /Run

You can download the new version of AdvancedRun tool from this Web page.

Starting from version 80 of Chrome and other Chromium-based web browsers, the cookies and Web site passwords stored by the Web browser are encrypted in completely different way.
In previous versions,  the cookies and passwords were encrypted by using the DPAPI encryption system of Windows.
In the new version of Chrome/Chromium, cookies and passwords are encrypted using the AES256-GCM algorithm, and the AES encryption key is encrypted with the DPAPI encryption system, and the encrypted key is  stored inside the ‘Local State’ file.

This change caused all NirSoft tools related to passwords and cookies of Chromium-based web browsers to stop working properly, and update of these tools is needed in order to extract the cookies and passwords stored with the new encryption.

2 of these tools, ChromePass and ChromeCookiesView are already updated to decrypt the new encryption of Chrome. Other tools will also be updated in the near future.

PropertySystemView is a new tool that allows you view and modify the properties of a file from GUI and command-line, using the property system of Windows operating system.
For example, you can use this tool to modify the ‘Media Created’ timestamp stored in .mp4 and .mov  files , ‘Date Taken’ stored inside .jpg files,  ‘Content Created’ and ‘Date Last Saved’ values stored in Microsoft Office files (Word and Excel), Title, Authors, Comments, Tags, ‘Last Saved By’, and many other properties…
PropertySystemView also allows you to set properties of Windows. For example, you can set the System.AppUserModel.ID property of a window in order to disable the taskbar grouping of the specified window.

You can download this new tool from this Web page.

The new version of AdvancedRun tool (version 1.15)  allows you to easily launch a program with the desired run options directly from Windows Explorer.
In order to activate this option, run the AdvancedRun tool and then click the ‘Add Explorer Menu’ button:

After activating this option, every time that you right-click on .exe file or on a shortcut to .exe file, you’ll see the ‘Advanced Run’ menu item:

If you choose the ‘Advanced Run’ menu item, the AdvancedRun window is opened with the selected .exe file inside the ‘Program to Run’ field and then you can choose to run the program with the desired option, like running the program as SYSTEM user, running the program without elevation, running the program with the specified user name and password,  running the program with the specified environment variables, and so on…
In the example below – after selecting regedit.exe and choosing the ‘Advanced Run’ menu item, the window of AdvancedRun  is opened with regedit.exe as the program to run. In the ‘Run As’ field the ‘SYSTEM user’ option is  selected,  and the when clicking the Run button – RegEdit will be executed as SYSTEM user.

Finally, if you don’t want the ‘Advanced Run’ menu item anymore, simply click the ‘Remove Explorer Menu’ button and this menu item will be removed.

BrowserDownloadsView is a new tool for Windows that displays the details of files you downloaded with Chrome and Firefox Web browsers. For every download, the following information is displayed: Filename, Download URL, Web Page URL, Start Time, End Time, Download Duration, Download Size, Web Browser, and more…
BrowserDownloadsView allows you to load the downloads list from your current running system (your user or all user profiles), from remote computer on your network , and from external hard drive.
After BrowserDownloadsView loads the downloads list, you can select one or more downloads and then export them to comma-delimited/tab-delimited/html5/xml/JSON file, calculate the MD5/SHA1/SHA256/SHA512 hash of the downloaded files, copy the downloaded files to the clipboard and then paste them into a folder on Windows Explorer, open the downloaded file in VirusTotal Web site, and more…

You can download the new BrowserDownloadsView  from this Web page.

The new version of WifiInfoView (2.60) allows you to easily create a shortcut on your desktop to connect the desired wireless access point. You can create 2 types of shortcuts: ‘Connect Access Point By BSSID’ and ‘Connect Access Point By Name’.
If you have multiple access points with the same name (Wifi Extenders) and you want to create a shortcut to connect only a specific access point, you should create the ‘Connect Access Point By BSSID’ shortcut. Otherwise, you should use the ‘Connect Access Point By Name’ shortcut.

In order to create the desired shortcut, simply select your access point in WifiInfoView , right-click with the mouse and then from the ‘Create Desktop Shortcut’ submenu choose the shortcut you want to create:

WifiInfoView will ask you if you want to create the shortcut, choose ‘Yes’ to create it:

After choosing ‘Yes’, you should see on your desktop the new shortcut to connect your wifi access point:

Optionally, you can right-click on the shortcut, choose ‘Properties’ and then in the ‘Shortcut Key’ field – type the key combination to activate the shortcut.

The new version of BrowsingHistoryView allows you to delete individual history records of Chrome and Firefox Web browsers. This feature also works with other Web browsers that use the same history database of Chrome/Firefox, like Waterfox, SeaMonkey, Vivaldi, Yandex, and so on…
In order to delete the history records of Chrome  or Firefox, simply select the desired records, and then from the File menu or from the right-click context menu, choose the ‘Delete Selected History Records’  option (You can also press Ctrl+Delete).

BrowsingHistoryView will ask you if you want to delete the selected history records. Click the ‘Yes’ button to delete them.

You can download the new version of BrowsingHistoryView from this Web page.