NirBlog

Some of the password-recovery tool on NirSoft Web site allows you to decrypt passwords stored on external hard drive plugged to your computer.
If the passwords are encrypted with the DPAPI (Data Protection API) system, you may need to type your login password, because the login password is used
to decrypt the encryption key, and without the login password it’s impossible to recover the passwords instantly.

However, if you login with your Microsoft account (On Windows 10 and Windows 11), the login password is not used anymore.
Instead of the login password, Microsoft generates a random 44-characters password for your Microsoft account, and this password is used in the DPAPI encryption process instead of the login password.

So if you want to recover from external drive the DPAPI passwords created under Microsoft account , you have to provide the random password generated for your Microsoft account instead of the login password.
You can get this random password by using the new MadPassExt tool.

The new MadPassExt tool

The MadPassExt tool decrypts the cache file of your Microsoft account, located under C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\CloudAPCache\MicrosoftAccount ,
and extracts the randomly generated password needed to decrypt DPAPI-encrypted passwords stored on external drive.
This cache file is created when you login into Windows 10 and Windows 11 with your Microsoft account.

In order to decrypt the Microsoft account cache file, you have to provide the actual login password of your Microsoft account.

The new MadPassExt tool is available to download from this Web page.

The new version of the SearchMyFiles tool (v3.15) allows you to easily search empty folders on your system.
In order to search empty folders with the SearchMyFiles tool, follow the instructions below:

1. Click the ‘Reset To Default’ button to ensure that all files are scanned.
2. Type the base folder to search.
3. Choose ‘Summary Mode’ in the Search Mode combo-box, and then in the nearby combo-box choose one of the following options: ‘Only folders with zero files and subfolders’ or ‘Only folders with zero files’. If you choose the first option, only completely empty folders without files or folders will be displayed. If you choose the second option, SearchMyFiles will also display folders with subfolders, as long as the folder and all its subfolders are empty from files.

After the search of empty folders is completed, you can optionally delete these empty folders by using the ‘Delete Selected Empty Folders’ option.
But before you start to use the delete feature, read this warning: Although deleting an empty folder is relatively a safe action, it’s possible that delete of empty folders will cause a significant problem (For example: a software that expects a specific directory structure, and doesn’t work properly without it).
So when you choose to delete empty folders, it’s your responsibility to check every empty folder you want to delete and ensure it’s ok to delete. It’s also recommended to export the empty directories list to a file, so if there is a problem after the empty folders deletion, you’ll be able to create again the deleted empty folders.

SoundVolumeCommandLine (svcl.exe) is a new console application that allows you to do many actions related to sound volume from command-line, including – set sound volume of devices and applications, mute / unmute devices and applications, increase/decrease volume of devices and applications, set the volume level of specific channel, set the default render/capture device, get the current sound volume level of specific device, and more…

svcl.exe is the console version of the SoundVolumeView tool, so you can use all commands of SoundVolumeView in svcl.exe, with exactly the same syntax.

This tool is released because when running .exe with command-line options – a console application has some advantages over a GUI application.
For example: If you want to get the current volume level (e.g: /GetPercent command), the console application is much easier to use then the GUI tool.

You can download the new SoundVolumeCommandLine tool from this Web page.

IPNeighborsView is a new tool that displays the IP neighbor table of your local computer. For every IP neighbor entry, the following information is displayed:  IP Address, MAC Address, MAC Address Company, State, State Time, Local Adapter Name, Local Connection Name.
In the IP neighbor table, you can find the details of computers and devices recently connected to your network. Be aware that devices are listed only if Windows operating system detected them.
This tool works on any version of Windows, starting from Windows Vista and up to Windows 10. Both 32-bit and 64-bit systems are supported.

You can download the new IPNeighborsView tool from this Web page.

The new version of PingInfoView tool allows you to easily specify group name for every group of computers that you want to ping. When group name is specified, every group is displayed separately, and you can collapse and expand a group by double-clicking the group header.

In order to use this feature, you have to turn on the ‘Use IP-Host Description format’ option and then type the IP addresses, names, and groups in the following format:

The result looks like this:

You can download the new version of PingInfoView tool from this Web page.

The new version of AdvancedRun tool allows you to easily run a program on a remote computer.
In order to use this feature, you must have full admin access to the remote machine, including admin share (For example: \\192.168.0.55\admin$ )

This feature is quite similar to the psexec tool of Sysinternals/Microsoft.  AdvancedRun first copies itself to the admin share on the remote computer, and then a temporary service is installed and started on the remote machine.
The temporary service on the remote machine runs the program according to the configuration you chose, and then AdvancedRun uninstalls the temporary service and deletes the .exe file of AdvancedRun tool from the admin share.

In order to use this new feature, simply select the ‘Run on remote computer with temporary Windows service’ check-box and type the name or IP address of the remote computer.
If you don’t specify a computer name, AdvancedRun will execute the specified program from a temporary service on your local system, although there is no any benefit from it.

It’s also possible to execute a program remotely from command-line.
For example, the following command will run RegEdit as non-admin user (without elevation) on a remote computer (192.168.0.40):
AdvancedRun.exe /EXEFilename “%windir%\regedit.exe” /RunAs 2 /RunFromService 1 /ComputerName 192.168.0.40 /Run

Be aware that if the remote computer is 32-bit, you have the use the 32-bit version of AdvancedRun.

You can download the new version of the AdvancedRun tool from this Web page.

DNSLookupView is a new DNS tracing tool for Windows 10 that allows you to view the details of every DNS query sent through the DNS Client service of Windows.
For every DNS query, the following information is displayed: Query Timestamp, Host Name, Query Type (A, AAAA, and so on), Query Status (Error or succeeded), Query Result, ID and name of the process that requested the DNS lookup.

You can use the DNSLookupView tool with GUI as well as you can run DNSLookupView without displaying any user interface for the specified number of milliseconds, and then export the captured DNS requests to csv/tab-delimited/xml/html file.

The new DNSLookupView tool is available to download from this Web page.

The new version of the AdvancedRun tool (v1.30) allows you to easily run a software as ‘Network Service’ account or as ‘Local Service’ account.
In order to use this feature, simply run the AdvancedRun tool, type the desired .exe file you want to run in the ‘Program to run’ field,  in the ‘Run As’ combo box – choose the ‘Network Service’ or the ‘Local Service’, and then click the ‘Run’ button.

Optionally, you can also run a software as ‘Network Service’ or ‘Local Service’ from command-line.
For example, this command will run the RegEdit tool of Windows as ‘NT AUTHORITY\Network Service’ account:
AdvancedRun.exe /EXEFilename “%windir%\regedit.exe”  /RunAs 10 /Run

and this command will run the RegEdit tool of Windows as ‘NT AUTHORITY\Local Service’ account:
AdvancedRun.exe /EXEFilename “%windir%\regedit.exe”  /RunAs 11 /Run

You can download the new version of the AdvancedRun tool from this Web page.

TCPConnectProblemView is a new tool for Windows that monitors the TCP connections on your system and displays an alert when a software tries to initiate a TCP connection and there is no response from the server.
When a problem with a TCP connection is detected , TCPConnectProblemView adds a new entry with the following information: Process Name, Process ID, Detected On (date/time), Local Port, Local IP, Remote Port, Remote IP, Remote Host.

TCPConnectProblemView also allows you to automatically close any IPv4 TCP socket with no response from the server, in order to decrease the time you wait for any software to display an error message.  Also, if a software stopped responding because a remote server is down, activating this automatic close feature may return the software back to life.

You can download the new TCPConnectProblemView tool from this Web page.

USBDriveLog is a new tool for Windows 10 that displays the history of USB drives plugged to your computer.
For every USB drive plugged to your computer, the following information is displayed: Device Model, Revision, Manufacturer, Serial Number, Plug Time, Unplug Time, Device ID, Device Capacity, File System, Disk Number.

USBDriveLog allows you to retrieve the information from your local computer, from remote computer on your network, and from external hard drive.

You can download the USBDriveLog tool from this Web page.