MS12-020 denial of service code test

The RDP Vulnerability attack code has been spread like a wild fire.  I just tested the code yesterday, it works really well even cross the Internet. I recorded the whole process. You can see how easy it is. Currently the code can only cause blue screen, but it might change to remote code execution soon. The clock is ticking. Install the patch in your computers. You can download the code from http://aluigi.org/adv/termdd_1-adv.txt

To check if the patches are already applied, use these 2 commands:

wmic qfe | find "KB2667402"

wmic qfe | find "KB2621440"

For more information: http://isc.sans.edu/diary.html?storyid=12808&rss and http://isc.sans.edu/diary.html?storyid=12805&rss

D3DX9 error when installing Movie Maker 2011

I was trying to install Movie Maker – one of the components of Microsoft live Essentials 2011 in my Windows 7 box, and got this error:

My troubleshooting steps:

1. Install other components of Microsoft Live Essentials 2011 (live messenger) without any problems.
2. Google 0x800b010e, no luck. Looks like it is a general error message.
3. Google D3DX9. Looks like it is something related to DX9 (DirectX 9)
4. Run “dxdiag”. Determine my DirectX version is 11.
5. Check Movie Maker System requirements in Microsoft website (bing movie maker 2011): http://www.microsoft.com/download/en/details.aspx?id=26689

Found this important requirement:

For Photo Gallery and Movie Maker: Some required components of DirectX 9 may be installed for you if they're not already on your computer.

6. Find out the DirectX 9 runtime installation in Microsoft.com: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=35. Install the Runtime.
7. Reinstall Movie Maker. Problem solved.

How to make Office 2003 Macro works in Office 2010

So you upgrade to office 2010? Enjoy the great interface? But suddenly, you find your Word Macro that were created on Word 2003/2007 doesn’t work anymore, you get some errors like this: “Compile error: Can’t find project or library”

Basically, it happens because you are missing some OCX file, typically, they are MSCAL.OCX (Microsoft's ActiveX Calendar Control) and mscomct2.ocx(Microsoft Windows Common Controls). Follow below steps, most of your word and excel macro should work:
1. Get the OCX files: you can get mscomct2.ocx from Microsoft website: http://activex.microsoft.com/controls/vb6/mscomct2.cab or http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=25437d98-51d0-41c1-bb14-64662f5f62fe, but not MSCAL.OCX. Of course you can download from other sources, but I would recommend you install office 2003 pro in a spare computer or a VM, then copy this file.

2. Copy these 2 OCX files to c:\windows\system32 (if your OS is 32 bit) or C:\Windows\SysWOW64\ (if your OS is 64 bit).

3. Register these 2 OCX files:
For 32 bit OS:
regsvr32 /s C:\Windows\ system32 \mscomct2.ocx
regsvr32 /s C:\Windows\ system32 \MSCAL.OCX

For 64 bit OS:
regsvr32 /s C:\Windows\SysWOW64\mscomct2.ocx
regsvr32 /s C:\Windows\SysWOW64\MSCAL.OCX

4. Put your file location into trust location:
1). For Word 2010:Click menu “File”-> “Options” -> Trust Center, click "Trust Center settings" button, select "Trusted Locations"; click "Add new location..." button, add your file location there, you may also select "Subfolders of this location are also trusted".

2). Same as Excel 2010

 5. Ok, open your Word/Excel macro file, works? No? oh, you are using office 2010 64 bit, unfortunately, Microsoft said they won’t provide 64bit version of mscomct2.ocx even its name is “Common Controls”.


If your word/excel macro files are shared with other users, you need to implement this change silently to other computers. Here is what I’ve done:

1. Create a folder that includes these file: MSCAL.ocx, mscomct2.ocx, a .bat file, a .reg file:

2. The .reg file (Change “C:\\test\\” to your actual folder):

Windows Registry Editor Version 5.00

 [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations]

 "AllowNetworkLocations"=dword:00000001

 [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location9]

 "Path"="C:\\test\\"

 "AllowSubfolders"=dword:00000001

 "Description"=""

 "Date"="2/8/2011 11:19 AM"

  

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations]

 "AllowNetworkLocations"=dword:00000001

 [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location9]

 "Path"="C:\\test\\"

 "AllowSubfolders"=dword:00000001

 "Description"=""

 "Date"="2/8/2011 12:36 AM"

3. The .bat file(change SysWOW64 to system32 if you are using 32bit OS):

regedit.exe /s .\TrustP.reg
copy .\mscomct2.ocx C:\Windows\SysWOW64\ /Y
regsvr32 /s C:\Windows\SysWOW64\mscomct2.ocx
copy .\MSCAL.OCX C:\Windows\SysWOW64\ /Y
regsvr32 /s C:\Windows\SysWOW64\MSCAL.OCX

Now you can push the change using your patch system like SCCM.