fdv

oh good someone else is going to ask about this too. because you know, i got to thinking maybe she was like that redhead in The Wedding Crashers. Isla Fisher: Don't ever leave me! Vince Vaughn: Ever. Isla Fisher: Good. 'Cause I'd find you! maybe she planned on making him love her and he had to call the cops! heh heh hee hee hee

i finally got some time to comb through these. they are best practice whitepapers. (in other words, they are simply a bunch of PDFs that the NSA has released about good security practices). it's a dry read and they talk about things that most people here would kind of say "huh? why would you do it that way?" for example, the papers talk about securing IIS. if you're using my fileset, you don't install IIS. the papers don't really get into disabling Internet Explorer, even... yet another group of people that don't seem to realize that to make Windows more secure, you really have to rip stuff out of it. so, i can't really recommend bothering with the NSA papers, because even if you are setting up (for example) Active Directory, you'll probably find more useful information in an O'Reilly's book.

Hey folks... I am about to start the long journey of making an IE free fileset for Windows 2003 for myself. I am working first on gutting the registry of its junk. I am not very far along for lack of time, but I will chip away at it. I am wondering if I can proceed and be assured that what I create will work (registry mod-wise) on WinXP also. I don't want to have to install two virtual machines and compare key by key to see if the CLSIDs are the same. The two OS's are very alike in many respects and I was wondering if anyone knew offhand of XP and 2003 use the same CLSIDs?

What is it you were doing Mister?? You were tinkering, weren't you? You need a SETUPAPI.DLL that bypasses DigSig checking. (Guess who offers one for download? )

oleg_ii - you forgot to confess something ? what is the line? sounds good. what i do is run virtual pc, make a hard drive of fixed size -- 700mb. then i install windows 2000 without my files, shut down, and copy the virtual pc file (.VHD). then i restart the virtual machine and right click on IE.INF and select "install." i go section by section, not line by line. i do this by going to the [DefaultInstall] lines and making new sections (in other words, DelReg = delreg1, delreg2, delreg3 etc and then i add [delreg1] etc sections below so that i can delete the registry keys section by section and NOT all at once. if i screw up, i just shut down the virtual machine, delete the .VHD file, and recopy the copy and start again. actually go back to the post, i put up an EXE version that i made with IEXPRESS so people can place it in their startup group. i'll modify it if people have other keys for other programs they want to add. for example i dont run microsoft media player, but if someone gets me those keys, i'll add it. maybe i can collect enough key data to make this little INF delete every piece of registry data collection from as much software as possible...

ok at first i'll admit i thought the avatar was a clever photoshop until i clicked on the profile name and saw the larger picture x-pert i have narrowed this down to my IE.INF file. something in it is destroying QuickLaunch. i'll keep investigating, it's only a matter of running the INF with one section at a time.

hee hee, i'm getting a kick out of this confession thing you've got me and os2fan2 started on yeah i'll admit i used to use OS2 also, heh heh random factoid: microsoft explorer stores a lot of stuff you've done in the registry. read about it here: http://www.velasco.com.br/explorer_spy.txt i am attaching a "most recently used killer" INF. save, right click, install. all it does is empty out the keys that m$ stores data in of things you do. it actually made my machine faster -- at work i'd been using an install for over a year, never got around to cleaning it out. also attached is an IEXPRESS repackaged version for you to run at startup if you like (place in startup). read the original thread, did you? glad folks still read thoroughly! i guess you spotted that post about one evening of mine restraining some coke head i guess i do ems maybe as self punishment, HAHA... perhaps to make up for all those sins o' mine, like using a non-microsoft OS now and then (don't tell bill g!)... mru_killr.inf mru_kill.exe

WWWebb I love this Okay. I sometimes read MSFN and Slashdot at work. I once did something in the back of a cab with a lady I'd just met (introduced by a mutual friend 3 hours previously) and we both didn't care that the cabdriver tilted his rearview and drove slowly and watched. I once gave $20 to a homeless person and told them to buy the very best booze, not junk. I once ate a can of the boss' soup at work. When I was about 17 I lied to my mom and said that the pipe cleaner she found in my pants pocket was just a keychain. oh, definitely. I had to take a screenshot to show what I meant, after all... But I didn't want to link to every utility. The reader should use Google for some of those to chase them down, like for example, ActiveXHelper. Great util, but I didn't feel like making links to the six dozen programs I personally use that others might find no real use for <laughs>. Cool. I get a lot of emails from people who comment that they find them logical and well-drawn out, but if you feel something can be improved, I'll listen, without a doubt. BTW, all - November patch (the_guy has been PM'ed)

i just put it up. Edit: rest of post obsolete.

hi DW, with this method, HFSLIP is not run. it is drag, drop, replace, burn bootable cd. it's not recommended but only there to show people how easy it is if they want to only spend 30 seconds reading. you'll remove IE, get the memory and space benefits, but no DX9 or MP9. for that, you have to do the full process. which i thought you had..?

This is right. Mine does this too.

TommyP thanks for the regedit! these four files are for some reason required to prevent windows from giving errors. i will attempt to fix them by integrating them into SYSSETUP instead of IE.INF as i think that might be the problem here. these error messages x-pert shows are like nothing i have ever seen; it's almost like something is editing his IE.INF, because things are running together - "HKCR" appears in the filename, for example. very odd. i think putting these somewhere else will also simply make for cleaner code anyway.

FDV sits in a red velvet chair reading a book. Indistinct shouting comes from another room. FDV looks up. TommyP enters, wearing his green robe, Cognac in one hand. "You lazy bum," he starts. "What?' "There's a new post. Go reply." "Allright allright. But I was busy, dude." "Obviously. Get posting. The party for the latest HFSLIP is later. saugatak's out getting the champagne and Oleg_II's buying the caviar." "Hey, man. Do you think all of this makes us a little hard to approach?" "Hard to approach? dirtwarrior checks everyone against the guest list at the door. If they're new, they gotta join MSFN, but the forum's open to anyone." "Yeah, I guess that's right. Okay, I'll get busy and post." "Good. 'Cuz we also need you to work out the contract with the strippers too. They said they want more if we're gonna ask them to tolerate us talking about MS Windows all the time." Hey Master of Your Domain, come join us in the forum! if you have suggestions on anything, even like documentation, we're open to suggestions. Some offering projects on the board might not like feedback, but we welcome it. I recently (October 31) made some changes to the site to clarify what files go in which folders, and in fact I get compliments via e-mail that the instructions are logical and laid out well, but if it's a train wreck to n00bs, I don't mean it to be. In fact, we've just started a set of "Generic Instructions" at http://www.vorck.com/hfslip-info.html (scroll down a little). With a little time I think it will be a good resource for new folks who really need the basics.

Ohhhh, you bet I'll jump on this one. This is a topic I am very, very interested in, since I develop in MS Access. I found an MSDN blog post about MDAC. I love that the last few questions... go...... unanswered...... So, they're going to discontinue the redistributable MDAC. But since win2k will no longer have Service Packs... Ummm, what do we do? Yeah, I can't wait for the day MS announces "if you want to run SQL-anything, you'll have to upgrade your OS! Sorry! Everyone has to go buy MS VistaWhistlerHorn 2007 ServerNET!" Microsoft MDAC Technical Reference Active Data Objects in .NET require MDAC. Visual Studio requires MDAC. SQL Server requires MDAC (obviously ).

Crash&Burn - made the directory correctly this time, added that RegEdit, still no QuickLaunch. This is a freeware substitute but I really want the Deskview script back and working. I bet that's right about Active Desktop... when I right click on my toolbar, I get NO options at ALL! have not yet tried tips at http://support.microsoft.com/?id=273785 Oleg_II - adding icons via SHELL, yes. if you do this send me the info I'll incorporate it. As for the Help System, that's weird... let me know what line in IE.INF is a problem. I bet it's one of the IE keys I delete or something. x-pert - i will reread posts to try to determine what is going on but what makes this odd is that no one else has this problem, even with other languages! let me ask you this if you are willing to give it a try. 1. Delete the i386 directory from SOURCESS 2. Copy your SOURCES i386 directory to SOURCESS (now you have a totally unmodified i386 dir here) 3. Drag and drop my test fileset files into i386. If Windows asks if you want to replace anything, say yes. 4. Make an ISO. in other words, just take an unmodified i386 directory and put my files into it and make a new ISO. we are totally bypassing HFSLIP for purposes of finding this bug. FDV (who is up to his ears in work and has not read his personal email in days)

Windows 2003 SP1 has the files in question. licensing issues are left to the reader

saugatak oops, i guess that i create the wrong path with my fileset.i created a shortcut to the fake IE in: %systemroot%\Program Files\Internet Explorer\Quick Launch. that could be one problem crash&burn thanks for the regedit. oleg_ii the problem was that HFSLIP calls my IE.INF as one of the last steps. i added a filecopy to that IE.INF in the last test fileset, so HFSLIP would be running last tasks and all of a sudden a filecopy request would be made. the whole INF was not parsed, so the computer did not have path information. so, it would stop. when i moved the filecopy out of IE.INF, HFSLIP would run normally without the worry of a filecopy. IE.INF is really meant for registry edits, not file copying anyway. i just used another file, AXANT5.IN_, to copy the files i needed.

changes / fixes in test set 1 (October 18), listed no matter how minor: - APCOMPAT.INF removed. No longer used at all. - ACCESSOR.INF removed. No longer used at all. - help files removed - wordpad and converters removed - POSIX subsystem removed - OS/2 is gone by default now. still have not created an OS/2 INF installer for folks. - added my own SHELL.INF to replace all of that garbage MS put in the start menu. Wow. anyway, this is the place to add Start Menu icons if you really want to. say, if folks change their mind and want icons for Paint and Calc <laughs> - reference to hticons commented out of HIVECLS.INF - DFRG.INF has been rewritten to install Defragger separately (not installed by TXTSETUP any more) - MSHTML.INF has been rewritten to install MS HTML and Help system - AU.INF has been rewritten to install auto update, but needs MSHTML.INF - add/remove windows components has been added to Accessories changes / fixes in test set 2 (October 30), listed no matter how minor: - paint and calc and sound volume are all installed by default, with no user choice (this was the popular consensus for these.) wallpaper bitmaps, mouse pointers, clipboard, packager and other such things are not installed anymore. - paint and calc do not have shortcuts created in the Start menu. this was also by popular request. - DTC and COM are removed. use ADD_COM.BAT to add them back. - DELFILES will no longer be supported. instead, a newer system of cleaning up source will be supported in HFSLIP. there will be more on this later. for now, the point is that when DELFILES disappears next time, don't panic - the fake IEXPLORE.EXE is copied into Program Files\Internet Explorer now. A shortcut to it is now created in the Quick Launch directory. Now if only i could find out what seems to be killing Quicklaunch?! I am sure I am responsible for this at some point, I just need to figure out what I did to kill it I guess <LOL> IEXPLORE.EXE dummy file Copyright Johnathan Howell of datafreak.org. - still can't figure out that stupid IE icon on the desktop. i need a before/after registry watcher to see what is modified when i delete the icon but i have not gotten to it yet. in the meantime i plan to just add tommyp's bit of code to prevent it from displaying. (that code is HKLM,"Software\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo","HideIconsCommand",0x00020000,"""%11%\rundll32.exe"" ""%11%\shell32.dll"",OCInstall HideIE") - removed a lot of DirectAnimation stuff. MS made / treated it like it was a part of DirectX 9, so i never ripped it out before. well, I finally discovered that only IE makes use of it! so, of course, it got yanked out. changes / fixes in test set 3 (November 5), listed no matter how minor: - shortcuts for paint and calc, thanks oleg_ii - fixed minor file bug in WSH.INF - re-arranged registry edits in IE.INF - corrected buggy regedits in IE.INF changes / fixes in test set 4 (November 27), listed no matter how minor: - fixed ie desktop icon, thanks tommyp - fixed quicklaunch, thanks oleg_ii and tommyp - corrected buggy regedits in IE.INF to everyone SYSOC.IN_ is modified by HFSLIP. HFSLIPWU.INF must be run, and it is added into this file. so if you start getting too adventerous and adding this into SOURCESS manually (after having run HFSLIP in other words), things won't work right! as tommyp notes, and i want to repeat: of my files, sysoc.inf & txtsetup.sif are files that HFSLIP alters. the rest copy over unchanged. oleg_ii no, do not run without these. well, you could for multimed... but the first two, no. the first is the optional components manager that allows this INF to be parsed when Windows Components icon in Start menu is clicked... picture a snake eating its tail, sort of. display is of course necessary too. Crash&Burn thanks for the Windows Scripting file list. long story short, no program is going to install anything but shared libraries, and AFAIK my fileset doesn't remove any (MDAC is staying, sorry to those who want me to add the semicolon for them <LOL> ). things it does remove, like IE or Outlook, are not licensed to be redistributed. also, might as well mention it here, installing patches on your system will also not install new versions of files not there. in other words, double-clicking an IE patch on an IE free system will not add files not already there.also, i recommend turning SFC on which will help prevent this issue of file replacement. these tweaker guys in other forums with Pentium 4's and 512 Mb sticks of Corsair who turn SFC off because they are worried about performance decreases make me laugh. it's designed to protect them from DLL mismatches and they turn it off because they want to recover that extra millionth of a second. saugatak yeah, go ahead and uncomment MPLAYER from SYSSETUP but look in the file... you will see "; sets up mplayer2 files to work in Media Player Classic" so, all this does is pave the way for you to use the freeware MP Classic. the only thing is that inside the INF, it associates the extensions with MPLAYERC.EXE. so if you use APPREPLACE, you have to do some changing in this INF. remember -- and this note is to everyone and is something even I often forget -- not all of my INF files remove things. sometimes they fix things, sometimes they consolidate things. WSH.INF is a perfect example, or DFRG.INF -- WSH.INF takes info from something like 3 or 4 different INFs and puts it all into one, so that if someone wants to take Windows Scripting Host out or add it later, it's easier to do than what Microsoft set up originally. no, this is one thing you don't need to do actually. this INF only asks if you want to use the default or not.

fyi, i did base some of my security setting info from templates that i downloaded from the NIST's Computer Security Resource Center. i am downloading the NSA inf files now and i'll have a look. right now i seem to be stalled at 758kb of 15,758kb if someone else wants to start writing instructions on how to implement security templates from CSRC and NSA, i will put it on my site... so, i'll hold off on my own vote til i actually see these files

the test fileset has been updated. www.vorck.com/data/test-set.zip

Windows Scripting Host - anyone have an absolute list of all WSH files? my WSH.INF is not preventing this, as it turns out. i think a file is failing to copy over, that's the problem. anyone with an URL? i google but frankly no one really gets into this kind of information on other sites. testme.inf

ditto for my filset. it will reduce installed files as well as source.

well i fixed this icon on desktop (i think) and the filecopy error. icon on desktop CLSID is {871C5380-42A0-1069-A2EA-08002B30309D} so i just instruct the system to delete it. i thought about adding hex to make it look for IEXPLORE.EXE but then whats the point. might as well just delete the stupid looking blue "e". i have left the line of code in IE.INF if someone still wants the blue "e", they can have it (and it should point to the IEXPLORE.EXE binary correctly this time). as for the file not found, it was this... HFSLIPWU.INF calls on IE.INF to execute registry stuff. now that there is a filecopy section in it, it stops with an error. no surprise there. so i'm gonna move that filecopy to AXANT5 probably.

you dont need to learn anything about INF files if you don't want to. you can skip around and stop reading the regular process at step 11. howto in 11 steps: http://www.vorck.com/2ksp4-basic.html howto in 4 steps: http://www.vorck.com/answers-ie.html#reallyfast (that last one's been there forever, it isn't a poke at you) but the process is made lengthy because it combines my howto with HFSLIP's documentation. just download my files and put them in FDVFILES. the rest is learning HFSLIP.

dirtwarrior - your commit is lower with my files because nLite does not remove as much, and does not gut the registry. the_guy - xp and 2k3 would involve a LOT more registry cleaning. i'd love a look at the file lists for things to remove, but the one task that NO ONE has so far taken on is cleaning out the garbage registry entries. i haven't had time, but it's something i know very well how to do by now. that would be good for a few megs. i mean, just look at my IE.INF file... many of those registry branches hold a LOT of info, and with them gone, win2k has a MUCH smaller registry. can you post the URL here for that thread in the unattended forum for removing components from xp/2k3? it would be useful to many here i am sure. x-pert - actually those files do need to be on your system (sorry saugatak ). looks like the IE.INF file is somewhere not doing what it needs to. open my IE.INF (well, IE.IN_ to be specific) and search for "RunOnce Commands" this is the section that is apparently not running. in order to help me troubleshoot, first let me know if these files are, in fact, on your system. we'll go from there. you are the only one getting this message so far.