Jump to content

heinoganda

Member
 View Profile  See their activity

  • Posts

    848

  • Joined

  • Last visited

  • Days Won

    17

  • Donations

    0.00 USD 

  • Country

    Germany

 Content Type 

Posts posted by heinoganda

    uBlock Origin, Chromium 54 and Firefox 52.9 ESR

    in Browsers working on Older NT-Family OSes

    Posted · Edited by heinoganda

    For Google Chrome 49 (Chromium 49), I was able to convince μBlock 1.17.4, but I modified the file manifest.json ("minimum_chrome_version": "49.0") and the file "asset-viewer.js" from the μBlock version 1.16.20 taken from the js directory. 

    Download from https://github.com/gorhill/uBlock/releases

    Run custom version in developer mode under Extensions.
     

    CH49-UBLOCK1174.jpg

     

    :)

    1

    Is it worth updating to WMP11?

    in Windows XP

    Posted

    Windows Media Player 11 is not a must, but windows media 11 runtime (wmfdist11.exe, most recent for Windows XP) can be used without any problem even if an older Windows Media Player (9,10) is installed. This ensures that programs that are runtime-dependent on the latest windows media runtime display smoothly.

    :)

    1

    POSReady 2009 updates ported to Windows XP SP3 ENU

    in Windows XP

    Posted · Edited by heinoganda

    @someguy25

    Why do you start this barrel again, this would have been appropriate at an earlier date.

    Did not you read the comments?

     

    KB4466388 (November 2018) > KB4134651-v2 > KB4134651 > KB4074852 > KB4018556-v2 > KB4018556

    On the left the most recent update and on the right which updates are no longer used and what does this mean that the files of KB4074852 are overwritten by those of KB4466388.


    Do not come up with the idea to uninstall KB4134651-v2 or KB4134651 or KB4074852 or KB4018556-v2 or KB4018556! You would use it to restore outdated files!

    :)

    0

    Root Certificates and Revoked Certificates for Windows XP

    in Windows XP

    Posted

    CertUpd.jpg

    Disallowed certificates New:

    E = support@senncom.com
    CN = 127.0.0.1
    OU = R&D
    O = Sennheiser Communications A/S
    L = industriparken 27, 2750 Ballerup
    S = Denmark
    C = DK

    E = support@senncom.com
    CN = SenncomRootCA
    OU = R&D
    O = Sennheiser Communications A/S
    L = industriparken 27, 2750 Ballerup
    S = Denmark
    C = DK

    Update for root certificates:

    New:

    CN = Microsoft ECC Root Certificate Authority 2017
    O = Microsoft Corporation
    L = Redmond
    S = Washington
    C = US

    CN = Microsoft EV ECC Root Certificate Authority 2017
    O = Microsoft Corporation
    L = Redmond
    S = Washington
    C = US

    CN = Microsoft EV RSA Root Certificate Authority 2017
    O = Microsoft Corporation
    L = Redmond
    S = Washington
    C = US

    CN = Microsoft RSA Root Certificate Authority 2017
    O = Microsoft Corporation
    L = Redmond
    S = Washington
    C = US

    CN = PostSignum Root QCA 4
    O = Ceská pošta, s.p.
    2.5.4.97 = NTRCZ-47114983
    C = CZ

    CN = ZETES TSP ROOT CA 001
    SERIALNUMBER = 001
    O = ZETES SA (VATBE-0408425626)
    C = BE

     

    Those using heinoganda's Cert_Updater.exe should run it ASAP. Others needing a redistributable rootsupd.exe should follow his instructions for creating their own, or PM at 5eraph for an updated EXE file.
     

    :)

    1

    POSReady 2009 updates ported to Windows XP SP3 ENU

    in Windows XP

    Posted · Edited by heinoganda

    Good news for users using Avast or AVG antivirus protection, the file "rpcss.dll" of KB4466388 and KB4467689 in English (ENU) is no longer incorrectly detected as malware.

     

    @someguy25 @Bersaglio

    If interested, created a batch where this problem will be corrected when MUI packages are used. Any appropriate language code in the batch needs to be customized (SET "LangCode=XXXX").

      
    
@echo off
SET "LangCode=0407"
	
SET "LINE=4"
SET "LastFileName=NA"

:LOOP 
SET /A LINE=%LINE%+2
SET "DATA1A="
SET "DATA2A="
SET "DATA3A="
SET "DATA1B="
SET "DATA2B="
SET "DATA3B="
SET "DATA4B="
SET "DATA5B="
SET "DATA6B="

(FOR /F "tokens=9 delims=\" %%f IN ('REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%" ^|^ FIND /V /N "" ^|^ FIND "[%LINE%]"') DO SET "FileName=%%~nxf") >NUL 2>&1

IF "%FileName%" == "%LastFileName%" GOTO END
SET "LastFileName=%FileName%"

((FOR /F "tokens=2" %%a IN ('REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" ^|^ FIND /V /N "MUIVer" ^|^ FIND "[6]"') DO SET "DATA1A=%%a")&&(FOR /F "tokens=2" %%a IN ('REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" ^|^ FIND /V /N "MUIVer" ^|^ FIND "[7]"') DO SET "DATA2A=%%a")&&(FOR /F "tokens=2" %%a IN ('REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" ^|^ FIND /V /N "MUIVer" ^|^ FIND "[8]"') DO SET "DATA3A=%%a")) >NUL 2>&1
((FOR /F "tokens=2* delims=	 " %%a IN ('REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" /v "%DATA1A%"') DO SET "DATA1B=%%a"&SET "DATA2B=%%b")&&(FOR /F "tokens=2* delims=	 " %%a IN ('REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" /v "%DATA2A%"') DO SET "DATA3B=%%a"&SET "DATA4B=%%b")&&(FOR /F "tokens=2* delims=	 " %%a IN ('REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" /v "%DATA3A%"') DO SET "DATA5B=%%a"&SET "DATA6B=%%b")) >NUL 2>&1

(IF "%DATA1B%" == "REG_DWORD" (IF "%DATA2B%" == "0x0" (REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" /f /v "%DATA1A%" /t REG_DWORD /d 0x1))) >NUL 2>&1
(IF "%DATA3B%" == "REG_DWORD" (IF "%DATA4B%" == "0x0" (REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" /f /v "%DATA2A%" /t REG_DWORD /d 0x1))) >NUL 2>&1
(IF "%DATA5B%" == "REG_DWORD" (IF "%DATA6B%" == "0x0" (REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions\%LangCode%\%FileName%" /f /v "%DATA3A%" /t REG_DWORD /d 0x1))) >NUL 2>&1

CLS
ECHO.
ECHO  "%FileName%"
ECHO.
GOTO LOOP

:END

ECHO.
ECHO Process completed!
ECHO.
pause

     

    :)

    3

    POSReady 2009 updates ported to Windows XP SP3 ENU

    in Windows XP

    Posted · Edited by heinoganda
    Update of the code due to behavior of the IE8 at WU/MU.

    @someguy25

    This requires at least KB4316682 for IE8 dated 05/30/2018 or more recent Cumulative Update for IE8!

    To enable TLS 1.1 and 1.2 in Internet Explorer 8, run the following code for a reg file: 

    Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.2]
"OSVersion"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.1]
"OSVersion"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"SecureProtocols"=dword:00000a80
"ShowPunycode"=dword:00000000
"EnablePunycode"=dword:00000001
"DisableIDNPrompt"=dword:00000000
"CertificateRevocation"=dword:00000000
"WarnOnPostRedirect"=dword:00000001
"WarnonBadCertRecving"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols\Mailto]
"UTF8Encoding"=dword:00000000

    For deactivate Unsecure Ciphers, run the following code for a reg file: 

    Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]
"Enabled"=dword:00000000



    :)

    2

    POSReady 2009 updates ported to Windows XP SP3 ENU

    in Windows XP

    Posted

    19 hours ago, heinoganda said:

    Problems with the file "rpcss.dll" from the updates WindowsXP-KB4466388-x86-ENU.exe and WindowsXP-KB4467689-x86-ENU.exe with under forwarded to Avast.

    https://www.virustotal.com/en/file/1857d37693b8b96a2fdfaadc9bc18e4839fedd5a18ee064f922370887210d024/analysis/1542142348/

    A comparison with the German-language updates (The file "rpcss.dll" is just in the English language version and identical in size)

    https://www.virustotal.com/en/file/58098a479b7db74de938f5a9dd3e474ea5ec52ad46883a659a5d490daf01c75d/analysis/1542143217/

    The problem persists, a test of all language versions of KB4466388 and KB4467689 found no find, except for the English language version (ENU). I have not received any feedback from AegisLab, Avast and Qihoo-360 until now. Will the next few hours the file "rpcss.dll" from the ENU Upates at Virustotal check several times.

    Current status at Virustotal:
    https://www.virustotal.com/en/file/1857d37693b8b96a2fdfaadc9bc18e4839fedd5a18ee064f922370887210d024/analysis/

    :)

    0

    POSReady 2009 updates ported to Windows XP SP3 ENU

    in Windows XP

    Posted · Edited by heinoganda

    Attention! KB4467689 has been released twice this month! The file versions of the files (kernel32.dll, ntdll.dll, ole32.dll, rpcrt4.dll, rpcss.dll, sprv0407.dll, xpsp2res.dll) are different! In this regard, KB4466388 (kernel32.dll, ntdll.dll, ole32.dll, oleaut32.dll, rpcss.dll, xpsp2res.dll)! With KB4466388 the file "oleaut32.dll" is available again in its original size (550 KB), here I still have to test. For KB4467689
    (windowsxp-kb4467689-x86-embedded-enu_b974cbc4675474ddb38c41f7926f493cde207eee.exe)
    the version should be taken from 11/12/2018, as the file version harmonizes with KB4466388.

    Meanwhile, the older version of KB4467689 was taken offline at MS.
     

    Update:

    Problems with the file "rpcss.dll" from the updates WindowsXP-KB4466388-x86-ENU.exe and WindowsXP-KB4467689-x86-ENU.exe with under forwarded to Avast.

    https://www.virustotal.com/en/file/1857d37693b8b96a2fdfaadc9bc18e4839fedd5a18ee064f922370887210d024/analysis/1542142348/

    A comparison with the German-language updates (The file "rpcss.dll" is just in the English language version and identical in size)

    https://www.virustotal.com/en/file/58098a479b7db74de938f5a9dd3e474ea5ec52ad46883a659a5d490daf01c75d/analysis/1542143217/

    Funny, I am curious about the result of Avast.
     

    Update 2:

    A test with MBAM legacywos-3.5.1.2522 was successful and I could not find any problems because of the current "oleaut32.dll" of KB4466388. Apparently the missing functions were implemented again. In addition, KB4134651-v2 has been replaced by KB4466388.

     

    @Sampei.Nihira

    :)

    1

    Problems accessing certain sites (Https aka TLS)

    in Browsers working on Older NT-Family OSes

    Posted

    @Thomas S.

    I offer a variant of HTTPSProxy with and without UPX, since depending on the processor and storage medium speed advantages can result. With one of the reasons why I do not let the files created with PYInstaller be put together in one package, but in a folder where all needed Python libraries are stored as well. With a single file created by PYInstaller it will be unpacked in the TEMP directory (like a SFX created by a packer) where these needed Python libraries still have to be created temporarily. It is time consuming, but usually it does what if false positive messages are sent to the virus scanner manufacturer. I had this problem for a long time with files that I created with "7z SFX Builder", but my stubbornness paid off, because since then it has become very rare that these generated files still lead to a message under Virustotal.

    :)

    0

    Problems accessing certain sites (Https aka TLS)

    in Browsers working on Older NT-Family OSes

    Posted · Edited by heinoganda

    @Youse

    Unfortunately there is an abuse with Python, with which a malware can be realized quite easily. Here only helps one, at the corresponding virus scanner manufacturer (test with virustotal.com) to report positive as false and submit the files. The files that are generated with PYInstaller from version 3.4, have become synonymous with me several times at Virustotal conspicuous, so I once stayed at PYInstaller 3.3.1. With many small programs there is an increasing number of problems with a false positive message from the virus scanner.

    :)

    1

    Problems accessing certain sites (Https aka TLS)

    in Browsers working on Older NT-Family OSes

    Posted · Edited by heinoganda

    On 11/6/2018 at 10:41 AM, Thomas S. said:

    There is a bug in the modules of python, which are used for the build of HTTPSProxy, that allow weak and unsafe ciphers.

    You can test it yourself by open the site https://www.howsmyssl.com/ in IE8, it reports "BAD" because of this weak ciphers.

    IE8-HTTPSPROX.jpg

    I could not find this problem in my compiled version (REV2m) of HTTPSProxy. :no:

    :)

    0

    Root Certificates and Revoked Certificates for Windows XP

    in Windows XP

    Posted

    9 hours ago, Thomas S. said:

    New MS files without analysis - who except you can tell what's going on...

    Just compare the contents of the updated sst files to the earlier ones. Also, based on the date of the updated sst file, it may not necessarily be assumed that the content has actually changed. Since an ECC certificate under Windows XP is not taken over / processed, was on 10/31/2018 about this update an info superfluous.

    :)

    0
×
×
  • Create New...