Tripredacus

When you use this: wevtutil al <FileName.evtx> [/l:<LocaleString>] to export... the location of where the .evtx folder ends up, there will be a LocaleMetaData folder created with the .MTA file inside.

I am designing a new application that requires something to be run after a reboot but doesn't exist on the computer. To save against the program being left behind, I wanted to create a shortcut to execute the program on a network share. I have some other options available to me, but wanted to know if such a shortcut is possible. Shortcut sits on the Desktop, points to a program on the file server using a UNC path. This part I can do. The problem is that when the shortcut is executed, Windows prompts for credentials to log into the share. Is it possible for me to create a shortcut that has this information in it already, so that the login is handled automatically? My other option (if this isn't possible) would be to build a .cmd file to sit on the desktop, which would map a drive to execute the file instead.

What an odd looking thing! Anyways, I found a site that shows how to replace the screen, which looks like step 2 says there is a tab that holds the cover on. http://www.ifixit.com/Guide/Installing-Touchscreen-or-Display/7865/1 Personally, I hate tabs, because I have a habit of always breaking them!

Make sure the Base Filter Engine service is enabled.

Do you actually use the Serial or Parallel ports? If not, I'd recommend disabling them in the BIOS. No reason to use up resources for things you never use.

In the future, off topic posts should be made in a new thread, and definately NOT in a developer's thread.

There may well be a better way to code this, but I do not know that answer. I am quite green with VBScript. You should post your code-related question here: http://www.msfn.org/board/forum/66-programming-c-delphi-vbvbs-cmdbatch-etc/ And maybe the real programmers can come up with some other ideas to try.

I would disagree. There are way too many differences between WinPE 3.0 and Windows 7 to rely on testing on a live OS to be enough.

You can generalize twice, so yes.

maybe find something useful... http://support.microsoft.com/kb/97522 These may require login to Google account: My link My link You can try other things to search for in Groups. Another search term that I stumbled across: XL4 macro http://www.jkp-ads.com/articles/excelnames08.asp

Baaaah!

I've got 2 of them, but we are not ruling out a problem with the HDD. The second dump I gathered was when I ran Gmer on it just got kicks. It reported a failure to read MBR on Disk 0 on the initial scan. I do not think I ever ran Gmer in Safe Mode before, so I do not know if that is why I got that error. I was unable to write down or screenshot what it actually said, because then I got a 0x7E STOP error. MODULE_NAME: nt FAULTING_MODULE: 82049000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 4f766ae5 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!wcsupr+2aa 820eb2ba 8b5110 mov edx,dword ptr [ecx+10h] EXCEPTION_RECORD: 8c3bbba4 -- (.exr 0xffffffff8c3bbba4) ExceptionAddress: 820eb2ba (nt!wcsupr+0x000002aa) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 09187910 Attempt to read from address 09187910 CONTEXT: 8c3bb780 -- (.cxr 0xffffffff8c3bb780) eax=8c2b26f8 ebx=00000004 ecx=09187900 edx=00000258 esi=00000009 edi=8c2b2120 eip=820eb2ba esp=8c3bbc6c ebp=8c3bbc88 iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206 nt!wcsupr+0x2aa: 820eb2ba 8b5110 mov edx,dword ptr [ecx+10h] ds:0023:09187910=???????? Resetting default scope DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x7E CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 820c1ed8 to 820eb2ba STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 8c3bbc88 820c1ed8 00000000 84bb7720 00000000 nt!wcsupr+0x2aa 8c3bbd50 82252056 00000000 ab22cb2c 00000000 nt!ObfDereferenceObjectWithTag+0x221 8c3bbd90 820fa1a9 820c1d60 00000000 00000000 nt!RtlAnsiStringToUnicodeString+0x19d 00000000 00000000 00000000 00000000 00000000 nt!KeInitializeTimerEx+0x3c6 FOLLOWUP_IP: nt!wcsupr+2aa 820eb2ba 8b5110 mov edx,dword ptr [ecx+10h] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!wcsupr+2aa FOLLOWUP_NAME: MachineOwner IMAGE_NAME: ntkrpamp.exe STACK_COMMAND: .cxr 0xffffffff8c3bb780 ; kb Uploaded dumps.rar to SkyDrive... apparently let me put the whole thing up there.

My co-worker's computer (around noon time EST) decided to do some BSOD. It is 0x8E pointing to iaStorv.sys (Intel Matrix). His data volume is a 4 drive RAID5. It is healthy in the RAID BIOS. The computer will BSOD after being in Windows after about 2-5 minutes. Logging into the OS is not required. Safe Mode works fine, even when accessing (copy, move, delete files) the RAID volume. I have already updated to the latest driver for the board. OS: Windows 7 Enterprise SP1 x86 Board: Intel DX58SO The same BSOD happens with either driver. He has already tried a previous restore point without a problem. MODULE_NAME: iaStor FAULTING_MODULE: 82c37000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 4cd505bd EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: iaStor+2ff15 8be3af15 8b4704 mov eax,dword ptr [edi+4] TRAP_FRAME: b000f744 -- (.trap 0xffffffffb000f744) ErrCode = 00000000 eax=8890e800 ebx=00000000 ecx=0000000e edx=8890e790 esi=8890e790 edi=00000000 eip=8be3af15 esp=b000f7b8 ebp=b000f7c8 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 iaStor+0x2ff15: 8be3af15 8b4704 mov eax,dword ptr [edi+4] ds:0023:00000004=???????? Resetting default scope DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x8E CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 82cec01c to 82d15e9c STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. b000f2b4 82cec01c 0000008e c0000005 8be3af15 nt!KeBugCheckEx+0x1e b000f6d4 82c75e66 b000f6f0 00000000 b000f744 nt!RtlAppendUnicodeToString+0x45d b000f764 82c05ba9 85e4cc7c 00000000 00000000 nt!Kei386EoiHelper+0x1de b000f7c8 82c6e5be 864aab50 8890e800 94057888 hal!KfLowerIrql+0x61 b000f7e0 8bf86f2b 8bf8a4a4 82c6e539 00000001 nt!IofCallDriver+0x64 b000f814 8bf92aba b000f8e8 2a861fdf 00000000 MpFilter+0xf2b b000f8a8 8bf926af c0000004 b000f8e8 00000000 MpFilter+0xcaba b000f8c4 8bf5519a 85f5fc78 b000f8e8 b000f900 MpFilter+0xc6af b000f930 8bf5a9ec 85e28008 85f5fc18 3bf5d18d fltmgr!FltDetachVolume+0x832 b000f998 8bf5ac5b 88ceaeb0 88edb4f8 88edb4f8 fltmgr!FltProcessFileLock+0x20a0 b000f9c8 82c6e5be 88ceaeb0 88edb4f8 82d6eb88 fltmgr!FltProcessFileLock+0x230f b000f9e0 82dd0daf 82c03870 864aab50 82c03900 nt!IofCallDriver+0x64 b000fa44 82cdf57e 864aab50 85f5f301 00000000 nt!NtDeleteFile+0x67c b000fa7c 82e7cd19 85f5f320 b000fba8 b000fb40 nt!RtlCopyUnicodeString+0x16e b000fb60 82e5cc2e 864aab50 a5bbf3f8 85f73008 nt!NtClose+0x821 b000fbdc 82e6d040 00000000 b000fc30 00000040 nt!ObCreateObject+0x90b b000fc38 82e63b1e 00bbe4d0 85bbf3f8 00000001 nt!ObOpenObjectByName+0x165 b000fcb4 82e87396 00bbe52c 80100080 00bbe4d0 nt!NtAllocateVirtualMemory+0x1f52 b000fd00 82c7527a 00bbe52c 80100080 00bbe4d0 nt!NtCreateFile+0x34 b000fd34 76e67094 badb0d00 00bbe498 00000000 nt!ZwYieldExecution+0xb66 b000fd38 badb0d00 00bbe498 00000000 00000000 0x76e67094 b000fd3c 00bbe498 00000000 00000000 00000000 0xbadb0d00 b000fd40 00000000 00000000 00000000 00000000 0xbbe498 STACK_COMMAND: kb FOLLOWUP_IP: iaStor+2ff15 8be3af15 8b4704 mov eax,dword ptr [edi+4] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: iaStor+2ff15 His PC does not have the debugger installed, and it won't let me install it in Safe Mode due to a DCOM error with MSIServer. So I had to analyze on my own PC. Other than updating the drivers, I can't think what else to try, and I'm not sure what I'm looking for in the dump. Any ideas?

I forgot to post this as I posted it in that thread as well: There is some changes to how VBScript is handled between WinPE 2.0 and WinPE 3.0, this I ran into when I updated my HTA as well. The changes aren't documented as far as I know. But I wonder if you are having the same problem in WinPE 2.0?

I'll agree. The WMI code is suspect because it is written expecting it to work 100% of the time. For example, there is no check to see if the data collected is an object, or is an array. Did you install the WMI package into your WinPE? Are you using WinPE 2.0 like the OP has this coded for? There is some changes to how VBScript is handled between WinPE 2.0 and WinPE 3.0, this I ran into when I updated my HTA as well. The changes aren't documented as far as I know.

Clicking through some thing, it seems that these old Excel macros used something called "XLM" format saved into an .xlm file. Not to be confused with XML. Anyways, it looks like XLM macros were platform independent and allowed you to use them in both Windows and Macintosh versions of Excel. I found this link: http://plymdesign.com/microsoft-excel/macros-for-macintosh-excel-2008-using-xlm/ My search terms: XLM Macros Excel 4.0 macro language I hope this isn't what you were looking for... since... it would be strange to find something for The Finder. Its like the Keymaster going to the hardware store to copy a key.

I knew it ran in the background now (its in the event logs)... Does it still do the disk space check?

Seems he comes up with more math to try out.

Hmmm I see, second welcome...

I'll presume this is a typo...

What packages have you added into your WinPE?

Link to WinPE builds removed.

I don't think we have one either.

Did you try this one? http://blogs.technet.com/b/fixit4me/archive/2009/03/31/error-code-2738-when-running-a-microsoft-fix-it-solution.aspx

You should try to keep enough free diskspace for whatever that % that Defrag needs to be able to run.