Malware deleting TrustedInstaller.exe, therefore crippling Windows

Posted on by
Reply

My sister’s computer is was infected with a bunch of stubborn malware. Even after cleaning the offending files, a lot of things won’t wouldn’t work.

Windows Update, run sfc /scannow, or DISM /Online /Cleanup-Image fails with unknown reasons, which I found it somehow related to “Windows Module Installer” service not running.

I saw something weird in services.msc: “Windows Module Installer” doesn’t exist, but I know the underlying name is “TrustedIntaller” and noticed a service named as such is there, but it cannot be started, nor there are any descriptive information.

So I searched registry for “TrustedInstaller” and got to its entry. I noticed these two:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TrustedInstaller]
"DisplayName"="@%SystemRoot%\\servicing\\TrustedInstaller.exe,-100"
"Description"="@%SystemRoot%\\servicing\\TrustedInstaller.exe,-101"

It means the meaningful names and descriptions I saw on services.msc are generated by calling the underlying  service executable file with switches. I checked my “C:\Windows\servicing” and found that “TrustedInstaller.exe” is not there at all! Of course you cannot start a service where the file does not exist at the promised path (ImagePath).

I searched the hard drive and found only one instance of the file stored somewhere (like C:\Windows\winsxs\x86_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.1.7600.16385_none_90e389a7ae7a4b6c) and I tried to move the file to “C:\Windows\servicing”. However the ownership and permissions to write to “C:\Windows\servicing” goes to “TrustedInstaller” account, not “Administrator”, so I took the ownership, gave Administrator full rights, then move the file over.

Everything worked after that! Just the mere trick of deleting TrustedInstaller.exe is enough to make the user miserable trying to clean the system up! “sfc /scannow” or the like requires TrustedInstaller/WIM to be working in the first place, so you cannot use it to repair TrustedInstaller/WIM problems.

Loading

Floppy Disk Drive Ribbon Cable Orientation

Posted on by
Reply

Hooking up a floppy drive after a decade of disuse today, I followed the notch/key on the connector/cable but it turns out to be incorrect! Turns out I should do the opposite, forcing the key to the side without the notch, by force (or trim the key)!

So stick with the conventional wisdom that the ribbon’s pin 1 (marked) should always stay close to the power connector, regardless of whether it’s IDE or FDD (3.5″ or 5.25″), EVEN IF FOOLPROOF MECHANISMS TELLS YOU OTHERWISE!

 

 

 

Loading

Option 005 “Vertical Output” port of 54600 series oscilloscopes (54616B, 54616C, etc) A secret backdoor feature that new oscilloscopes lack

Posted on by
Reply

Over the last year, I got a couple of requests for 54616B that specifically ask for a “vertical output” port at the back. I have never seen an oscilloscope that came with such a port, including a few hundred of first generation first generation 54600s I acquired from many different sources.

I got curious and looked it up. Turns out it’s a secondary feature of a relatively obscure option (only mentioned in the manuals, but I have never seen one) called Option 005, which lets you analyze (like count lines) and trigger over common TV signals, like PAL/NTSC/SECAM, which is way obsolete today. It also seems that none of the customers asking specifically for the “vertical output” port at the back know that it is a super rare option that is normally not included, so they must be using it for something else other than analog TV signal analysis.

A closer look at the user guide shows that “vertical output” port duplicates the signal source (e.g. channel 1) that the scope is triggering on, limited to what is seen by the oscilloscope, to the said “vertical output” port, a secondary feature to let you chain your signal to instruments like spectrum analyzers for further analysis.

I tried the feature myself by chaining the output to another oscilloscope. Even if the waveform is off-screen for the current vertical volts/div, the vertical output port waveform did not clip. I also played around with input impedance settings 1MΩ and 50Ω for a 50Mhz square wave. Based on what gets the square wave badly distorted, I can confirm that the vertical output signal is the analog signal after attenuator (the amplitude changes only with Volts/div that causes relay clicks) but before ADC, assuming a 50Ω load.

Wait! An oscilloscope that duplicates the input analog signals after being processed by the front end (post-attenuator, pre-ADC) to an external output port?! I don’t have to mess with the original signal path by splitting the signal (passively) or make an amplifier to duplicate the signal? Wow! How come it’s not standard (or at least a purchasable option) in modern oscilloscopes? I’d like to see what’s going on with the analog waveform before the scope processes it! Not only it’s very educational, it allows other instruments to get an accurate insight of what the oscilloscope is seeing. Neat!

Installing the Option 005 is not difficult if you happen to have an unobtainium Option 005 case with labels, and the entire kit with all the necessary interconnect. However, it’s like an unicorn and I’ve never seen one. Drilling professional looking holes for it is a nightmare as we don’t have the dimensions. The hardware is also insanely hard to get as it was made for a specialized crowd for the time and practically nobody cared about analog TV signals nowadays. Even if I can get that, they are most often missing the interconnects. The ribbon cable is missing for nearly all of them, and if you get a standard ribbon cable, you’ll realize the plastic retainer gets into the way of a screw on the main acquisition board so the Option 005 card won’t slide in unless you trim some of the plastic off. PITA!

Nowadays I am already spoiled by high end gears like MSO6054A and 13Ghz Infiniiums (like DSO81304A), but none of them has a convenient analog, post-attenuator output like a first generation 54600 with an Option 005. Given the hardware is scarce, I’ll save it for the top of the line first generation 54600 series, namely 54616B and 54616C.

For those who have this special need (need to tap into the pre-ADC signals up to 500Mhz), I can custom build these Option 005 units for you, depending on parts availability. Call me at 949-682-8145 or reach me at my business website www.humgar.com.

Loading