Netstat -b on Windows
-
netstat in some upgraded version of Windows XP has a -b switch that "displays the executable involved in creating each connection or listening port." For fairness, it's also documented that "[...] this option can be time-consuming[...]" but that's a gross understatement. In fact, it took some ~2 minutes to display "the executable involved in creating" some 50 connections.
We've had a discussion about this on another thread. I've pointed out that I had no pagefile (maybe a WTF in its own but I'm a romantic), so some ~2 minutes of disk access couldn't be justified. Someone reminded me of memory mapped files and delayed loading, but I still wasn't satisfied. So I fired up FileMon to have this issure clarified: (sorry, couldn't resist)
In short, netstat -b scans the entire %SystemRoot% directory tree multiple times per connection. FileMon was displaying some 234,000 file (mostly directory) accesses by the time I got bored and cancelled netstat, at which point it was still trying to print the second connection...
I'm OK with the occasional sacrifice of runtime in order to shorten the coding time, but this is plain, old MS™ WTFery.
-
Okay
-
You had me at "displays the executable involved in creating each connection or listening port."
-
I just tried it out on my PC then and it was virtually instantaneous. Admittedly, I only have 5 active connections, but yeah, it's not really following the pattern you described.
-
@aib said:
In short, netstat -b scans the entire %SystemRoot% directory tree multiple times per connection.
blinks
WHY?!
-
The -b is a truly wonderful option though. Highly wish Solaris would support it to make the old "ah shit, what port is this server listening on?" nag a little easier.
-
Linux has -p, and SysInternals has a utility called Tcpview that does the same thing without all that HD access...
Just tried -bv, which shows you a set of DLLs as well... ~250k filemon entries to show me that inetinfo.exe and ws2_32.dll have port 80...
-
@vt_mruhlin said:
The -b is a truly wonderful option though. Highly wish Solaris would support it to make the old "ah shit, what port is this server listening on?" nag a little easier.
Historical irritation - most other unixes have -p, but solaris has always lacked this feature. Install lsof from SFW and use that instead.
-
Never heard of that -b parameter before in XP.
When I have had to find out which port is being used by which executable I go for the -o option which lists the PID of the processes. That combined with -n makes it really fast to find out which executable is linked to which port.
-
I would have guessed that Windows doesn't really know which process the port belongs to, so it takes an image of each running process, kills it, looks if the port is free now, then recovers the process from the image taken earlier.
-
I just tried this on a running webserver, instantanious results.
-
@ammoQ said:
I would have guessed that Windows doesn't really know which process the port belongs to
That's not entirely true
-
@bobday said:
@ammoQ said:
I would have guessed that Windows doesn't really know which process the port belongs to
That's not entirely true
The filemon and regmon (now procmon) utillities install their own drivers to intercept the requests and get the desired data. I don't know if TCPView does it the same way, but if yes, it wouldn't technically be windows that knows the mapping. :)
-
@PSWorx said:
The filemon and regmon (now procmon) utillities install their own drivers to intercept the requests and get the desired data. I don't know if TCPView does it the same way, but if yes, it wouldn't technically be windows that knows the mapping. :)
Judging from the fact that I've never had to install those programs (extract&run works fine), I guess they do that at runtime?
Do you know if they extract a driver file and then load it, or use a less hacky way?
Anyway, if netsat has a -o switch that shows the PIDs (didn't know it had one, is it new like -b?), it's trivial to get the executable's name from that.
Of course, "svchost.exe" tells you nothing at all.
-
@aib said:
@PSWorx said:
The filemon and regmon (now procmon) utillities install their own drivers to intercept the requests and get the desired data. I don't know if TCPView does it the same way, but if yes, it wouldn't technically be windows that knows the mapping. :)
Judging from the fact that I've never had to install those programs (extract&run works fine), I guess they do that at runtime?
You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.
-
@asuffield said:
You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.
Surely you must mean "not been using Windows for long enough"? Any decent OS would not let programs do that, at least not behind your back. User programs for the said OS would also be more user-friendly and be more specific than "You must have administrative privileges to run this program."
Fuck mefor thinking they used undocumented calls, everyone knows there isn't any in Windows!
-
FYI - netstat -o (letter oh) will show the same thing, but by PID. It's trivial then to open up task manager, add PID to the column list, and see what process is using the ports.
-
I've taken a quick look at it, and I think I know why.
The -b command, to quote netstat -?,multiple independent components, and in these cases the
And if asking netstat -anb for an example, you get to see what for:
sequence of components involved in creating the connection
or listening port is displayed.UDP 192.168.228.8:1900 : 1340
It becomes rather obvious that it's looking for what files ("sequence of components") have been used. That's more information than the process ID alone can give you. And way more than most people will need at any time; but this param is not for them. Though it's questionable wether it needs to look at every file even once, let alone one time per line of that output. Or why they aren't providing a -o speed option for displaying name or even both pid and name.
c:\windows\system32\WS2_32.dll
c:\windows\system32\ssdpsrv.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\kernel32.dll
[svchost.exe]
-
@asuffield said:
You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.
You've been MS bashing too long to know what you're talking about. None of the apps mentioned from SysInternals installs anything to the Windows folder tree or requires an install; you simply extract them from the ZIP file and run them.
-
@KenW said:
None of the apps mentioned from SysInternals installs anything to the Windows folder tree
That is simply not true.
-
@asuffield said:
@KenW said:
None of the apps mentioned from SysInternals installs anything to the Windows folder tree
That is simply not true.
What do any of those install? They're all self-contained, statically linked binaries. What exactly do they install to the folder tree?
(Unless you're just nit-picking since in order to launch a file it has to be stored somewhere and IE doesn't typically allow direct memory injection, so it'd have to exist somewhere. Say, %TEMP%)
-
It occured to me that you might be refering to the fact that it loads a Device Driver.
This is just part of the application and the driver is unloaded with the application. If it leaves anything behind, it would be irrelevant anyway.
-
@ShadowWolf said:
@asuffield said:
@KenW said:
None of the apps mentioned from SysInternals installs anything to the Windows folder tree
That is simply not true.
What do any of those install? They're all self-contained, statically linked binaries. What exactly do they install to the folder tree?
Most installers are self-contained, statically linked binaries, with their payload stashed in a resource inside the .exe file itself. This one is no different.
begin-base64 644 PROCMON11.SYS.gz
H4sICF6RL0cAA1BST0NNT04xMS5TWVMA7b17WFPH1jC+AwEiBBI1KCpqWtFa
r4EQICThIgSxFQwGEm9AEYIhcjMkqK1UFLBut+ntbXs8p55Wq6fHXo89x6pt
rcXqEa3WeqvS6mlpa9ttQ1taqaZK3d9asxMISM/7fr/nff/4nt8bnyGzZ9as
WbNmzbrMzI45ix6nAimKEkLiOIraT/GfNOo//ywIoKiI8W9HUHuGfHjXfsHc
D+/Kt1bUyWvtNcvsJVXy0pLq6hqHfKlFbndWyyuq5ZnzjPKqmjLLjPDw0Jj/
Av7//fzPf5K/XlbwcPOQYF9aOMsR3ADf7zLBwWtJmSg4GL7v+evo4NWkvizY
Sb6dpH7hrBXke35FqRXb+/Aa9BQ1VxBMJdG3snxlHVSAIEwgoqil8DCSLwuy
UFQjCF/jQnwSUI3wF1OwNwV52zY2eOGqBQCFH3iQ4rfU+937RT7ZgNeAGTtF
7QrsK0c82UMhU09Rq6CD2sUUFf1v+CMt7r8WkM5Owe/Dz3BYVjng+1Q+Ty9V
4P32+8gpyjrDXlbiKKEoRwiPszHEx4O+D/SbPYMHozw4hhJ+2OS7P9yxOblz
8jH/vhj+wNipcO93/36/nGGvs5dSXp7Yvfjsd+CbNcNuqawBwPlAF/Kq0fs9
EO73OfF/82G4AqaT0UsPdUSFG6qqKQPnFHNOERf5wGIBVQhjOomf7c0lAqql
1SG2CdinYO7I80QBx3EG9slR3uemDrGB/S6doiR7g0h9AKlvn0RRTTosoJwh
NorNh/aHCVbSt8lGWbvLBJQN/nGRC6BX6J6dfQ+Q1tVyfc0odi/As+Gj4U9y
JmhKp5h9fC5UHi0qfF9E+eExMw1iyb4QziltahUZEIkc+kckjshyJqSczgow
u7JEJjpLyEXmQz/FBIfYHwcDI88Su0zZzCkucu5iHLNTwtXLuSwpVx/D1Udz
psnQRujXhskRlTPpQi5dVq5JF9nDkH/pUVzeNHc4UyB2pWcbuMhswkt/aps6
pUaTGUd8ZaGAmhrUARxgVHtKBdSYyCuY1+2GvMk838DuzKGANXRh9zuNz2yh
jJyzm9Z78uiCHnYp8IGA5MxFEKjqYbo4p4e5yc6GksCu4TcDVSxgG67rRJxH
mYvFRYuP88zn6TCaJPucUmSdDVBxkVqgVLKvfftGfr7nNlmkVHnLpfoMyb4c
KSN+THOsPpKJ7ADaAk9rPqgbwuml5epCqb2jvKlBSjmiJfv0UubU1GOHvgjI
cwkfMZjZ4/fD9B8RTy2UNjaIKIdMsu+wTTC1y4S1fH+B7cVF5czhxX5zYTQx
qnioMisvvXcaOnOHcpFdZUhSw3UjfMzcBaDODaPxzQWKjxVBuUgFNHxfSvmN
ktGLANzZqNuMUuhIa9S5iDjmubJF6vBWaOXMWrdKilqwXmdtLEMskxfzMumH
9GgQNhO4R1tbAaTpOJe3/4FPP+EM3hbTAOStB8oQDvsRcJEdC3He/aUlLw+m
nQBxkZcX4jzHQKt3kAT1WPzr0DOqI/DddNQDDkEANTVLqtGL6gKU11uuOwtc
eo+Bu7gdAZkCz1SDh8npGZPdownPB4xr564RaSINkFs5y0rBF3vPb94FEGfi
LjaVSykmHHHDKqCj6GwhLdiBj8AdQZaUyRHTsUyudOoxV2aszD3cSyQOgdGL
m+SUshWFp58U5zH6qCZLDwVjkuxrkHPOaFf0u/GgVQIPG1ixd/VJmjdSqP1F
AlAzzmEgKGLKOYIJ3w9d07lS9xiUC2cQnSV1S5Vn38LiWV2SQ0Nn0SapZG+O
iM6FBZYjLqdzxXQwFykHfsESZvQyOisG+qezprEv9XAcnRVdzujlsMwnM22H
OgJAA8S4suINtEnO6ucQGQy85g5knD247mEgcn8JUbYaoIEMlAev/wwGdjTQ
X9hfjtZ1ouNlfQbG42rZBcw1gD7cA51L9rW6XFiQB1iiOWeUPy729G2OO/5+
1J2YTP6oENJKcHV5S0wwhAHo2GbABbIcKdl3yiV2oS/HnJ56hgllCuR0aJH/
qEwHcQZRkaGgETHmBdMrxzC50YsRoIibiLPcTyuQtmbmlJLzyilZJfvxj+aY
YwwDPdKkiE4XqoOIPN50CJWX3ONIR++AnW8dvDdepFo4xxjXSo8L5E7UdEgI
bCsQmXihffEmxxUXEX3QT8/qRb3LcUdXmW9N9gLxUESWMk3m98jYP+KJP4j0
uaMYQdMhT94OfCA90bVCVg2d8WPTnHJ+hg2QuuIid7KVJX3g8rTuJioANTVZ
6jtQW9NET/N6ov9I+9Pd1BkDy4PRGQBOed2kvJRh5FXKRa/aEEKFyZobAshb
SYGYFKAxtkaBBjCZCNt57pAFS4bARYoQzmitRGLG4nhpVRn5a0U0F22z32PB
1TAb6YYeNtID4xwrhRbuUSBWHi5SBnlBQ49tNlgNkOLuGxznyunJgycwLwZb
GHcObN95psGjTqxPc80Tv/1lGHB0lObTOjGzWhh4S3MT6laGp607FA1j1oTY
v3KPqmjFfGAbky2mw9GEMGnSHR3EkPEdmqyjYZwmk0t/2WDlAsdTLn23oS0I
dRb1xS9BtAr1WJv+chTINe3saNOzwADIXaGdnbSzi4uMQrtdpGztb8WaOuVg
hukcj7LVlePJc+V05BloPQzkCq1naX0Xre926UWGNn0HIm7TdyJWLpIiBr5B
qGwFvaAXHR8wb3LQe4AFahApcAWxE8z+aMV3oO1Z5I9W3Ksy+ywAo/IAjEvf
Y1BeMhptAnS4LugmwJpxhChbrx4EbGabEqbCyC65DhPn0dyiGzxOrNuOCgMa
QqXZ2xD6CjN6GUwXetSFYkekLWkBziZ6czAEWygBZBqkmluOSGxuE5ptUb7W
gU0SjmmQQV0G1gFFo/oocs70UnL2F47THKZDHOO8cmLwgpH+uUQvAeMZvYcY
in6as6lTbDThZLv0HKTbyksGIJXdnwGxAhfpQQ3TpbnmjEoqFDkVXGQ3FEB5
l7fcMRYNH9AlMlqRxyYusnYRr0y68VvvwQ4H2FlgLU46eAvEnxWRWVmz0hZv
kxvZIH4w+h4H2BYRE7kLhdQ2PvDMfOhWSHD2bFwAY+kBu+GqFWwSpSWfcP46
9SjjFKeVgyxAn65MKgC9SlD+ttkGI/tGN8GZJXREGJFeoJICTO7Acnqcn+W0
Kaz7i0HP7QZvVnkdpPyo/lsK2E+vFJbTiWjRaiGjYAqlms8kxG0GxnUYTCZT
7zg0RxtC4lqvZgtQFlphkjuA+Uh0hlRzVNI8WoBrpud6mkjgCGKyte4Q5jRz
nzbwAzrncjmTlgT0t6OVyQqgQamqDOCU/3INLOhsIViWCdDNZWCCFPDB2M/8
wMwWljfF1FJgXUXldAhQK7DdLgal4r5H2Zp2mLGwjFPGZGHbcBvOGopBU7mQ
4qFgHG36HozbbAlAn2RfGnywy/XQJeME+40t05j7oSovbf71dCSaW5HpDmby
Mvn58JLibX2GZXKRonSqF105HYz0TOylJ2oweoAMMJ4c4VikGNmV08EL0Cb9
t2w5iOL7sn4rFcOBlutH9RzlWGJ2PSxk2sDnA9dE5Jzb2CAWGN95AB02EXOC
NzNNqZQzsunhKMoRxmRFMbnRtACcLGguQGgeDq1LYwNHLXYMsaEYy4g+6+9V
2UgEtJq4H/01krjJ0k0ZzaCHGjxvYeev8D1vN6DNxT+aw45sEyNy1XYwKbjc
0K8xmOmcHi4S/WldAPq/45gsOZMbQwtsSGDTJMrEhqGz9pFvOfVoDjvfLlKP
RYzFix2jrfJSr7/buucf6O+W9vm7pT4vkZDNj6h3LdpybFKY6j/8RJyWEeBF
2gSGtjTRtGGgKdLEoM8XDfTVwfUo7XNbmHAD76E2tcppUVua0MD7HMypHYbe
nskgDexjMIYif3/A7KWOsCgNsu/hH02bIw1UcJSrlmUiWo47ZPyogQ0+tgBT
fBPIc6g8CljEgkum+Zw57DxStJggLr7DbwKbYYRYSmoTKVuVlxZee0U9dksJ
KuUexyyT1xl8/ld0i0GnzTTaonFhG0EMtpBwa00wo+8AnWS0gSsttQm8FfAV
DQQWwbwUgxoRD+gRmGPkasXKS6hQv/f49No8sDJyaGY22qLQbBkNqKm9XXgw
4BMtJB2Jla02Iajza69wF1BVEoXZwysaksHOwSHTewZ4/+s6cT/I2JRzjDNB
oKZspQtBMI+8wjSImNliW1QRrd/v0u8Hdd9oIAqRLrxCF3YdnS0V0IUHaGcj
Xdjcpt9MLHzhRrrwcbrwqV6jLNpYLL1qB/9lnQ53ByaHUlSdHJeukXgv0xb5
hDmMPCON7pNG75hdLVbceiCgOOjLLn07kMEauDcroYJbCTPhYevA92tudYpJ
BTwfhplRF8scoezCLtCGBVvdBcAgl36LAfnjoQu30IVbwYrqt4Tptzq1NgWY
2G50B7pdLUnYny0QdBUhf804hhRNbVmAC8ulhb9jXEvgL52zldZvMdqELv1J
A5pgwHuSu7D9qRJcvBsLuY2FYWCic07nEUtnFcFfHMZp9zCX/rSh9zlyMtqB
w2tmufRdMLRjBlcLxZEo4jT71A0UAkYVAyDgrDhCOAV3YaOeY/RdoB+8T8C3
0zzfehkIkTxLF3Y7QiCKB/+mG57byUO7QN+tLgREkr2gzTDfRfJhkGdmywCp
Xh3lCGFEzByROxAUhcsgAs0snG9AAWf03U2t8QZjng2WE3v4J5R/aMUp2PBb
HGfkVsp4reEeYzT6w3MrReAbsU/+xC8YSfNvGO3MFtHBTMsaGKuRzhJzb2KO
PYgu6GE0dnz/Bgga2b+hb6/fsiknjIbVrN8KESLIJYkdT0K0yeiPQay4Sc9t
zJ1OF8k2Zk1jXCKcoVw54xKTTAw4B+3lZ65C7KmALMtnZzQdjU8+7IiS7G2F
yT/P6K9wChP7RTIfYzrPJ8EMjkLu8LVdWHu4t1Zd2OkYiQyGqeo0sS9DBT5h
ZZe68LJjKPIb6i6b2Ef5RmDeWdWPHOcOhDWBAjoFuWQTIoPoYpktBJhU+BNO
uUPKuJAftAjbCKBNUiHHqJC5jmBYDVe4CzjHJN9J8u0kf5m7gERjtou7UOzn
THljr3BUnGaiPt3hrnSWMYg1BSJHODNE85HzR2VrMapd5VlXtpCE7q7sKDVp
4viGGWpiVgjpEbRdyERiET2UXi2k7xPSBKDIfaSfxYXArbQvcFNeV6vQA3JK
fJEZeMBfgxQYmUKRkX2AGC1Qdnyd2tkjadmFjkaibbKJvdvt23/4G5SBa/DW
4xiRnCZ7C03lMtT4dJHYVSQEHCYRHXg0S+o1FqinAzm0WYDcOU1NtjMdMTwb
XFlRxBKl8ZZoB36D7nP2pAHmQB+hQIxTCnafcgwHJcqeAFl095n8poYeCqJo
8C5XySinmMCJG1dJKWewgX2eyG3P4oF+AVoXiB+TCqXg+Tvykcijt3EBOcWM
h33ntteuKG1J1gdAdRhZ+Xe8QypzRNNJTJaM7Dbg5igIzG3kTq6sHEZgcgvM
7HrQGe5S3GGw+xAVELeTfQoNlsellxpsMiNXL7IFQPPvfyDydjfgzelCe5nT
TWeLmBwPnS1mcnrobClYMHZtJ8eZ2HsAtXqcI9jEjvFgaH+nDYu5TjgskDQj
hSYS17Df/eabv0ayfySlHPfwoQt4GkBGIJBR/gNxLJbg5pUI+RwOPbpzzBhf
eu1tqYcnHxrK+IZCaDidb0jo7yT0dxH6uwn9HkJ/D/seMKnYxJZDDFZ0vN9O
cVMn6A8Z2BsFOOxMlE1gZJN/4wUmStL8Jgng1FZRI+7LsltYJKGFkzT/B2qw
LCEJHHsMZpsItDeYxPKmeygII3sQnp0VQaEFWSrZF1IOJC5y5UblSfblyvJw
kwmj20xKDDoyCgZTK7IFwWBqO8lgFOAX0yImVwzjKWck5TAgyT5J4PE81zxR
XlOr2MDqErwKxcNeAdmwUd6okXNGsesgIiqGMfHqApCDleBdugs4Y7IB0Rwf
o2mCtsG8SZqbQf/2zuFKeAAvCHygcnWIM6ScmQdhkgR45ZS+gx5DyzhJC24J
qn2Nccmm2xQGtuZbnoUiSfNMALTNstYGEA6aoIJpb7nkmGMLWshvmmVEGZhb
NsG1v7DKqxynvA7xkcm6fwy4S+V0howtUmFkiQ5p0iJ0oZxiPgyMh6erZ7FH
HNvV93vpQD+g22BmJ8ZSlPteYJwtI8/A/usbpAi4CT5TOZ1znZdQM4LyhwhN
DR4YwjoKhwWrUsSpslFJhnCRCujJwMbc4ufeYcIZB93ejTMBna/k526nm8xd
XL+5y+kmlgbnDzwMmC4ye2vjvbPXw06CIZvZU9dwDnt3c4oWFw9YWcZNhaLm
S44xjbqtZL97mFU4Bh3izEW4Z4VlguSxf0bdNrr5kuSpVoN12misTyOOg2gj
qWu+tNhRb1Zyah1hU6LJzI+RnXOTKIobjglejWNmX/8a1EIbapwhROOU06uE
JnYS0FkEi5pvNuwmngoNg7JG3XNIVrFzonVvNPar5fs9GvQc2WePaCJdUs4g
dmY36kTRgN0+spvOS6LyEtNFj8Uwfjv+sQUHHjVYpyxArAY+fAQuD+OCsHKd
Dv9SCoqyn92P6ntHJv7B3H6MKnbk4x8D0etpRoO1Eh/RLtFjy8hfKwkrcEev
zztlVHMxdtJlw1/7CKvHjBs8HnC6+T37HejJ89CnYIEDxKmBEOgCekMr3BM0
Wq9AlERCL35PkBep4qIdyEbfBphfFABOOFkF4GaFmEy0nkW8RIfjPoiJU8lK
cXOtg99cu9Km70wjm2tdtLObnR8HQ/Bobq8RodJMikOLqbldDEJR1H9nBTj+
jwDcFmaB68mHD4oAaV0oxmvnoWBT+/adJXhew2QLNTkiCHoh3nL+7I6wxaLh
MbOGK7geGm8FOEI3ncNW7RjltYFVGDi3xncQNQbN53mTDB4siYpbWp05vtM+
RCvF3YT4r7xHHaCQReDj8Sd+IleWFLxEWM153EqhgdXC4iYE0sEgEbQKs8VF
mwo47AYpWTxgtw61lowJNr+HZ0PKS5o25rQ9gLnI5Ehd6eDVqKNovcw5JKlQ
JGkZIsCTT4hUWVAIF9HSsoGS5iOQyc6WND9FCoIkzQwpcEyd/g1kJC3nUBXF
zTewdV/yKk7S3ApFXAKjF3O1sqt/RYuRI25cHSSQtLyID+kxyrOa951BTLrc
HX09LTgI3N40sXuoTTp/vk2A+yX5ZG9DzMyRasA7EtUFML/a4sw2ik5hw729
OIq4BGCp+37ohkmTatoAyOMDYr/wAqm9ZES5J9iEC2xxdLDBHaIeteYuoBh4
3uqDG4rIwDnw7dSADz6J8u7hS/vvYIDnJuUnb+9sofK48vrUQ3ROj6T5KwHy
J1jSHCTwMupTZJSjHvLArE7CLDNaA9ECW7Yhjw5k07/wOQg63HdVNrVJze4k
Zq1U8yt4piE0xiZgaj3uYBrseo6nr2VIb8tA0hLVuYkdP5Po16tuoKBxLfL7
WwEGHDLNIYdUso8qh2/QyGCfYIB0DkiVXtzUGuDF+Y+OXncTWpUD38rPsOU0
jOhZxBKYnW3AoKdW6MoKMLifZGZLvQ0f7G1Yj8ckSm5l1NUaEPOmtbJQSctL
OOXzpMxseXo6HYY7r1YBgtWKXNniPEAH4s7VSrlaMfvXGeg4OIeC7wjBlwjI
BGIFge7gu5w9dznFtmxOCZMW5u3OoeFWSrmVcvDPZvD0QjcwfEK1MAKPclsD
W8HR6AHcQK0rUxFgYG9NJzxC/1XSjMYTrdHdgODqmyQ48w3qL5/7BoUb1jgo
+dU/gWNpE2zMkbBXicXWHAXhdMSAxjKwX4CLhM9SiOcVXCRGrhv1EmKxMTKF
dQUWWAQqBPCbAL/+c99y55TQK+oWE1sExG3SS4C+5taNWULHRGjP6KWcwpUl
MrBpPOmNDRLKEYZmU8qbzZbrThBEOsx7LCge6HEz4F7nSnF/I01zgi7swb3/
wm5JszjQ5/MESJo5kCNmjlhzAh0fR/T19GCRYwSvI7UCcETrpexBNJft7mno
B1gFQjSXo6YTV+8uYDKvH42sAgaG5/jt7MlpUHlJ0kIJ+B1/awBp8/U00mZ8
bxuY01uf+Rr9AWqvHsWpKJIyGWjzIkFFiBwSLvIB3DDIiJc0pyOti8Wwbsdc
z4C6SL4O10sWCFI8F7lkEW+aiL/MLpuGTitutSoEZOO7t9/3/uVVAPeC/IB/
lBHgyhDRGUKyW49Np/FNm1oV8By5ALVDQzflGMI5u/leoJLJFrccBzKRZRLU
f9txV8nAXoe4Ax+fFBAcoONgNKFkNORoBebD4POyDv7EO46dkuZFuHohkpI0
G9ApDQlwCJuWiclBE/hcJrYOHbJ5sDq6NqULtUH2cG1wvVAb6gzaNEfmDtw0
J2hjThjMN0wmUBVKqALxgO6OpzPOblfBlfmugo75kn3DhTJXflzcfKags1yy
t9UaiKvSDmwJzGNHfemTflT/m/RhG4OZ2WAKwSCBXsoS40OaFPcgMCMDf4lk
onCfAjPRZKsCMnI6S46Z7Bg6N4ZJm0xnTS5nAskSzZom2Rdo4OpAn4DnXDrF
uy6Bu3cBd6EOYnlYs1A3m69Dke/y+ftX2K9AZgB14yqh1BEBq4TJ6WiysBQt
cg8HXUCCC95jYBdPwWXeyRZfRXfTyKPwNi0G30w/GSZIz94R1+FZLK4es3NI
m16Mt53cwST4EeOpmYkcaIvYp73xmYgEbGhHWFsH8YmHMTlRTEE081PYz45g
OpulDZ14d8AxBuoiANjcdzTgF8mI2CEwsmJla1Hh+9ED7/bUT3NlyfEaT30U
Vz/ZRhkke7OkBjaHw5F5Y/MB93uIh4nrmCmUXT8sgOXtrNUGOOfb5tgUsAQO
fOpVRIvB5LVliWz3wkqqxxnelCbcmCVlwy/j3YQo2sRvPsF0SsnFBdzfhemk
i6bxu+Du0dDGSG5BOaWueWIgLU0IEcgbGI6vFTWuFYY7o9etjZJTQyjnwCna
D1NAjkX729u8vKacHo64l05Zm97TWLGM672WYJWiZ8m33wrtB5zYkU11L6S4
D9I+meq7ynTS+qcpUHYMdBbvjSpb++1YoFihSdJ6Q6zp7KhJFGU9go3ugUnm
XfcdWAdmbIeYbPVHtVGYcY/dP15AtbqjmjwCtGmiHVJftZR45oUDYtIGqbAu
ZH84BW3G4o2VJGATFIrsbiZNuAP1NKv6BOwONIzy38VuEGF3ADuRHLY1TSQx
BzvkE9SpPgY/co/fuT6Msh+Xjb6TXB4YbASBJ+coDofZNgevo0Cs93g7f5br
KMYGUI3lZm8PBfcQva41Ka+rC3vqleBTGh1DjVz8Pi/AZABwR/Q9HwFWwhMr
hPIsjbPH/mGR7xS4GA/Ie89gplk78LwxbTJ/3thDq9CxtiIS6+kifs2MByS0
/ormqGRzEyxUq4DCs3mwmjcneSvWVFvjFqBZwMNBDHXa9Ef4SOJYm/40RhJQ
RetPovutP087220B1vumQhfr8c9nMOUQhhwxWKP6ZOlJHjf2/xAOhi8t40u9
p3Us3qZk9FfYo0AhbjJeVzuvNIzbjmg0Rx3BBnYywG+X9T5enei7XnjSJrJS
DwDGLGiK15S4SOsiYo+nQIgkgpVsZlRluAF+gZHgWb+ImSeE+NsmkOwToWvF
XXBPh+Ew5G7UUJAiOl3oHuM7ZAxnl5KrUdAsvBOy0NJL824BG4XU+lYJ0CFH
Og5OGkDHOKAjCvQSaB5CByxNMJp63NbMErpH4Ml0uohRMAVSOg67nyVk0oVI
jKC3J7fUS4+3JK6V3TqJXEbt7TsN+57Vr28wZsmHnKPzeGWgzhGho1WJWiiY
J8WLDRbwwA6UrazGrwPvvi1OiwhkyzG5IYLvormVmOkxZN/D//AaLxwAJIj/
gMgShgsmN5g/juuLBm3R1gdwBI0wsRgwkND18hIUvZwOIBC8ch2EEOVqkSOI
1ne4w8kdoBAIdD0lvQNxj+4dRQfOm298zivK42pw5Ul8hgKfl4fbqWMdOB3n
dEK8ALFGsq8B/MgONDvlDFUeqBeVBwkpyT6PLVOyrw0dob3n0QoAZWAIcnhb
JiIHfudgtMN7TcvBVpQT5xV3KLktKSynHw6wCazSpeSQbwl/3zTc4IUmQ2Ua
OnDjkMUNpuuOBetuIwpJczsh9zKE9+e9yxFzJkaHPhZ30Xvizjk7TNxF9wjv
2K1EYp1XTLwr5uXB1c3k8kpPAEaieoipvc7dl+f6xrQErwySoNrs1nuxKTl1
wxVHqBmPFQi9tizJviDsgo/0X/C119xwRHvbb8dqQoYJb07wW2heOsAPH0YY
BJkhB1mScUxoelhIOcZK9gVL9h07c5UxCcub1tx3e4kzuKn1NkRXzFF3AEjk
SxMGSCQ6CiazQ4wb2gvJRjJe/QNhl6Egsni9DkEYD25LP4wAbcVFA2778Tda
cQPA5L1895ucImfRECXRiiI3orORG8k9cuJi9SKAVbcFZfbk3SCzXLm6QezA
a1iSfRCG3WcysxvOQo85UlqgaXMG0Q1i9wwky8Bu5fG4x/feZJAywUpO0+YQ
mb03GQCaTvGyDKM29rW7B4yd3HatlzV5AuonN3kCHZFNHqEjrMkT4hiFxk9M
QSzvvmGTLlDrpXU/4o1d99X9lAisyw8n+61GpkAM4YxM2XpXyNRjjow5jrFz
nIvBx3XNEhs4u5B9lCM3H2Fmmg6J3ZOY+9BlTjYxdlGeSziCgCzvBQk8VeQO
tEkXAsjI/fi+i+ZYXaBk3yGzYT774W0CVdzfe2FyZE13UeRiMRLpkHjVFfsc
Dz4AmtzxHalDwXFIdShIeMfCy7UBt3CNTKHcrORoDR/AiY/qMZ7FvRabwBdT
2Pi9TL1c0vwo8eJloNKkWoFDrBU7RNoIh1Ab7hRCS4Gp16fCaHjNb95tUQgS
8EQthimMCjwcqI8Giy/nw4RaEYQMepmBHKV0fuzdIY4uZ4KJax8CDQ1cvdAl
HG9g6XFEJEzsCDy5dsrZdgi6ikBc+66w8mPiXb0eUAkyDNzIjVEinSjwQWTf
zCFC9/rqWXK+NPCGVoOIc4xC3dXb6MvzxAVi95/Fqyj9b7EZlZewBV5tqFMX
iteYTGaXPgrPJSB+J32zibf5y6xk3/u22YvUdZ6cHA0v11xzREBhlAGjAXZT
D8epC6OKixzRRrzwyp8IS8l9NG9LIyGnh70XyBl4IuE3etxdt4ltgb3DGMJf
mZXhgsMzHhlYahSjL84Mxgdw95F8MX8L53nC9CjG43+hl4s8tpQcmuBteyyD
Ff3NbTw+wRcKfo8uKU9XUN+94NrffITJCGHRhDApm+0jLKqfL29EFqMrL246
wbHjb/CUgXYCIcL7nSj+UAIwKJAGfgD1aOXa+VvEfnIa2UVGEM0QWLORbcQo
u40czkUNiCA8HLnjDWKMG3dy4E+0kX3yFpncctDRZJIATTQbxBfiKZVk31FX
jjzPYJPi5QkprY/2DvqhHkLpDFe2uByXd8t1eoGQXiVyAH+jJfvw3M2VaZAa
8tiVN3mBV59GZd0DAc5ifuOmxxuC6j3HfSGej9o+Fn3EsT2/IAIcOZiza9dJ
v9F4SV3v6b1T7WWTBNnkufPuNhcpRpvZBTN8oYef4QE3uQdKntQW3Ct5j90i
fY72SV4UOWmEySZ2qeQj7zTL/m9X1uKbg60s5ZlBV5bi1/90Zf16ml9ZH526
c2Xheoji+cGzKpgsiWjGcwerTntlqosvBp5N4Xyr4j/hWUgvz3Bsv8+z6acG
49kdND7zuzSK7qBx2q3BafQjEnfCQFeH8dG5iN33q0+bethnP+Q43rltX0oO
9kH5O0bybUzI1K0fIS0e1g6ARHz8LZHJDHiH8FhVRN5FQHTkSZ/Qldz0Edf/
JqCUJ64LRZ2VXeP6ExqKNTxSsR+pXScJqTwjugen9odTPLVHTnqpFQ1uY6Te
nvq02QseX09SdsNJ7zT1ixJQjUCkQCxNqtopdorXNeCbgwHOQJuwyKtFCC7r
KX4HCLRLhMmVI8szsOtG9p5+Tj5JzuP7nyzIkDaTuc9+v/wv36m7izjLnQay
BwjUVf6MF78cMixDLnWDAj36C3ESg3yOp4k/PMMFFoz+LG+4V4ogYkOjncgT
OAWDMTyxjSAHtiLJvog8MNzYgD09ovewfeUJvAdRcAMPbUddIFptMFVzfvAp
WfwhPyWxJ3wKKHrgyD1c37j/ftl7cUXSvBMPndATdkzixy8m8lL5Exl/mG/8
YreEDNs91Oc1wAjf7PZubC3kr217fJyAefV5MUQEBOyUD33MEP0eMw5HepnR
zdo+QGZkX+dVTujH6M2gJh9ghb07YUS+yWqW4mrmGdXhWx6zbviWx4AbJWJe
GsgV2Ou+6BOtti4Gb9mP9y0XEwwggFSzX/7Cs/mD4/zGT6TQNx0exwgCa0aC
PzzBg+04zgcNA98aID37ieGES7wY0g3dvgkRUSZnEANsH8oPiPBbj9ehu/B4
TLIvzE/4XJkiYZ/0iQnD3zrhdRln3eEyzhYaWJMMD3T4beLZAbhNDLW4U5yZ
BLVJMpwKvHnIfn4MLIZTvBiDoH3dOK5udvU5MiE9fncJbFHW/RjN3IZJ3E9i
yHbG05TTwZHtJP5u5RXy/tKwH4lkDcUyYOoVoLXqZ3RA+oDE5O7QAKBsBPKY
jSZ2L/hREMUb2Xu6cbXcBX/dIf13IHxScJmXArzqloyr9yj7QqTfroufFveb
jqc+8bKukr/d7YxAnYMu1BFyz9CP82lpfXwPJ3xP/4AIesydIh5gYDuG9a73
R9pQxC3XcATorXr5KerjZzvy83UZBt5XSMgMqpHnUQdh5PHvCY+isQzXQQf0
PuEnZM2Vgeywke38CK8DA3yhfKsjpptwZbOM7Jz1Wx/SAWxpaPeyBRVfF9GS
Bzs5jrcj0PfKHwYwp6nVTyojCHcmHCfcmejjTnZAL3tA7A4N7WWP9SiyJ+tn
ZE/omYHi5ud3ksNi5XXm8NSjZtxcCsl2jrQJ3QE2ke/tFhn7RJfXF/IQq4T+
EPgTol5/Iuxn3t8ER5M4E3huCh5nOR3rGAbuprnP3wzpImqGPf7Pf+Nv9vM7
cG9cjg5F5JpFA2NMo8lbhSdSTJfyEnhls83sUTB4RiO5hCo20sF4efu9bQBn
prNE/B19JpwitwzF5JYh5o10utC8gyIXQRrJFZDF/d8mxtBAySkvsVbAbobP
QURpIjcjEeV2bPsWRV6kZQp61AYPuZhxyPmzO5wRMQYhHUrnCV0Lus0mXw/M
4b4bJgQ7on0H0Rp5nAcJuvGMiCb00iuEBFNTazcdagBsPM9Iz5qjZudFYy/t
/m9u4Ua95x7JIzUBeHmikdXjTlhMy0Y9blRJuXoxVy8CCeISwIP/CsKlq2MD
KL9rNABTH8RkReMmEJcAgBDws1+DI3L1F9zD//y27xwuAs88w7EZE/w2ttR8
YIaWq+TQktN8ANk0gsRswAPjWiHuw86+gWI6HAO7q6cEFE8QTw0rAb/s6hPe
QiTuUfAir2IQBUtBenU5nxl6dSmfCbi6kM9Irhr4zJCrs30o+dE9Cwbxaqqv
bMDQd8PSv3o3DkncOyQNwgZztTKuVgy2uI/uN0HvXB3ph6kXzf1YcwlsEPvP
3suV3dTvoKlG4NOUF43sDpouI02PUoN0E4VKeyVb0tvH47/Xx2681lzjm2m+
9TRYhm41O8H37rIJW0rxrKtW6D7ix7FYYLlbin65bxKugZYyGdg1EKm5x7Nf
9HgxyPo6HPojzmkq1BTxe2EMdytDQL2UKaCEkOSQTwDZOw75pZBCIR8F3z9D
+QOQvwrfHfC8BtI4eFbBdzKULYU0G57fgO+jCAPpIqS1UEYJAgKFQcEhoiEj
R44MDQvFjzg8QhIaKh0qHTosdHioLDQydERo/70YCmN5EeqwyI2L+r1cM2An
ZvsWfMkD2ANLlIt8Cg/528gRgRO33/OZ8C3k/uMKkdnAFogpisAz2biJiS/p
cwpo9Tjfyimig0mrsQYucjOCBZc3ZQcLbFIzmAozLDBytaioeKD2UV5SF4ok
zSWwyJLG7sZLnS3rIb/9VfJSgyPqul4kcg6zelB7WCngC3f66lR8j8+M+01o
Ueixu/CADuNFJvIYdm0XgDuZFB3rHM08KDgYpQOVqN3/SCKtIs7ffMFR4VAB
Qy6HAGgvnKkPTugPd2QA3JOqXrhj/nCtA+ByE3vhxP5wBwbATUnohevyh9s/
AO6FpF640/5wewbAZal74UT+cLsHwFHJvXAn/eFeHQCX0AfX7Q+3awBctqYX
7rw/3M4BcH/qo6/dH27bALiXU3rhLvvDbR0AdzO1F47qg8O3XNnvcN+l6GjQ
bnIndDovYI6JaiIxjrHsEohwOVUP2lqVh1hcrNhIwPzPQX07RPxFTSuFty1x
l5i7YI0v8Z5KQP7lBZDHkyPI52O5lJT7Xd1cbrY2L/Dd3eQvfHpvcKK8Wxct
6H+v04oXeKzzLcuqbDISixC/YAcSyUWehsb7KfJ6N9rWHUK8aspb+pPEWg54
zzkNbLH14AL+uIc/+LEtPYjveYMLCy4SO+1tWEE68qJ3VO9lDYGzx7aUf89b
/DbvjpM3iI22MO5iS6vzwl16D75a2KShJBuG432jOjET/NaM+2D5HqoLZ0zC
wNOaM/XC3QJ3QFwrXnl2CptbncMgJ5C0nALt3twqacFrR+tyWilil2j9ESZL
6MqV4ZHwIdcqwSZpWvNZ569T28pp/WWbgD+86jTQ+A4mRY4FJZubyVlvV3lT
0hJHIaM/z+R0Bh4C+G/wFduleCiV8xYf3LIOHXKAhBTkEImPb/FpAZmPVt/d
ICxks87wfjLr3f2S9QPoNLATz6Cz2wll5/EATd/N6LvXHSVvtgdK1nehnw0s
avAESNafu+13DWbg76k0dUbjD3y0lvT9wAc5yrvkHspkiYw79mBFAnfRaOIu
Mip80lxzfs2/3WykC7uNV/Fkz7bUJjayJft9Lz59TcrAdTayc/eTdzqCJc0n
cVcjx4PXw3Ejr9t7fF4SQhFe7iI2F88rIWZgIJghF4K7yHCNyJSNhRwX2c6/
FQ1eTxeTNg3PiIKaPAHOEHBQ8cVVmAD+ODapkHNMbXpYGLAfaXaOVI/Fb4eE
ETWtFgY4QlzpInWU8ycGf62DVriHGH2D5PBVBw//FraPxIPBFKUbTVGNkpZh
eDbbB+1lHP8bDP05m5fn/aUR/NGcy6g+GsQb9Z53sIXvDVyII1paebbWB2cz
9SLnTTD/tYQN+Ds9gQLbHD4kbkVhovYRYZotdOQwEZJ9Q8ppiWTf8TwmIj09
z8BKg0jA4ntrF+yvmRcuM/vIWfLm4Hi8xu91dJuWCUFseq6uQAvW28TDk+r/
wyn8aMq3dwGReLkQY8i4S+WaY/XjwciarFgu2fdrOf7WifdEOOD24XI6pbho
0yC/iWFiamPM4Mea2Z0cIepeM8ue4cmDEPAQCCseoTpV7BJwqKDkb76SCXh9
miwqz5uED1lChwRPeP2OZr0/uoF3rPmf2yi+YydSQW5Ikvc9LtFF/L1rvYdf
sEb2z2/63ketlexDYcVb2HsDCWdBLoy0vou880fjhUADWcen2/TtKbl4H/Ey
XXiaX6SaILzzDnUQkIFV4C9MBRvY6/j+k5F/bZAPS4y94dodv1bT1LlkeyUa
hX8CPU06K4oaiJN44cGbqFAbTl77S3ERubRgxJczXfpXvRoWr0LZ5Pi6hhVf
RTLQ+v2g3mj9MZd+J4DtMVgDKCmsxVetVnLjYA//cxCtaeSOwgEQBnIhu0f5
IVsGXk//m/uTMQQ02wIX0/oOjPaVnDWYCqD436toJzdsGi636a8QZA0s3QAr
8hi/alebQFHIzGzSHu+JY5F1ykJkU1fvnQCPwSYz2QL4mB4cyAN8y+lMkVjz
uXMSvoZKfgzCC9Cm78FfJ+OIH0QaoOE3m3ov13lfRVa2aj7HdwP6rOt2HHqT
h3Og74gwTeGEweQ3WzpKfD/X0jQRf+GD6vvJj/34SzG969zke+PPEUOTb3b9
PzjOegqCJvY6qH7ykg+PDSe76HC/tdDUibsFJhOnwB0HHBLu/KkIHZEs0LSu
oWst3uiYYJPhq1ceAsMD0E4PjZJzBcDYmRzZYPatWPZdclC3Jsx6Xx7UfgIq
+DD7LPz1I957x1BlIL9axSlb08wG68kS/LEWxK47Qv4eI34Fe+ZX/mD119/I
Ls9ss5kf1AVrAv7GTBchmHgpL0OHPLMaHWdH0zrkHtsJXbeRg2v8aTi2+O8c
x17GndC+xakJR0l3Blw7fBV/x89PjdI5PaC2VLXYhwqBYMFYb5BJ71rke5ud
m5i5uC+f5pdP8sv3LOzLr/Jre8yv/IhfvtUvf8Avv98vv8cvv9sv/6pffpdf
fqdffptffqtffotf/im//ON++c1++Y1++Wa/fKNf/mRv3vcxmwpg3r9nMmNk
Ya0NkbP1TH6M9Eb7jU+b2ikaCml4hMpoqJTNhrqovrpoqIsKa3VOZubGRCEC
5dkbPzHtkJPCdxdz+EYZlB9jjuJ34Bn3bKhDyPwYGcKccZ/55Mx3Z9rDLjm7
ER6gogE6E7r4JvCMPUIDcCtFdokGYOuH5E6FijH5MdHKS5CTQk6Wszrkxqc3
2ps+pZgPmHPMJ9jVPKevrLCo2Lc5b5UXCKgyTkV+ORAa05UxUhekqR1gmIly
jdX3KP9poC0s/g6dvse7RwkWAZZa2Q5sd5jJ6Sqj8VoftbAYlDTzdWHe4ZN3
fnynG0amUGxi6kRKIq1mJrjJcxt/k6NN78E7Tq6HpI5wJlcY+JFSnMQKcdcg
Vwy+Fv/c3UPeG7ueJiyXtHxJ3qWRugo6aWMPs1jcdOs2re+kc7ocxa45lEu4
mJm7QdZy3JW5QYqX4fFVNIeMucj+A19abEV/aE3a2tmoaDy3mXbnKfwhD0cM
IciPhHU9PAkmQkIyu4KQ4OFHehioxpG7j0OMzjahq6wXqxeIHcOs/OjOMcfY
DXwxOU4RD0R/9wD0wwj6bojomYtX5dDybWS42ih2bPKiPMFCsEtdzYdiH2/x
F6l4cZShIBXMN+TlWTlT79zydvIIiKaojJ7onW0Fs0AE0NOUo5hacdPt244Z
gCO+6eZth1Dzc/1drvh615J/SJkwILrpIXAwTr6F88NkiNgzOOJ3yx4jPyna
dCQKNwEBk/BGuhB/aXQ/wjmU0IUIhqE8xqbc4mDyrVFku0jK1crY+/GFmCPi
QgIDlNMB+9FQHS4ANCLmXm5FNLciilsxmb3bCwiKsMBkNjLf4S9xKM8qrys5
7sxi0JCHme+Yn5hDpPg4VHDcN/wtb2KpnjcLqDz2Xooim6yAvjJGND+Pc8TI
2GO3vZi9ZoE7fdirC8pAJy6iVlLzqFrKQlVTBspO1VClkK+Df/mQX07K9dQq
QIyQeZQTSuzUamoOlJcDhJ2qokooB1UB+WpoY4USC5SU4dvuq+sclirq5JIB
mHMIbAW0wvYG8hd/ATUDcBVAzXyAWwb1dVCKvWUAvkr4txS+S4EmHvI/h5pM
ZUJNOTw7odxBIXuWUEagnm+DOGrgn2NAqZKKg5JMwFlB1RPcddSSf9PWN7oq
Mq4ZwM0q8oO1Rqgt8Y5t8Lb/Xz71KyhqPqR4SFGQhJDYWoo6C6kV0i5IT0Ja
A8kGKRdSMqTJkIA0qqOGok5DOgJp0woe51OQb4Rkg5QPKQnSrhq+rrWCoj6F
1AVJaqOoSZCyIIEHTlVC2gDpcUi7IL0N6QikDkhdkIJhGsZBSoB0H6QlkB6E
tBXSQUifQvoZUg+k6EqKSoE0H1I5pHpImyDtgn73wPcxSGchdUEKqAI6IGkh
LYBUDmkVpKcgvQDpdUgHIH0A6TNInZBuQ5JVQztICZAyIRkglUHaAOk5SG9D
ugDpG0i3IYmBB6MhPQ401EMqh2SCNAtSBCQFpJ+t0Aeko5D2QnoO0iZID0Kq
hFQEKQuSFtJkSOMgySBdX0ZR7ZCOQHoV0lZIf4KxNcP33hX959z3m8h41zUH
0oJiPuHH99PCA78H5p+bKKBeuFfQr9y/LGCQssBByoSDlAUNUhY8SFnIIGWi
QcqGDFIWOkhZ2CBl4kHKwgcpixikTDJImdSvzPcZOgjcsEHKhg9SJhukLHKQ
slGDlI0epGzMIGXcIGW3Byn7bZCynkHKbg1SdnOQsmuDlP08SNlPg5R1DVL2
4yBlPwxS9v0gZZ2DlDVSd34UfaJP7V7Mw709VUCdnyIYBJr/+K+17N+F+s8/
6K7sLhYQAuYbM43qMe9NDxEuyniKSdbtOL39KOIvTV5SZy9dUmuvKa2qqV5S
t7puSc1SW7ndUrwybnnxqqSEJRVK+OOtj42bUVu21L8PeQHIgwnmn+OIWOz2
fuPzYSmEaZAwbxwKTtdQQS/cHj84/E6Y7pUj73O7X/1+qDvwb+qzZwiouTN+
v/4lqHttQP0Rv/qamQKqbiZP23KFgKpR8Pm34Ptdxe/jHRsnoO6K619/zK9+
aqqAmpn6+/XJaQIqJa2/HGjB98kFa15AZcG/OeB3zAEPKRd8HznYdT3UzIO6
+VCO+RS/NiYqnZoLuUyAzIV8DkDw9Uv6eTPoX+H/rcBxud+kvfPGqPcy/8sC
9b+f//387+d//sMfYVeSnz98C1cpxJKHnOOYyE48GMPyQ6xIGbCD7GaFMIdI
5sbpHbh9VXj1nechpBWV96GbAj5mF/4/EX7//8IBKDsPZVv8yl5ecef/+eD7
/G9c8P+fuCCZ0q9Kr6ysKS1xWAw1NZXmCoc1v2QZ9WmAoW62xWGy2OsqaoDO
MYHzHZUZNbWrC6orSmvKLEaHvaIacQvut8yprnBUlFRWPGjR11uqHVQR4JxT
7bDYAe1yS5mhplZf7bCvNs6tqINA9YEBtc46q1/1KmFxSWVlWUU9tZrkqpyV
1CXs21xSuTzLXlJlybCWVFRTLwirLFWltWDeZAH3W8wlFY6sGrsRSKq0zFtq
s5Q6qFtAmdHi4EmiRAHkKb+iymKnqL9CXUZJdamlki/4FzznOS1ABNlowEKq
nedAhtNuBwz5VrulpGxOGUgLtq20lNi9mM8DXAZUOizexgQSvTn9qiy7pR9X
FwgXrfTrZ051eY29qsRBOJxD+OLjZK6hZJmlbG5NzfKSuooyC+HN4X68zqwt
pU70K+HHkg59zKu1VBvAjbPU1VF677OPrjwfDX6959cst1RT7wbMW1qeabFb
yiEBc7yMpN6EcsTAP89abaipwPmjrsDI5/uADfaKqhL7ah5TsmBOTR/vfJR8
5Q8/p6oWZKum2q//PTCagRyHVRIAs59eXVfBi1x+zQAJ3C2sc9irURT2A53z
+xM/a3V2SXVZpYWKgPkvqK5zlJQuz7TAX6uPKGoHSlJVTb2FCkUZQYh0Rz8I
K8wMcMxpMdfYl8/BjajxwMOMypo6C2UYhJu+hutQbudaqpc5rMYKGMms/jPD
D5pyQOlg8nuxn/x524AAniFzXmexOwhN6SAG1KF+coBFbmgN8j63BoS2CkQp
t8ZRUb56fo3TUVFtoVi+lhdbL+r+EFf9Ifip6A9AZQTkVAF9vCR7S9PLyuw4
ciuOHAkaMFd/4+eqqpbKg9Y5JbVzeR0ABNYZay2lgD8DOA/YBYghvRa4VdYP
R36ND9dakDFc0TW1cy31lso5drA8c3i561f2UQAMcKkF2DufyNP9MJsAY7Bb
6itqnHU5gJo63Qtjtlc4LNRQXttV1ZbYLf2HsBdkjMx3Lqgib9lOlKA6C6yU
Od41n18zyPKlrsIszbeA6qiz5DgdllVgJfy0b5a9pmqwVhXAqYLqqn68gpZQ
OstZUVmWU1YJZOeC1GFbVDZUEtTxEweVVOIADU9RN4hmtNdXlFoyLXWl9opa
R409v2QpLBNqBUhjQXUliM39ltWUGp7mevNKyGdVgrbGB2oirgDSBz5OhadM
GJnDYiqpdJIiakpvGT4q4Elf7QQF5W1CxfqX9DZb6FtPvSVVUALz3Pts9EEQ
LGneNYUPbf1WAc/i3H5adTD+5uNc46QNkFUdL0uZFuQTvyZ9io962Ct7ZF1k
l9jL9HZ7jZ2IEhXTy5msCuSohaffTz/w5U5c9yht5DEcdE9+RenyjBonGJUX
YSSznMsyrJbS5XqQk2pHTd1ye3XlDMsqaJlFea2VwWInSEHdkXZAmgDG65Wx
rJI6h1fOKJSB0hXOCrt/6Xzq/nIvrLG2ohrlCyLO+8u9kL1lmZS/Xp5jXwEy
lJ0+d0ZZZSU1hsqqdPCqkLqb5PuGvgGffcRAAS4Zf5M3C+sJi+tAefSyZiAY
NQPheK1tqqkEiaGKvS35R2yAXOHLBkOxGeuMoEtyQDuBDOD/u+ajO6OyAvVr
jR1kYRuWFlTbLctANCx2QIU8rcJSXgL8rCPuI0I5byu8dCViSZ9Qk8I6amxf
XzVVVU4QM95MYJdbCGWOEruD7wxFLwXLUCKNllInSMjqvlVK3dXH4zuRUWKs
JWoh01Je4sQx34FhPT8r/UaYMAjd/vzLmpufM3v+DONCI0WdwPVSUL2yorrs
vykE4j8Csj8adcfWGv9/7ikGKR8i5PfMHoAVmRlI3fHJDMT/iclEGUFeTJQe
5N0IGnoe6IRisouSBXn8vCv88Tbik1G+fVX+O9WLRwj/EH2IH+4XArCFkeyx
VFDV1DLAVkFVUpbe8yzQEgRGQcVDUpPvpTgO8CdioDwDYKogXCoB+NVATQk8
8QEaf76DWPnzqGpyHlVHyanpkFaSfzPgeXCoGVQpwYwjHwn9+OjKJGdmpYTe
2t5zNvz0P1OTDzhVk/c7v8LPFCrID6/Je67Vhy8WaIgjI4U4D2RSQHjiT2Xf
aAeeePGjgvgS1pKAmkv2srAFcqsW6pCSZcBB/pRvYJmcmgyl98I39q8AuZ7u
zSWScc0gO2tOMk7kXA2MqgJ6t0I5zkMZfM8iUIh7GUCtBArwLBA/aWQs87z9
VXjH4uNDde+YageMyegdUxpIuMA74jKgohQo9p/3fz8PqAeD7mg/kPv+vM8k
q8RETg7vlE6wVOQEJh9qcex1UF/STy6GCHcP+N8j//s/eMH0+fjX4t+N/zD+
X/E/xIepIlUNqu0qtyokITxheMKohPEJyxKqEp5O+HPCOwlBifLEyYmKRGPi
wkRHYkMinfjHxOcTdyW+nrgn8UDiicQziRcSLyd+lXgrUZAUkiROGpY0OkmT
lJNkTipKqk9qSdqW9GISpR6pTlQvTbYl1yQ7k9ckNyVvTn4u+aXkvyXvSX4/
+URye/JXyd8l/5T8a/JwTaJGq5mlKdKUa5ZrVmkaNIzmD5ptmhc1r2je0OzV
vKM5pGnTfKg5r/lRc0sToBVpI7TDtaO0U7Wx2gStRpuuzdbmavO1i7R12rXa
3doOLavt0l7XhukidSrdet0nut90eSlnU8JSo1MnpKakZqXWpLpS/5R6JfVW
KipDGfAmUTFP8bziE8WU2IrYh2MfiT0c+2HsL7FBcWlxs+PmxuXF1cY9Hbcj
7tW4d+IOxR2NOxl3Ma4nLkg5SnmX8h5lgjJNmaUsU9qUNUqHklG+qzyi/EYp
jp8YPy2+NH5b/EvxI1X3qnSqHJVZdUEVkZCasDShJeHRhPBEW9JrSf9I6ki6
liQAbo1X36OOVeeo7eo/qF9V71G3qo+pP1V71BGaR7R/1LZqj2rPagN1+Tqr
rl7H6N7Xtes6dDkpVSnOlIdS1qVsTHk65dmUnSl/TzmQci1FmBqeOhzGOzH1
vtT81IWppakVqfWpa1IfSd2c+kTqM6nPpm5LfTn1b6lvpr6Teii1LfVM6sXU
z1J/TP0FlbEcom0UGsVQxQhFtOJuxT2K6QqlIllhV7Qq2hRnFO2KkNi7Y6fE
ro5tjn0idlHc+bho1WRVs+qo6oqqNmFzwrMJPycIErMSVybtTHo7Sa/OUz8F
I7qgDkuenbwu+ZHkV5LfSP5n8g/JN5ODNKGaYZoxmlhNsqZas0nzpOaPml2a
jzWhMLsarVm7XPuQtlHbov279oD2K5jX77U3tL9ph+tSdDk6i86h26A7pDup
+17Xo4tIqUhZlfJEyh9TLqV0p4xOnZq6NHV16p9hTN04JgXaA/AlYExjFYmK
+xUmRZ2iQfGh4oLiF8VNRVBsZOy42M9jlXFmZZGyQvmI8k/K8aoDqocTdIl/
TVyddDapXn1GHZ28NnkRyOYw7Xzto1qNzq7brvtC91rKvpT01NrU31KJ8qHw
N8qHKBYqHlG8FtsGcvRlLBsbGieLGx03KU4RlxBXGLcsrjJuRdyWuD0gT61x
H8R9EfdN3M9xMmW0UqusU25UbVY9rnpKtUW1VbVNtVO1S/Wqardqj2o/0NOq
OqI6pjqpOq06r2pXXVZ1AMfvTYhPyE4oSLAmrEpgEp5PeDOhPeErmAFPgiRx
dOL0xKREfWJB4gOJVbCSNyY+nfiXxN2J7yZ+mNie+HXiL4lUUnjS2KTJSaok
fZIhqTCpKmkVrOCnYQ2/lvRu0rGkj5O+TupK+i0pXB2lVqjV6nR1rjpfvUj9
gPpB9Vp1s5pRPw7yulW9Q71LvVt9AGT2nLpdfVPNqYOSQ5OlyZHJo5PlycnJ
mclLkpclv5AcprlPs0CzVLNS0wScPKS5rPlSw2p+0QQCT1u0L2n3ad/T/qKN
1I3RaXWzdfN0i3Sv6N7UfaD7TPetjtONTJmQsi3ljZRhINuTU2ekalPnpy5J
daY2pjKpL6aeT3WnEgVP4ctvGkWBoljhVPxZ8aLidcU+xUeKS4ovFG7FT4ob
ituKUbF3xU6NVcemwoqvid0U+0zsntgLsV/BXP0Q2x0bERcJ8yWPmxg3NU4F
WqA47uG45rgn456Lezlub9z7cafiPiVzdjsuVDlCebdyhjIZdMB8kB2bsl65
XvkoyM+Lyr8rDyrfjD8bH6eSJpQmPAG69enEDxL3aw5oTmpOazo0VzTdGo9G
pBVro7VyrUIbr80EXbZAu0Rbqa0FuW/WPqXdot2lfRWkv1V7WnteewXWgEcr
1kl1cl2MLl6XpMvWzdUt0T2gq4XV0KzbqNui26p7Vbdb16o7ojsPOoLVdcLq
oFKkKbKUmJTJKUkp2pS5KYaUB1LKUhywYjambE7ZCjzdnbIn5XLKlRQ2ZW6q
IfVk6unU9tTLqR7k5wPoX4CeVEQp4hVJinzFAoVDsUrRqGhWbFY8rnhVsVtx
UnFa0anoUoSpxqkmqKarEkDf/U/btP9XPuT/og4IoBTrh6qCh0zZkL3hRrgg
JGDb+qGToOjuAIEgNkwxJDhoakRgwOggSmENDp0aLBAK1icGCITbFgG3lX4l
EsXEQAG1Tf7CuMZoSkv+zQOHtw7cCXQ80P1LwX+Ku/xwCmVxBcN/XWhKf+W1
4L0vn/9jw5DkXyM/2rY+4qBivfA9SJO3BQYIAgKk6U9sX6Re9flHcyzlSWPn
Ot9XhPdSLAgC2ooJqYEFwuDhAQXG2JGKSHwIHR5hgpjKWLGsepp8TnXpjNhE
hQorwobPyKgsqauTK+UG59LKilK5d/9SnmGxOyrKvVGVPN3psNZgAKUYNzIc
hCwxNkFBPotGhsfioypOqVKr1IsU6/b8FykYrxjLUzDCVyHPtzvrHPJci2Nl
jX15rEah5gHi8i32qjp5TbncWWeRlzjkVoejti555syVK1fOqIfGddB4RmlN
1Ux7bYl8cum9ivjYGYpp2Dhw+MRe7L6BZtSUWeRYAjGmPE6hiJdnpCvWC+72
Z6UgiApcL5CASAhCA9YLBNTBAz8cePjHJndH4rxbgdKkg6Kzmxv+fPPJtaPE
7y//Ydb8zZ+di84ePvG7Q6UP/ppn+eHcy5pfup7aOvXWz+XnYz698cvz1aPU
CQdO76gXjbv7npjKpCfu+bJ5zutjNm3/beL6aVIFu+KVyezK+/J+6vzQ05V/
vqb1q6rQxz5pL3OV/n167j3XWyJuV3117x+/bJm9ZvqGtaz5sdeWva+Me2K4
vOelCbI/Vb3ffH+9VfjximmFd93cGD7pt/HTn5j6raAg5+cq1eT1n3+yfMne
C5+8vO634g+b3i798+m7e17SzKr4+6PJbx7Y85yk6Mh309Yzk38zip7515sC
+Zlf/xL1besPebWJX+wNyp6fXZP03WG28qHM5ncCQKYFO9YLtgFHtiqGAW/H
DhcIOKFIEQxfARDeZWKZXKhT4LyFPbAhW7DBoxeEjAxUTFFMDhbB+ggKCgkQ
jIj+d7OniEUs44XQRDFpW8y2uzeQyQboUntlf+ja0hLlDCglYjR2onCEQubr
JTCgNxeoiMBqCdIqhCUUrBgaPIQnbpZAgEWUQHEvggwV3q2Q7xyniI4drYji
ZWcoERllRnqcIj5peuz0eCXfWYRwhFAm+iWPvXVbpytLWGP9aPGqXZ+/9c9E
xbpGrJ8gXK1Yub10Z8n/+HJcL619+8pY6Sf3xu9N+uChwJNvvzdAIQSuW0e9
njxy/30PFdwsK+hM2/n9nPTH/7iVPvC3GWM/WDXh1+hRkrVu64G4TzYmfXY5
9Ry9J/WN9c/8tHPR29/PmHTuszWCaiqU2hn85NDsIWm/RketXjYhpuOdj78w
vD7ml4h/dcxY92Hjjsr5855wFmx6++6fz36X7tw4s7SgYVz+oqcXfvBJ/LrW
4qLrD74J6qtLsT6w3avCGqbR54Z8/dAPP1984p1HL7xQM1CF/T+qQVAxJoIX
rupTjFATq+5VjP/oP6wIhRgfRMOD8i2rSupiJcAHeA4ZHpzuxH3A2EjFcDJu
mdi4uo5suFaXVNbFpii0/KBUmRXLKhwllfI5mb2UTZfnVJTaa+pqyh1yI/xZ
WWK3yE0llRVlvODUx/nQhsnE2ZaSshXOEjtgrvMVB/bvTbHu+YFqcZ0LpogO
ALl6JSkiPWPz978FjHBp9hnU+9/d0rV/Zv0vX67Z8/aY/xA7Hzzx5p4Hty4a
O2Tmn+8zJE76MOXCzpKeoZOejFq1u6ol53tD1Ownvn35QfMLL1ddP1T7eNPi
bwtOZ+UHvr/sU9t7815TaZ+956BSfa3wwheN1oOlf15lPpB88ftz9bMy/5IR
XlU3Y/WR37b7dNJa0EkPEdaOHS4MUFD9l3xIoyKNVypqmB/VNuW22A0zvUol
w5ihnI4TOP0O9dJbRXTMf49yG85rKrEi1E8/OX15UEcVimWKGN+zQrAhyktn
TWldbT90itReqIANyjtGU1JR8jujIVWlFrtiPK+oohQjGgdXZQP1pFCqGOHn
5ozhVT8FXB6octBebj/155+fGHvs4t3rzx2JPn5f0dEU6tLnDwgWig7UJqx6
48VHJ57pNDdemcjtfTRlzO7vlp58dqc2YtK0m8WVBTELKmwnls2aMPlz+V2L
XphR5Moc2W597ETwoc8kV2K/WRf5zK3wE+yyx755fIsl4ZHd6a/k/ngualRZ
61/uLu7Y/kBN96FpqeaL38g3hH9Yvmu/KcN165EzEYaD3z3XRJedXZA99GbT
5IevlbKPzvvn/tPPz9xz27324s9/rS854fzetO3cXsln32csm22unW20j/Uc
axzHFmVH3bwlmPDHN87ZHh25/4r47W2/0WOqZgRFXjp/MePKjO9UL73xxHuT
dhl+7B696MVPzI/Hbd10167NQ2++rVgfFKhYH+DmdV5oiXgYf3t3zEBtt7a/
VhgOfCdaIdRcUmcF/eKoqY6VEokG1RAy31JWVVNdFgtmiteJkX3rPaPGXltj
J+s89l7FPbzykvvXg9ZCXdZrRubX1DiI3kpQgP8GRig2To16y/sYi4//8x7l
v1Mxx5csfO7nMZsEsj3Sz4Vpl74y/82mT3usWRx2RvnJJ0M/+iFgwfiJN6bs
ygx6uTNw/Kq1z/3HW3+iXp7QcOHVlhdK9W32e052zz3qXHFW/eO8WV3Oz0Mf
P/qovGaLxPPqhOLaexN2Ht/w7Rt/kp8w/qXlW93Bhj/djtErL9dHfi95YUXZ
XMuMdVb9X30qZgKomPFkakALhCpA9IOFkKUUCcFDvEsiMkSIXB/vexS5Os7Q
uc0Xtx4O2fDihlvRj51778VIwagAQTV6S2FERRGXZINC0utOBSkCcUH1eRlf
rn2ofeXHnz8XmvrcnhMRM1768VLFSqj2dSqDZTkugsoge6G4W5pBpfdb2ktv
hd61eG1G9dBPh+Qblv9y9pkVPz2nKOD1Ya5iruK+bdnbsjZk+jlZVT6B4b2s
5RVYOrPWXlPmLHXUzeyVJxQnIk0oRURJDlQDME7Blax/aPRrncMfebg447Os
R09senfv7PQDJ086nmg/pc57eueLb85u/fHspw89Zh7aHbd5zYepP8z6VHjX
fTeOZWy8r2bJB7Ke+888P/fd8wXVJwMOhr+48bENQ97eOfFddnfXTWZF7rLd
J9bvuvhowY1Ed1fKxh+vdGz6Lbp6Rkl6tnPP7mljJ7fPkVyM7Iqpm6g9uVH8
2eS5lvzbRa9v/m7Ua9Py/v5s8uxftI0qwcgv5zxyIf++W/e/EnLgvYbVH72n
opa889xHPevpMepteX/Y+1nrP0K4zGcyW+OnjFryyg9dms57c98c/s/Eloed
H++5EB5c/ebZygkrln3304pH/5breFn8a+d7cxfcLHr82Sr1iQ0bU5noXSPi
Pr5d9dZPnn98d/GJ6wmzV7XeMyWyzXqh+58983KPLUuVTk97/qdxx0uyv/1r
YE9snbgra+Nt06dz7n36xyGf7vj64I8PdH6Sv23h1snv5v9YHrn2kbnNl16M
eHrZjLyH4tV709/f3GyddDkmYMi36x4N/cP0H3/461tbXpSsc7VJ3/zi+y0z
s2uMLXPKVj3bWfjqH8IKJh3+8W3XsTN/mblo7X8sLxmtfDZq/wtLpZ/FfFf/
xcwMd+e/1gyLj6E/nVzw+tfO3Nipy0r37rr4Sl1o4Kl/frcwtc09Rf/6rqWL
Z1J/VL+yp7jusKizcehjsyMemzI844sngpcWvMO9rXvpJd0kyesfNCxlIgvo
C0/F51ywxK4XfAlL5zOIoRXrjv8/6toN4rL2Re7bahVSP7MojkUHZFTvShgS
GCv23y4Avd33FEacwL7nSMWEvobCWFj+qmWbX9/9T8FfjnStrnqgJjfgwMuT
KgdoS+G6xoKwP17/9v3x+yJj4tePvO/7kwf3/7i4OPu+1bXCLXnZTd/MpzY9
+IPjXx9eFmjWndBFnlpcGf1nefCkl9aNHnHu52ubrrX/kvtM+tDX7gt4kdq5
Z/OkTdfGPr+oJX7aG1+eFD1FP3bxMaa64/WdH//Hlj+s//hfmz7eOf+5GcrY
108+037DYJhQ89ipujjv9s3/AZf6L9HIjgAA
====You will note that this file bears the cryptographic signature of sysinternals and the product name of "Process Monitor". It is installed into windows\system32\drivers. There's a couple others in there somewhere.
There are few things more tiresome than people who argue with empirical facts, particularly when they're just trolling.
-
@ShadowWolf said:
It occured to me that you might be refering to the fact that it loads a Device Driver.
This is just part of the application and the driver is unloaded with the application. If it leaves anything behind, it would be irrelevant anyway.
Well, I just wanted to point out that it got the information from its own device driver and not from a windows component. But in principle, asuffield is right (even though I'd choose another tone): There is no per se difference between an installer and any other program - unless you set permissions. The *mon utilities are so nice to remove their drivers once they exit. But there is nothing forcing programs to do that. In fact, there are lots of "stand alone" executables that create a whole heap of registry entries once they're run the first time. There maybe aren't that many that actually write files but it's very much possible.
-
Is that PROCMON11.SYS.gz thingy usefull for anyone here? If not, I'd rather have it removed, because of copyright and stuff.
-
You can get it by yourself if you open procmon in any kind of resource viewer.
-
I hope you weren't accusing me of trolling because I was assuredly not and it's rediculous of you to accuse me of doing so.
That said, from my understanding it unloads and cleans up anything it installs. Do you have proof it does not, which was your original claim?
If it doesn't, it's something worth bringing up.
-
@ShadowWolf said:
I hope you weren't accusing me of trolling because I was assuredly not and it's rediculous of you to accuse me of doing so.
I think A was taking a stab at Ken Black.
-
@asuffield said:
@KenW said:
None of the apps mentioned from SysInternals installs anything to the Windows folder tree
That is simply not true.
Andrew, as usual you have no clue about what you're talking about.
Let me reiterate for you: None of the apps mentioned from SysInternals installs anything to the Windows folder tree.
And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.
Let me ask you once again to keep your mouth shut when you're clueless, instead of posting nonsense. Thanks.
-
@KenW said:
@asuffield said:
@KenW said:
None of the apps mentioned from SysInternals installs anything to the Windows folder tree
That is simply not true.
Andrew, as usual you have no clue about what you're talking about.
Let me reiterate for you: None of the apps mentioned from SysInternals installs anything to the Windows folder tree.
And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.
Let me ask you once again to keep your mouth shut when you're clueless, instead of posting nonsense. Thanks.
-
@KenW said:
Let me reiterate for you: None of the apps mentioned from SysInternals installs anything to the Windows folder tree.
And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.
I already posted cryptographic proof that you're wrong, so you are now obviously just trolling. Get a life.
-
@asuffield said:
@KenW said:
Let me reiterate for you: None of the apps mentioned from SysInternals installs anything to the Windows folder tree.
And by "none", I mean exactly that. None. They're all self-contained executables, usually a single executable and a help file in a simple .zip container. The "installation" is simply unzipping the files into the folder of your choice.
I already posted cryptographic proof that you're wrong, so you are now obviously just trolling. Get a life.
At this point, you're picking nits, which like I said in my original post, is largely irrelevant. It has to load a device driver to work on XP and older OSes. There's no other way around this.
But it also shouldn't leave the driver operational in the background. Per Microsoft best practices, the binary for the driver likely remains behind; however, this is largely in part because Microsoft reccomends that you do not delete the binary data for your drivers in case something else is attempting to use it at the time. More information can be found in the DDK or Windows SDK.
[edited: clarification]
-
I don't quite see why "installing" has the prerequisite that the file stays there as well. The point is that there is nothing that prevents the programs from doing so.
And KenW, I don't accuse you of trolling, but maybe you could actually proof or at least explain your statement instead of just repeating it in increasingly eye-catching font. The resource entry IS there. As is the appropriate error message when you try to start them without sufficient permissions.
Of course the driver is there only temporary. But what does that change?
-
@ShadowWolf said:
At this point, you're picking nits, which like I said in my original post, is largely irrelevant.
The troll made an irrelevant rant, I proved it false. Your ire is misdirected.
But it also shouldn't leave the driver operational in the background. Per Microsoft best practices, the binary for the driver likely remains behind; however, this is largely in part because Microsoft reccomends that you do not delete the binary data for your drivers in case something else is attempting to use it at the time.
And anybody who has had to hit up drivercleaner.net to get the ATI or nVidia drivers working again knows that "do not provide a (real) uninstaller for your drivers" is a stupid and wrong recommendation. Just because it's not trivial to get right doesn't mean that you shouldn't do it at all.
-
@PSWorx said:
I don't quite see why "installing" has the prerequisite that the file stays there as well. The point is that there is nothing that prevents the programs from doing so.
And KenW, I don't accuse you of trolling, but maybe you could actually proof or at least explain your statement instead of just repeating it in increasingly eye-catching font. The resource entry IS there. As is the appropriate error message when you try to start them without sufficient permissions.
Of course the driver is there only temporary. But what does that change?
The point is what he originally wrote:
You've been using Windows too long, you're starting to think that there's a difference between running an installer and running any other kind of program. The thing you download is the installer, it's just completely silent and doesn't add anything to the start menu or desktop. It does scatter files into the \windows\system directory and keys into the registry. It also doesn't have an uninstaller.
Either way, there's not one ounce of evidence that supports the assertion that "It does scatter files into the \windows\system directory and keys into the registry". "It also doesn't have an uninstaller."is either a red herring or false depending on how you look at it. It extracts one of three driver files, starts it and then hooks in to whatever callback mechanism exists on the machine to do its job. That driver exists until you reboot at which point it's cleaned up.
-
@asuffield said:
@ShadowWolf said:
At this point, you're picking nits, which like I said in my original post, is largely irrelevant.
The troll made an irrelevant rant, I proved it false. Your ire is misdirected.
But it also shouldn't leave the driver operational in the background. Per Microsoft best practices, the binary for the driver likely remains behind; however, this is largely in part because Microsoft reccomends that you do not delete the binary data for your drivers in case something else is attempting to use it at the time.
And anybody who has had to hit up drivercleaner.net to get the ATI or nVidia drivers working again knows that "do not provide a (real) uninstaller for your drivers" is a stupid and wrong recommendation. Just because it's not trivial to get right doesn't mean that you shouldn't do it at all.
mmm...those issues occured because ATi and nVidia were determined to use their own method to install drivers instead of using Microsoft's way of doing things. Had they followed best practices in the first place (as they do now), this would be a complete non-issue. I haven't had to use Driver Cleaner to update a driver from either company in quite some time.
But their installers were not the pinnacle of install technology.
-
I can't check right now, but I believe PageDefrag has some kind of an uninstall button.
-
@PSWorx said:
I don't quite see why "installing" has the prerequisite that the file stays there as well. The point is that there is nothing that prevents the programs from doing so.
And KenW, I don't accuse you of trolling, but maybe you could actually proof or at least explain your statement instead of just repeating it in increasingly eye-catching font. The resource entry IS there. As is the appropriate error message when you try to start them without sufficient permissions.
Of course the driver is there only temporary. But what does that change?
What that changes is Andrew's assertion that an "installer" runs and puts a bunch of stuff in the Windows System folders, which is just wrong. I never said anything at all about SysInternal's utilities not containing resources, but as usual Andrew reacted by posting crap and calling people who had the audacity to disagree with him trolls. Andrew is a pompous ass who has a reputation for being so and pissing people off; 99.9% of what he posts is unfounded MS-bashing FUD. See his other posts here for evidence of that fact.
-
@Cap'n Steve said:
I can't check right now, but I believe PageDefrag has some kind of an uninstall button.
You apparently don't read any better than Andrew. Try again:
@KenW said:
None of the apps mentioned from SysInternals
-
@Daniel15 said:
@aib said:
In short, netstat -b scans the entire %SystemRoot% directory tree multiple times per connection.
blinks
WHY?!Comon!!! Are you really surprised? After Microsoft's end task nothing microsoft made EVER surprised me again.
-
@dlikhten said:
After Microsoft's end task nothing microsoft made EVER surprised me again.
End task? zuh? Could this be a WTF yet unknown to me? Please elaborate, this sounds interesting.
-
@KenW said:
@Cap'n Steve said:
I can't check right now, but I believe PageDefrag has some kind of an uninstall button.
You apparently don't read any better than Andrew. Try again:
@KenW said:
None of the apps mentioned from SysInternals
Congratulations on winning an imaginary argument on a technicality. The original discussion was about whether there was any difference between a standalone program and one that uses an installer, so I was contributing a relevant example.
-
@Cap'n Steve said:
@KenW said:
@Cap'n Steve said:
I can't check right now, but I believe PageDefrag has some kind of an uninstall button.
You apparently don't read any better than Andrew. Try again:
@KenW said:
None of the apps mentioned from SysInternals
Congratulations on winning an imaginary argument on a technicality. The original discussion was about whether there was any difference between a standalone program and one that uses an installer, so I was contributing a relevant example.I've never seen an uninstall button on PageDefrag. To refresh my memory, I redownloaded it and there is no such button that I can see.
I got it from here: http://www.microsoft.com/technet/sysinternals/utilities/pagedefrag.mspx
As for whether there is a difference between a standalone app and an installer, I would always contend that there is a substantial a difference. An Installer is a seperate, independent application designed specifically to place files and resources on the machine for configuration and use later. An Installer is not functional application - ie, it cannot do anything outside of that goal. A standalone app could easily be an Installer. Calling any one of the SysInternal tools an Installer is deceptive in my mind.
-
Here's what my version looks like. Not exactly an installer, but the authors seem to think it's close enough to use the word uninstall.
[URL=http://img248.imageshack.us/my.php?image=pagedefraguk3.png][IMG]http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png[/IMG][/URL]
-
@Cap'n Steve said:
Here's what my version looks like. Not exactly an installer, but the authors seem to think it's close enough to use the word uninstall.
[URL=http://img248.imageshack.us/my.php?image=pagedefraguk3.png][IMG]http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png[/IMG][/URL]
An odd decision on wording on the part of the author. I'm not sure exactly what it's uninstalling, but I kinda wanna find out now.
-
Okay, look, here's the deal. FileMon - at least the FileMon that was available before the Microsoft acquisition of SysInternals (I haven't had the chance to test any prior versions) - probably *does* install something to the Windows system folder. However, it cleans itself up afterwards. Let me explain how I believe this is true.
I used to run it on the computers at the college I went to. I was just an ordinary student, and the college computers (running NT 4) were set up so that there were no write permissions to the Windows folder, *especially* the system folder. Don't get too cocky on reading this - the program refused to run normally. It just wouldn't start.
However, I did notice that on computers where it *did* run, it extracted a file to the current directory, which was removed very quickly. This file - which I have on my USB drive - is called filem.sys and has an md5sum hash of 5888bb7122cb80babf3a849189bee679. At least, the version that was extracted did. I got the file by having a batch file continually running which attempted to copy the file to another directory repeatedly. Not the best or most efficient way to do it, but it works.
Now, when this file is in the same directory as the EXE and the program is run on a system with write permissions denied to the Windows folder, it works. I'm not kidding.
My best guess here is that the program attempts to use the SYS file, and if it can't find it, it extracts it to the current directory, moves it to the system folder, and then tries again. The system folder is probably used because that's the canonical place for such files. But it would explain why it doesn't work when it's not extracted, and does when it is.
Now can we stop the argument now?
-
@Ciaran said:
Okay, look, here's the deal. FileMon - at least the FileMon that was available before the Microsoft acquisition of SysInternals (I haven't had the chance to test any prior versions) - probably does install something to the Windows system folder. However, it cleans itself up afterwards. Let me explain how I believe this is true.
I used to run it on the computers at the college I went to. I was just an ordinary student, and the college computers (running NT 4) were set up so that there were no write permissions to the Windows folder, *especially* the system folder. Don't get too cocky on reading this - the program refused to run normally. It just wouldn't start.
However, I did notice that on computers where it *did* run, it extracted a file to the current directory, which was removed very quickly. This file - which I have on my USB drive - is called filem.sys and has an md5sum hash of 5888bb7122cb80babf3a849189bee679. At least, the version that was extracted did. I got the file by having a batch file continually running which attempted to copy the file to another directory repeatedly. Not the best or most efficient way to do it, but it works.
Now, when this file is in the same directory as the EXE and the program is run on a system with write permissions denied to the Windows folder, it works. I'm not kidding.
My best guess here is that the program attempts to use the SYS file, and if it can't find it, it extracts it to the current directory, moves it to the system folder, and then tries again. The system folder is probably used because that's the canonical place for such files. But it would explain why it doesn't work when it's not extracted, and does when it is.
Now can we stop the argument now?
You know...all this information is on the website :-)
-
@ShadowWolf said:
@Cap'n Steve said:
Here's what my version looks like. Not exactly an installer, but the authors seem to think it's close enough to use the word uninstall.
[URL=http://img248.imageshack.us/my.php?image=pagedefraguk3.png][IMG]http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png[/IMG][/URL]
An odd decision on wording on the part of the author. I'm not sure exactly what it's uninstalling, but I kinda wanna find out now.
I'm guessing it's registry entries or batch files or whatever it uses to run on startup.
![http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png[/IMG][/URL]](http://img248.imageshack.us/img248/4756/pagedefraguk3.th.png%5B/IMG%5D%5B/URL%5D){kind=link}