D
David Candy
So you turned on Auditing in Local Security Policy, then set auditing on that particular key in the Permissions - Advanced - Auditing..
--
----------------------------------------------------------
http://home.comcast.net/~wizardofwhimsy/index.html
--
----------------------------------------------------------
http://home.comcast.net/~wizardofwhimsy/index.html
Clark Murray said:I checked in the Event Viewer, but I couldn't find any Audit Failure records
relating to this.
--
Best Regards,
Clark Murray
And please post back the guilty party.
--
----------------------------------------------------------
http://home.comcast.net/~wizardofwhimsy/index.html
Clark Murray said:BTW where can I see the audit? There doesn't seem to be anything about this
in the registry help text.
--
Best Regards,
Clark Murray
Changes don't happen straight away. Reboot (or terminate explorer and
restart it).
--
----------------------------------------------------------
http://home.comcast.net/~wizardofwhimsy/index.html
Clark Murray said:OK, so I denied permission for the SYSTEM to Set Value and turned on
auditing for that key. However, the bottom line is that I'm still getting
the same search results--nothing found between <% and %> in an ..asp file.
--
Best Regards,
Clark Murray
Turn auditing on and see what changes it.
--
----------------------------------------------------------
And the band played ....
http://www.smh.com.au/articles/2004/05/14/1084289883713.html
Clark,
If {5e941d80-bf96-11cd-b579-08002b30bfeb}has helped you, deny write
permission for this registry key and see if that works well.
--
Ramesh - Microsoft MVP
Windows XP Shell
http://www.mvps.org/sramesh2k
The Parasite Fight - Quick Fix Protocol:
http://aumha.org/a/quickfix.htm
------------------------------------------------
Ramesh,
Something in Windows keeps changing the text filter back to the html filter.
I looked at my registry yesterday and noticed that the Persistent Handler
for HKEY_CLASSES_ROOT\.asp was specified as
{eec97550-47a9-11cf-b952-00aa0051fe20}, the html filter. I thought maybe
the registry patch I used didn't work, so I edited the registry to change
the Persistent Handler to {5e941d80-bf96-11cd-b579-08002b30bfeb}, the text
filter. Today I checked back under HKEY_CLASSES_ROOT\.asp and noticed that
the Persistent Hander had been changed back to
{eec97550-47a9-11cf-b952-00aa0051fe20}. Any idea how or why that happens?
--
Best Regards,
Clark Murray
Clark,
By any chance, does "<%" denote a comment entry (like REM). If it is a
comment entry, the NLHTML filter (the CLSID you used initially) ignores that
commented area in the ASP file. Apart from this, sorry no idea why this
occurs
--
Ramesh - Microsoft MVP
Windows XP Shell
http://www.mvps.org/sramesh2k
The Antivirus Defense-in-Depth Guide
http://go.microsoft.com/fwlink/?LinkId=28734
Ramesh,
I'm pretty sure I've found the problem now. There's a filter somewhere
which is preventing searches of anything between <% and %>. I created two
files:
FILE1.ASP
set rsESL = createobject("adodb.recordSet")
rsESL.open listSQL, Application("pm_dbconstring")
FILE2.ASP
<%
set rsESL = createobject("adodb.recordSet")
rsESL.open listSQL, Application("pm_dbconstring")
%>
Any of the character strings I search for are found in FILE1 and none in
FILE2. How can I fix that?
This is also consistent with what I reported earlier, but mistakenly
interpreted as a directory level problem. The string I was searching for
earlier sometimes appears in html and other times in vbscript.
--
Best Regards,
Clark Murray
Clark,
Does it happen with Indexing Service turned Off as well?
--
Ramesh - Microsoft MVP
Windows XP Shell
http://www.mvps.org/sramesh2k
The Antivirus Defense-in-Depth Guide
http://go.microsoft.com/fwlink/?LinkId=28734
Ramesh,
I applied the plain text filter and that didn't work either.
This problem appears to have something to do with the levels of the
directory tree. I tried searching for a particular string, and that string
was found in asp files that were 3 levels down in the folder I specified for
the search. However, asp files 5 levels down which contain that same
character string were not listed.
--
Best Regards,
Clark Murray
Hi Clark,
Make sure that the search keyword is not a comment entry in the ASP file.
This filter ignores text that is contained in comments in an HTML file. If
not, try using the plain text filter {5e941d80-bf96-11cd-b579-08002b30bfeb},
rather than {eec97550-47a9-11cf-b952-00aa0051fe20}. But, always backup the
appropriate registry key before modifying.
--
Ramesh - Microsoft MVP
Windows XP Shell
http://www.mvps.org/sramesh2k
What You Should Know About the Sasser Worm and It Variants:
http://www.microsoft.com/security/incident/sasser.asp
Ramesh,
I tried both of these fixes. They both were applied successfully. However,
Search still won't find text in .asp files.
--
Best Regards,
Clark Murray
Clark,
Type the command in RUN box. This adds the PersistentHandler for ..asp files
automatically.
REGSVR32 NLHTML
If not, create and apply the REG fix. From Alex Nichol.
Make the following, after - - start and before - - end into a file by
cut/paste
to NotePad. Don't let lines wrap around, and make sure there is a blank
line at the end. Save as "Patch.reg" then right-click on this file and
take Merge to enter it into the registry.
- - start
REGEDIT4
[HKEY_CLASSES_ROOT\.asp]
@="aspfile"
[HKEY_CLASSES_ROOT\.asp\aspfile]
[HKEY_CLASSES_ROOT\.asp\aspfile\ShellNew]
[HKEY_CLASSES_ROOT\.asp\PersistentHandler]
@="{eec97550-47a9-11cf-b952-00aa0051fe20}"
- - end
--
Ramesh - Microsoft MVP
Windows XP Shell
http://www.mvps.org/sramesh2k
What You Should Know About the Sasser Worm and It Variants:
http://www.microsoft.com/security/incident/sasser.asp
Windows XP V 2002 SP 1:
Search Companion will not find text in .asp files. I have changed the
configuration as specified in Microsoft Knowledge Base Article - 309173
which basically says to turn on "Index files with unknown extensions".
Still won't work.
