Possible aol.com WHOIS poisoning

I was trying to report some spam abuse this morning, and happened to do a WHOIS on aol.com via swhois.net (my usual location because they have one form that works for IPs and names). What I got was this:

A couple of other WHOIS sites I tried (such as InterNIC) didn’t have this result. I don’t know enough about the structure of the WHOIS DB to know what’s going on, but it looks like something’s been hacked somewhere.

Advertisements

Finding memory in use when balloon driver is active

When the balloon driver kicks in on a Windows VM, the <strong>Performance</strong> tab in <strong>Task Manager</strong> will show nearly all the physical memory consumed. However, adding up the memory of each of the processes shown in the process list will likely not come anywhere near the amount of physical memory consumed. You’ll be left confused as to where the memory has gone. The answer is that is has been consumed by the balloon driver, because the host the VM is located on is running out of RAM.

You can defeat the balloon driver with a memory reservation on the VM, but how do you know how much to reserve? How much is actually being consumed by the processes that are running? Here’s a piece of PowerShell that will give you a decent estimate.

<code>
foreach($p in Get-Process)
{
&nbsp;&nbsp;&nbsp;$mem_used = $mem_used + $p.WorkingSet
}
Write-Host $(([int] ($mem_used / (1024 * 1024))).ToString() + “Mb”)
</code>

Office automation: Accessing constants such as xlCenter

When automating Office via COM using PowerShell, you can work out what methods to call using the Microsoft.Office.Interop Document Object Model or you can run Office, record a macro doing what you want, then edit it to see the VBA that would do what you want. From there it’s easy to find out what the methods and properties that you need are.

Something less obvious is when a method uses a constant, such as xlCenter, how can you access that constant? They’re stored in an enumeration called Constants. If anyone knows how to access these enumerations in PowerShell, please let me know. Otherwise, you have two methods.

Spy on the values in the Macro Editor

  1. Record a macro in Office that does what you want.
  2. Open it in the macro editor
  3. Start debugging it with Step into…
  4. Hover over the constant to see its value

Using the Macro Editor to find constant values

Look in the object model

Only works for constants like xlCenter.

  1. Find out what integer the constant corresponds to by finding it in this list (could be negative)
  2. Create an integer object set to this value
  3. Reference it in your COM call.

Example:

$excel = new-object -comobject Excel.Application
$workbooks = $excel.Workbooks.Add()
$worksheets = $workbooks.worksheets
$worksheet = $worksheets.Item(1)
$worksheet.Name = "Name of Worksheet"
$excel.Visible = $True
$worksheet.Cells.Item(3,3) = "Title of Excel Document"
$centre = [int] -4108
$worksheet.Cells.HorizontalAlignment = $centre