Two New Free Tools Added - Anti-Spyware & Anti-Rootkit

I added two new free pieces of software to the Malware Solutions online arsenal.

The first is free rootkit detection and software from Grisoft (yes, the makers of AVG Anti-Virus). The name of the product is AVG Anti-Rootkit Free. You can find it on our Free Anti-Virus Software page.

Here is what AVG has to say about their own product:

"AVG Anti-Rootkit is a powerful tool with state-of-the-art technology for detection and removal of rootkits. Rootkits are used to hide the presence of a malicious object like trojans or keyloggers on your computer. If a threat uses rootkit technology to hide itself it is very hard to find the malware on your PC. AVG Anti-Rootkit gives you the power to find and delete the rootkit and to uncover the threat the rootkit is hiding."

The second application is also from Grisoft. I am talking about AVG Anti-Spyware.

"AVG Anti-Spyware Free is a free anti-spyware protection tool developed by GRISOFT for home use. We invite you to join the millions of satisfied customers worldwide who have downloaded the software and now enjoy the benefits of AVG Anti-Spyware Free."

You can download AVG Anti-Spyware Free from Free Anti-Spyware Software page

What you get with AVG Anti-Spyware Free

	Easy to use
	Daily database updates
	Heuristics to detect unknown threats
	Automatic Cleaning Engine
	And most of all ... great customer satisfaction!

What you do not get

	Automatic online-update
	Real-time monitoring of the entire system
	Self-protection at kernel layer guaranteeing gapless monitoring
	Consent for commercial use

If you are wondering what a Rootkit is then read on....

"A rootkit is a set of software tools intended to conceal running processes, files or system data from the operating system. Rootkits have their origin in relatively benign applications, but in recent years have been used increasingly by malware to help intruders maintain access to systems while avoiding detection. Rootkits exist for a variety of operating systems, such as Linux, Solaris and versions of Microsoft Windows. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules.

The word "rootkit" came to general public awareness in the 2005 Sony BMG CD copy protection scandal, in which Sony BMG music CDs surreptitiously placed a rootkit on Microsoft Windows PCs when the CD was played on the computer. Sony provided no mention of this on the CD or its packaging, referring only to security rights management measures."
What is a Rootkit?

How To Remove Spy Sherrif

Here is how to remove Spy Sherrif: (adapted from a post in MalwareSolution's Forum

1. Download SmitfraudFix.exe from here and save it to your desktop:

Confirm that the file SmitfraudFix.exe now resides on your desktop, but do not double-click on the icon as of yet. We will use it in later steps.


2. Next, please reboot your computer into Safe Mode by doing the following:

-- 1. Restart your computer

-- 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.

-- 3. Instead of Windows loading as normal, a menu should appear

-- 4. Select the first option, to run Windows in Safe Mode.

-- 5. When you are at the logon prompt, log in as the same user which you had done the previous steps.

3. When your computer has started in safe mode and you see the desktop.

4. Close all open Windows.

5. Now, double-click on the SmitFraudfix icon that should be residing on your desktop.

6. When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screen.

7. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).

8. The program will start cleaning your computer and go through a series of cleanup processes. When it is done, it will automatically start the Disk Cleanup program.

This program will remove all Temp, Temporary Internet Files, and other files that may be leftover files from this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will should continue with step 10.

9. When Disk Cleanup is finished, you will be presented with an option asking Do you want to clean the registry ? (y/n). At this screen you should press the Y button on your keyboard and then press the enter key.

10. When this last routine is finished, you will be presented with a red screen stating Computer will reboot now. Close all applications. You should now press the spacebar on your computer. A counter will appear stating that the computer will reboot in 15 seconds. Do not cancel this countdown and allow your computer to reboot.

11. Once the computer has rebooted, you will be presented with a Notepad screen containing a log of all the files removed from your computer. Examine this log, and when you are done, close the Notepad screen.

Your computer should now be free of the Spy Sheriff infection.

Free Anti-Virus & Anti-spyware Software for Windows Vista

Good news! I learned that AVG Anti-Virus, Spybot Search & Destroy and AdAware run on Windows Vista! The best part about these programs are that they are free to download.

You can find a full list of free anti-virus software here

You can find a full list of free anti-spyware products here

New Sites Launched

I launched a new site a few days ago. Take a look:

Pathways To Well Being

I also setup a page for my web design services:

Web Design Services

This one went up a few weeks ago:

Onion River Chiropractic

How To Remove: Trojan Downloader Zlob.Media-Codec

How To Remove: Trojan Downloader Zlob.Media-Codec Overview: Trojan-Downloader.Zlob.Media-Codec disguises as required upgrade software for Windows Media Player to be able to view adult videos online. It contains malicious codes that downloads a variant of Trojan.Zlob which is the culprit for Rogue Antispyware Programs such as SpywareQuake, SpyFalcon Winfixer and others. Category: Malware/Adware Related Files and Process: %program_files%\intcodec\iesplugin.dll %program_files%\IntCodec\iesuninst.exe %program_files%\IntCodec\isaddon.dll %program_files%\IntCodec\isamini.exe %program_files%\IntCodec\isamonitor.exe %program_files%\IntCodec\isauninst.exe %program_files%\IntCodec\pmmon.exe %program_files%\intcodec\pmsngr.exe %program_files%\IntCodec\pmuninst.exe

Download SmitfraudFix and save it to a desired location. This will be in ZIP File. Extract all the files to your Desktop, it will create a folder SmitfraudFix. Note: When extracting or executing, some files might be detected as Potential Threat or Harmful Script. Please disable AntiVirus or Any Script Blocking Software temporarily. It may harm or make the Fix incomplete. Temporarily disable System Restore (WinME and Windows XP) [how?] Reboot your computer in SafeMode [how?] Browse the folder SmitfraudFix on your Desktop and double-click on smitfraudfix.cmd “Enter your Choice: (1,2,3,4,L,Q):” Press no. 2 to clean to the infections. Wait for the process to finish. If prompted for: Registry cleaning - Do you want to clean the registry? Press Y, as Yes It will check if your wininet.dll file is damaged, if so it will ask you to Replace Infected File? Press Y as Yes and hit Enter. In order to make sure that Adware is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to detect the virus using various Scanner Program without the need to install can be done with Free Online Virus Scanner. http://www.vermontpcsolutions.com

Updated: How To Remove Spyware

Spyware, Adware, Malware, Badware....whatever you choose to call it, it's a problem. Chances are that you or someone you know has or will experience some sort of 'ware' infection on a computer and it can be frustrating.



What is spyware?
Spyware is malicious software that collects information about a user and is installed on a computer without the user's informed consent. Not to be confused with a virus.
There are many different types of spyware.

• Adware - is a type of spyware that collects information about a user in order to display targeted advertisments to the user.


• Browser Helper Objects (BHOs) - is a plug-in for Internet Explorer which helps developers customize and control the browser.


• Browser HiJacker - is when a malicious application adjusts your browser settings without your concent. For example: your homepage has changed to a search page, dangerous sites have been mysteriously added to your Favorites, questionable websites are added to Internet Explorer's list of Trusted Sites etc...


• Keyboard Logger - logs all the activity of your keyboard and reports this information back to a remote computer. This information can be used to steal passwords, bank information etc...


• Phone Dialer - AKA - Modem HiJacker - this type of application changes the phone number dialed when using a dial-up Internet connection so charges are incurred on the users phone bill.


• Remote Access Trojans (RATs) - malicious programs that run on a user's computer which permits an intruder remote access to that computer.

How do I know if my computer is infected? What are the signs of spyware?

• slower than normal computer? - Is your computer having trouble performing routine tasks? Has there been a sudden increase in the amount of times your computer crashes? Does your computer not start at all?


• homepage has changed by itself? - Has your homepage been hijacked? Does it open to a search page that you did not specify?


• pop-ups driving you crazy? - Do they appear as soon as you turn on your computer? Are they for adult websites? Some spyware will bombard you with popups that aren't even related to the website you are visiting.


• browser settings have changed and you can't change them back? - When you open up Internet Explorer does it open to a search page that you did not specify?


• new browser toolbars installed - but not by you? - Is there a mysterious toolbar installed on your browser?


• phone bill sky-rocketed - Do you see charges on your phone bill for adult websites or 1-900 numbers?


• unexpected new or new icons in your system tray? - Are there applications running on your computer that you did not install?

Now that you know a bit about what spyware is and how to tell if a computer is infected, let's get down to the removal process. First things first - backup your personal data! You should be doing this regularly anyway. Using Windows XP - Click Start >> All Programs >> Accessories >> System Tools, and then click Backup to start the wizard.



To remove spyware/adware you need two programs (maybe three). The two I recommend are SpyBot Search & Destroy and AdAware. SpyBot Search & Destroy can be found here www.safer-networking.org. AdAware can be found at this address www.lavasoftusa.com. The Third is an application called HiJackThis (which can be found here www.spywareinfo.com). Be warned, HiJackThis is for advanced user, the is a powerful tool! Consult the program's documentation before deleting any files, you could cause serious system damage if you do not know what you are doing.



Download, install and update the programs. Then restart the computer and tap the
F8 key on your keyboard as the computer begins to start - this will give you the
option of starting in 'Safe Mode'. You will see a few other options here as well.
For this particular job select 'Safe Mode'.

What is Safe Mode? Safe Mode is an alternate way of starting a computer using only the bare minimum of resources. It's a troubleshooting tool built into indows based operating systems.



If a computer is running in Safe Mode you should see that the screen resolution looks 'off', which is perfectly normal, and you should see the words 'Safe Mode' in the corners of the screen.

Run full system scans with both programs. They should be able to find the problems and remove them. To learn how to remove a particular item using SpyBot and/or AdAware consult each program's 'Help' documentation.



Next, restart the computer in "normal mode" and see what happens. If you are still experiencing problems start the computer in Safe Mode again and run the spyware scans once more. Make sure that the spyware definitions are up-to-date for each program before using Safe Mode. This will give you the maximum advantage when trying to detect and remove malware.



There is another tool built into Windows called MSCONFIG which I use quite often when troubleshooting spyware.

What is MSCONFIG? MSCONFIG is a special tool built into the Windows operating system (not included with Windows 95 and 2000) called “Microsoft System Configuration Utility” or “MSCONFIG”. MSCONFIG is designed to help you troubleshoot problems with your computer such it being slow, frequent crashes, as well as to remove spyware and viruses. As you may already know, running many programs at once will cause your computer performance to slow down. Don't forget, Windows also runs many programs in the background that you never see, you can use MSCONFIG to prevent some of programs from loading at startup which can greatly increase the speed at which your computer runs.

To access MSCONFIG Click Start, then click Run and type “MSCONFIG” or "msconfig"
(without the quotes), in the window that opens. Once MSCONFIG opens you will see
6 to 8 tabs (depending on which operating system you are using) which provide
access to various parts and processes that Windows uses. The tab you are interested
in is on the far right, it s called “Startup”. It controls which processes start
automatically when Windows loads. If this is the first time you are running MSCONFIG
you may notice that the list of start up items is quite long. You will see four
columns: the first is a column of check boxes, the second is the name of start
up item, the third is where the item is located on the hard drive and the fourth
is the registry location.



To remove an item from the start up menu remove the check mark from the corisponding check box. To instruct a process to run on start up put a check mark in the box.



By now you might be asking, "Which processes are safe to remove?" This is where it gets tricky. An easy way to determine whether a startup item is needed or not is to do a Google search for the process name and see you if you can safely remove the item from the start up menu. Many autostart entries are crucial part of Windows XP, for example: Userinit.exe and Explorer.exe, so don't remove these.



Once the computer is clean you should follow these tips to keep spyware and adware off your machine.

• Install anti-spyware software before you get infected


• Install a software firewall - a firewall acts as a barrier between your computer and the Interent, you can find many free for personal use - software firewalls. ZoneAlarm is a great free choice and can be found here www.zonelabs.com.


• Keep Microsoft Windows Up-To-Date - with Windows Update. Microsoft often releases software patches which you can download and install to help prevent malicious software from being installed on your PC.


• Stay away from questionable Websites! - you know what I am talking about!


• Use a secure Web Browser - such as Mozilla Firefox

When troubleshooting a computer with spyware problems the most important thing is to remain patient. I have personally removed over 30,000 infected files from computers over the past two years. I have had a 100% success rate thus far using the methods described above!



Good Luck!

Author: Michael McKennedy - http://www.MalwareSolutions.com



Resources:

http://www.malwaresolutions.com/what_is_spyware.html

http://www.malwaresolutions.com/tools_spyware.html

http://www.malwaresolutions.com/how_to_remove_spyware.html

http://www.malwaresolutions.com/how_to_use_msconfig.html

http://www.malwaresolutions.com/how_to_backup_files.html

Free Anti-Spyware Software

Free Anti-Virus Software

Search Malware Solutions

Spyware Problems? Search For The Solution

Virus Problems? Seach For The Solution

MalwareSolutions.com

The new website has gone live. It's been completely rebuilt again. I am getting great results with the new format and layout. Seems like people are having a much easier time locating the free anti-virus/spyware removal software and advice.

If you are looking for a way to remove viruses for free go here for free anti-virus software

Trying to get rid of spyware? - click here for free spyware removal tools

Sunday, June 25, 2006

I have been focusing most of my attention on websites. This is one that I have been actively working on www.creativequestvt.org

My own site is coming along as well. I have been focusing on gathering as much information about virus removal and free anti-virus software as I can find. The goal is to enable users to help themselves in removing viruses and spyware from their infected computers. Another focus is to look at the preventative side of things. Not only do I want people to be able to repair their computers for free that's why we offer free virus repair plus many links to free resources about removing viruses from an infected PC. The goal is to educate about viruses and spyware that's why we have added a few new pages What is a virus? and What is spyware?

You can now search our site for free virus removal tools - search by virus name.


I have been getting a lot of feedback lately from people who have found all of this free information useful. Therefore, here is a sitemap of VPC Solutions.com.

home

    what is spyware?

    what is a virus?

    services

        repair

        installations

        web design

        security

        existing clients

                client projects

        contact information

        legal information

        privacy statement

    shopping for software

    free downloadable tools

        free antivirus software

        free virus removal tools

        free firewalls

        free microsoft tools

        free misc tools

        free spyware removal tools

        free web browsers

        contact information

        legal information

    free Windows resources

        forums

        networking information

        spyware information

        anitivirus information

        Windows information

        contact information

        legal mumbojumbo

    VPC Solutions blog

    VPC Solutions forum

    search

    news archives

        2005 News Archives

Monday, April 11, 2006

Busy, busy, busy - too busy to blog! Over the past few months I have been keeping busy with websites. I completely overhauled this site The Spirit of Ethan Allen III. I did some more work on this site Welcome Kitchen Catering. I started a new site for the Creative Quest Summer Arts Day Camp and I got a call over the weekend about building a site for Onion River Chiropractic.

I worked on one computer (another Dell) where the client suspected spyware, or possibly a worm. The only sign of anything wrong (according to the client) was that the computer was running slowly. I picked up the machine, brought it to my shop and began the usual process of checking for problems (check startup menu, scan for viruses, spyware and adware etc..). As usual there were a few spyware findings but nothing critical - just tracking cookies. The end result was $50 in RAM (giving the machine a total of 512 MB) and two hours of my time and the machine is running perfectly.

I worked on another Windows 98 machine. This one had some problems, nothing major, just some spyware. The complaint was that the machine was spitting out errors when attempting to run some kids games. I don't mean graphics intense games or anything that is demanding of resources. The machine wasn't even going to have Internet access. I cleaned the machine removing five or so spyware applications and then I was tasked with installing about eight kids games -easy money! I picked that one up on a Sunday evening and dropped it back off on Tuesday. The clients were quite happy.

I was supposed to pick another computer up yesterday. I got a call over the weekend from a woman who didn't know what the problems were. I asked her if she could tell me what operating system she was using and she didn't know. When I asked what kind of problems she was experiencing she said that it was slow and the cd drive would not open. I was scheduled to pick it up yesterday at 3:00 but early in the morning I got a call from her husband who left me a message stating that he did not want to waste a "few hundred bucks" on a machine that is obsolete (about three years old!) so he went out and bought a new one. He said, "I am just going to throw the other one away!" I hope that he really didn't mean what he was saying. I hope her recycles the thing!

Also yesterday, I went to a house to troubleshoot a problem with a game "The Battle For Middle Earth II". The problem is that when the game is run it crashes and reports that there is a problem with game.dat. Upon investigation (Google) I realized that this computer is not alone! There are many users experiencing the same problem. It looks like the solution is going to be a video card driver update. The computer is lacking access to the Internet so I was not able to update the driver but I was told that they would be getting Internet access soon. The sad part is that this poor kid saved up $50 to buy the game and he has not been able to play it!

Monday, January 16, 2006

I created the VPC NewsLetter this weekend. The first mailing went out yesterday. You can sign up for it by clicking here.

Tuesday, December 27, 2005

The Gateway I was working on on Monday is working fine. That poor machine was loaded with problems and after four or five hours of work it seems to be running fine. The hardest part was removing Zone Alarm from the system (which is not completely gone yet). I was in the registry deleting. I removed half a dozen files relating to Zone Alarm. I searched and searched some more and could not find anything else to delete. I decided to try installing Zone Alarm again - no - did not work - got the same error "Validation failed for C:\WINDOWS\SYSTEM\VSINIT.DLL". Since the machine was hooked up to my DSL connection -sitting there online waiting to get infected I found a way around the Zone Alarm issue (see -- Monday, December 19, 2005), I was able to install Outpost Personal Firewall. Sure, it's a trial version but it will keep the "bad guys" out for 30 days!! Beyond that, the machine is running smoothly! The client will be more than happy!



In regards to Windows 98 - CRX model. Last night I connected the machine to my phone line, booted and noticed Net Zero on the desktop. Guessing that this was the service the client was using to "try" to get online I ran the application. Once I got to the final screen and was about to attempt a login to the network - CRASH!!!! The machine reset itself!! I waited calmly. The monitor screen remained black, the only words on it told me that the monitor was working but to check the cable. I knew that the cable wasn't the issue! I tried rebooting - not a chance!!! The poor machine lie dead in my shop, the fans humming but not boot beeps, nor sound of the hard drive. I unplugged the machine and sat dowh to think.

Did the hard drive just die?? Should I try another monitor? Do I really have to remove hardware one piece at a time until I figure out what is causing this death?? If so, the first piece I will look at is the modem! It was clinking and clanking around in the tower. Maybe it's causing the system not to boot. That would be okay! I would simply replace the modem. But, if it is the hard drive or something else?? I don't think that this client wants to put much money into this old computer. At this point we are looking at about $100. You start adding hardware plus my time and soon you could buy a new computer!!

Hopefully I will pull the machine apart, take out the modem and the machine will boot! If not, it's time to call the client!

I'll try to keep you posted!

Thursday, December 22, 2005

The Subject: Windows 98, a machine that has passed through many hands. It’s a CRX brand computer; ancient, dusty and probably really messed up.

The Problem: As vague as, “I think that it can’t get on the Internet?” and “The mouse doesn’t work right.”

I looked down at the back of the machine to see what kind of network connection was there and I noticed something quite peculiar. There wasn’t a modem attached. Oh, there was a space where a modem once rested and functioned properly but apparently the modem got pushed inside the tower and slid around every time someone moved the case.

I sat the computer down in my shop. I moved the red toolbox a bit closer and began to look towards the gray beast of a machine for some sign of how to open it up. I saw a few screw-looking things in the back but noticed that they were not screws. They were more like rivets. In other words, they would not come out with a mere screwdriver.

I began to poke at the top of the case. I looked at the front. I closely examined the sides to try to get some clue as to how it opened. Finally, I pried the front plastic piece off and noticed six screws holding the sides of the tower on. I removed three; slid the metal cover off to see the poor modem lying there in the dust. I picked it up (the modem) and slid it back into place, grabbed a screw from the toolbox, secured it and reassemble the tower.

I booted the machine; it was quiet compared to the one I worked on yesterday. It loaded fine. First thing, ran msconfig. Nothing jumped out at me. I installed Spybot Search & Destroy, updated the definitions file and ran it.

The results are in: 42 problems found in 19:24 minutes – all removed.

Some of the problems found: Advertising.com, Alexa Related, Avenue A, Inc., Bfast, Bluemoutain, ClickAgents, Commission Junction, DoubleClick, Engage, Inc., Enliven, Excite, FastClick, Flycast, HitBox, HitsLink, MediaPlex, PornTracker, SexTracker, TargetNet, ValueClick, and WebTrendsLive.

I ran msconfig and removed some unnecessary startup items. Rebooted. Edited the startup menu - shows a significant decrease in startup time! I will run a defrag too. Just to speed things up. 1% Complete ………..3% Complete……………………..4% Complete……………………………………………………5% Complete……………oh, never mind. I could go on like that for quite a while.

It’s 11:07 and defrag is at 10%

Monday, December 19, 2005

11:35 pm
I just finished with the Dell Laptop. Here is what I did to complete the job: Reinstalled OS and drivers. Installed AVG AntiVirus, Microsoft AntiSpy, Zone Alarm, SpyBot Search & Destroy, Updated Windows to SP2 and installed all other security patches and fixes. Turned on Windows Update. Installed Microsoft Office, QuickBooks (and imported the client’s data) and the Internet Connection software and all is well. It’s like a brand new computer just out of the box

Now I am in my basement in working on this old Gateway I picked up tonight. First impressions, what a piece of crap! I just booted, popped in a cd full of helpful goodies and attempted to run AdAware when suddenly that old familiar blue screen jolted me. InCd crashed! This is Windows 98, supect: loaded with spyware and/or adware.

I'm letting it run through a quick disk check after the abrupt shutdown. By the way, between the buzz of this laptop and the hum of the extra-large pc sitting on the table to my left sounds like an airplane heading straight for my head.

Windows is booting - "Validation failed for C:\WINDOWS\SYSTEM\VSINIT.DLL" - click ok to cancel. I'll try Ad-Aware again -found 4 New Critical objects. I noticed, running in the system tray was the icon for 180 Search Assistant.

Scan is complete 259 - could not remove 4 and guess who they belong
to, 180 Search Assistant. Ad-Aware reported that on reboot it would remove the 4 infected files. I am running SpyBot Search & Destroy right now. So far no problems reported. Spybot is checking against a list of 32,660 posible known threats. It's 11:51 pm

11:58 PM
SpyBot has hit the motherload. Here is what has been found:
Alexa Related, 180Solutions.SearchAssisant, CoolWWWSearch. WinPro.32, DyFuCA.Internet Optimizer, Huntbar, n-Case, WildTangent, RealDownloadExpress, NewDotNet, MyWay.MyWebSearch, ISearchTech.YSB, ISTech.PowerScan, GoldenPalace.Casino, GAIN.Gator, FunWeb Products, EffectiveBandToolbar and maybe a few that I missed to jot down - 69 problems reported.

12:03 am - 12:08: 69 problems removed.

Installing AVG AntiVirus....Rebooting...No Viruses found during AVG's boot scan.

AdAware is checking the system right now. I don't think that AdAware will find much. Spybot just cleaned it out.

If I could install Microsoft AntiSpy (doesn't run on Win98) I could seal the deal. Actually, HiJackThis followed by a clean bill of health by AVG. Okay, nothing found by AdAware - E Trust EZ Firewall error - OK to cancel.

1 Virus spotted - 12:22 AM - Trojan horse Downloader.Generic.ML location -- C:\NULL (file name NULL)

This computer is so loud!! 2nd virus found - Trojan horse Dropper.Exebind.W C:\Windows\System\in10bfs.dll - it's 12:27 AM I'm beginning to fall asleep. 2 more viruses found these two are stored in C:\Windows\TEMP folder. There are two versions of Downoloader.Istbar - Downoloader.Istbar.CE and Downoloader.Istbar.AF

12:38 - another found: another Downloader.Istbar.9D, this one is sitting right there in My Documents.

We are up to a total of 5 viruses and I am going to bed....12:50 AM

Woke in the morning to find the computer stalled. AVG reports that the viruses had been removed. I rebooted and attempted to install Zone Alarm - error appears - "cannot validate C:\WINDOWS\SYSTEM\VSINIT.DLL" - an online search tells me that Zone Alarm needs to be uninstalled completely before it can be reinstalled.

Okay after much research I figured out what part of and possibly the entire problem might be. It appears that eTrust EZ Firewall might have link here been distributed Zone Alarm as part of it's software package. I found this article on how to uninstall Zone Alarm.

It seems like that is what needs to be done. Since I know that the client did not backup the files I will call her and tell her that I need to edit the regristry and there is always a chance that something undesirable could happen. I always think of a computer being somewhat delicate after being "beat up" in the process of extracting lots of files that don't want to go away. Either way, I will end up backing up the data but I really wish that people would at the very least know the how and why of backing up data. It only takes one data loss for a person to "learn the lesson".

Saturday, December 17th, 2005

Yesterday I got a call. The problem: client could not open QuickBooks nor print from any application. The computer: Dell Inspiron 5100 - laptop, dialup connnection. No firewall running, AVG AntiVirus not updated, Windows running SP1 only!!!

I logged on under the default user - no password protection. After Windows came up I began to see SpyBot Search & Destroy warnings popping up stating that uwtrevuxuunh.exe was trying to add itself to the startup menu. A quick Google Search resulted in no information for that particular file. As I denied the action another would popup, each time changing locations as well as file name. The CRASH!!! - Memory Dump error – blue screen!!

I booted to safe mode using F8. I was able to log in under the admin account.
Started Microsoft AntiSpy – found 148 registry keys infected, 43 files and 19 different viruses, adware and spyware running. A few of the culprits were:

- Rbot
- Delfin.Media
- Adware.PEDev
- SdBot.tsecure worm
- 180Solutions Search Assistant
- Media Motor
- Ist.SideFind
- WebHancer
- Shop At Home
- Trojan.Startup.NameShifter.BT

Removed all of them.

Rebooted, same SpyBot warnings. Ran AVG AntiVirus – blue screen error - CRASH again!!! IRQL_NOT_LESS_OR_EQUAL was the specific error.

Rebooted to safe mode
Ran msconfig edited the startup menu - removed 3 entries
Ran AdAware found – 40 items

Ran SpyBot Search & Destroy - found 42 problems including registry settings to disable AntiVirus, Firewall, SP2, etc…rebooted

Ran in safe mode – removed Temp Internet Files, cookies and history
Ran AVG AntiVirus – no infections found
Turned on Automatic updates
Ran SpyBot again – found 10, removed 5, needed to reboot to remove others
Rebooted – SpyBot ran found 16 problems – removed 10
Rebooted – still getting errors
Rebooted – msconfig – removed 1 entry
Rebooted – blue screen
Last Known Good Config – rebooted – errors
Booted to safe mode installed updates for Ad-Aware and SpyBot
Ran AdAware – found 87 problems removed
Ran SpyBot – found 20 – removed 16 – 4 resident in memory must reboot
Rebooted – SpyBot ran found 6 problems removed 2 could not remove 4
Rebooted – Safe Mode – stalled
Rebooted – Safe Mode – tried to backup Quickbooks to ThumbDrive – failed
Rebooted to blue screen
Ran chkdsk /f – in safe mode found error rebooting to fix
Rebooted tried to run QuickBooks in safe mode – got blue screen
Rebooted – safe mode – ran QuickBooks – blue screen
Might have been able to backup QuickBooks to Thumb? but no way to verify data....
Rebooted several times more – blue screen
Booted to safe mode -
Ran QuickBooks - created a backup - was able to save to the Desktop and then drag the file to the thumbdrive!!!
Client is going to neighbor's house to install QuickBooks on their computer, then she will try to restore QuickBooks using the thumbdrive backup file. If this works and all data is current I will pickup the laptop and reinstall the OS. Four hours spent on this one so far. I will wait until tomorrow for the call. I hope the data is verified as the most current!!

Sunday, September 18, 2005

Re: Dell Dimension 2200 - This machine is still sitting in my shop. It was preloaded with Windows XP Home Edition when my client purchased the machine. I called him to see if he could locate the software for it. He seems to think not. I looked through the software he gave me when I first picked up the machine and it's not there. Three days ago I called my client to let him know that I am up against a wall with this one. I have two options, 1) get the original system recovery disk 2) call Dell and order a replacement system recovery disk.

I have worked on several computers over the past week. One was another Dell, this was the 4600 Dimension with Windows Media Center installed. I picked it up after working at my new job Dealer.com on Thursday. My plan was to clean it up that night and return it the following morning. Instead I found out that this particular Dell would not work with any one of three monitors that I have. I joined a chat session with a Dell support person to find out what the deal was. First he told me that there was a problem with the video card. Then I explained to him two things, 1) the machine has onboard video (built into the motherboard) 2) the computer see the clients Dell monitor just fine. The support person insisted that the machine does not have onboard video - I told him that I was starting into the belly of it and indeed, the VGA port was built into the motherboard. What he was talking about was the tv tuner card. Anyway, after finding out that this Dell would only work with a digital monitor I switched my flat panel display to digital and booted the machine. Again, it would not recognize the monitor. The support person from Dell eventually disconnected me from the chat. I guess that's what happens when they can't answer a question.

I returned the computer to the client the following morning and set up the machine with his monitor to get a feel for what the original problem was. He was complaining that his DSL connection was slow. He was correct. I ran an AdAware scan and removed twenty five problems but none of them were critial. Eventually I ran out of time due to a previous commitment. I told him that I would be back after the weekend to give his computer a full "once-over".

I worked on a few other machines but their problems were similar to those you can find in previous posts.