Free Computer Consultant ………. Daily Insights

This week I had the distinctly disagreeable task of trying to clean a PC that was infected with primarily one trojan.

However, it attached itself to about every executable file on the system including the i386 directory copies of the XP CD; about 896 files in total that were uncleanable and therefore had to be moved to quarantine.

As you can imagine, the PC does not work too well for the most part. I will have to completely reinstall Windows. This could be avoided, of course, if the user had a USB drive that had a disk image made with Acronis True Image (Save 35% here) at any point before the infection.

The real problem was that this home user had ignored my stipulation to  get a quality antivirus program (she did not want me to do it at the time I upgraded her hard drive).

So, she’s been tooling about the internet with computer security software whatsoever.

Please, please make sure you are covered and that the antivirus signatures are up to date.

With most of these internet security suites, it is your choice if you want a software firewall or not and if you want a full complement of antispam, etc. (This is usually the difference between buying just an antivirus program and getting a suite, but some have middle ground).

Here is a list of quality antivirus programs/suites to choose from:

Eset is (currently) said to be the best antivirus. Firewall is optional purchase.

AVG has a free version, but the paid software is an upgrade.

Panda internet security is highly acclaimed.

Trend Micro has been a reliable option over the years for many of my clients on their home PC’s.

ZoneAlarm has always been known for their software firewall product that was pretty much the first of its kind. I have used this product in many small office situations.

Today I had the task of repairing a Windows installation on a computer whose RAM (memory) was becoming faulty and thereby corrupted the information (fortunately no data) on the hard disk.

Attempting a normal boot came up with the error that winlogon.exe could not run because (whatever.dll) was not found.

I had the recovery console loaded on the system, but trying to boot into that gave me and error of “\system32\hal.dll missing”.

I booted from a Windows XP CD (always have your Windows CD handy, if your computer didn’t come with one then shame on whoever sold it to you and run, don’t walk, to obtain one) and tried the recovery console from there and executed the command:

chkdsk /p

and that did indeed find and fix some errors; but alas, the system still would not boot.

My best option at that point was a Windows Repair Install.

Booting from the Windows CD I selected Install, then when it found the existing installation, chose to repair that installation as opposed to starting a new installation.

After that was complete, Windows XP did boot successfully, and with the exception of a few small customizations undone, the system was as good as before.

I then ran a test on the hard drive itself to make sure that it was not failing and found that it indeed was good.

I recommend upgrading RAM in your computer using quality memory from Crucial.com. You will get memory certified to work in your machine and tech support to back it up if you have any problems. And, if needed, warranty service should the memory ever go bad.

With Windows operating systems it is common practice to have to reboot the server or workstation from time to time just to straighten things out. Add to that the times you reboot because you installed or updated a program and you can be rebooting quite often.

Don’t Touch That Dial!

I think the narrator in the TV version of Batman used to yell that out, but I could be wrong. What I mean is this: Don’t reboot without considering that the computer may not come up after the reboot.

When was your last backup?

Before you reboot, make a quick backup of at least the work you know has changed since your last good backup. Also think about your contingency plan in case the server or workstation chooses not to come alive again.

It’s just a fact with computer hardware that any time it’s running, it might be the last time. Does this happen frequently? Thankfully, no. But over the last couple of decades I have received enough frantic calls when it hasn’t to warrant mentioning it here.

Then there is the Windows operating system.

Just last week a client called me to say that their Windows 2000 server had a BSOD (blue screen of death) with 0×0000007B “Inaccessible Boot Device” on the screen. Not good.

Everything was working just fine except that a vendor support person couldn’t get in with pcAnywhere (an old as the hills remote control program). Why they haven’t joined the 21st century by using a product like GoToMyPC for tech support access is beyond me. So, without thinking about the last 3 nights backups that did NOT complete successfully, they rebooted.

After spending about 3 hours following all of Microsoft’s suggestions and Googling for any other hints, I punted. With a Windows Server 2003 CD at arms reach I couldn’t justify spending any more time trying to fix Windows 2000.

Fortunately, Windows 2000 Server was all that was corrupt; the data was all good (sigh of relief here). This is a client that does NOT hire me to monitor their server and such items as backup – that may change. A new Dell PowerEdge Server has also been ordered.

So before you click on Start | Shutdown | Restart – ask yourself what you will do if it doesn’t restart; and do a quick backup first.

Every once in a while I will come across a computer that will not boot up but instead stops at a black screen of death (as opposed to a blue screen of death) that looks something like this:

This happens to show the system hive of the registry as being missing or corrupt, you might also see the same thing only with “software” replacing “system”.

Either one is bad news.

Microsoft’s answer is to boot with your XP CD and try a repair. What the repair process will hope to find is backups of these critical Windows registry files in %WINDIR%\Repair (Probably C:\Windows\Repair, but maybe C:\WINNT\Repair if XP was an upgrade from Windows 2000).

But as I show in the video down below, those files may not have been updated since Windows XP was installed – maybe a long time ago. If that is the case, you might as well plan on a complete Windows Reinstall, along with reinstalling all of your software programs and any special device drivers.

The solution is to be prepared with current, updated repair files. How, you ask?

Easy, watch this short video showing how you can make a system state backup that will update these repair files and even schedule that backup to occur automatically, say, once per week so that a repair can be quick and successful should this little tragedy ever befall your computer.

How and Why to Make a System State Backup

I have recently complained about Microsoft requiring a floppy drive to load a driver on Windows Recovery and installation. Well, though I haven’t had reason to try it yet, Windows Vista now allows one to load a driver from something other than a floppy drive – FINALLY!

VPN clients allow you to securely connect your workstation to a host network somewhere else. Typically, a firewall company (Fortinet’s Fortigate line in my case), support IPSec VPN’s to their firewall with VPN client software they supply.

Because of the tight integration between the VPN client software and Microsoft networking components in Windows, loading a VPN client from 2 or more vendors, say Fortinet and Cisco, isn’t a very good idea.

VPN client softwares have a nasty reputation of not playing well together. In fact, it has been known to happen that when you install a second VPN client on your PC, not only does neither VPN client work, but neither does the Microsoft networking to you local network.

In some cases, the only fix is a complete Windows reinstall. Ouch.

Enter the Virtual Machine. What if your need to connect to another network were limited enough that you could set up a simple Virtual Machine instance of Windows to connect to and access that other network?

Not only could you have multiple VM’s for multiple VPN clients so they don’t HAVE to play together at all, but the remote network could be less concerned about whether your PC has been compromised in some way? Yes?

So who needs multiple VPN clients? How about an accounting firm with many clients, high gasoline and other travel costs that make remote access appealing, and a typical lack of standardization between chosen firewall products among those accounting clients?

I have one such accounting firm as my client. I think I just found another use for Virtual Machines.

I wish I weren’t such a nice guy. A gal that works for one of my clients asked where she could take her laptop to for cleaning.

There wasn’t anyone I really felt comfortable recommending and I figured “how bad can it be?”

“Bring it to me”, I foolishly said.

It’s an IBM Thinkpad, which is good, with a Celeron processor, that’s bad.

Even though it has a Windows XP Pro license sticker on the bottom, XP Home is installed – Strike two.

And this thing is so polluted you can barely move the mouse pointer. There was no working antivirus software, although I finally found some program shortcuts for Norton 2003. No sign of the software though.

Internet Explorer is absolutely useless, well, more than usual. Unless you like infinite exploding popup windows. So after cleaning out the registry and everything else that was easy to find, I loaded BOClean antitrojan, antimalware and Firefox. BOClean has found only 1 item so far (and killed it).

Firefox runs, go to Google and do a search, no problem. Try to navigate to http://housecall.trendmicro.com and the program closes.

Using a USB flash drive I copied adaware 2007 (free version) and ran it twice. Found quite a bit and cleaned it. Now it refuses to run.

Using a USB flash drive I copied SysClean from another PC where I downloaded it. It gave me fits too, but finally I was able to make it run.

Also from a USB flash drive I copied the free antivirus from Comodo. It found nothing, although much had already been cleaned.

Searching for RootKits I used F-Secure’s Free (expires Oct 1st) BlackLight. It found nothing.

The persistent file I find, loading from the registry is PRX.exe in C:\Windows\System32. Googling it brought up nothing of any use.

I keep threatening to blast the whole thing, format the drive and reinstall Windows XP Pro from scratch but:

• I’m stubborn and see this as a challenge
• The owner says there is nothing she wants on the machine, but I’ve heard that before
• I can save C:\Windows\inf off to USB before I blast it, but I still fear the potential hassle of finding all of the drivers I will need for a laptop this old

Folks, surf wisely. Check out my User Behavior page on my website. Use SiteAdvisor. Run a competent antivirus program and BOClean for malware. Don’t open suspicious emails.

============

Update

============

• McAfee’s rootkit tool found nothing
• Trend Micro PC-Cillin would not install.. reported corrupt installation file. Installs fine on other, known clean, PC’s
• Navigating to Avast.com or AVG in Firefox caused the browser to immediately close
• Even if left unattended, at some point IE windows would open at a furious rate trying to go to www.llehs.com

Final resolution: Wipe Drive and Reinstall Windows XP.

If you own Dell stock and are less than pleased with the performance, I’m afraid that it’s partly my fault.

You see, it’s almost daily that someone asks me whether the remedy to their slow pc is to buy a new one.

“How old is it?”, I ask. If the answer is 4 years or less, then I can presume that:

• They probably have a Pentium 4
• They probably don’t have Windows ME
• They probably can add RAM real cheap (Rambus excepted)

Case in point over the weekend.  Pentium 4 1.7, 512MB RAM, decent 7200rpm hard drive. Windows 2000 Pro was installed, along with all kinds of picture and photo printer garbage. Ran like a hog with no legs.

I backed up all of the data, twice, and did a clean install of Windows XP Pro. Be innovative and you can pick up a copy of XP cheap, if not free. Possibly even legally

Ok, just kidding. I don’t recommend pirating software, but between extra open license copies, cheap OEM licenses, legitimate educational copies – you get the idea.

At 512 RAM, this machine didn’t even need any money spent on it.

After the clean install of Windows XP Pro and just the needed software, no extra garbage, and this PC came to life.

Unless you are running the latest and greatest high intensity software, chances are that a clean install (after 2 backups!) will give you back that new PC performance you haven’t had in years.