Antivirus Pro Infection / Worm Infection / Conficker type infection

When you boot up the PC you are faced with a splash screen that looks like windows but is asking for you to purchase an Antivirus program.

The worse one at the moment employs a ‘Conficker’ type worm that spreads through the network compromising all PC’s and servers.  Cleaning one will likely cause it to be re-infected once the shares are re-instated, and even in some case when they are not.

Pages like http://www.techprotectltd.com are used to propagate this virus around the internet…they are embedded in advertisements on legitimate sites and you may even stumble upon it when looking for anti-virus software. 

This virus is a nightmare. 

It creates its own shell so you think you are booting into windows but you are not, and there is nothing you can do when in this state.

If you can, then it’s probably not this virus and you should be able to run system restore or malwarebytes, there’s plenty of free cleaners available.

Only use these instructions if you are not able to get into safe mode, not able to system restore not able to install and scan any anti virus software as it is an extreme solution and only used when all else has failed.

You will need another PC that is not infected to be able to carry out these steps.

This must be carried out on a PC that has been removed from the network, if there is an affected machine on the network it will simply reinfect the rest after a period of time. So do them 1 at a time, once complete turn it off and move on to the next one.

Download Hirens BootCD follow the instructions to burn the ISO to disk and use this to boot up your infected PC.  If your PC does not boot from disk you will either have to search google to find out how to change the BIOS to boot from CD or find out the keypress to prompt   (DELL for example is F21)

Boot into Hirens Mini XP feature and open the browser. 

Download Autoruns.

Autoruns needs to be set to scan an Offline Registry file.  So choose file and choose ‘Analyze Offline System’.  Choose your operating system folder and select the windows folder….it should pick the user folder automatically.

autrunsoffline

This will load your registry and show in yellow the suspicious items.

 autoruns

 You should right-click and ‘jump to image’ to delete the folder.  And delete the entries from in here too.

Next use the Hirens built-in ‘Registry Editor PE’.  Open the Hirens Utils from the desktop and choose programs from the menu the registry edit PE.  Choose the operating system drive as you did with autoruns (you may need to reeboot into Hirens again as autoruns sometimes locks the software hive).

Go to > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ and make sure ‘shell’ is set to explorer.exe, if not change it.

Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit and makes ure this is only C:\WINDOWS\system32\userinit.exe in some occassions I have seen an addition to this that can lead you to the folder where the virus resides…delete the folder too!

You should now be able to boot into windows safe mode. (Hit F8 on startup).

You can download malwarebytes free and clean up anything else that may have been installed.

This virus disables system restore and windows update, it also screws up downloads through your browser so you may get this when trying to download anything.

containedvirus

Rename the windows defender folder to .o.d in c:\program files\windows defender.

You can then download fine.  You can also try changing the key in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments to ‘1’

Check windows updates, make sure it is active and running.  This virus sometimes changes reg keys and disables BITS so it won;t work.  Go to services and check that BITS is active, if its missing you can add it.

open RUN as admin then type:

sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto

BITS will appear in services, if you cannot run it add this reg file (windows 7 only).

I would run malware bytes again just to be sure.

Using POP on Office 365 when your client does not support SSL.

Just thought I’d add this, been working on a document that should help with pop connectors on server 2003 and any other clients that do not support SSL that outlook.com requires.

You can download and install a program called stunnel which listens to port 110 and 25 then creates it’s own SSL tunnel and sends the mail for you.

It seems to work about 60% of the time for me, some machines have other software monitoring these ports and you can only bind 1 service per port so it won’t work.

Here it is :

Download Stunnel 4.53 or the latest version  from Url http://www.stunnel.org/downloads.html

Run Installer and select all options for server Installation  Self-signed certificate tools is not required if installed on client installation IE XP; Vista or Windows 7

Once installed you will be presented with a dos screen

Fill in has much has you can (I just put UK for them all apart from line 6)

1)    Country name
2)    State or Province name
3)    Locality Name
4)    Organization Name
5)    Organizational Unit name
6)    Common Name (full name which is computername.domain.local)

Goto all Programs then stunnel and select edit Stunnel.conf

Select all data and delete

Paste this in:

# GLOBAL OPTIONS
client = yes
output = stunnel-log.txt
debug=4
taskbar=yes
cert = stunnel.pem
# SERVICE-LEVEL OPTIONS
[POP3 Incoming]
accept = 110
connect = pop.outlook.com:995
[SMTP Outgoing]
protocol = smtp
accept = 25
connect = smtp.outlook.com:587

Goto all Programs then Stunnel and select in this order

1) Service Install   (this will allow it to start every time the server restarts)
2) Service Start
3) Service Run

then run Stunnel program itself

Last step open exchange (or any other client) and navigate to pop connectors and update pop3 mail box email server for any mail box that has been migrated to office 365 should now have 127.0.0.1 for the mail server and username updated to the full email address

If all goes well customer will now be receiving email back into their mail box.

0X800CCC0B

Your outgoing mail settings are wrong, even if nothing has changed best to check them.  Every mail provider requires different outgoing settings and some change them without telling you so check with your provider and make sure your account is correct.

Settings you want to check for outgoing are the SMTP authentication settings, port numbers and security type.

Email Error Code 0x800CCC0E

Error 0X800CCC0E simply means your mail client cannot connect to the mail server.

Can you get web pages?  if not then it’s not an email problem, you are not connected at all and you need to investigate that instead.

If web is fine then make sure you have typed the outgoing mail server name correctly.

If it still isn’t working then try and telnet the server.  If this fails then it’s a firewall issue or the email server is down.

Kill your firewall, try again…if this works then find out how to configure your firewall to allow the server.

Not sure how to do any of this? feel free to ask in comments.

Slow PC? How to speed up and optimize.

Slow PC? How to speed up and optimize.

There are millions of answers to this question on-line…if you’ve found mine you don’t need to look any further.  I have no interest in selling you software, hardware or promoting optimization tools or built in operating system software as I am not affiliated with anyone other than myself.

All I can advise is what has worked and continues to work for me and for me the simplest solutions are always the best.

This guide makes some assumptions about the reader, this is based on my experience with a vast number users experiencing these issues.  It will be aimed initially at the IT challenged and move on to include more technical advice…so apologies if it doesn’t fit with you immediatelly…it is a guide for all levels.

What is slowness? What is your interpretation of slowness? What expectations have you set regarding the speed of the PC? what makes you think it is slow?

Before we even talk about the PC, you need to be asking yourself these questions; have you just came back from an internet cafe, opened you PC and it’s sluggishly responded in its usual sloth like fashion.  Maybe you nipped into PC world to price a new laptop and were stunned by how fast the windows responded…then you got home…and sat there squeezing the mouse with frustration.  This doesn’t really mean your PC could have a problem, it just means your PC is lower specification than you want or need.

To use the old car anology, a mini and a ferrarri, both are cars…but

You have to be really honest with yourself and maybe face up to the fact that your PC is past it.  There are tools available to make the transition from one pc to another quite easy.  I’ll write another blog about that soon and link it here but in the meantime look into microsofts easy transfer wizard, there is already plenty advice available if you ask google.

When is it slow?

Booting up? Opening windows? trying to get a webpage? downloading mail? All areas of possible slowness, but are they all related to your PC? NO.  If it’s slow opening a webpage, watching youtube and downloading mail then your connection is slow, this is nothing to do with the PC…and no amount of ‘interent optimisers’ will fix this, in fact they serve to actually slow the PC down while leaving your connection as rubbish as it was before.

However if the internet window takes ages to appear, outlook hangs for ages or slow booting up….that’s a PC problem.

Just show you how confusing this can get heres an example; if you have an old printer that is no longer connected and you open microsoft word or excel it can hang for ages.  This is due to word asking the default printer a question, if the printer doesn’t respond it waits for an answer, and waits, and waits.

These are some of the nuances in fault diagnosis, and there are a lot.

This article won’t help you if you have problems with individual applications.

IT Services

If you can’t be bothered then call an expert…of which, there are many.  PC world? friend from the pub? cousin of an aunt? guy up the high street? All of the above!  There are IT specialists around every corner and it all comes down to how much do you trust these people to fix the computer quickly and for as little money as possible…and thats the problem, you just don’t know.

I’ve not shopped around, I don’t need to.  But to give you an idea of one of the cheapest big brand names without plugging it to you (too much) you could look into IT Support Manager.  For price and level of support you can’t really go wrong with this .  UK ONLY

But if your interested and want to fix it yourself then read on.

So why is it slow?

A PC can slow down for many reasons but can be simply put into two problem categories..hardware and software. ‘Well thats obvious’ I hear a nerdy geek saying right now but to some folk it aint…and it helps me section my blog.

To understand what type of problem you have it’s best you have an understanding of what’s going on inside your PC!

I don’t really want to get too technical here, but I do want to make sure you have some idea of what components we will be looking at and what tools and skills we need to check they are working.

The PC is made up of several hardware components that can all contribute to the problem.  These are the parts I am interested in:

Processor – Hard Drive – Memory (RAM)

Thats it. So what are these parts, and what do they do?  google it….i.e http://www.lowter.com/article/pc-parts

Use your eyes.

The Processor is suseptable to heat, the hotter it is, the more likely it is to fail to calculate the information it receives, causing it to retry and retry.  Hard drives and memory can be affected as well although not as much, so the easiest thing to do is have a look at the external casing, particularly the air vents.  Are they clogged?  then the inside of your PC could look like this..

I hope I don’t really need to tell you that this is a problem.  Get some compreesed air in a can, a hoover at the ready and clean that crap off.  If you don’t want to, take it to a shop.  DO NOT, whatever you do, stick your hoover in there and start sucking the memory off the board, use a can of air.

Hard drive faults are diabolically hard to diagnose, in many cases you really need some intuition to know when a hard drive is failing, every scanner you run, every chkdsk, every seagate tool you’ve downloaded says it’s fine but still programs take ages to load, windows takes ages to boot and you keep getting errors.  Hard drive failure is a real problem and can happen at any time without warning.  I’ll cover testing later.

Memory can be tested by using software and is really cheap to replace, the errors produced by failing memory are easy to spot and pretty specific, we’ll cover later but can cause lots of strange beeps that come from the PC.

Don’t ignore the warning signs!

  • The fated blue screen of death. (google it)
  • PC stops responding, or completely freezes for longer than a few minutes,
  • PC turns off for no reason.
  • PC takes several attempts to boot.

If the PC is also running slow and doing a combination of these things it is without any doubt a hardware problem.

If you haven’t backed up your highly important data to another drive then do it and do it now, your PC could literally stop working at any minute, your data will be lost and it could cost hundreds to recover!

All backed up?? good.

I’m going to stop discussing hardware here.  If you are afraid to open the unit or don’t have any idea how to replace memory or a hard drive then take it to a shop, your stuffs backed up, you have little to lose.  There is no point in testing if your not prepared to fix it yourself.  For more experienced users I’ll cover this at the end.

A final hardware check.

Load the PC into safe mode.  The most common way is to tap F8 as soon as you turn the PC on at the power and choose safe mode from the list.  If this doesnt work search google for your PC make and use ‘safe mode’ as the keyword.  Does it go into safe mode? no? probably a hardware fault.

If it does go into safe mode and everything appears to be running nice and fast then there is hope so read on.

Check the resources.

Before going any further it’s important to make sure your not flogging a dead horse.  Use the task manager to see what’s going on in the background and see how much resources you are using.  There is a lot of info here but you only need to check a couple of things.

You can find out about task manager here, it is by far the quickest and easiest way to find out real time information about what’s going on in the PC.

Check the CPU % usage

If it is high then we need to find out whats using the processor.  Click the processes tab and click the CPU column a couple of times to order it by the highest cpu usage.  Take a note of what is using the highest cpu (ignore system idle) and search google for it if you need to know which program it relates too.  Then read the section below about ‘clear out your startup items’.

Check the memory usage

If you don’t have enough memory (RAM) then the PC uses the hard drive.  RAM is very fast, the hard drive is not.  So if you run out of memory your hard drive will go crazy and the PC will slow to a halt.  AGain, use task manager and click the  performance tab.

Look at the ‘Physical Memory’ section and see how much is available compared to how much you have in total, if you hardly have any left them something is eating the memory or you simply don’t have enough.

As with the CPU, click the process tab and sort it by memory this time, you can clearly see whats eating it.

Upgrading memory is easy enough, it’s finding a compatable type that can be difficuilt.  Leave it to the professionals.

Software.

So no PC crashing, no BSOD, no errors relating to memory, just appallingly slow when being used…hey, it could still be hardware but lets follow the obvious stuff first.

Get cleaning!!

Windows XP users click start>control panel and open add/remove programs.
Windows 7 and Vista users click start>control panel and choose programs and features.

Remove every piece of PC optimization software you have ever installed, reg cleaners, Internet accelerators, speedy Gonzales freeware promising to make your pc run lightning fast and could be even faster if you buy the pro version…the whole lot, spare NONE.

Then go back through every item in this list and remove anything that you no longer need and remove it.

I am going to advise downloading a few programs during this speech.  I have been using them for years, they are free but when installing them make sure you untick the boxes that ask about bing bars, ask toolbars and other crap you get with free software, or you’ll end up with it installed and in your face….keep your eyes open!

Download ccleaner  (the free version) and run it and run the registry tool, fix everything it finds a problem with.  Remove ccleaner if you want but for me it has been tried and tested and is a great little tool

Clear out your startup items.

The startup programs directly relate to the icons beside your clock…do you have many? well, you probably don’t need them all, and you probably don’t need any of them apart from your virus checker on bootup…figure this out for yourself.

Run msconfig.  Winxp start>run type msconfig.  Vista or 7 click start and type msconfig in the search box.  Click the startup tab and have a look in the list.  The key to this is really understanding the fact that you might now know what any of this is, and neither do I but I do know what some of it is and thats the stuff I want to keep.

It’s probably tempting here to go ‘hmmm not sure’ but do not worry, this will not in anyway affect your PC booting up or functioning and it’s a simple case of ticking the box again if an icon you expected to see beside the clock doesn’t appear…so don’t be afraid, untick the lot if you want and restart the PC just to see if the performance has improved then tick each one, reeboot and experience the difference.

Defrag!

This is your drive fragged – 001001010001010011111111000010000111011110111111

This is your drive unfragged – 1111111111111111111110000000000000000000000000

Defrag it.

So hows it going so far?  you’ve done the basic software checks which really should be part of a routine and the more you do it anderstand the necessity the better you can maintain your PC.

OK im bored now i’ll finish it later

Windows Update stuck on startup on Vista.

This is a known issue, there is lots of forum posts and info about how to fix it so here is a summary for you and the steps that have always worked for me.

Turn the PC off, start it up while pressing F8 and choose ‘Repair your Computer’.

I would suggest system restore first.  If this is not enabled then use the command prompt:

  • Type C: and hit <enter> this changes the directory from X to C.
  • Type cd C:\windows\winsxs, and then press ENTER.
  • Type ren pending.xml pending.old, and then press ENTER.
  • Type regedit, and then press ENTER.
  • Select HKEY_LOCAL_MACHINE.
  • On the File menu, click Load Hive.
  • Locate the following folder:C:\windows\system32\config\components
  • When you are prompted for a name, type Offline_Components.
  • In Registry Editor, locate and then delete the following registry subkey:
  • HLKM\Offline Components\AdvancedInstallersNeedResolving
  • HKLM\Offline Components\PendingXmlIdentifier
  • Exit Registry Editor:

These subkeys may not exist…do not fret.

Once fixed run this fixit from MS to stop it happening again:

http://support.microsoft.com/kb/971058

And install this update…if you can.

http://support.microsoft.com/kb/949358

 

By davierus Posted in Vista

Highlands of Scotland Taxidermy by A R Taxidermy

With a lifetimes experience of wildlife in their natural habitat and 25 years in taxidermy Andy Russell has produced some magnificent pieces of art.

His newly built studio at Achany, Lairg, in the highlands of Scotland is the base for his recent work which has allowed the business to expand to accept new clients.

” Andys work is beyond attention to detail; what he does is natural, instictive and encompasses years of experience and knowledge of these native animals in their natural habitat. Each mount has it’s own personality and presence brought to life by a skilled hand, not just preserving the animal but the memories and the sentiment that accompanies it. ”

Andy works with his customers on commissions, rather than producing birds and mammals for sale.  All photos on this website are of previous commissions and are not offered for sale.

Andy combines the old traditional method of mounting birds, mammals and fish with modern methods and materials, producing a lifelike mount that is pleasing to the eye. Customer satisfaction is at the top of the list of priorities and he will work closely with his clients to ensure the finished product is what the client wants and that the work is completed within a reasonable timescale.

http://www.artaxidermy.co.uk/

Livemail overwrites, changes, modifies the body of emails in storage folders.

The indexing has become corrupt for that particular folder.  The messages themselves are still fine so if you locate the folder in question which resides in:

“C:\Users\ logon \AppData\Local\Microsoft\Windows Live Mail” for windows 7 or
“C:\Documents and Settings\ logon \Local Settings\Application Data\Microsoft\Windows Live Mail” for windows XP

or for the experts:
%homepath%\appdata\local
%homepath%\local settings\application data

Have a look in the folder for your account and the storage folders, find your folder in question and copy and paste it to your desktop.

Now open livemal and use the import feature from the top menu.  Find the copied folder and import all the mails.

You will have another folder in storage folders in livemail now called ‘recently imported’ with you emails in it.  You can use it from here or you can delete the old folder (in livemail) and drag and drop this in it’s place….you can also then rename it to whatever it was before.