Wednesday, March 31, 2010

90 percent of Windows 7 flaws fixed by removing admin rights

Friendly Computers found this article very useful.

After tabulating all the vulnerabilities published in Microsoft's 2009 Security Bulletins, it turns out 90 percent of the vulnerabilities can be mitigated by configuring users to operate without administrator rights, according to a report by BeyondTrust. As for the published Windows 7 vulnerabilities through March 2010, 57 percent are no longer applicable after removing administrator rights. By comparison, Windows 2000 is at 53 percent, Windows XP is at 62 percent, Windows Server 2003 is at 55 percent, Windows Vista is at 54 percent, and Windows Server 2008 is at 53 percent. The two biggest exploited Microsoft applications also fare well: 100 percent of Microsoft Office flaws and 94 percent of Internet Explorer flaws (and 100 percent of IE8 flaws) no longer work.

This is good news for IT departments because it means they can significantly reduce the risk of a security breach by configuring the operating system for standard users rather than an administrator. Despite unpredictable and evolving attacks, companies can very easily protect themselves or at least reduce the effects of a newly discovered threat, as long as they're OK with their users not installing software or using many applications that require elevated privileges.

In total, 64 percent of all Microsoft vulnerabilities reported last year are mitigated by removing administrator rights. That number increases to 81 percent if you only consider security issues marked Critical, the highest rating Redmond gives out, and goes even higher to 87 percent if you look at just Remote Code Execution flaws. Microsoft published 74 Security Bulletins in 2009, spanning around 160 vulnerabilities (133 of those were for Microsoft operating systems). The report, linked below, has a list of all of them, which software they affect, and which ones are mitigated by removing admin rights.

Source: http://arstechnica.com/microsoft/news/2010/03/half-of-windows-flaws-mitigated-by-removing-admin-rights.ars

Monday, March 29, 2010

AVG Rescue CD Cleans Your Infected Windows PC

There's any number of great antivirus tools that help protect your PC from viruses, but what about when you encounter an already-infected PC? Friendly Computers found this article very useful and would like to share it with you.

If a virus or spyware has crippled your PC to an extent that it won’t boot up normally to Windows (not even in the safe mode), then using a bootable rescue CD could be the last resort before you reinstall the OS.

You could use AVG Rescue CD (now available to AVG free users too) in such situations to repair your infected PC.  It is a portable version of the AVG Antivirus and can be used as a bootable CD or USB flash drive.

There are four other tools are available in the package which you could use to perform some other necessary functions. They are:-

  • Midnight Commander
  • Windows Registry editor
  • Ping
  • TestDisk

    Here is the step by step guide for creating AVG rescue CD/USB flash drive and removing viruses or malwares with its help.

How to create AVG Rescue CD (for USB stick)

Following steps tell you how to install AVG Rescue CD files onto a USB pen drive. The steps for installing it on a CD would be a bit more complex because you would need to download the iso file and then burn it onto the cd and make it bootable. Doing it on a USB drive is easier though.

1. Download AVG Rescue CD (for USB stick).

2. Plug USB flash drive in the USB port of your PC.

3. Now extract the downloaded AVG rescue RAR file in the USB drive.

4. Open the drive by double clicking on it to see all the files inside it.

5. Locate the “Makeboot.bat” file and double click on it to launch it.

Warning: Never launch this “Makeboot.bat” file from any other drive other than USB drive. If you launch it from the system drive, it will make it unbootable.

6. A command line window will appear.

avg-rescue cd

7. Press any key of your keyboard. Wait for few seconds. After some time a message will pop up saying “The AVG rescue USB should be bootable now”.

How to Remove Virus or Spyware using AVG Rescue CD

1. Insert the AVG rescue CD (bootable flash drive in this case).

2. Go to the boot menu in BIOS settings.

3. Select the source (CD-ROM drive or Removable devices) you want to boot from. It will depend on the method you used to create the AVG rescue CD. In my case, I selected removable devices because I’ll boot it through  the USB flash drive.

4. AVG welcome screen will appear. Press enter key or wait for 10 seconds to boot AVG rescue CD.

avg-welcome screen

5. Accept the license agreement.

6. Run the update of AVG. You can update via internet. If internet connection is not available then you could update it from previously downloaded files(stored in your computer) from the AVG website. If there are no update files saved then you can’t update it. Proceed to the next step.

AVG-update

7. After updating, main menu will appear. Select “Scan” option (selected by default) and press enter key to start the scan process.

arl_menu avg

8. Choose between two options – scan the volume or scan directory.

9. Run the scan.

10. After scanning is complete, scan report is displayed on the screen. You can take following actions: Report file, Delete all, Rename all.

So that was how you use AVG Rescue CD to boot into Windows and clean it up.

Source: http://www.guidingtech.com/2083/avg-rescue-cd-virus-spyware-removal/

Wednesday, March 24, 2010

Long Live Your Laptop Battery!

Using laptop and trying to keep laptop battery working for as long as possible? Friendly Computers found this article very useful and would like to share it with you.

Laptop batteries are like people--eventually and inevitably, they die. And like people, they don't obey Moore's Law--You can't expect next year's batteries to last twice as long as this year's. Battery technology may improve a bit over time (after all, there's plenty of financial incentive for better batteries), but, while interesting possibilities may pop up, don't expect major battery breakthroughs in the near future.

Although your battery will eventually die, proper care can put off the inevitable. Here's how to keep your laptop battery working for as long as possible. With luck, it could last until you need to replace that aging notebook (perhaps with a laptop having a longer battery life).

I've also included a few tips on keeping the battery going longer between charges, so you can work longer without AC power.

Don't Run It Down to Empty

Battery settings in Windows 7. (Click for larger image.)Squeezing every drop of juice out of a lithium ion battery (the type used in today's laptops) strains and weakens it. Doing this once or twice won't kill the battery, but the cumulative effect of frequently emptying your battery will shorten its lifespan.

(There's actually an exception to this rule--a circumstance where you should run down the battery all the way. I'll get to that later.)

The good news: You probably can't run down the battery, anyway--at least not without going to a lot of trouble to do so. Most modern laptops are designed to shut down before the battery is empty.

In fact, Vista and Windows 7 come with a setting for just this purpose. To see it, click Start, type power, and select Power Options. Click any one of the Change plan settings links, then the Change advanced power settings link. In the resulting dialog box, scroll down to and expand the Battery option. Then expand Critical battery level. The setting will probably be about 5 percent, which is a good place to leave it.

XP has no such native setting, although your laptop may have a vendor-supplied tool that does the same job.

Myth: You should never recharge your battery all the way.

There's considerable controversy on this point, and in researching this article I interviewed experts both for and against. But I've come down on the side of recharging all the way. The advantages of leaving home with a fully-charged battery--you can use your PC longer without AC power--are worth the slight risk of doing damage.

Keep It Cool

Heat breaks down the battery, and reduces its overall life.

When you use your laptop, make sure the vents are unblocked. Never work with the laptop on pillows or cushions. If possible, put it on a raised stand that allows for plenty of airflow.

Also, clean the vents every so often with a can of compressed air. You can buy this for a few dollars at any computer store. Be sure to follow the directions on the can, and do this only when the notebook is off.

Give It a Rest

Removing a battery from a laptop. (Click for larger image.)If you're going to be working exclusively on AC power for a week or more, remove the battery first.

Otherwise, you'll be wearing out the battery--constantly charging and discharging it--at a time when you don't need to use it at all. You're also heating it up (see "Keep It Cool," above).

You don't want it too empty when you take it out. An unused battery loses power over time, and you don't want all the power to drain away, so remove it when it's at least half-charged.

Never remove the battery while the computer is on, or even in standby or sleep mode; doing so will crash your system and possibly damage your hardware. Even inserting a battery into a running laptop can damage the system. So only remove or reinsert the battery when the laptop is completely off or hibernating.

If you've never removed your laptop's battery and don't know how, check your documentation. (If you don't have it, you can probably find it online.) The instructions generally involve turning the laptop upside-down and holding down a button while you slide out the battery.

Myth: Refrigerate your battery.

Some people recommend you store it in the refrigerator, inside a plastic bag. While you should keep a battery cool, the last thing you want is a wet battery, and condensation is a real danger in the fridge. Instead, store it in a dry place at room temperature. A filing cabinet works fine.

You don't want the battery to go too long without exercise or let it empty out entirely. If you go without the battery for more than two months, put it in the PC and use it for a few hours, then remove it again.

Also, before you take the laptop on the road, reinsert the battery and let it charge for a few hours before unplugging the machine. Allow the battery time to get a full charge before you remove the AC power.

Heal a Sick Battery

Myth: You can rejuvenate a worn-out battery.

This isn't, strictly speaking, the case. You can't make old lithium hold more electrons than it can currently manage.

But if the battery is running out unexpectedly fast, or if your laptop is having trouble figuring out how much power it has left, you might be able to fix the battery's "gas gauge," so it at least gives a more accurate reading.

If you suspect the battery can't tell if it's charged or not, run it through a couple of cycles. Drain it of all its power (yes, this is the exception to the "don't drain the battery" rule mentioned above), recharge it to 100 percent, and then repeat.

But how do you drain the battery when Windows won't let you do just that? Don't bother with the settings described above. They're not safe (you might forget to change them back), they may not be getting an accurate reading, and they quite possibly won't let you set the critical battery level to 0 percent. (If they did, it would crash Windows.)

Instead, unplug your AC power and keep your laptop running (you can work on it if you like) until it automatically hibernates. Then reboot your PC back and go directly to the system setup program.

I can't tell you exactly how to get there; each computer is different. Turn on your PC and look for an onscreen message (one of the first you'll see) that says something like "Press the X key for setup." Immediately press the designated key.

It may take a couple of times to get the timing right. If there isn't enough power to let it boot, plug in AC until you're at the setup program, then unplug it.

Leave the notebook on until it shuts off. This can take some time (45 minutes on my laptop); setup uses a lot less power than Windows.

Once the PC is off, plug in the AC power, then wait a few hours before rebooting to Windows and making sure you've got a full recharge.

Repeat the process once or twice.

With luck and proper care, your battery will still be useful when you're looking for a new laptop.

Longer Life Between Charges

The tips above should lengthen the time before you need to replace your laptop's battery. But on a daily basis, we're far more concerned with another type of battery life: how long we can keep our laptop running without AC power. You may know most of the following tips already, but it never hurts to refresh (or recharge) your memory.

Dim your screen
Your laptop's backlight requires a lot of juice. Keep it as dim as you can comfortably read it.

Shut off unneeded hardware
Turn off your Bluetooth, and if you're not using the Internet, turn off your Wi-Fi receiver, as well. Don't use an external mouse or other device. And muting the PC's sound system not only saves power, it avoids annoying everyone else in the café.

Avoid multitasking
Run as few programs as you can get away with. If possible, stick to the one application (word processor, browser, or whatever) you're currently using, plus your antivirus and firewall in the background.

And if you're not on the Internet, you don't need those two.

Avoid multimedia
Save chores like photo editing and watching old Daily Show videos for when you have AC power. And if you must listen to music, use your iPod (or similar device).

Know when to sleep and when to hibernate
Choose Sleep or Hibernate depending on how long you plan to be away from the computer. (Click for larger image.)You need to think about when you want to save power by sending your laptop into Standby or Sleep mode, and when you want to hibernate it.

There's a difference. XP's Standby and Vista and Windows 7's Sleep modes keep your PC on, using some power, but less of it than in normal use. Hibernate saves the PC's state to the hard drive, then shuts it off entirely, so that no power is used.

On the other hand, Windows takes much longer--sometimes minutes--to go into and come out of hibernation. And those are minutes that the battery is draining heavily and you can't work.

XP's Standby mode isn't really all that efficient. If your laptop will be inactive for more than about half an hour, hibernate it. Otherwise, use Standby.

But Vista and Windows 7 do a much better job with their Sleep mode. Don't bother hibernating your PC unless you think you're going to go more than two or three hours without using it.

Myth: Adding RAM saves battery life.

True, more RAM means less hard drive access, and the hard drive uses a lot of electricity. But RAM uses electricity as well, and unless you're doing a lot of multitasking (not a good idea when you're on battery power), more RAM won't reduce hard drive use.

Source: http://www.pcworld.com/article/191574/long_live_your_laptop_battery.html

Monday, March 22, 2010

doubleTwist is an iTunes Alternative that Supports Several Devices

Friendly Computers found this article useful and would like to share it with you.

There are a lot of iTunes users out there, but unfortunately you can’t use it with all of your portable devices. Today we take a look at doubleTwist, which allows you to sync your media with a multitude of portable devices and easily share it as well.

Note: You can run doubleTwist on Windows or Mac, and here we take a look at the Windows version.

Install & Setup doubleTwist

Download and install doubleTwist using the defaults in the wizard…

1

Installation takes several moments and you’ll see the progress while it finishes up.

2

After installation is complete, sign up for an account if you don’t already have one. If you do have an account you can login right away.

3

Enter in your username, email address, and password then click Sign Up.

You’ll get an confirmation email and need to activate the account before you can sign in.

5

Once you’re all signed up, launch doubleTwist and you’ll be ready to start using it.

6

doubleTwist Music

The default music store is Amazon MP3 store which might appeal to those of you who are tired of the iTunes music store. A lot of times the music is cheaper and available at higher bit rates.

7

You can start searching for music in the Amazon Music Store and previewing songs.

8

To purchase anything though you will need to sign into your Amazon account.

9

Under Playlists it allows you to import your playlists from iTunes and Windows Media Player, which is a handy feature if you don’t want to set them up again.

10

Of course you can play your songs through the music player on your desktop.

11

Devices

One of the coolest things about doubleTwist is that it supports a lot of different portable media devices including iPod, BlackBerry, Windows Mobile, Android, PSP, Smartphones, and much more.

Unfortunately for Zune users…there isn’t any support for the Zune of Zune HD yet.

12

Here we have a Creative Zen attached and can sync songs, pictures, and podcasts.

13

An HTC-S620 Smartphone running Windows Mobile…

14

Even a simple USB drive will be recognized and you can transfer your media to it as well.

15

Podcasts

Finding your favorite audio and video podcasts is easy with the search feature.

16

You can easily manage and subscribe to podcasts in the subscriptions section.

17

You can watch the video podcasts directly in doubleTwist.

18

Sharing Media

Also you can share digital media with your friends or add it to Flickr and YouTube.

19

You can send any pictures, videos, or music in your library to other people by dragging it over. You can email users individually…

20

Or access contacts from your Gmail and Yahoo accounts.

21

There is a limit to how much you can send of video podcasts… only the first 10 minutes.

22

The person you send it to will get a link in their email that points to your My Feed page on the doubleTwist site.

23

There they can access the media you sent…in this example it’s a video podcast but you can share any media.

24

Other Features

Under My Profile you can change your avatar and personal information.

In Preferences you can choose where media is stored, its startup actions, podcast subscriptions, and manage device syncing.

 

Conclusion

It’s still in beta stage so expect some bugs, but overall doubleTwist is a solid media player that is easy to use with a clean interface. It’s simple and doesn’t try to do too much so is fairly easy on system resources. The main annoyance is it tries to catalog all of your media out of the box. Which may be alright for some users with smaller media collections, but very irritating to advanced users with large collections. Also there is currently no support for the Zune, but according to their forums, it’s on the way.

At the time of this writing it’s in public beta and can be downloaded for XP, Vista, Windows 7 (32 & 64 bit), and Mac OSX. If you’re looking for an iTunes alternative that works with several different portable devices, you might want to give DoubleTwist a try.

Download DoubleTwist Public Beta

See If Your Media Device is Supported by doubleTwist

Source: http://www.howtogeek.com/howto/13001/doubletwist-is-an-itunes-alternative-that-supports-several-devices/

Friday, March 19, 2010

The Right Hard Drive For You

Is it time to upgrade your laptop's hard drive? Friendly Computers found this article very useful and would like to share it with you.

Traditional hard drive have never been cheaper, and the advent of flash-memory based SSDs—that's solid-state drives—delivers a storage upgrade path that actually deliver solid, real-world benefits that you'll notice every single day. SSD-equipped PCs boot faster and are quicker to load applications. In fact, the only bad thing about SSDs is their cost—a 128GB solid-state drive can cost upwards of $400.

So what's the right storage solution for you? Read on, and I'll tell you what you need to know.

Option 1: The Cheapskate

The Right Hard Drive For You
SSDs sound pretty sexy, but you're running an old machine—say an Athlon 64—and you've got an immediate problem. Your porn collection has filled your old 500GB drive. You need more space, stat, and there's no reason to shell out more than your PC is worth for a 128GB SSD. Lucky for you, terabyte drives are cheap—$90 at Newegg for an awesome drive. There are a few key specs to watch out for when buying a hard drive for use as your system drive. The speed that the platters spin at has a direct correlation on the performance of the drive. Faster platters = faster data transfer. For an inexpensive, mainstream drive, that means you should be looking at 7200rpm exclusively. The number of platters is also relevant. The fewer platters there are in the drive, the faster the drive will be. For those reasons, I recommend Seagate's 7200.12 series 1TB drive. At $90, it's cheap, fast, and reliable.

Total Capacity: 1TB
Total Cost: $90

Option 2: The Budget-Conscious SSD Shopper

The Right Hard Drive For You
Today, the 128GB SSDs sit in the sweet spot for price to performance ratio. However, smaller SSDs don't necessarily sacrifice anything in terms of performance, just capacity. (The brand of controller used and configuration of the memory are much more important to SSD performance.) So, if you want to scrimp, you can buy a smaller SSD for Windows and your applications, and pair it with a traditional hard drive where you store your large files—like your music and video files. If you want to get really tricky, you can even use symlinks—special links that are invisible to applications but are between files or directories—so that your applications don't even realize your files are on different drives.

While Intel's mainstream 160GB SSDs cost about $500, the 80GB retail version comes in right around $220, and even includes a mounting kit, so it will slide into your 3.5-inch drive bays (most SSDs are 2.5-inch drives, sized for laptops and servers). That's not a ton of capacity, but it's more than enough if you just want to install Windows and your applications. You'll need to install games and store your media on a secondary drive, but for that you can use an inexpensive traditional drive, like the Seagate 7200.12 1TB. And, the quick boot and speedy application load times are more than worth the hassle. One caveat, when buying Intel SSDs, make sure you get the second generation drives (they'll have G2 in the model number). The first-gen models don't support TRIM, which is an important feature for maintaining the drive as you use it. We'll talk about TRIM in a moment.

Total Capacity: 1.08TB
Total Cost: $310

Option 3: Handy Laptop Upgrade

The Right Hard Drive For You
While it's definitely tempting to put a speedy SSD in your laptop—after all quick load times and a complete lack of moving parts does sound spiffy—if you use your portable machine like I do, you'd probably rather have some extra space. Lots of extra space. That's why I recommend the Western Digital 640GB Scorpio Blue drive. It's a 5400RPM drive, but its balance of price to space is excellent, and it shouldn't eat through your battery too quickly. When you upgrade the hard drive in a notebook, you need to know what height drive your computer can accommodate. The easiest way to find out is to look in Device Manager (in Windows) or in System Information (in OSX) and see what model drive you have currently. Then Google that model number to find out thick your current drive is. Anything that size or smaller should fit. At 9.5mm, the Scorpio is a perfect upgrade for my MacBook Pro.

Total Capacity: 640GB
Total Cost: $99

Option 4: Balls to the Wall

The Right Hard Drive For You
What's a truly nutty storage solution? How about a pair of 160GB SSDs paired with 2TB of the fastest traditional hard drive in the world? While there are some faster SSDs out there, they're either based on untested controllers or have had problems in the past. When dealing with bleeding edge, we'll take reliable and slightly slower in some situations over speedier with a chance to lose our data, which is why we recommend a pair of 160GB Intel's X-25MG2's running in RAID0, paired with a speedy and spacious 2TB Western Digital Black drive. This gives you 320GB of storage on the RAID, more than enough space for Windows and all your applications and games, plus an extra 2TB for your music, videos, and... yes... your porn collection. It's the best of both worlds, but with a pair of $500 SSDs, it'll cost you!

Total Capacity: 2.380TB
Total Cost: $1280

The Care and Feeding of SSDs

There are a few things you need to know about SSDs, before you shell out big bucks for one. First, because of the way flash memory works, either the operating system or a vendor-provided piece of software needs to do some occasional housekeeping to keep write speeds up. If your drive supports the TRIM command—as the second-generation Intel SSDs I recommended do—Windows 7 will take care of the scut work for you.

If you're running XP or Vista, you'll need to manually run the Intel SSD Optimizer every few weeks or months, whenever you notice write speeds slowing down. It's part of the Intel SSD Toolbox. Unfortunately, the SSD Optimizer doesn't run on RAID arrays, so it's a bad idea to RAID your SSDs, unless you're running Windows 7.

You should prevent defragmentation programs from running on SSDs—they're not necessary and can actually degrade performance. Windows 7 will automatically disable defrag, but you'll need to turn it off manually in XP or Vista.

Unfortunately, there's no way to properly maintain an SSD on OSX today. OSX doesn't support the TRIM command and there aren't any OSX-native tools for Intel drives. The only way to restore like-new write speeds on a Mac is to backup your drive, format it, then restore from your TimeMachine backup. If you frequently write large files, you'll definitely notice the performance hit. For that reason, it's not a great idea to buy a SSD to upgrade your MacBook Pro today.

Source: http://gizmodo.com/5496302/the-right-hard-drive-for-you

Thursday, March 18, 2010

Use Autoruns to Manually Clean an Infected PC

Friendly Computers would like to share with you this article.

There are many anti-malware programs out there that will clean your system of nasties, but what happens if you’re not able to use such a program?  Autoruns, from SysInternals (recently acquired by Microsoft), is indispensable when removing malware manually.

There are a few reasons why you may need to remove viruses and spyware manually:

  • Perhaps you can’t abide running resource-hungry and invasive anti-malware programs on your PC
  • You might need to clean your mom’s computer (or someone else who doesn’t understand that a big flashing sign on a website that says “Your computer is infected with a virus – click HERE to remove it” is not a message that can necessarily be trusted)
  • The malware is so aggressive that it resists all attempts to automatically remove it, or won’t even allow you to install anti-malware software
  • Part of your geek credo is the belief that anti-spyware utilities are for wimps

Autoruns is an invaluable addition to any geek’s software toolkit.  It allows you to track and control all programs (and program components) that start automatically with Windows (or with Internet Explorer).  Virtually all malware is designed to start automatically, so there’s a very strong chance that it can be detected and removed with the help of Autoruns.

We have covered how to use Autoruns in an earlier article, which you should read if you need to first familiarize yourself with the program.

Autoruns is a standalone utility that does not need to be installed on your computer.  It can be simply downloaded, unzipped and run (link below).  This makes is ideally suited for adding to your portable utility collection on your flash drive.

When you start Autoruns for the first time on a computer, you are presented with the license agreement.

After agreeing to the terms, the main Autoruns window opens, showing you the complete list of all software that will run when your computer starts, when you log in, or when you open Internet Explorer:

autoruns

To temporarily disable a program from launching, uncheck the box next to it’s entry.  Note:  This does not terminate the program if it is running at the time – it merely prevents it from starting next time.  To permanently prevent a program from launching, delete the entry altogether (use the Delete key, or right-click and choose Delete from the context-menu)).  Note:  This does not remove the program from your computer – to remove it completely you need to uninstall the program (or otherwise delete it from your hard disk).

Suspicious Software

It can take a fair bit of experience (read “trial and error”) to become adept at identifying what is malware and what is not.  Most of the entries presented in Autoruns are legitimate programs, even if their names are unfamiliar to you.  Here are some tips to help you differentiate the malware from the legitimate software:

  • If an entry is digitally signed by a software publisher (i.e. there’s an entry in thePublisher column) or has a “Description”, then there’s a good chance that it’s legitimate
  • If you recognize the software’s name, then it’s usually okay.  Note that occasionally malware will “impersonate” legitimate software, but adopting a name that’s identical or similar to software you’re familiar with (e.g. “AcrobatLauncher” or “PhotoshopBrowser”).  Also, be aware that many malware programs adopt generic or innocuous-sounding names, such as “Diskfix” or “SearchHelper” (both mentioned below).
  • Malware entries usually appear on the Logon tab of Autoruns (but not always!)
  • If you open up the folder that contains the EXE or DLL file (more on this below), an examine the “last modified” date, the dates are often from the last few days (assuming that your infection is fairly recent)
  • Malware is often located in the C:\Windows folder or the C:\Windows\System32 folder
  • Malware often only has a generic icon (to the left of the name of the entry)

If in doubt, right-click the entry and select Search Online…

The list below shows two suspicious looking entries:  Diskfix and SearchHelper

ar_entries

These entries, highlighted above, are fairly typical of malware infections:

  • They have neither descriptions nor publishers
  • They have generic names
  • The files are located in C:\Windows\System32
  • They have generic icons
  • The filenames are random strings of characters
  • If you look in the C:\Windows\System32 folder and locate the files, you’ll see that they are some of the most recently modified files in the folder (see below)

system32

Double-clicking on the items will take you to their corresponding registry keys:

regrun

Removing the Malware

Once you’ve identified the entries you believe to be suspicious, you now need to decide what you want to do with them.  Your choices include:

  • Temporarily disable the Autorun entry
  • Permanently delete the Autorun entry
  • Locate the running process (using Task Manager or similar) and terminating it
  • Delete the EXE or DLL file from your disk (or at least move it to a folder where it won’t be automatically started)

or all of the above, depending upon how certain you are that the program is malware.

To see if your changes succeeded, you will need to reboot your machine, and check any or all of the following:

  • Autoruns – to see if the entry has returned
  • Task Manager (or similar) – to see if the program was started again after the reboot
  • Check the behavior that led you to believe that your PC was infected in the first place.  If it’s no longer happening, chances are that your PC is now clean

Conclusion

This solution isn’t for everyone and is most likely geared to advanced users. Usually using a quality Antivirus application does the trick, but if not Autoruns is a valuable tool in your Anti-Malware kit.

Keep in mind that some malware is harder to remove than others.  Sometimes you need several iterations of the steps above, with each iteration requiring you to look more carefully at each Autorun entry.  Sometimes the instant that you remove the Autorun entry, the malware that is running replaces the entry.  When this happens, we need to become more aggressive in our assassination of the malware, including terminating programs (even legitimate programs like Explorer.exe) that are infected with malware DLLs.

Shortly we will be publishing an article on how to identify, locate and terminate processes that represent legitimate programs but are running infected DLLs, in order that those DLLs can be deleted from the system.

Download Autoruns from SysInternals

Source: http://www.howtogeek.com/howto/12837/use-autoruns-to-manually-clean-an-infected-pc/

Wednesday, March 17, 2010

Top Free Troubleshooting Tools for Windows

Friendly Computers would like to share with you these seven handy tools that help you diagnose and cure a wide range of Windows ills, and they're all free for the downloading.

No computer runs perfectly forever. Somewhere along the line, something will go wrong. While each successive version of Windows has been that much more reliable and self-healing, that's never been an argument to forgo a good collection of software tools.

Over the years I've accumulated a slew of third-party troubleshooting apps that have proven their value again and again, so much so that they're among the very first programs installed in any system I use. If something goes wrong -- a Blue Screen of Death, a slow-booting system, a recent program install that's made everything slower than molasses going uphill in January -- I turn to these tools to set things right. All of them are free for personal use, some are open source, and each of them deserves a place in the toolbox of the savvy Windows user.

Sysinternals's Process Explorer

"Task Manager on steroids" -- that's how someone describedProcess Explorer to me when Mark Russinovich first released it many years ago. It can replace Task Manager or run side by side with it, but either way it's an absolute must-have for technically savvy users. I typically use it as the replacement for Task Manager on any PC I run; it's just too handy not to have installed.

When you launch Process Explorer, you'll see a tree view of processes; they're nominally organized by which process spawned which, but you can click on the column headers to change the sorting as you please. The top portion of the window has four graphs: CPU usage, commit history, I/O bytes history, and physical memory history. Click on one to bring up a full-sized window view that's akin to the Performance tab in Task Manager -- but with a level of detail and insight into what programs are doing that Task Manager doesn't even come close to providing.

Double-click on the name of a process, and up pops a window with a startling amount of detail: the process's running threads (and the stack for each thread), which can be frozen or killed; its permissions; its network access; the program it was launched from; even a dump of text strings in either the on-disk program image or its copy in memory. Processes, or whole trees of them, can be killed off, frozen, resumed, or have their windows or priorities manipulated -- handy if a process window vanishes behind something else and you need to force it to the front. You can also toggle on or off a lower pane that contains detailed information about a process, find the process for a particular window by pointing to it, or search by name for any running process, handle, or DLL.

System Information for Windows

No other free tool I've encountered packs as much true utility into a single executable as this one. System Information for Windows, abbreviated as SIW, has replaced more than a dozen other programs I've used that dump one kind of system or application data or another. SIW lists application license keys, probes installed hardware, fetches device temperatures, catalogs installed multimedia codecs -- the list seems endless.

SIW is organized into four basic categories. Three of them are available through a tree view on the left side of the program window: Software, Hardware, and Network. Click on a branch of any of those items and you'll see the right-hand window pane fill with the corresponding data. The harvesting process may take a moment, especially for things like device lists, so don't freak out if you have to wait a bit before SIW pulls everything together. Half the fun of using the program is just spelunking through these three lists and seeing what's available.

The fourth category is a gaggle of miscellaneous tools in the program's Tools drop-down menu. This is stuff program author Gabriel Topala apparently couldn't fit in one of the previous three areas, but still wanted to include. Among them are such goodies as Eureka, a way to expose starred-out password fields in most any program; a tool for sending a wake-on-LAN packet to the MAC address of your choice; a BIOS dumping tool; a Base64/UUencoder-decoder; a CPU stress test; and plenty more. SIW even runs in the Windows Recovery Environment.

One caveat: SIW is mostly read-only. While it's good at listing or dumping out system information, it doesn't always allow you to change those settings. If you wanted to disable or enable ActiveX controls listed through SIW, for instance, you'd need to do that with a third-party utility such as Nirsoft's ActiveXHelper.

BlueScreenView

In Windows, there's little worse than dealing with a Blue Screen of Death, or BSOD for short. Aside from being cryptic and difficult to decipher -- especially since some BSODs can have multiple causes -- they're just plain annoying. Granted, BSODs happen much less frequently these days, but when they do it's no less of a chore. After dealing with a whole slew of BSODs the other month -- which turned out to be a hardware issue -- I hunted around for tools to help analyze BSODs and found one that did the job and more: BlueScreenView.

When a BSOD occurs the results are, whenever possible, saved into a dump file that can be examined later. BlueScreenView scans your system for these files and produces a report from them, which you can read within BlueScreenView itself or save to HTML for separate analysis. Each line in the report describes the BSOD's crash code, the time and date of its occurrence, any parameters that might have been passed with the crash (useful for debugging), and a slew of other minor details. The results are searchable, so you can hunt for a particular crash code, driver, or DLL that you think might be present.

Another thing BlueScreenView does is list all of the device drivers that were running at the time of the crash. If a particular driver was listed as the cause of the crash, it's flagged and displayed in red. You can filter out all the other drivers that were loaded at the time if you just want to focus on the culprit. You can also load dump files copied in from elsewhere by pointing to a folder, or even from computers accessible across the local network (provided you have permission to do so).

One minor annoyance with BlueScreenView involves the reporting function. If you want to print out both a crash message and its attendant driver stack, you have to treat them as separate reports. That said, the core crash message typically lists the offending driver; if nothing else, you can use the basic BSOD report to derive all the most crucial information.

Sysinternals' Autoruns

One of the great banes of any Windows user's life is software that insists on shoehorning things into the system to launch at startup, whether or not you actually need or want any of it. Scanner and printer drivers are among the worst offenders in this regard. They often insist on installing a bunch of system-tray-resident utilities of dubious usefulness.

Autoruns -- by Mark Russinovich, of Process Explorer fame -- not only roots out these annoyances, but it comes in handy for so many other things that it's simply indispensible. Autoruns probes your system and dumps out lists of programs and system components that start automatically, without user intervention -- from apps in your Startup folder to scheduled tasks, from services to device drivers, from Sidebar gadgets to codecs. By default it dumps out data pertinent to the current user context, but the program's User menu lets you switch contexts. (You'll need to run the program as Administrator, though.)

Autoruns organizes its views into the system by tabs (Logon, Services, Explorer, Internet Explorer, Drivers), making it easy to drill down to the entries you're most concerned about. You can disable any app or service without actually deleting it, simply by unchecking a box, or you can remove it entirely with a selection from the right-click menu. That same menu also has options for jumping to the service's entry in the Registry, verifying its code signature, and looking it up on Google.

Select Options | Hide Microsoft and Windows Entries, and when you next run Autoruns or click Refresh, you'll see only third-party applications -- a handy way to focus only on programs added to Windows after the fact and, thus, might be a problem. If Process Explorer is currently running, you can right-click on an item and bring up its Properties pane in Process Explorer, assuming said item is actually running.

Autoruns also comes in a command-line version, which can be used with scripts or other automation. Finally, check out a video for some neat Autoruns usage tips, from Mark Russinovich himself.

WinDirStat

Where did all my disk space go? Every PC user asks this question at one time or another, and the answer can easily be found with a copy ofWinDirStat. WinDirStat generates easy-to-understand graphical reports about disk usage, allowing you to see at a glance which individual files or folders hidden deep within a directory tree may be gobbling up dozens of gigabytes. A few other programs of this kind exist, but WinDirStat has consistently trumped them all.

Fire up the program and you'll be asked to select one or more drives or folders in your system, which are then analyzed for space usage. The analysis may take a few minutes or more, depending on how many files or directories are on the drive(s) in question; you can switch away and let the program run in the background. (Cute touch: The progress bars use Pac-Man icons.)

Once the analysis is done, the results appear in an arrangement known as a treemap, where the files that take up the most space show up as large colored blocks. This makes it easy to quickly spot the biggest space hogs. Click on any block and the top part of the program's window will display the corresponding file in the context of its directory, via a conventional tree-list view. You can also use the tree view to determine the relative space usage of the file or directory of your choice, so you can in effect drill down (or up) by either file size or location. Finally, files are color-coded by type, so you can see at a glance what kinds of files take up the most space.

It's also possible to do cleanup operations within the program. Right-click on a file or folder, and you can delete it -- either by sending it to the Recycle Bin or deleting it directly. You can also pop open a command line or Explorer window on the directory or file in question.

Unlocker and OpenedFilesView

Here is another scenario most of us have encountered: a file that simply can't be deleted because it's "in use." Windows Vista and Windows 7 are a little better at informing the user about which program is using the file in question, but sometimes you're stuck playing digital Whack-A-Mole trying to figure out which window to close.

I've used not one but two programs, at different times, to deal with these annoyances. The first is Cedrick Collomb's Unlocker, which many people know and love. The second is the lesser-known but still valuableOpenedFilesView (by Nir Sofer, author of BlueScreenView). Both do the same thing: Determine which process has a lock on which file, and let you release it either by killing the file handle or the offending process. However, they go about it very differently.

Unlocker runs silently in the background and adds a right-click context menu to Explorer. If you want to know what's locking a particular file, right-click and select Unlocker. From there you can elect to terminate the processes locking a file, make a copy of the file in question, or remove the locks that the process has on the file.

OpenedFilesView, on the other hand, provides a regularly updated list of all files currently locked by all processes, which can be sorted and searched. The same types of action can be taken, although OpenedFilesView doesn't support deleting a locked file or making a copy.

One major drawback to both Unlocker and OpenedFilesView is shaky 64-bit support. Unlocker doesn't work in 64-bit Windows at all. OpenedFilesView has a 64-bit edition, but requires that you disable driver signing system-wide (which requires a reboot). Turning this off makes it that much easier for unauthorized software to install drivers, although I'd bet most users who need a tool like this are well aware of those risks.

Source: http://www.pcworld.com/article/191362/top_free_troubleshooting_tools_for_windows.html

Thursday, March 11, 2010

Discover the hidden gems found in the Windows 7 calculator

Friendly Computers would like to share with you this article.

Admittedly, the standard calculator application found in every version of the Microsoft Windows operating system since the beginning is not usually considered sexy, but the new version found in Windows 7 earns props for adding real value. Check out some of the new features found hidden in the menu tree of this often taken for granted free applet.

This blog post is also available in the PDF format in a free TechRepublic Downloadand as a TechRepublic Photo Gallery.

The Hidden

The Calculator app is located in its typical spot in the Start Menu - under Accessories. Of course, the easiest way to get to the application is to type “calc” in the Start Menu search box as shown in Figure A.

Figure A
Type “calc” into the search box to start the application

Click on the Calculator application icon and you will get the familiar standard view as shown in Figure B.

Figure B
The standard calculator format

Click on the View menu item (Figure C) and one of the first things you should notice is that there are a plethora of new options available besides the Standard and Scientific modes of the past, including the new Programmer (Figure D) and Statistics (Figure E) modes.

Figure C
View menu
Figure D
Programmer mode
Figure E
Statistics mode

History is a feature I have wanted for a long time (Figure F). The ability to get what amounts to calculator tape appeals to the accountant in me.

Figure F
History

But where the real feature changes have taken place are in the lower levels of the View menu. Figure G reveals the conversion feature, where you can convert one kind of unit of measurement into another unit of measurement. The categories of units you can convert range from angle to weight/mass.

Figure G
Conversion

The Date calculation will tell you how many days separate two dates. Yes, that is a lot of days. (Figure H)

Figure H
Date calculation

Under the Worksheets menu item (Figure I), you see four additional worksheets for calculating:

  • Mortgages
  • Vehicle leases
  • Fuel economy in miles
  • Fuel economy in kilometers
Figure I
Worksheets

I have been using Web sites to calculate the mortgages on my dream houses in the past, but now I can dream without involving the Internet. (Figure J)

Figure J
Mortgage calculation

Take advantage

The unadvertised enhancements to the standard calculator applet that comes with Windows 7 has raised the usefulness of this ubiquitous program 10-fold. Check out the new features and you just might end up pinning it to your desktop.

Source: http://blogs.techrepublic.com.com/window-on-windows/?p=2196&tag=results;CR1