Replies

An Athlon dual core 4200 and 2GB Ram is plenty for Win7 to run reasonably well. OK, not a flying machine, but no reason for spinning circles waiting for things to happen. I occasionally use a single core Win7 Pro machine with 1GB inside a Virtual Machine on top of a native Linux box. Said machine is connected to a corporate network and it runs just fine for office applications etc.

As others have suggested, check resource utilisation and startup programs. Verify that the behaviour occurs when only the OS is running, i.e., not Corel Draw etc.

The other key thing I would check is the Event Viewer. Look to see if you are getting any trouble with timeouts or errors, in particular disk errors.

Your “couple of fast disks”…….Are they configured in anything sexy like a RAID array and if so does the OS/BIOS manage that? If a RAID then it’s possible you may have a bottleneck in the system.

Finally, (and this might be termed heresy in some corners!), unless you have a real need to remove traces of data, don’t be bothering with cleaners etc, they can sometimes marginally improve stability and are useful in cleaning a up problem, but most often they make hardly any real-world impact to the system performance and can damage the OS if run wild. IMHO, generally, let Win7 take care of itself and don’t micro-manage it.

Add groups from Outlook?

I’m not sure I understand you. Your machines’ Outlook clients are connected to Exchange, yes? These are groups already in existence on SBS2008? You can add users to those groups through the Users and Groups Wizard in the SBS2008 console.

If the groups don’t already exist, you can create new ones and assign roles from the same wizard.

….on the other hand, maybe I’ve missed something about what you are trying to achieve. Perhaps you could clarify.

Ran across one case where the trojan was active in safe mode and it killed explorer.exe as well so there was no access to Start preventing you from running any programs! Had to evoke task manager, go to the services tab and kill the trojan process. Then, I was able to start explorer and clean the PC.

Jerry

Good tip Jerry!

I’ve seen it in Safe Mode too, but never Safe Mode Without Networking. However, these things are moving targets and could easily have variants that are active in without networking mode by now.

Thanks!

Tinto, very good explanation, easy to follow. Thanks. This will hopefully help many others with this problem. I, with your permission of course, will be copying these steps to a notepad file and placing them on a flash for future use. Thanks again.

Ted

p.s. I would assume this same procedure will work on Win 7 as well.

You’re very welcome Ted. By all means keep a copy to hand. Hopefully you’ll never need it!

The key is to stop the trojan before it can launch the attack and that’s where Safe mode without networking comes in. When in Safe mode without networking, all instances of the problem that I have come across have not been active, allowing you to use the cleanup and removal tools.

There are programs, such as rkill, that can be used to disrupt the trojan without using Safe Mode Without Networking, but I have had mixed results with this: when active, some variants are clever enough to stop the rkill, mbam and other processes.

Oh, and yes, the process applies across XP through Vista to Win7.

If the fake alert appeared after a virus infection you may also have a rootkit that Malwarebytes is often unable to remove. It is worth the extra 5 minutes scanning with Kaspersky TDSS Killer.

One of the best ways I’ve found to overcome these fake alerts is to use the following process:

Download Malwarebytes Anti-Malware, and Autoruns from Sysinternals plus the Kaspersky tool above on a clean machine and transfer them to USB stick or CD.

Boot the affected machine into Safe Mode Without Networking.

Run Kaspersky TDSS Killer

Run a System Restore to a time before the infection. This will require a reboot and it’s important to re-enter Safe Mode Without Networking to complete the Restore.

Run Autoruns and remove any rogue or fake antivirus remaining

Run Malwarebytes Anti-Malware removing anything they find.

Finally, boot into normal mode and re-run Malwarebytes, this time updating the program.

I’ve seen dozens of these fake alerts on client machines and the above technique has worked every time.

Whichever way you clean up: afterwards you should ensure your AV program is fully up to date, but also make sure your Adobe Flash Player, Adobe Reader and Java are fully patched. Particularly important is Flash Player as many of these fake alerts arrive via poisoned animated adverts on websites that require no user interaction to launch the attack. Also consider the use of ad-blocking ad-ons in your browser such as ADBlock Plus.

Some of these fake alerts run a script that changes the hidden file attribute on the contents of your documents and pictures folders, making it appear they have been removed. It’s tedious in the extreme to reset that attribute on every file, so if it has occurred, you could select the show hidden files and folders option.

I have a slightly different approach.

I use iAccounts on my iPhone. Purchasing iAccounts gave me a free copy of iBackup to run on my main workstation.

The process I use is to generate strong passwords held on the iPhone in iAccounts behind a strong master password in the app. If the master password is entered incorrectly 5 times the encrypted database in iAccounts is zapped. I can sync over the air to iBackup on the workstation and copy/paste passwords from there into websites, remote PC’s and servers etc.

The iPhone is also connected to an Exchange server so it has an unlock PIN too. I also have the ability to remote wipe the phone for extra security.

To backup the iBackup database on the workstation, I use a TrueCrypt container which holds an export of the database.

The TrueCrypt container is then backed up onto more than one location every night along with the rest of the workstation.

Complicated? Over-the-top? Not for business purposes I think. At it’s simplest level, my iPhone has a dynamic and portable record of all my passwords and this is synced to my workstation which is securely backed-up.

I’m a little confused about the question. I followed right up to the point where you asked about reducing the size of the system partition on the old Dell.

I’m assuming for a moment that you have something like System Partition – Drive C: 50GB, Backup Partition – Drive E: 30GB. Also if I read your intention correctly, having transferred everything from the backup partition to the laptop you want rid of that partition on the Dell and then to increase the size of the system partition?

EASEUS Partition Manager Home will do the trick. It’s free for personal use and can shrink, expand, extend and move partitions while Windows is running. It has lots of other useful stuff too.

You can delete the backup partition, then expand the system partition to use all available space. Using the tool, you may also observe a hidden Dell recovery partition – I would leave that as it is.

I agree with you, this is an option worth considering.

Although it’s nice to track down the root cause, sometimes you can go round and round in circles and its just more efficient to nuke the problem with a non-destructive OS re-install.

Double check first though that your are licenced for such a re-install and that there are no obvious hardware issues: bad disk, insufficient memory etc.

As I understand it God Mode is merely a shortcut pointing to a CLSID in the Registry that already existed? Thus all you really need to do is to delete the shortcut. Also the shortcut should show up if you search for it…see below.:cheers:

I’m with 100% you on this one RetiredGeek. God Mode is not really a mode at all. In fact there is nothing really to uninstall. Just ignore the shortcut or folder; it’s merely a distraction.

The implication however is that something has changed since setting up the folder. That being the case, the admin tools exposed by the user have been used to alter the behaviour and/or appearance of Windows. If that is so, use System Restore to go back to a time before it was enabled unless the OP knows what it was that was changed and can go back manually through those individual changes.

God Mode is simply a folder that contains links to all the systems administrative tools. The folder itself does not change anything so it should be just a matter of finding that folder and deleting it. If you have used any of the tools exposed in God Mode, then you need to restore those settings individually or collectively using System Restore.

To remove the folder: The shortcut doesn’t help as you are right, you don’t want to remove explorer.exe (don’t get me started, but that’s a different thread!). Click on Start, and enter “God Mode” without the quotes in the search box, hopefully that will find the folder for you and assuming you havent tweaked your system too far you can just remove the folder.

Chuck,

Python is an interpreted language that requires somebody to have installed the Python interpreter software on your machine before the Python virus would run (like Java). It’s not like a normal “drive-by” attack. If your technical source is correct it means somebody has seriously compromised your machine and you should take action.

The date you mention is interesting, partly because it’s a couple of years ago and that raise questions about why wait so long. But also because, at that time, there were strong rumours circulating about a BIOS virus written Python. If those rumours were correct, re-installing you Operating System or even formatting the disk will not remove the problem.

If it has not affected the BIOS, then removing the Python interpreter will stop in dead in its tracks and you can then clean up as Ted suggests.

However, to be frank, I would seek out a local independent and reputable computer repair company close to where you stay and take the machine to them. Describe exactly what you have said here and that should sound alarm bells with them too. If it’s a BIOS virus then I’m afraid it’s not an easy answer.

Also, consider how somebody got into the system to install Python and how your technical source knows so much about it (hopefully that’s a completely innocent answer).

Well, this is going to my last post on the subject as it seems I’m the only one that gets along with the default Windows Explorer.

I can’t agree that the highlighting of a folder is weak or grey or difficult to see. Perhaps it’s my eyes, but it’s perfectly clear to me: see attached.

27975-explorer

In that image I’m browsing C:ATISupport10-12_vista64_win7_64_ddPackagesAppsCIMWin64. The folder is quite clearly highlighted as is the path in the explorer navigation bar at the top. I could do the same with the files and folders in my user account, but that’s not for public display.

Perhaps the issue is with Libraries rather than Explorer. If so, don’t use libraries, just navigate to where you need to be – no virtual this or virtual that – a solid defined path.

As users migrate from legacy systems there are new ways of working. Windows 7 is a huge leap from Windows XP and I guess many people have become comfortable with interfaces that they have become used to. Many will wish to have similar experiences to XP or earlier. But to quote today’s Windows Secrets Newsletter “Don’t pay for software you don’t need”. Learn to use the new features and they will reward you.

OK, so bring on the flames: but it works perfectly well for me, and my (non-server) systems and I don’t have to learn to use a non-native interface.

YMMV

Is there a way to show “Disk free space” the same way when using Win Explorer with with Win7 ?

Not that I’m aware of.

I use a nifty little tool called Scanner from Steffen Gerlach which builds a nested pie chart of the drive. You can drill down into each folder, and launch an explorer window from any layer as required. You can also add it to the context menu so you can right click on an object and “Scan” it to produce the pie chart.

Really useful for finding where all that disk space went to.

Classic theme…geez

Managing Windows servers with Classic Theme as the only available option (yuk!) might explain why I like the in built Aero Theme on Explorer when I can get back to the office for a dose of sanity.

BTW, full path does work, but only as an extension of classic theme.

Good luck with the add-ons.

Change to Classic Theme. Should do most of what you need out of the box (though it looks rather clunky).

Control Panel> Appearance and Personalistion> Classic Theme (near the bottom).

However, you also should supplement classic theme by adjusting the folders view and menus:

Select Organise from within Explorer, then Folder and Search Options and the View tab. Then tick Display full path in Title Bar. At which point you have the full path in the title bar at the very top of the window.

Think that covers it.