Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

SP3 issues

5 views
Skip to first unread message

Ronin

unread,
Feb 19, 2010, 4:32:09 AM2/19/10
to

A friend's son's machine is relatively new for XP (2005), but it is sorely
lacking in RAM, something that will be remedied as soon as Crucial delivers
on Monday. It was also wildly inundated with spyware, etc., but no viruses
according to Avast! Took a couple of days, but it seems relatively clean
now. Probably some permanent damage, but clean reinstall is something I'm
trying to avoid.

Meanwhile, being an impatient sort of person, I still tried to install SP3
before upping the RAM. The install failed at first due to permissions issues
which I thought I had remedied using SUBINACL as described here:
http://www.askvg.com/windows-xp-service-pack-3-sp3-setup-error-access-is-denied

The install actually finished after several hours -- 256MB RAM for WinXP is
a
crime, Dell should be held responsible for even allowing such a
configuration. Anyway, when I rebooted, it showed itself updating things
before logging on (the way Windows Updates often do.) But after logging on,
two command windows popped up. One did whatever and went away quickly, but
the other one showed a dozen or two responses, all of them "Access denied"
(may not be the exact phrase.)

I plan to reinstall SP3 when the new RAM arrives (unless that is
contraindicated), but I suspect that won't solve this issue. My assumption
is that the errors mean that the install wasn't entirely successful, but I'm
not stuck on that. Maybe the responses are expected in certain
circumstances. Still, if there is anything more I can do to ensure a clean
installation, please tell me all about it (or them.)

Much thanks,

--
Ronin


Shenan Stanley

unread,
Feb 19, 2010, 5:14:42 AM2/19/10
to

If the system is slow with 256MB RAM in Windows XP - it is *not* generally
the fault of Windows XP - but of the things running resident. I'd check
what all runs at startup...

You mentioned "Avast!" --> I suggest switching to "Avira AntiVir" or "eSet
NOD32" (AV only - no suites.) The first is free for home use, the latter is
less than $60 U.S. for two years. I would say they should run quite well
and use less resources - thus making the entire computer run a bit better.

No third-party firewall software. Use the built-in firewall.

For the most part - no active 'antimalware only' software. One could
purchase/run MalwareBytes active protection if you feel it will keep this
machine running longer because of the owners 'habits' --> but I wouldn't do
it unless it comes to that.

But on to your cleanup query...

First - do you have a complete backup of this system "as-is"? I would
suggest some sort of image file creation of the entire system - so you could
revert to that if things get really bad. Barring that - just a copy of all
the important files (documents, bookmarks, emails, contacts, music,
pictures, etc...)

As for your resistance in a clean install - that may be doing yourself/your
friend's son a dis-service. If it was "wildly inundated with spyware, etc",
there is no guarantee, short of a clean installation, that you have cleared
everything (rootkits are seldom found by antivirus or basic antimalware
applications.) It is almost a certainty (given nothing more than your
symptoms) that even if you have cleared everything - the dmage from the
attacks still exists.

Along that latter line - I would highly suggest a repair
installation(in-place upgrade). Not just any repair installation (in-place
upgrade) - but one with a Service Pack 3 level installation media (of
Windows XP.) That way you kill two birds with one stone. You fix the
system files and you do so with SP3 level replacements. (You can
integrate/slipstream SP3 into said media, burn a new copy and use it to do
the repair - if you don't know how - look into nLite and/or AutoStreamer
using Google.)

How to Perform a Windows XP Repair Install
http://www.michaelstevenstech.com/XPrepairinstall.htm

How to perform an in-place upgrade (reinstallation) of Windows XP
http://support.microsoft.com/kb/315341

After you perform said repair - I would probably still suggest the following
steps.
(Yes - all of them, even ones you have done before, in order.)

Reboot and logon as administrative user.

Download/install Internet Explorer 7 - it will revert to IE6 - you should at
least have the system at IE7 - and for now - leave it at IE7.
http://www.microsoft.com/downloadS/details.aspx?familyid=9AE91EBE-3385-447C-8A30-081805B2F90B

Reboot and logon as administrative user.

Fix your file/registry permissions...

Ignore the title and follow the sub-section under
"Advanced Troubleshooting" titled,
"Method 1: Reset the registry and the file permissions"
http://support.microsoft.com/kb/949377
*will take time
** Ignore the last step (6) - you should already have SP3.

You will likely see errors pass by if you watching, even count up. No
worries *at this time*.

Reboot and logon as administrative user.

Download/install the "Windows Installer CleanUp Utility":
http://support.microsoft.com/kb/290301

After installing, do the following:

Start button --> RUN
(no "RUN"? Press the "Windows Key" + R on your keyboard)
--> type in:
"%ProgramFiles%\Windows Installer Clean Up\msizap.exe" g!
--> Click OK.
(The quotation marks and percentage signs and spacing should be exact.)

It will flash by *quick*, don't expect much out of this step to get
excited about.

Reboot and logon as administrative user.

Download, install, run, update and perform a full scan with the following
(freeware version):

SuperAntiSpyware
http://www.superantispyware.com/

Reboot and logon as administrative user.

Download, install, run, update and perform a full scan with the following
(freeware version):

MalwareBytes
http://www.malwarebytes.com/

Reboot and logon as administrative user.

Download and run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

Reboot and logon as administrative user.

Download/Install the latest Windows Installer (for your OS):
( Windows XP 32-bit : WindowsXP-KB942288-v3-x86.exe )
http://www.microsoft.com/downloadS/details.aspx?familyid=5A58B56F-60B6-4412-95B9-54D056D6F9F4

Reboot and logon as administrative user.

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
... and save it to the root of your C:\ drive. After saving it to the
root of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot and logon as administrative user.

Visit this web page:

How do I reset Windows Update components?
http://support.microsoft.com/kb/971058

... and click on the "Microsoft Fix it" icon. When asked, select "RUN",
both times. Check the "I agree" box and click on "Next". Check the box
for "Run aggressive options (not recommended)" and click "Next". Let
it finish up and follow the prompts until it is done. Close/exit.

Reboot and logon as administrative user.

You should now perform a full CHKDSK on your system drive (C:)...

How to scan your disks for errors
http://support.microsoft.com/kb/315265
* will take time and a reboot

You should now perform a full Defragment on your system drive (C:)...

How to Defragment your hard drives
http://support.microsoft.com/kb/314848
* will take time

Reboot and logon as administrative user.

Visit http://windowsupdate.microsoft.com/ in Internet Explorer and
select to do a CUSTOM scan...

Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot and logon as administrative user.

If it did work - try the web page again - selecting no more than 3-5 at a
time. Rebooting/logging on as an administrative user as many times
as needed.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one and any of the "Office Live" ones or
"Windows Live" ones for now. I would completely avoid the
"Optional Hardware" updates. Also - I do not see any urgent need to
install Internet Explorer 8 at this time.


After all of that...

If you are comfortable with the stability of your system, you can delete the
uninstall files for the patches that Windows XP has installed...
http://www3.telus.net/dandemar/spack.htm
( Particularly of interest here - #4 )
( Alternative: http://www.dougknox.com/xp/utils/xp_hotfix_backup.htm )

You can run Disk Cleanup - built into Windows XP - to erase all but your
latest restore point and cleanup even more "loose files"..

How to use Disk Cleanup
http://support.microsoft.com/kb/310312

You can turn off hibernation if it is on and you don't use it..

When you hibernate your computer, Windows saves the contents of the system's
memory to the hiberfil.sys file. As a result, the size of the hiberfil.sys
file will always equal the amount of physical memory in your system. If you
don't use the hibernate feature and want to recapture the space that Windows
uses for the hiberfil.sys file, perform the following steps:

- Start the Control Panel Power Options applet (go to Start, Settings,
Control Panel, and click Power Options).
- Select the Hibernate tab, clear the "Enable hibernation" check box, then
click OK; although you might think otherwise, selecting Never under the
"System hibernates" option on the Power Schemes tab doesn't delete the
hiberfil.sys file.
- Windows will remove the "System hibernates" option from the Power Schemes
tab and delete the hiberfil.sys file.

You can control how much space your System Restore can use...

1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Highlight one of your drives (or C: if you only have one) and click on
the "Settings" button.
4. Change the percentage of disk space you wish to allow.. I suggest moving
the slider until you have just about 1GB (1024MB or close to that...)
5. Click OK.. Then Click OK again.

You can control how much space your Temporary Internet Files can utilize...

Empty your Temporary Internet Files and shrink the size it stores to a
size between 64MB and 128MB..

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section, do the
following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the "Amount of disk space to use:" to
something between 64MB and 128MB. (It may be MUCH larger right
now.)
- Click OK.
- Click on "Delete Files" and select to "Delete all offline contents"
(the checkbox) and click OK. (If you had a LOT, this could take 2-10
minutes or more.)
- Once it is done, click OK, close Internet Explorer, re-open Internet
Explorer.

You can use an application that scans your system for log files and
temporary files and use that to get rid of those:

Ccleaner (Free!)
http://www.ccleaner.com/

Other ways to free up space..

JDiskReport
http://www.jgoodies.com/freeware/jdiskreport/index.html

SequoiaView
http://www.win.tue.nl/sequoiaview/

Those can help you visually discover where all the space is being used.

In the end - a standard Windows XP installation with all sorts of extras
will not likely be above about 4.5GB to 9GB in size. If you have more space
than that (likely do on a modern machine) and most of it seems to be used -
likely you need to move *your stuff* off and/or find a better way to manage
it.

Not mentioned above - amazingly - is the fact that you also may want to use
this mass-cleanup/updating/fix opportunity to download the latest hardware
device drivers from the manufacturer(s) web site(s) and install them. If it
is a third-tier type system (Dell, HP, Lenovo, Gateway, etc) - get all those
from said manufacturers support web page for the product model in question -
I would even recommend updating the System BIOS at this time (it could
prevent some issues with the memory you plan to install even...) If it is
less of an OEM/third-tier and more a hodge-podge of parts - visit the
individual hardware manufacturer's web pages and get the device drivers
straight from them (avoid getting non-microsoft hardware drivers from
Microsoft.)

The system should be - for all intents/purposes - pretty well cleaned up
after all that. Still a possibility it is infected, still a possibility
that some of the other software installed (likely beyond the OS) still has
damage done by the, "wildly inundated with spyware, etc" situation the
system was once in. Better however - without a doubt.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


Daave

unread,
Feb 19, 2010, 7:39:53 AM2/19/10
to

Although it's a good idea to up the amount of RAM, you should know it is
certainly possible to run XP on a PC with only 256MB of RAM. My work PC
is older than your friend's son's and it has only 256MB RAM, and it runs
quite quickly (and it has SP3 to boot). The trick (as Shenan alluded to)
is that it runs lean and therefore very rarely relies on the pagefile.

Two thoughts for the situation you mention:

1. The PC was found to have been "wildly inundated with spyware." It's
certainly possible there is still some spyware present. Non-viral
malware is one of the most common causes of slow PCs. Of course,
anti-malware programs will show tracking cookies as undesirable, so
since you didn't inform us as to *which* spyware was found, we can have
no idea as to the severity of the situation (tracking cookies are text
files, so they won't slow a PC down). If you did write down specific
names of infections, include them in your next post!

This page has all the information you need to deal with malware of all
types:

http://www.elephantboycomputers.com/page2.html#Removing_Malware

2. There is a best-practices method for installing SP3. It sounds like
you didn't follow it. Among other things, security programs such as
Avast should not be running when SP3 is applied.

The first thing you need to do is find out what SP level the PC is
currently at:

Start | Run

Type:

winver

Click OK.

What is the SP level shown?


Jose

unread,
Feb 19, 2010, 9:06:22 AM2/19/10
to
On Feb 19, 4:32 am, "Ronin" <wanderer> wrote:
> A friend's son's machine is relatively new for XP (2005), but it is sorely
> lacking in RAM, something that will be remedied as soon as Crucial delivers
> on Monday. It was also wildly inundated with spyware, etc., but no viruses
> according to Avast! Took a couple of days, but it seems relatively clean
> now. Probably some permanent damage, but clean reinstall is something I'm
> trying to avoid.
>
> Meanwhile, being an impatient sort of person, I still tried to install SP3
> before upping the RAM. The install failed at first due to permissions issues
> which I thought I had remedied using SUBINACL as described here:http://www.askvg.com/windows-xp-service-pack-3-sp3-setup-error-access...

>
> The install actually finished after several hours -- 256MB RAM for WinXP is
> a
> crime, Dell should be held responsible for even allowing such a
> configuration. Anyway, when I rebooted, it showed itself updating things
> before logging on (the way Windows Updates often do.) But after logging on,
> two command windows popped up. One did whatever and went away quickly, but
> the other one showed a dozen or two responses, all of them "Access denied"
> (may not be the exact phrase.)
>
> I plan to reinstall SP3 when the new RAM arrives (unless that is
> contraindicated), but I suspect that won't solve this issue. My assumption
> is that the errors mean that the install wasn't entirely successful, but I'm
> not stuck on that. Maybe the responses are expected in certain
> circumstances. Still, if there is anything more I can do to ensure a clean
> installation, please tell me all about it (or them.)
>
> Much thanks,
>
> --
> Ronin

You did not mention if you followed the SP3 installation directions.

http://support.microsoft.com/kb/950717

It includes solutions to the access denied issues that come about by
not following the recommended installation procedures, why they happen
and what to do about it.

You should not need to download any third party solutions, ideas, etc.
to install SP3.

I would think that if I got a single error that defied explanation
during any SP3 install, I would just start over.

I would recommend expanding your malicious software detection horizons
a bit. No single program knows about everything and it is easy for me
to infect my computer on purpose and Avast! will miss some infections
every time. It is not terribly bright about some things, and I have
concluded it is weak, a system resource hog and a waste of time. But
that is my opinion.

Depending on your Avast! installation options and what pieces you
chose to install (or did you just let it install everything?), you
probably have a bunch of Avast! things running you do not need and can
thwart an SP3 installation and reduce your performance - a lot. If
you decide to stick with Avast! you may want to uninstall it all,
clean up the mess and then uninstall/reinstall SP3 properly so there
are no errors (using the directions), then rethink how to install
Avast! again with less overhead for your system resources.

256MB RAM is fine for some people. It has served me well for many
years but I run a pretty lean configuration.

You do not want your system to be relatively clean, you want it to be
squeaky clean.

Perform some scans for malicious software, then fix any remaining
issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

If you want some ideas about your configuration, start here:

To eliminate questions and guessing, please provide additional
information about your system.

Click Start, Run and in the box enter:

msinfo32

Click OK, and when the System Summary info appears, click Edit, Select
All, Copy and then paste the information back here.

There will be some personal information (like System Name and User
Name), and whatever appears to be private information to you, just
delete it from the pasted information.

PA Bear [MS MVP]

unread,
Feb 19, 2010, 11:31:08 AM2/19/10
to
> ...It was also wildly inundated with spyware, etc., but no viruses
> according to Avast!

Assuming you installed Avast *after* the computer was infected (in which
case I can assure you that it did not install properly)...

Back-up any personal data (none of which should be considered 100%
trustworthy at this point) then format the HDD & do a clean install of
Windows. Please note that a Repair Install (AKA in-place upgrade) will NOT
fix this!

HOW TO do a clean install of WinXP: See
http://michaelstevenstech.com/cleanxpinstall.html#steps and/or Method 1 in
http://support.microsoft.com/kb/978307

After the clean install, you'll have the equivalent of a "new computer" so
take care of everything on the following page before otherwise connecting
the machine to the internet or a local network (i.e., other computers) and
before using a flash drive or SDCard that isn't brand-new or hasn't been
freshly formatted:

4 steps to help protect your new computer before you go online
http://www.microsoft.com/security/pypc.aspx

Other helpful references include:

HOW TO get a computer running WinXP Gold (no Service Packs) fully patched
(after a clean install)
http://groups.google.com/group/microsoft.public.windowsupdate/msg/3f5afa8ed33e121c

HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
clean install)
http://groups.google.com/group/microsoft.public.windowsxp.general/msg/a066ae41add7dd2b

Tip: After getting the computer fully-patched, download/install KB971029
manually: http://support.microsoft.com/kb/971029

NB: Any Norton or McAfee free-trial that came preinstalled on the computer
when you bought it will be reinstalled (but invalid) when Windows is
reinstalled. You MUST uninstall the free-trial and download/run the
appropriate removal tool before installing any updates, Windows Service
Packs or IE upgrades and before installing your new anti-virus application
(which will require WinXP SP3 to be installed).

Norton Removal Tool
ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

McAfee Consumer Products Removal Tool
http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Also see:

Steps To Help Prevent Spyware
http://www.microsoft.com/security/spyware/prevent.aspx

Steps to Help Prevent Computer Worms
http://www.microsoft.com/security/worms/prevent.aspx

Avoid Rogue Security Software!
http://www.microsoft.com/security/antivirus/rogue.aspx

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

Ronin

unread,
Feb 19, 2010, 1:55:03 PM2/19/10
to
"Shenan Stanley" <newsh...@gmail.com> wrote in message
news:uhjXdxU...@TK2MSFTNGP06.phx.gbl...

With all but the minimum background apps disabled (all but Avast! and
Ad-Aware resident protections), the system essentially doesn't run at all.
Takes ten minutes just to load, probably mostly due to three or four IMs
that load automatically. I'm going to try and get him to launch those things
as needed, instead of leaving them in the tray. I've uninstalled Dell's
multitude of "support" apps, and I uninstalled everything I thought should
go before starting in with the scanners. Regardless, even with Avast and
Ad-Aware fully disabled, we're still talking blackstrap molasses. My hope is
that once I'm finished it will gain speed, as it has already done to a fair
extent. Fact is, I'm looking at this lack in a positive light, since it's
actually possible to see slight improvements in performance as clean-up
progresses (I'm continuing with various scanners, having already used
Ad-Aware, Spybot S&D (I only use it for scanning, I never enable TeaTimer or
whatever that other one is), MalwareBytes, and SuperAntiSpyware (all free
versions, I haven't yet decided which one I'll recommend to the mother for
resident protection.) I also installed SpywareBlaster, and I will also
suggest paying for it so that it auto-updates. After running the scanners a
second time over the weekend, I will also seek out others (though these will
be more in the antivirus line.) Any further suggestions will be more than
welcome.

> You mentioned "Avast!" --> I suggest switching to "Avira AntiVir" or "eSet
> NOD32" (AV only - no suites.) The first is free for home use, the latter
> is less than $60 U.S. for two years. I would say they should run quite
> well and use less resources - thus making the entire computer run a bit
> better.

I truly like Avast!, and even if it's a bit of a drag, I can't see it being
too much. Plus, I don't generally enable all of its scanners, or even
install them. Just the basic "Standard", "Web" and "Network" shields (or
whatever they're calling them in the new version.) But thanks for the
referrals. I'll definitely try them out, even if it's only on a test
machine. Been a few years since I did that kind of study and things
certainly do change quickly in this business.

> No third-party firewall software. Use the built-in firewall.

My usual practice, especially when the DSL modem/router has another one
built in.

> For the most part - no active 'antimalware only' software. One could
> purchase/run MalwareBytes active protection if you feel it will keep this
> machine running longer because of the owners 'habits' --> but I wouldn't
> do it unless it comes to that.

I assume that even if the machine is still in poor shape, the new 2GB of RAM
will allow whatever protections I deem necessary. I only ever allow one
background AV and one background anti-malware app.

> But on to your cleanup query...
>
> First - do you have a complete backup of this system "as-is"? I would
> suggest some sort of image file creation of the entire system - so you
> could revert to that if things get really bad. Barring that - just a copy
> of all the important files (documents, bookmarks, emails, contacts, music,
> pictures, etc...)

Before I work on a machine, I always create one backup of personal data on
CD or DVDs, and another straight-forward copy to an old machine that I use
for this and other "risky" things. Under certain circumstances I also clone
the system, but only if it makes sense. In this case, I figure that if it
isn't decently "cured" after Monday, I'll do a clean install.

> As for your resistance in a clean install - that may be doing
> yourself/your friend's son a dis-service. If it was "wildly inundated
> with spyware, etc", there is no guarantee, short of a clean installation,
> that you have cleared everything (rootkits are seldom found by antivirus
> or basic antimalware applications.) It is almost a certainty (given
> nothing more than your symptoms) that even if you have cleared
> everything - the dmage from the attacks still exists.

Acknowledged, and I am frankly a big fan of clean installs. Still, to do a
clean install will take a lot more effort (for me) and time (which the
"client" can't abide.)

> Along that latter line - I would highly suggest a repair
> installation(in-place upgrade). Not just any repair installation
> (in-place upgrade) - but one with a Service Pack 3 level installation
> media (of Windows XP.) That way you kill two birds with one stone. You
> fix the system files and you do so with SP3 level replacements. (You can
> integrate/slipstream SP3 into said media, burn a new copy and use it to do
> the repair - if you don't know how - look into nLite and/or AutoStreamer
> using Google.)

I can do a repair install using slip-streamed media that isn't derived from
the original media? Don't think I ever knew that, though my memory truly
sucks over the last few years. Thanks!

> How to Perform a Windows XP Repair Install
> http://www.michaelstevenstech.com/XPrepairinstall.htm
>
> How to perform an in-place upgrade (reinstallation) of Windows XP
> http://support.microsoft.com/kb/315341
>
> After you perform said repair - I would probably still suggest the
> following steps.
> (Yes - all of them, even ones you have done before, in order.)
>
> Reboot and logon as administrative user.

Always do. In fact, I created one just for me that I'll dump before
returning it.

> Download/install Internet Explorer 7 - it will revert to IE6 - you should
> at least have the system at IE7 - and for now - leave it at IE7.
> http://www.microsoft.com/downloadS/details.aspx?familyid=9AE91EBE-3385-447C-8A30-081805B2F90B

Should I change that instruction to IE8, as that's the one now there, or
should I uninstall IE8 and proceed as you instruct?

> Reboot and logon as administrative user.
>
> Fix your file/registry permissions...
>
> Ignore the title and follow the sub-section under
> "Advanced Troubleshooting" titled,
> "Method 1: Reset the registry and the file permissions"
> http://support.microsoft.com/kb/949377
> *will take time
> ** Ignore the last step (6) - you should already have SP3.

"My Computer" properties show SP3 installed. But I can't imagine that it's
proof of a perfectly successful installation.

Definitely the hints I was looking for, at least a few of them, anyway.
Thanks!

> Reboot and logon as administrative user.
>
> You should now perform a full CHKDSK on your system drive (C:)...
>
> How to scan your disks for errors
> http://support.microsoft.com/kb/315265
> * will take time and a reboot
>
> You should now perform a full Defragment on your system drive (C:)...
>
> How to Defragment your hard drives
> http://support.microsoft.com/kb/314848
> * will take time
>
> Reboot and logon as administrative user.

CHKDSK and DEFRAG are on my list, but I figured to wait until everything
else is done before running those.

> Visit http://windowsupdate.microsoft.com/ in Internet Explorer and
> select to do a CUSTOM scan...
>
> Every time you are about to click on something while at these web pages -
> first press and hold down the CTRL key while you click on it. You can
> release the CTRL key after clicking each time.

What does this accomplish? Not something I recall ever doing. When I try it
just now, I don't see any obvious effect. I regularly use the shift key to
open links in a new window, but I've never heard of this one.

> Once the scan is done, select just _ONE_ of the high priority updates
> (deselect any others) and install it.
>
> Reboot and logon as administrative user.
>
> If it did work - try the web page again - selecting no more than 3-5 at a
> time. Rebooting/logging on as an administrative user as many times
> as needed.
>
> The Optional Software updates are generally safe - although I recommend
> against the "Windows Search" one and any of the "Office Live" ones or
> "Windows Live" ones for now. I would completely avoid the
> "Optional Hardware" updates. Also - I do not see any urgent need to
> install Internet Explorer 8 at this time.

I already went ahead and installed the few priority updates last night, and
only the Optionals that I consider probably useful and not onerous. Windows
Live is the only stuff from your list that's installed, other than IE8. I
intend to remove the Live stuff, but other than speed/performance issues,
are there any other significant reasons to remove IE8? (I also blocked
Windows Search.)

> After all of that...
>
> If you are comfortable with the stability of your system, you can delete
> the
> uninstall files for the patches that Windows XP has installed...
> http://www3.telus.net/dandemar/spack.htm
> ( Particularly of interest here - #4 )
> ( Alternative: http://www.dougknox.com/xp/utils/xp_hotfix_backup.htm )

I've always wondered: Other than storage space issues, is there any other
reason for deleting those files?

> You can run Disk Cleanup - built into Windows XP - to erase all but your
> latest restore point and cleanup even more "loose files"..
>
> How to use Disk Cleanup
> http://support.microsoft.com/kb/310312
>
> You can turn off hibernation if it is on and you don't use it..
>
> When you hibernate your computer, Windows saves the contents of the
> system's
> memory to the hiberfil.sys file. As a result, the size of the hiberfil.sys
> file will always equal the amount of physical memory in your system. If
> you
> don't use the hibernate feature and want to recapture the space that
> Windows
> uses for the hiberfil.sys file, perform the following steps:
>
> - Start the Control Panel Power Options applet (go to Start, Settings,
> Control Panel, and click Power Options).
> - Select the Hibernate tab, clear the "Enable hibernation" check box, then
> click OK; although you might think otherwise, selecting Never under the
> "System hibernates" option on the Power Schemes tab doesn't delete the
> hiberfil.sys file.
> - Windows will remove the "System hibernates" option from the Power
> Schemes
> tab and delete the hiberfil.sys file.

I almost never use Hibernate, or even Standby, for that matter. That's
mostly due to the horrible effects I encountered during years of Win9x work.
But I never new how to make Hibernate disappear. Is it possible to do
something similar for Standby as well?

These are all things I've already done, but thanks for reminding me to
reduce the TIF size. I maxed it at one point to see if it was involved in
preventing SP3 from downloading successfully, but forgot to change it back.
It didn't help, so I DL'd it on my machine and made a CD. (Copied that to
the HD before installing.)

> You can use an application that scans your system for log files and
> temporary files and use that to get rid of those:
>
> Ccleaner (Free!)
> http://www.ccleaner.com/
>
> Other ways to free up space..
>
> JDiskReport
> http://www.jgoodies.com/freeware/jdiskreport/index.html
>
> SequoiaView
> http://www.win.tue.nl/sequoiaview/
>
> Those can help you visually discover where all the space is being used.

I've used CCleaner, but I'm not familiar with the other two. I am also
considering temporarily installing R-Wipe&Clean, which I own, just to finish
cleaning up, but I figure I'll wait until everything else is done.

> In the end - a standard Windows XP installation with all sorts of extras
> will not likely be above about 4.5GB to 9GB in size. If you have more
> space
> than that (likely do on a modern machine) and most of it seems to be
> used -
> likely you need to move *your stuff* off and/or find a better way to
> manage
> it.

The drive is 70GB with 50GB free. Still, I am also a fan of creating at
least one separate partition for user files and other storage (downloaded
apps, etc.), and I usually also create a TEMP partition for TEMP and TIF,
just to keep the system partition from getting too cluttered. I have to ask,
first, but I assume I'll be doing that at some point.

> Not mentioned above - amazingly - is the fact that you also may want to
> use this mass-cleanup/updating/fix opportunity to download the latest
> hardware device drivers from the manufacturer(s) web site(s) and install
> them. If it is a third-tier type system (Dell, HP, Lenovo, Gateway,
> etc) - get all those from said manufacturers support web page for the
> product model in question - I would even recommend updating the System
> BIOS at this time (it could prevent some issues with the memory you plan
> to install even...) If it is less of an OEM/third-tier and more a
> hodge-podge of parts - visit the individual hardware manufacturer's web
> pages and get the device drivers straight from them (avoid getting
> non-microsoft hardware drivers from Microsoft.)

Again, this something I intend to do after the new RAM is installed. And I'm
very aware of the need to ignore drivers provided by WU! Learned that lesson
not long after they started offering them.

> The system should be - for all intents/purposes - pretty well cleaned up
> after all that. Still a possibility it is infected, still a possibility
> that some of the other software installed (likely beyond the OS) still has
> damage done by the, "wildly inundated with spyware, etc" situation the
> system was once in. Better however - without a doubt.
>

Thank you VERY much, Shenan. This post is a keeper. It's already copied into
my stash of reference materials. While I knew much of what you suggested,
there were a few thing that I *should* know but have slipped through the
sieve that is my mind these days. I can report one good thing: I realized
this morning that I hadn't actually run Ad-Aware yet, so I set it to do so
while I was out. The system is now doing MUCH better (though it is still
ridiculously slow!) I'll let y'all know the results.

--
Ronin

Ronin

unread,
Feb 19, 2010, 2:07:13 PM2/19/10
to
Thanks, Pa! I'm quite familiar with clean install procedures, and even when
I use "Restore" options from Dell, HP, etc., I'm careful to get rid of the
pre-installed crap. But can you give me any more information on Avast being
installed before cleaning up the system? I have occasionally gone to the
trouble of removing an infected drive and installing it on my disposable
machine to run one or three AV apps before scanning it all over again after
reinstalling it (can't really scan the Registry if it isn't loaded, can
you?) In fact I was already considering doing it for this machine, now that
I have to wait until Monday. Thing is, this is a no-pay job and I'm a bit
tight on time. But if you say that Avast is probably not functioning
properly, I'll go ahead and dive deeper. Is this only Avast you're speaking
of, or AV apps in general?

Thanks, too, for the additional suggestions. As I mentioned in my reply to
Shenan, I have a tendency to forget a lot of things, and your list includes
a few such items.

--
Ronin


"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:eMs7SFYs...@TK2MSFTNGP04.phx.gbl...

HeyBub

unread,
Feb 19, 2010, 3:28:20 PM2/19/10
to
Ronin wrote:
>
> With all but the minimum background apps disabled (all but Avast! and
> Ad-Aware resident protections), the system essentially doesn't run at
> all. Takes ten minutes just to load, probably mostly due to three or
> four IMs that load automatically.

So, is the system unacceptably slow only at start up, or is everything
creepy even after booting?

If only the former, don't power-down the system, "hibernate" instead.

256M *IS* sufficient to run XP.


Ronin

unread,
Feb 19, 2010, 4:15:21 PM2/19/10
to
The system is snail-slow all the time. It's only when I leave that ton of
stuff in the Startup queue that it takes ten minutes to load (maybe more
like 20!), and is so slow that I keep expecting a bunch "Not responding"
messages. Of course, it's so bogged down, maybe those messages are trying to
appear and never actually make it to the screen, ;-)With the startup queue
disabled entirely, it loads as fast as I'd expect under these conditions.

As noted in my reply to Shenan, I loathe both Hibernate and Standby. And I'm
installing 2GB of RAM when I get back from running chores later, so I figure
that problem will disappear.

You may be able to run XP on 256MB of RAM, I may be able to run XP on 256GB
of RAM (though I of course couldn't get any real work done, being in the
graphic arts business), but this is XP Home Premium, with Media Center or
whatever it's called, and while he doesn't store much on the HD, he
obviously uses it fairly often to listen, watch and burn. Plus, as I said in
my reply to Shenan, why would anybody want to practice such stinginess when
you can buy two gigs for 50 bucks?

Thanks,anyway.

--
Ronin

"HeyBub" <hey...@gmail.com> wrote in message
news:ejCfVIas...@TK2MSFTNGP02.phx.gbl...

Ronin

unread,
Feb 19, 2010, 4:34:21 PM2/19/10
to
"Daave" <da...@example.com> wrote in message
news:%23T8bnCW...@TK2MSFTNGP02.phx.gbl...

I'm aware that XP can run on 256MB of RAM, even when video is stealing some.
(I'll be tossing a real video card into the machine at some point -- I've
got quite a few in my spare parts bin.) In fact, I've done is a few times on
a temporary basis. I also maintain a "lean machine", if that can even be
said for Vista. But there's no way I'm going to expect this kid to keep it
that way. (He's not actually a kid anymore, but he has a few developmental
issues, mostly a textbook case of Tourette's syndrome.) But when you can get
2GB for $50, there's very little reason not to. (Good news! That Crucial
order that I placed late Wednesday evening (PST) arrived just now instead of
Monday as expected. Makes the weekend look a lot less frustrating.) I
checked on pagefile usage and it's consistently running well over 512MB when
anything is happening, and over 300 when simply idling (no background
stuff.)

> Two thoughts for the situation you mention:
>
> 1. The PC was found to have been "wildly inundated with spyware." It's
> certainly possible there is still some spyware present. Non-viral malware
> is one of the most common causes of slow PCs. Of course, anti-malware
> programs will show tracking cookies as undesirable, so since you didn't
> inform us as to *which* spyware was found, we can have no idea as to the
> severity of the situation (tracking cookies are text files, so they won't
> slow a PC down). If you did write down specific names of infections,
> include them in your next post!
>
> This page has all the information you need to deal with malware of all
> types:
>
> http://www.elephantboycomputers.com/page2.html#Removing_Malware

Thanks for the reminder! I'm familiar with that site from years back. Isn't
that Malke's site? As for the malware that was found, see below. By the way,
FYI, I just saw that AdAware's new release is not doing well on XP (Home or
Pro). Anyone who has installed it should run Update to fix the issue. This
info was just released today.
http://www.lavasoft.com/mylavasoft/support/blog/adaware-82-update

> 2. There is a best-practices method for installing SP3. It sounds like you
> didn't follow it. Among other things, security programs such as Avast
> should not be running when SP3 is applied.

I killed everything, including Avast!, before doing any of this stuff (with
the network adapter disabled.) Worst thing that I didn't mention before is
that the system went quite a while (weeks, at least) without any AV
installed. They apparently tried to remove McAfee (the one that came from
Dell), and of course ended up with a royal mess. First thing I did was to
clean that up.

> The first thing you need to do is find out what SP level the PC is
> currently at:
>
> Start | Run
>
> Type:
>
> winver
>
> Click OK.
>
> What is the SP level shown?

It says SP3, but is that really any confirmation that the installation was
entirely successful?

Here's the list of malware found, though I'm not sure it's complete. I'm
relying on log files and I'm not sure I've found them all. I can't honestly
remember the exact order I ran them in, (I think it's chronological here),
but if it's important I'll try to pin it down. I won't post all the details
out of respect for the forum, and I intend to eventually run HJT when I
think everything else that can be done is done. If I see anything I don't
recognize, I'll post it to one or another appropriate forum. I will also be
running these scanners and others until all scans show clean. Plus, after
reading Pa Bear's advice, I'll probably yank the HD and drop it into my
throwaway machine to scan it from outside the system. With any luck, that
will do it. I really don't feel like getting into all the apps reinstalling
and setting up that a clean install would require. Got too many other things
on my plate.

If anybody sees anything truly dangerous or unlikely to be uninstalled
completely, please advise.

SuperAntiSpyware
-- Rogue.AntiSpyStorm
-- Unclassified.Unknown Origin ({279A05E3-C129-4189-F0DB908C89B0};
{4816B9DF-8D34-49D3-B96A-5FCE358835D5}; HKCR\msscds32.msdn_hlp, plus a DLL
in the System32 directory and a few other things. It's apparently a BHO and
I'm certain the kid doesn't even know what MSDN is.
-- Trojan.FakeAlert-IEBT
-- Rogue-AntiSpyCheck
--Trojan.SmitFraud Variant
-- sPeerObj Class BHO
-- Trojan.Agent BHO
-- Adware.2020Search
-- Adware.404Search
-- Adware.180Solutions/SurfAssistant
-- Adware.Second Thought
-- Trojan.PBar (LOL, this one immediately brought Pa Bear to mind!)
-- Adware.MyWebSearch
-- Transponder Variant BHO
-- Adware.BetterInternet
-- Trojan.Smitfraud Variant/IE Anti-Spyware
-- Adware.Tracking Cookie
-- Adware.MyWebSearch/FunWebProducts
-- Browser Hijacker.Internet Explorer Settings Hijack
-- Trojan.Media-Codec
-- Trojan.DNSChanger-Codec
-- Trojan.VideoCach/Gen
-- Trojan.Media-Codec/v3
-- Trojan.Media-Codec/v4
-- Adware.E404 Helper/Hij
-- Rogue.PersonalAntivirus
-- Adware.180solutions/ZangoSearch
-- Rogue.Agent/Gen-Nullo[DLL]
-- Rogue.Agent/Gen-Nullo[EXE]
-- Trojan.FakeDrop-764
-- Trojan.FakeDrop-CDSM32
--Trojan.FakeDrop-Swin32

SpyBot S&D
-- 2020Search
-- 7FaSSt
-- ABetterInternet
-- WinSpyareProtect
-- AntiSpyStorm
-- Fraud.MSAntispyware2009
-- FunWebProducts
-- MagicAntiSpy
-- MalwareAlarm
-- Microsoft.Windows.ActiveDesktop (is this the actual Windows Active
Desktop or an imposter???)
-- Microsoft.Windows.Security.InternetExplorer (again, is this real or
fake?)
-- MyWay.MyWebSearch
-- MyWebSearch
-- SecondThought.STCLoader
-- Smitfraud-C.
-- Smitfraud-C.gp
-- SpySherrif
-- Win32.BHO.je

Malwarebytes:
-- Rogue.AntiSpyStorm
-- Adware.MyWebSearch, mostly in HKLM\Software\Microsoft\Internet
Explorer\Low Rights\ElevationPolicy but there's a couple elsewhere.
-- Adware.PopCap (PopCapLoader)
-- Trojan.BHO infecting folder C:\WINDOWS\System32\459849
-- Malware.Trace 50 or so files in C:\WINDOWS\System32\drivers
-- Fake.Dropped.Malware
-- Trojan.Agent
-- Trojan.Zlob

Ad-Aware:
-- A few cookies of the type that always seem to weasel their way through
the walls. IIRC, they were mostly webtrends and atdmt. I'm only half
educated on these items, but I'm working on learning how to prevent them
from digging in their hooks.
-- 2 items belonging to Win32.Trojan.Agent. Removing these a bit ago
improved things substantially, though it may have been the result of the
MalwareBytes scan I ran befrore posting last night. Still slow, but no
longer in critical condition.

Shenan Stanley

unread,
Feb 19, 2010, 6:45:34 PM2/19/10
to
Ronin wrote:
> The system is snail-slow all the time. It's only when I leave that
> ton of stuff in the Startup queue that it takes ten minutes to load
> (maybe more like 20!), and is so slow that I keep expecting a bunch
> "Not responding" messages. Of course, it's so bogged down, maybe
> those messages are trying to appear and never actually make it to
> the screen, ;-)With the startup queue disabled entirely, it loads
> as fast as I'd expect under these conditions.
> As noted in my reply to Shenan, I loathe both Hibernate and
> Standby. And I'm installing 2GB of RAM when I get back from running
> chores later, so I figure that problem will disappear.
>
> You may be able to run XP on 256MB of RAM, I may be able to run XP
> on 256GB of RAM (though I of course couldn't get any real work
> done, being in the graphic arts business), but this is XP Home
> Premium, with Media Center or whatever it's called, and while he
> doesn't store much on the HD, he obviously uses it fairly often to
> listen, watch and burn. Plus, as I said in my reply to Shenan, why
> would anybody want to practice such stinginess when you can buy two
> gigs for 50 bucks?

I think you went overkill with the RAM - my bet - you won't even use up 1GB.
You *might* make it to 768MB, but my bet would be between 384MB and 640MB
actually used. Not that I wouldn't have probably just bought as much as the
machine would take, myself - just that I don't think it is really going to
speed up much of anything on that system in the long run. ;-)

Ronin

unread,
Feb 19, 2010, 9:26:16 PM2/19/10
to
I was going to go with a pair of 512's (according to Dell, it has to be a
pair) for $35, but it was only $15 more for a pair of 1024's, so I figured I
might as well. I've never bothered with more than that in a x86 machine, or
with any Windows, really. I know that three's pretty much the max for most
Windows systems (not sure about Vista 64-bit and I know zip about Win7).

I figure that this guy hasn't been getting into major multimedia stuff only
because he hasn't been able to. Plus, one thing that I've noticed becoming
quite popular in this town is getting TV shows from the internet. (Small
town in the boonies with lousy cable TV and well over half the roofs have
DirecTV or DISH receivers mounted.) Gotta think that needs a decent chunk of
RAM, probably somewhere between 1 to 1.5 GB. But I've always liked having
way too much RAM, even back when it was expensive. Don't really know if it's
needed, but I certainly don't have to worry about it, <s>.

--
Ronin

"Shenan Stanley" <newsh...@gmail.com> wrote in message

news:e$KSm2bsK...@TK2MSFTNGP02.phx.gbl...

Ronin

unread,
Feb 19, 2010, 9:54:14 PM2/19/10
to
For some reason, I can only post to this sub-thread. I can't post any
replies to Pa Bear or Daave, and some guy named Jose posted a reply that
also doesn't show up here (directly subscribed to msnews.)

So anybody who wants to continue with me probably ought to head over to
Google. http://preview.tinyurl.com/yaveerk

In any case, I will repost my replies to Daave and Pa here in this
sub-thread. Maybe that will cover it.

--
Ronin

"Shenan Stanley" <newsh...@gmail.com> wrote in message

news:e$KSm2bsK...@TK2MSFTNGP02.phx.gbl...

Ronin

unread,
Feb 19, 2010, 9:58:35 PM2/19/10
to

Daave, as noted elsewhere, I seem to be restricted to this sub-thread and
can't post replies to you or Pa Bear. Google Groups shows everything, but I
figure I'll try one more trick here. Replies are inline.

"Daave" <da...@example.com> wrote in message
news:%23T8bnCW...@TK2MSFTNGP02.phx.gbl...

Thanks for your interest and assistance, Daave

--
Ronin

Ronin

unread,
Feb 19, 2010, 10:00:40 PM2/19/10
to
Ummm... I've replied to both you and Pa Bear, Daave, but the posts haven't
shown up. That was almost five hours ago. I'll wait a few hours more and
check Google, but just know that I'm not ignoring you, OK?

OK, I checked Google now, and at least the posts are all there. I'll
continue there but I'm guessing something is blocking me

--
Ronin

"Daave" <da...@example.com> wrote in message
news:%23T8bnCW...@TK2MSFTNGP02.phx.gbl...

Daave

unread,
Feb 19, 2010, 10:11:34 PM2/19/10
to
I see what's going on, Ronin.

The MS news server has filtering lots of posts lately (including a
number of mine). It's very annoying. Thanks for figuring out your posts
weren't showing up. I'll now reply to your othr post.

Bill in Co.

unread,
Feb 19, 2010, 10:17:57 PM2/19/10
to
Daave wrote:
> I see what's going on, Ronin.
>
> The MS news server has filtering lots of posts lately (including a
> number of mine).

Based on what, I wonder?


Daave

unread,
Feb 19, 2010, 10:26:17 PM2/19/10
to

Seems like you know your stuff. Two gigs for $50 is a good price, so why
not? :-)

>> Two thoughts for the situation you mention:
>>
>> 1. The PC was found to have been "wildly inundated with spyware."
>> It's certainly possible there is still some spyware present.
>> Non-viral malware is one of the most common causes of slow PCs. Of
>> course, anti-malware programs will show tracking cookies as
>> undesirable, so since you didn't inform us as to *which* spyware was
>> found, we can have no idea as to the severity of the situation
>> (tracking cookies are text files, so they won't slow a PC down). If
>> you did write down specific names of infections, include them in
>> your next post! This page has all the information you need to deal
>> with malware of
>> all types:
>>
>> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>
> Thanks for the reminder! I'm familiar with that site from years back.
> Isn't that Malke's site? As for the malware that was found, see
> below. By the way, FYI, I just saw that AdAware's new release is not
> doing well on XP (Home or Pro). Anyone who has installed it should
> run Update to fix the issue. This info was just released today.
> http://www.lavasoft.com/mylavasoft/support/blog/adaware-82-update

You are correct, Ronin; that is Malke's site.

AdAware, although once highly recommended, is never recommended anymore
by those "in the know." The consensus is that MBAM and SAS is pretty
much all one needs when it comes to non-viral malware checkers.

>> 2. There is a best-practices method for installing SP3. It sounds
>> like you didn't follow it. Among other things, security programs
>> such as Avast should not be running when SP3 is applied.
>
> I killed everything, including Avast!, before doing any of this stuff
> (with the network adapter disabled.) Worst thing that I didn't
> mention before is that the system went quite a while (weeks, at
> least) without any AV installed. They apparently tried to remove
> McAfee (the one that came from Dell), and of course ended up with a
> royal mess. First thing I did was to clean that up.

It sounds like you're on top of things. I always configure a Clean Boot
before installing SP3, just to be on the safe side.

But this line is huge:

> Worst thing that I didn't
> mention before is that the system went quite a while (weeks, at
> least) without any AV installed.

Not good. This is what often produces a situation where malware is too
deeply entrenched that a Clean Install is the only rational solution.

WRT McAfee, did you run their removal tool from here?:

http://service.mcafee.com/FAQDocument.aspx?id=TS100507

But, seriously, running a number of weeks without protection might very
well mean nuking the sucker.

>> The first thing you need to do is find out what SP level the PC is
>> currently at:
>>
>> Start | Run
>>
>> Type:
>>
>> winver
>>
>> Click OK.
>>
>> What is the SP level shown?
>
> It says SP3, but is that really any confirmation that the
> installation was entirely successful?

Yes, that is *the* confirmation.

Did you make sure IE was at IE6 level when you installed SP3 (that is
recommended)?

Yes, my friend. Clean Install is definitely indicated! Whenever there is
this much malware, there are going to be a few rootkits dug in real
deep. It's not worth the effort to try remove them all; most likely you
won't be able to.


Daave

unread,
Feb 19, 2010, 10:30:21 PM2/19/10
to
No worries. I finally saw your other post. :-) Here's my reply:

http://groups.google.com/group/microsoft.public.windowsxp.general/msg/8bb53f09c0092a71?hl=en

Ronin wrote:
> Daave, as noted elsewhere, I seem to be restricted to this sub-thread
> and can't post replies to you or Pa Bear. Google Groups shows
> everything, but I figure I'll try one more trick here. Replies are
> inline.

> Thanks for your interest and assistance, Daave

You're welcome, Ronin.


Daave

unread,
Feb 19, 2010, 10:37:40 PM2/19/10
to

There was a very long list of malware in Ronin's post. MS's filtering is
extremely sensitive (something in that list probably tripped the
automatic mechanism). I've seen innocuous words and names of alt
newsgroups trigger the filtering, too.


Daave

unread,
Feb 19, 2010, 10:36:38 PM2/19/10
to
Daave wrote:
> I see what's going on, Ronin.
>
> The MS news server has filtering lots of posts lately (including a
> number of mine). It's very annoying. Thanks for figuring out your
> posts weren't showing up. I'll now reply to your other post.

Here ya go:

http://groups.google.com/group/microsoft.public.windowsxp.general/msg/8bb53f09c0092a71?hl=en

tl;dr - You will most likely need to perform a Clean Install as there
was *tons* of malware on that PC, which had been running unprotected for
a number of weeks.

20100220

unread,
Feb 19, 2010, 10:34:36 PM2/19/10
to

"Bill in Co." <not_rea...@earthlink.net> wrote in message
news:uo1qOtds...@TK2MSFTNGP04.phx.gbl...

> Based on what, I wonder?

Based on whether you are insulting Microsoft Valuable Pigs (MVPs) as
Scum-Sucking Pigs or questioning the solutions provided by MVPs even if they
are blatantly wrong. If you treat all MVPs as your gods then all your
messages will be posted otherwise they are likely to be censored without
giving any reasons.


Ronin

unread,
Feb 19, 2010, 10:53:30 PM2/19/10
to

Figures that as soon as I whined, the rest of my posts would show up. Don't
see the one for Pa Bear yet, nor the post from Jose. Strange days indeed.

--
Ronin

"Daave" <da...@example.com> wrote in message

news:3PidnenOLaLPyuLW...@cavtel.net...

PA Bear

unread,
Feb 20, 2010, 2:50:14 AM2/20/10
to
I interpreted your description of your friend's description of his
son's computer to mean that a valid, fully-functional & fully-updated
anti-virus application was not installed *when the comuter got
infected*.

You cannot successfully install an anti-virus or anti-spyware
application on an already-infected system.
--
~PA Bear, via Google Groups due to horked newsserver synchronization
(again), not due to any filtering despite what Daave may think


On Feb 19, 2:07 pm, "Ronin" <wanderer> wrote:
> Thanks, Pa! I'm quite familiar with clean install procedures, and even when
> I use "Restore" options from Dell, HP, etc., I'm careful to get rid of the
> pre-installed crap. But can you give me any more information on Avast being
> installed before cleaning up the system? I have occasionally gone to the
> trouble of removing an infected drive and installing it on my disposable
> machine to run one or three AV apps before scanning it all over again after
> reinstalling it (can't really scan the Registry if it isn't loaded, can
> you?)  In fact I was already considering doing it for this machine, now that
> I have to wait until Monday. Thing is, this is a no-pay job and I'm a bit
> tight on time. But if you say that Avast is probably not functioning
> properly, I'll go ahead and dive deeper. Is this only Avast you're speaking
> of, or AV apps in general?
>
> Thanks, too, for the additional suggestions. As I mentioned in my reply to
> Shenan, I have a tendency to forget a lot of things, and your list includes
> a few such items.
>
> --
> Ronin
>

> "PA Bear [MS MVP]" <PABear...@gmail.com> wrote in messagenews:eMs7SFYs...@TK2MSFTNGP04.phx.gbl...


>
>
>
> >> ...It was also wildly inundated with spyware, etc., but no viruses
> >> according to Avast!
>
> > Assuming you installed Avast *after* the computer was infected (in which
> > case I can assure you that it did not install properly)...
>
> > Back-up any personal data (none of which should be considered 100%
> > trustworthy at this point) then format the HDD & do a clean install of
> > Windows.  Please note that a Repair Install (AKA in-place upgrade) will
> > NOT fix this!
>
> > HOW TO do a clean install of WinXP: See

> >http://michaelstevenstech.com/cleanxpinstall.html#stepsand/or Method 1 in


> >http://support.microsoft.com/kb/978307
>
> > After the clean install, you'll have the equivalent of a "new computer" so
> > take care of everything on the following page before otherwise connecting
> > the machine to the internet or a local network  (i.e., other computers)
> > and before using a flash drive or SDCard that isn't brand-new or hasn't
> > been freshly formatted:
>
> >     4 steps to help protect your new computer before you go online
> >    http://www.microsoft.com/security/pypc.aspx
>
> > Other helpful references include:
>
> > HOW TO get a computer running WinXP Gold (no Service Packs) fully patched
> > (after a clean install)

> >http://groups.google.com/group/microsoft.public.windowsupdate/msg/3f5...


>
> > HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
> > clean install)

> >http://groups.google.com/group/microsoft.public.windowsxp.general/msg...


>
> > Tip: After getting the computer fully-patched, download/install KB971029
> > manually:http://support.microsoft.com/kb/971029
>
> > NB: Any Norton or McAfee free-trial that came preinstalled on the computer
> > when you bought it will be reinstalled (but invalid) when Windows is
> > reinstalled. You MUST uninstall the free-trial and download/run the
> > appropriate removal tool before installing any updates, Windows Service
> > Packs or IE upgrades and before installing your new anti-virus application
> > (which will require WinXP SP3 to be installed).
>
> >     Norton Removal Tool
>

> >ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_...


>
> >     McAfee Consumer Products Removal Tool
>

> >http://download.mcafee.com/products/licensed/cust_support_patches/MCP...

> >>http://www.askvg.com/windows-xp-service-pack-3-sp3-setup-error-access...

PA Bear [MS MVP]

unread,
Feb 20, 2010, 2:43:28 AM2/20/10
to

1. Try disabling the Communities "feechur" in Windows Mail.

2. Please do NOT edit the subject when replying to an ongoing thread.


Ronin wrote:
> For some reason, I can only post to this sub-thread. I can't post any
> replies to Pa Bear or Daave, and some guy named Jose posted a reply that
> also doesn't show up here (directly subscribed to msnews.)
>
> So anybody who wants to continue with me probably ought to head over to
> Google. http://preview.tinyurl.com/yaveerk
>
> In any case, I will repost my replies to Daave and Pa here in this
> sub-thread. Maybe that will cover it.
>
>

Jose

unread,
Feb 20, 2010, 6:42:25 AM2/20/10
to
On Feb 19, 10:53 pm, "Ronin" <wanderer> wrote:
> Figures that as soon as I whined, the rest of my posts would show up. Don't
> see the one for Pa Bear yet, nor the post from Jose. Strange days indeed.
>
> --
> Ronin
>
> "Daave" <da...@example.com> wrote in message
>
> news:3PidnenOLaLPyuLW...@cavtel.net...
>
>
>
> > No worries. I finally saw your other post. :-) Here's my reply:
>
> >http://groups.google.com/group/microsoft.public.windowsxp.general/msg...

>
> > Ronin wrote:
> >> Daave, as noted elsewhere, I seem to be restricted to this sub-thread
> >> and can't post replies to you or Pa Bear. Google Groups shows
> >> everything, but I figure I'll try one more trick here. Replies are
> >> inline.
>
> >> Thanks for your interest and assistance, Daave
>
> > You're welcome, Ronin.

I doubt anybody is filtering posts and why would they just pick on
some people and nobody else?

I would recommend reading the Jose post following your message of SP3
installation experience.

Daave

unread,
Feb 20, 2010, 10:00:20 AM2/20/10
to

There is no person filtering, but it is occuring (automatically). Simply
compare the Google Group versus the MS news server feed.


Ronin

unread,
Feb 20, 2010, 1:01:23 PM2/20/10
to
1. After looking high and low for any mention of "Communities", I finally
bit my tongue and consulted Help. I am not subscribed to any "Communities"
and as I said, I see absolutely no mention of them in Windows Mail
whatsoever. Is there something else I should do?

2. I am not in the habit of changing subject lines, but I was intent upon
getting the best advice possible, including from you (heck, especially from
you), and not seeing them show up was more than a little frustrating. Not
something I was used to seeing here back when I was more active. Catching
your eye with an addendum to the subject seemed the best way to proceed. My
apologies.

--
Ronin

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:e6AAkFgs...@TK2MSFTNGP05.phx.gbl...

PA Bear [MS MVP]

unread,
Feb 20, 2010, 4:21:04 PM2/20/10
to
You will find support for still-in-beta Windows Mail (i.e., disabling the
Communities feature) in this public newsgroup:
news://msnews.microsoft.com/microsoft.public.windows.vista.mail


Ronin wrote:
> 1. After looking high and low for any mention of "Communities", I finally
> bit my tongue and consulted Help. I am not subscribed to any "Communities"
> and as I said, I see absolutely no mention of them in Windows Mail
> whatsoever. Is there something else I should do?
>
> 2. I am not in the habit of changing subject lines, but I was intent upon
> getting the best advice possible, including from you (heck, especially
> from
> you), and not seeing them show up was more than a little frustrating. Not
> something I was used to seeing here back when I was more active. Catching
> your eye with an addendum to the subject seemed the best way to proceed.
> My
> apologies.
>
>

PA Bear [MS MVP]

unread,
Feb 20, 2010, 4:27:54 PM2/20/10
to
Daave wrote:
<snip>

>> I doubt anybody is filtering posts and why would they just pick on
>> some people and nobody else?
>
> There is no person filtering, but it is occuring (automatically). Simply
> compare the Google Group versus the MS news server feed.

Posts aren't going missing due to Filtering, they're going missing because
of the ongoing (i.e., since 2Q09) problem keeping the master and slave
newsservers in synchronization. When you open this or any other
heavily-trafficked newsgroup and find scores of new posts, the newssevers
have been syncing properly. When you open the same newsgroup(s) 12-24 hours
later and find only a handful of posts, syncing is horked again.

No amount of bitching & griping to the Power That Be have made any
difference.

PS: /No one/ is monitoring the synchronization between 5 PM PT Friday and 9
AM PT Monday or on any holidays!!

Sam Ronin

unread,
Feb 20, 2010, 5:02:18 PM2/20/10
to
On Feb 19, 7:26 pm, "Daave" <da...@example.com> wrote:
> Ronin wrote:
> > "Daave" <da...@example.com> wrote in message
<CHOPPED>

>
> It sounds like you're on top of things. I always configure a Clean Boot
> before installing SP3, just to be on the safe side.
>
> But this line is huge:
>
> > Worst thing that I didn't
> > mention before is that the system went quite a while (weeks, at
> > least) without any AV installed.
>
> Not good. This is what often produces a situation where malware is too
> deeply entrenched that a Clean Install is the only rational solution.
>
> WRT McAfee, did you run their removal tool from here?:
>
> http://service.mcafee.com/FAQDocument.aspx?id=TS100507

Yes, I ran the McAfee tool first thing. (I forget. What's "WRT"?)

> But, seriously, running a number of weeks without protection might very
> well mean nuking the sucker.

Yeah, I figured that, but when it comes down to it, the kid isn't
easily teachable and I'm not going to get involved in overseeing his
activities, either. That leaves me the task of doing what I can to
protect him from himself, but even if it's a clean install, I don't
give it more than a few weeks before it's all back (well, not ALL!) In
short, I don't really see a critical need to return a spanking new,
clean machine. My primary interest is to get SP3 installed properly
and the machine reasonably functional. Maybe in the future, when I
have more time, I'll do the clean install and also take the time to
teach him how to, for instance, NOT click on those pop-ups that scream
about your being infected and CLICK THIS NOW!! Not to mention those
despicable default inclusions of Google junk, etc. (Yeah, I know
they're supposedly not malware, but you'll have a hard time proving
that to me!)

> >> The first thing you need to do is find out what SP level the PC is
> >> currently at:
>
> >> Start | Run
>
> >> Type:
>
> >> winver
>
> >> Click OK.
>
> >> What is the SP level shown?
>
> > It says SP3, but is that really any confirmation that the
> > installation was entirely successful?
>
> Yes, that is *the* confirmation.

It showed SP3 when I checked. I'm hesitant to believe in such simple
yes/no answers when it comes to something so complicated, but until
proven otherwise, I'll go with it.

> Did you make sure IE was at IE6 level when you installed SP3 (that is
> recommended)?

IE8 is what is on it. Do I have to revert all the way back to IE6? Is
it even possible to revert all the way back to IE6?

Oh, well. I guess I'll give his Mom a call and have bring over his
apps CDs, etc., and go for it. Repartition it while I'm at it. This
exercise has been quite informative and good for my own goopy
knowledge store. I'll accept that SP3 installed OK (finally), but I'm
still curious as all get out as to what those two logon scripts do.
Now that I'm leaning more and more towards a clean install, however, I
think I'll run it again and see if I can find the BAT file (or script,
whatever) before it's obliterated, which I assume it is after it's
done its job. Unfortunately, the commands weren't echoed, just the
returns.

Thanks again to everyone,

--
Ronin

Sam Ronin

unread,
Feb 20, 2010, 6:23:29 PM2/20/10
to
On Feb 19, 6:06 am, Jose <jose_e...@yahoo.com> wrote:

> On Feb 19, 4:32 am, "Ronin" <wanderer> wrote:
>
>
>
>
>
> > A friend's son's machine is relatively new for XP (2005), but it is sorely
> > lacking in RAM, something that will be remedied as soon as Crucial delivers
> > on Monday. It was also wildly inundated with spyware, etc., but no viruses
> > according to Avast! Took a couple of days, but it seems relatively clean
> > now. Probably some permanent damage, but clean reinstall is something I'm
> > trying to avoid.
>
> > Meanwhile, being an impatient sort of person, I still tried to install SP3
> > before upping the RAM. The install failed at first due to permissions issues
> > which I thought I had remedied using SUBINACL as described here:http://www.askvg.com/windows-xp-service-pack-3-sp3-setup-error-access...
>
> > The install actually finished after several hours -- 256MB RAM for WinXP is
> > a
> > crime, Dell should be held responsible for even allowing such a
> > configuration. Anyway, when I rebooted, it showed itself updating things
> > before logging on (the way Windows Updates often do.) But after logging on,
> > two command windows popped up. One did whatever and went away quickly, but
> > the other one showed a dozen or two responses, all of them "Access denied"
> > (may not be the exact phrase.)
>
> > I plan to reinstall SP3 when the new RAM arrives (unless that is
> > contraindicated), but I suspect that won't solve this issue. My assumption
> > is that the errors mean that the install wasn't entirely successful, but I'm
> > not stuck on that. Maybe the responses are expected in certain
> > circumstances. Still, if there is anything more I can do to ensure a clean
> > installation, please tell me all about it (or them.)
>
> > Much thanks,
>
> > --
> > Ronin
>
> You did not mention if you followed the SP3 installation directions.
>
> http://support.microsoft.com/kb/950717

I did check that page, and the only thing that isn't SOP is the issue
about the two updates that need to be uninstalled. They're not
installed so that was that. I checked the error listings, and while it
gave me hints about earlier permissions errors, they don't appear to
cover my issue, the question about the post logon scripts. I later saw
the issue of DoRegistryUpdates failing, but only after I'd already
dealt with it based upon info from the site I mentioned in my first
post. It's fixed by installing SUBINACL.

> It includes solutions to the access denied issues that come about by
> not following the recommended installation procedures, why they happen
> and what to do about it.


> You should not need to download any third party solutions, ideas, etc.
> to install SP3.
>
> I would think that if I got a single error that defied explanation
> during any SP3 install, I would just start over.

Which I did, at least four times. Each time I researched and remedied
the error. It's just that this last time when the installation went
through to the end and I rebooted and then saw one console for a
couple of seconds with no text showing (usually normal), and then the
second console window that listed one "access denied" message after
another -- it's got me stumped. Daave says that if the winver says
it's SP3 then SP3 it is, but it just nags me that all those commands
returned those errors. Makes me feel all cold and clammy.

> I would recommend expanding your malicious software detection horizons
> a bit.  No single program knows about everything and it is easy for me
> to infect my computer on purpose and Avast! will miss some infections
> every time.  It is not terribly bright about some things, and I have
> concluded it is weak, a system resource hog and a waste of time.  But
> that is my opinion.

I agree that no one program can catch all viruses. And when there's
any question I run lots of various scans with the usual players. But
you can only run one AV background scanner at a time, and Avast has
proven to be (in my own experience), easy to use and dirt cheap (hard
to beat a price of $0). I don't know what tests or comparisons you've
run, but I'd be interested in seeing the results, and knowing what
things you're talking about that Avast! isn't too bright about? As for
being a system resource hog, I'm not clear on your meaning. You can't
be talking about Windows Resources from the 9x models. Do you mean
RAM? Or is there some other part of the architecture you're referring
to?

> Depending on your Avast! installation options and what pieces you
> chose to install (or did you just let it install everything?), you
> probably have a bunch of Avast! things running you do not need and can
> thwart an SP3 installation and reduce your performance - a lot.  If
> you decide to stick with Avast! you may want to uninstall it all,
> clean up the mess and   then uninstall/reinstall SP3 properly so there
> are no errors (using the directions), then rethink how to install
> Avast! again with less overhead for your system resources.

Avast is no different from most major-brand AVs and their "pile it
higher" mentality. In fact it's rather at the top of the list in this
regard when comparing "suites". And no, I don't install all scanners.
Even if they are all installed, I generally only enable Standard, Web,
and Network scanners. For home users, I often don't even bother to
install that last one if the home's machines aren't sharing. On the
other hand, the owner of this machine needs as much protection from
himself as I can build into it, so I'll enable the rest of the shields
as well, except the mail shield which I'm pretty sure is unnecessary
when there's no local email client being used. Heck, it's unnecessary
even when there *is* a local email client and the user is minmally
educated, but like I said...

> 256MB RAM is fine for some people.  It has served me well for many
> years but I run a pretty lean configuration.
>
> You do not want your system to be relatively clean, you want it to be
> squeaky clean.

1. It's not my machine, thank Gates.
2. The owner is very likely to have this thing reinfected to the gills
within weeks, anyway, even after a perfectly clean install and as much
protection as I can pile on. If relatively clean manages to pass my
own tests, it's going to have to be good enough, at least until I have
more spare time to do it right and to give the guy the training he
needs.

> Perform some scans for malicious software, then fix any remaining
> issues:
>
> Download, install, update and do a full scan with these free malware
> detection programs:
>
> Malwarebytes (MBAM):  http://malwarebytes.org/
> SUPERAntiSpyware: (SAS):  http://www.superantispyware.com/
>
> They can be uninstalled later if desired.
>
> If you want some ideas about your configuration, start here:
>
> To eliminate questions and guessing, please provide additional
> information about your system.
>
> Click Start, Run and in the box enter:
>
> msinfo32
>
> Click OK, and when the System Summary info appears, click Edit, Select
> All, Copy and then paste the information back here.
>
> There will be some personal information (like System Name and User
> Name), and whatever appears to be private information to you, just
> delete it from the pasted information

I don't see anything there that could possibly be of any further use.
Just a couple of things that have already been covered quite a bit
(RAM and WINVER). But thanks! I didn't respond to your post earlier
because it didn't show up on the msnews servers. I really am
interested in a more detailed account of your experiences with Avast,
and I know it's time I did another massive review of the field. Last
one I did was four years ago, having been out of the business
(actually more like outside civil society altogether).

Thanks again,

--
Ronin

Sam Ronin

unread,
Feb 20, 2010, 6:28:30 PM2/20/10
to
On Feb 19, 7:34 pm, "20100220" <20100...@discussions.microsoft.com>
wrote:
> "Bill in Co." <not_really_h...@earthlink.net> wrote in messagenews:uo1qOtds...@TK2MSFTNGP04.phx.gbl...

>
> > Based on what, I wonder?
>
> Based on whether you are insulting Microsoft Valuable Pigs (MVPs)  as
> Scum-Sucking Pigs or questioning the solutions provided by MVPs even if they
> are blatantly wrong.  If you treat all MVPs as your gods then all your
> messages will be posted otherwise they are likely to be censored without
> giving any reasons.

Ooooohhh... Sombowy got his feelings hurt... 'Course, he's a bit on
the schizo side... I think I'll choose your advice over that of the
MVPs. Got any? Let's trade!

--
Ronin

Sam Ronin

unread,
Feb 20, 2010, 6:40:41 PM2/20/10
to
On Feb 19, 11:50 pm, PA Bear <pabear...@gmail.com> wrote:
> I interpreted your description of your friend's description of his
> son's computer to mean that a valid, fully-functional & fully-updated
> anti-virus application was not installed *when the comuter got
> infected*.
>
> You cannot successfully install an anti-virus or anti-spyware
> application on an already-infected system.
> --
> ~PA Bear, via Google Groups due to horked newsserver synchronization
> (again), not due to any filtering despite what Daave may think

Most if not all of the infection looks to have occurred before the
(dirty) removal of McAfee, so I tool a chance. But you're right, I
need to at least scan the system with a few different apps from
outside the system. Whether I do that or do a clean install now
depends on what the mother says, since I've been given a bit of
breathing room by having that RAM arrive early. I can now do things I
wasn't even considering doing without the new RAM. Don't get this done
by Monday night, it isn't going to get done for another week.

Thanks again Pa Bear,

--
Ronin

> > >http://michaelstevenstech.com/cleanxpinstall.html#stepsand/orMethod 1 in

> > >> installation, please tell me all about it (or them.)- Hide quoted text -
>
> - Show quoted text -

Jose

unread,
Feb 20, 2010, 7:11:32 PM2/20/10
to

Experiences are different for different environments. I just know
what gets me the most bang for my buck with the least amount of effort
and consistent reliable results so when I get done, I know I'm done.

I can usually find something I don't like about most everything and
have to bite my tongue a lot!

If a system gets afflicted, it usually ends up being a self inflicted
wound. I just fix 'em.

Rotsa ruck!


20100220

unread,
Feb 20, 2010, 8:27:59 PM2/20/10
to

Sam Ronin wrote:
>

> Ooooohhh... Sombowy got his feelings hurt... 'Course, he's a bit on
> the schizo side... I think I'll choose your advice over that of the
> MVPs. Got any? Let's trade!

I have read your initial email and have noted that the whole problem
started with machine being infected with viruses of all kinds. This
being the case, the only solution is to start from scratch by
re-installing the OS and all other applications. I know that you want
to avoid doing this but there is no point in wasting any more time in
trying to get a solution because there isn't one!

You can install SP3 with only 256 MB of Ram. In your case you will be
better off doing a slipstream of SP3 and then installing the OS from the
new CD. The full instructions are here:

<http://www.theeldergeek.com/slipstreamed_xpsp3_cd.htm>

As far as anti-virus software is concerned, I strongly recommend you to
use AVAST (version 5 - this is the latest -
<http://dw.com.com/redir?edId=3&siteId=4&oId=3000-2239_4-10019223&ontId=2239_4&spi=4760315f46254456ce15dab0ea583ab1&lop=link&tag=tdw_dltext&ltype=dl_dlnow&pid=11267557&mfgId=85737&merId=85737&pguid=KyCWQgoPjF8AAGk0UrwAAAAe&destUrl=http%3A%2F%2Fdownload.cnet.com%2F3001-2239_4-10019223.html%3Fspi%3D4760315f46254456ce15dab0ea583ab1%26part%3Ddl-85737>)
and Microsoft Security Essentials:
<http://www.microsoft.com/Security_Essentials>

The reason you need to start all over again is because the system has
become completely unstable and for that there is no other solution.

hth

Daave

unread,
Feb 20, 2010, 9:43:44 PM2/20/10
to

That's interesting (and unfortunate). But that certainly explains what's
happening. I guess TPTB don't care too much partly because of the
transition away from newsgroups to Web forums.

But I have seen posts filtered in the past if they contain certain words
or even names of certain newsgroups.


PA Bear [MS MVP]

unread,
Feb 20, 2010, 9:38:53 PM2/20/10
to

Please don't feed the trolls. Thank you...

Daave

unread,
Feb 20, 2010, 9:57:23 PM2/20/10
to
Sam Ronin wrote:
> On Feb 19, 7:26 pm, "Daave" <da...@example.com> wrote:
>> Ronin wrote:
>>> "Daave" <da...@example.com> wrote in message
> <CHOPPED>
>>
>> It sounds like you're on top of things. I always configure a Clean
>> Boot before installing SP3, just to be on the safe side.
>>
>> But this line is huge:
>>
>>> Worst thing that I didn't
>>> mention before is that the system went quite a while (weeks, at
>>> least) without any AV installed.
>>
>> Not good. This is what often produces a situation where malware is
>> too deeply entrenched that a Clean Install is the only rational
>> solution.
>>
>> WRT McAfee, did you run their removal tool from here?:
>>
>> http://service.mcafee.com/FAQDocument.aspx?id=TS100507
>
> Yes, I ran the McAfee tool first thing. (I forget. What's "WRT"?)

With regard to.

>> But, seriously, running a number of weeks without protection might
>> very well mean nuking the sucker.
>
> Yeah, I figured that, but when it comes down to it, the kid isn't
> easily teachable and I'm not going to get involved in overseeing his
> activities, either. That leaves me the task of doing what I can to
> protect him from himself, but even if it's a clean install, I don't
> give it more than a few weeks before it's all back (well, not ALL!)

Unfortunately, a number of PC users do behave this way. You can lead him
to the water but can't make him drink, eh?

> In short, I don't really see a critical need to return a spanking new,
> clean machine. My primary interest is to get SP3 installed properly
> and the machine reasonably functional.

I believe that the only way to have SP3 installed properly is to do so
when there is no malware present.

> Maybe in the future, when I
> have more time, I'll do the clean install and also take the time to
> teach him how to, for instance, NOT click on those pop-ups that scream
> about your being infected and CLICK THIS NOW!! Not to mention those
> despicable default inclusions of Google junk, etc. (Yeah, I know
> they're supposedly not malware, but you'll have a hard time proving
> that to me!)

Although toolbars may not be malware, they can nonetheless have
crippling effects on performance, yes!

>>>> The first thing you need to do is find out what SP level the PC is
>>>> currently at:
>>
>>>> Start | Run
>>
>>>> Type:
>>
>>>> winver
>>
>>>> Click OK.
>>
>>>> What is the SP level shown?
>>
>>> It says SP3, but is that really any confirmation that the
>>> installation was entirely successful?
>>
>> Yes, that is *the* confirmation.
>
> It showed SP3 when I checked. I'm hesitant to believe in such simple
> yes/no answers when it comes to something so complicated, but until
> proven otherwise, I'll go with it.
>
>> Did you make sure IE was at IE6 level when you installed SP3 (that is
>> recommended)?
>
> IE8 is what is on it. Do I have to revert all the way back to IE6? Is
> it even possible to revert all the way back to IE6?

You don't have to do this. But it will make any future Repair Installs
problematic. Best Practice is to install SP3 when IE is at IE6 level.
(If you wind up performing that Clean Install, that is definitely how
you should do it.)

I don't know, but I would imagine there is a strong chance it is related
to the malware.

> Now that I'm leaning more and more towards a clean install, however, I
> think I'll run it again and see if I can find the BAT file (or script,
> whatever) before it's obliterated, which I assume it is after it's
> done its job. Unfortunately, the commands weren't echoed, just the
> returns.
>
> Thanks again to everyone,

YW. Good luck, Sam!


Ronin

unread,
Feb 20, 2010, 10:15:23 PM2/20/10
to
OK, I'll try.

--
Ronin

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:uqJDt9ps...@TK2MSFTNGP04.phx.gbl...

Ronin

unread,
Feb 20, 2010, 10:14:04 PM2/20/10
to
If you read my original post, then your reading comprehension is faulty. The
only thing I actually asked was if someone can tell me what those two logon
scripts do. The diversion into a discussion of malware was simply due to my
adding it to the post as a possible source of this specific set of failures.
Everyone latched onto that as the issue, not noting that I'd pretty much
cleaned it all up. Look again. I had already cleaned the system up enough to
successfully install SP3, even with the minimal RAM. I even used Avast!,
because that's pretty much the only AV I've been installing for folks since
I can't remember when. 2003? 2002? Of course, I use other on-demand scanners
when I think it's warranted. Like in this case

As I explained elsewhere, I've run a decent handful of anti-malware apps,
several times, and I will be doing quite a bit more before returning the
machine, including a few AV scans (so-called "online" scans included.) I
could pull the HD and stick it into my test machine (or throwaway machine,
however you want to call it), but it's going to be more convenient in this
case to plop another drive into the problem machine, load an OS (minimally),
install the various scanners and go for it. Or maybe I'll take the time to
build a fresh set of bootable CD/DVD-based systems. Or try using a USB
stick. Always wanted to play with that one.

Heck, the system is running just fine, now, and my next step is to refresh
my memory as to what tests I might want to run to further establish this
stability. While I'm ludicrously familiar with clean installs (many
hundreds, at least), even if it might actually take a smidge less effort,
I'm just not interested at this moment in dealing with getting together all
his installer CDs, making sure I've collected all his personal data and then
configuring the whole thing just like it was, so I don't spend the next six
months fielding calls for help because he can't find what he knows should be
right there. This is one of those cases where a clean install sounds more
efficient than it really is. Besides, I already mentioned in another post
here that the machine is more than likely going to be reinfected within
weeks if not days. "OK", in this case, is good enough. I didn't agree to
clean and armor his system, I just agreed to get SP3 installed. Cleaning up
was simply a prerequisite. With any luck, the little that I have done in the
way of armorizing will keep any future damage to a minimum. Maybe after I
recover from my open-heart surgery, maybe after my young sons whom I've
seldom seen have finished their spring visit, maybe after we've finished
doing taxes and filing bankruptcy, maybe after we've done moving her folks
into assisted living...

IOW, maybe next fall I'll have the time to sit down with the boy and do it
right. Or maybe not.

Here's my advice, as promised: You really ought to contain your venomous
rants, whether or not they are valid. They do absolutely nothing good for
your reputation (except among like-minded ranters). Just the opposite. This
is another place where I suspect I have more experience than you. Some of my
rants have cost me a lot, including money and marriage(s), several have
resulted in various physical damage to myself from people I shouldn't have
been ranting about, and more than a few got me free all-expenses paid weeks
down the street at the sheriff sub-station. Why so much ranting? Darned
thing is seriously habit-forming. Being a bipolar drunk didn't help.

PS -- Exactly how was your advice any different than that of the MVPs? Other
than being the only one to recommend Avast!?

--
Ronin

"20100220" <2010...@20100220.NET> wrote in message
news:4B808C1F...@20100220.NET...

20100221

unread,
Feb 21, 2010, 11:39:15 AM2/21/10
to

"Ronin" <wanderer> wrote in message
news:esG2tPqs...@TK2MSFTNGP05.phx.gbl...

> PS -- Exactly how was your advice any different than that of the MVPs?
> Other than being the only one to recommend Avast!?
>

I am the only one who has suggested that your system WILL NEVER be up to
scratch unless you install the OS from scratch. All so called MVPs
(Microsoft Valuable Pigs) have suggested to scan and re-scan your system for
viruses. There is simply no evidence that viruses will stop you from
installing SP3 because if SP3 is interfering with their work, they simply
destroy the relevant file. PERIOD.

I hope you manage to achieve what you are trying to achieve without
reformatting the HD and please let us know of any progress towards this
goal.

Ps: I am also the only one who suggested to use MSE as fall-back
anti-virus. I would also install Windows Defender (another Microsoft free
Product) for its tools apart from its anti-spyware function already
incorporated in MSE.

Good luck.

Sam Ronin

unread,
Feb 23, 2010, 9:56:18 AM2/23/10
to
This reply post was originally written and sent on 2/22/2010 at 10:57
am. Can't see it on the msmews servers OR Google, so I'm reposting.
-- Ronin

On Feb 21, 8:39 am, "20100221" <20100...@discussions.microsoft.com>
wrote:


> "Ronin" <wanderer> wrote in message
>
> news:esG2tPqs...@TK2MSFTNGP05.phx.gbl...
>
> > PS -- Exactly how was your advice any different than that of the MVPs?
> > Other than being the only one to recommend Avast!?
>
> I am the only one who has suggested that your system WILL NEVER be up to
> scratch unless you install the OS from scratch.  All so called MVPs
> (Microsoft Valuable Pigs) have suggested to scan and re-scan your system for
> viruses.  There is simply no evidence that viruses will stop you from
> installing SP3 because if SP3 is interfering with their work, they simply
> destroy the relevant file. PERIOD.

Not to put too fine a point on it, but regarding those first two
claims, you
are a liar, plain and simple. And/or incredibly ignorant. Just read
the
other posts in this thread, you dolt. As for that final claim, let me
give
you one last piece of advice. If you want to be taken seriously in a
forum
like this, when you make that kind of statement, you want to include
all the
details you can, especially quotations or, even better, links to the
pertinent discussions or other information that prove your claim. I
told you
already that ranting is bad for your health, really bad. I'm almost
certain
that you are a quite young being, so it's really important that you
train
yourself now, or habit will only become more and more entrenched until
you
can't stop doing it even when you're on the verge of destroying your
life
(or even past the verge.) Besides, the last half of the last sentence
is
incomprehensible. Writing skills are definitely necessary in this kind
of
endeavor, as well.

> I hope you manage to achieve what you are trying to achieve without
> reformatting the HD and please let us know of any progress towards this
> goal.

I always do. To recap: I've scanned with Avast!, SAS, MBAM, Spybot
S&D, and
AdAware. I then went out on the internet and played around for an hour
or
so, just playing around and giving certain trojans a chance to rear
their
ugly heads or just sneak in, and visiting sites that I know are
dangerous.
(No, I won't provide a list. That would be like decorating a nursery
school
with dynamite and then teaching teh kids how to use lighters.) I have
discovered and dealt with most of the issues I ran into while
installing SP3
except the one that brought me here, but it left IE8 unfunctional in
certain
ways (Adobe's downloader doesn't work, for example.) My mistake for
proceeding so hastily and believing the KB article that says the only
problem with IE8 or IE7 is that you can't install them after
installing SP3
(which I already knew and which is actually a quite common issue in
Windows.) So, after installing the new RAM, I uninstalled IE8 (after
uninstalling its Updates in reverse chronological order.) I then
uninstalled
IE7 (after uninstalling its Updates), and tried to create an MCE
installation disk with SP3 slipstreamed in, but AutoStream doesn't
think the
SP3 executable is a real SP. When I'm done here, I'm going to drop a
fresh
drive into the box, install a minimal copy of XP and thens can the
problem
drive with several AV and anti-malware apps (though I don't really
expect
anything from the latter.) Meanwhile, I'm going to see if I can figure
out
how to slipstream SP3 into MCE. Then I'm going to run a repair install
using
my own copy of MCE, then I'm going to see how it's doing. If it's
still not
acceptable, I'll proceed to perform a clean install. Whichever, once I
have
a stable and clean (clean as I can determine is good enough), then
I'll
reinstall SP3 if I haven't already, and then IE8 (or reinstall IE7 and
block
IE8, I'm not sure). Of course, there will be a bit more
installing/reinstalling/repairing some things, or just installing if
it ends
up being a clean install.

I probably left a few things out. I'll update this account and post it
as a
reply to my original when I'm done. Hope you enjoy it.

> Ps:  I am also the only one who suggested to use MSE as fall-back
> anti-virus.  I would also install Windows Defender (another Microsoft free
> Product) for its tools apart from its anti-spyware function already
> incorporated in MSE.

I'm not so sure I'd be bragging about those recommendations. Being the
only
one to even mention a Microsoft product in a Microsoft NG can't
possibly be
taken as a sign that your recommendation is a credible one. That said,
I
have no problem with running WD, provided it really is compatible with
XP. I
haven't personally tried it, so I don't know. I'm also not sure how
well it
plays with others, like Ad-Aware, MBAM, or SAS. I presume you have
heard of
the rule that says only one background scanner for each purpose at a
time?
However, considering the age of XP and the youth of MSE, and
especially
considering the rather shoddy reputation MS has with their
programming
compared to most other reputable software development companies,
particularly compared with the narrow focus of companies for whom AV
is their
only business, (though that is of course no guarantee, as evidenced
by
Symantec and McAfee) I will certainly not be installing it to the
exclusion
of what I know to be superior products. In fact, now that I think
about it,
MSE has the same lack of credibility in my mind as Norton and McAfee,
and
for the same reasons. They're more interested in keeping their jobs
by
producing perpetually mediocre products and spending great gobs of
money on
advertising, trickery and outright coercion than they are in
perfecting the
ones they have. It's a great way to provide jobs, a lousy way to
create real
value.

But thanks for reminding me of this new and as yet unproven app.
Perhaps
this is a good situation in which to try it out, add it to my list of
on-demand scanners that I use in situations like this. Probably going
to
have to dump the whole thing, anyway, and clean install it after
having as
much fun as I can. But don't try to tell me that MS can get something
like
this right after only a few scant years. (If they bought the thing,
then
its quality is most likely going to decrease over time instead of the
opposite.) Microsoft's primary products seldom even make it out of
beta
(otherwise known as "Gold" or SP1, or even SP2 though I usually see
those as
what should be RTM builds) before they're scrambling to get the next
version
out the door to cover their embarrassment over the significant
failures (in
concept, design and execution -- IOW in all ways) that their
head-in-the-clouds designers can't seem to avoid, even when they are
years
past deadline. If these were minor failures that would be one thing,
but
they're not. Sorry, I simply don't have the time to provide details,
but all
you have to do is spit in the direction of Redmond and you're sure to
hit
one. Besides, the literature is overwhelming and real easy to find.
You do
know how to use Google, right?

Anyway, it's been real, but I have work to do, starting with the snow
piled
a foot deep on my walkway that was perfectly dry eight hours ago. I'm
sure
you have more important activities to attend to as well. I think
we've
played this out far enough. I know Pa Bear thinks it's way too much.
Besides, I have no more advice to offer you and you're ignoring it,
anyway.
That's OK, I'm not likely to use any further advice you have to offer
me,
either. Time to go our separate ways.

--
Ronin

0 new messages