O.T. Missing Folder/files

[Robert in CA]

I have a Dell XPS 8500, with Windows 7 Professional, SP1,
with Spywareblaster, Malwarebytes, Avast , Windows Defender
and Windows firewall.

(1) TB HD
Intel (R) Core (TM) i7-33-3770 CPU @ 3.40 GHz
Ram 12.0 GB
System type : 64-bit operating system

I also have

I have a Dell Optiplex 780 Tower, with Windows 7 Professional,
SP1, with Spywareblaster, Malwarebytes, Avast , Windows Defender
and Windows firewall.

Seagate Desktop HDD ST2000DM001 2TB 64MB
Cache SATA 6.0Gb/s 3.5" Internal
System type : 64-bit operating system

and (external hard drives)

(8500)
WD BLACK SERIES WD2003FZEX 2TB 7200
RPM 64MB Cache SATA 6.0Gb/s 3.5" Internal
Hard Drive

(780)
Seagate Desktop HDD ST2000DM001 2TB 64MB
Cache SATA 6.0Gb/s 3.5"
Internal Hard Drive




The problem lies with the 8500.


I inadvertently deleted or moved a
folder and I can't find it. Before I do
any more damage I thought I had better
post it here and maybe I can recover the
folder/files?


Thanks,
Robert

--
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[Paul]

You must stop using the partition immediately,
to avoid damage to the missing items. Like, don't use
Firefox or any other program which causes writes to
the C: with the "missing files".

https://www.ccleaner.com/recuva

The colored dot next to the file name, indicates
how damaged the file is. If it has already been
overwritten (the clusters reused by the file system),
the dot will be red. If the file is in perfect condition,
the dot will be green. A color of yellow is bad news too.

Let's draw an example to illustrate. This is the drive, when
the accident happens.

+-----+--------------------------------+
| MBR | C: Windows with deleted files |
+-----+--------------------------------+

Plug in your emergency boot drive, boot from it.

+-----+--------------------------------+
| MBR | C: Emergency Boot Drive | <=== download Recuva onto this one.
+-----+--------------------------------+ Then, point it to E: to scan.
Store the recovered files on C: of
Emergency Boot Drive, not on E:
+-----+--------------------------------+
| MBR | E: Windows with deleted files | <=== we're not running this one, we're
+-----+--------------------------------+ trying to recover the files while this
operates as a "data drive".

Now, maybe you would be sticking one drive inside
your machine, and the second drive in your USB enclosure.
But, you get the idea. C: would be inside the machine,
E: would be in the enclosure.

Note: Piriform is the company that invented Recuva. There are
many similar programs, it's not the only one. Piriform was
bought by Avast, and when you download Recuva, there is a
danger that other garbage software will get installed.
Read all prompts carefully, and do your best to avoid
getting unnecessary passengers from the Recuva installer.

https://en.wikipedia.org/wiki/Recuva

Paul

[Robert in CA]

I don't quite know what you mean by I must stop using
the partition?

I just had a folder named 'Shopping' and I had files in it of
things like books, DVD's etc that were on my list. I have lots
of folders/files like that. You're saying it's bad? Isn't that what
Favorites/folders/files are for?

Hmmmm, I already downloaded CCleaner on the 8500
but I haven't opened it. I then removed them from the
download history.

When I click your link it doesn't give me any option to
download in another location, then the dialog box pops up
to save it or open. So how do I download it to a USB flash
drive?

Then I run a scan from there correct?

Thanks,
Robert

[John Dulak]

On 3/24/2021 7:47 PM, Robert in CA wrote:
> I don't quite know what you mean by I must stop using
> the partition?

You stop as much disk activity as possible because when ANYTHING is written to
the disk there is a chance it will get written over one of your deleted files
and it will be gone forever.

>
> I just had a folder named 'Shopping' and I had files in it of
> things like books, DVD's etc that were on my list. I have lots
> of folders/files like that. You're saying it's bad? Isn't that what
> Favorites/folders/files are for?
>
> Hmmmm, I already downloaded CCleaner on the 8500
> but I haven't opened it. I then removed them from the
> download history.
>
> When I click your link it doesn't give me any option to
> download in another location, then the dialog box pops up
> to save it or open. So how do I download it to a USB flash
> drive?
>
> Then I run a scan from there correct?
>
> Thanks,
> Robert
>

Robert:

I have used "restoration" in the past with good results.

https://www.download3k.com/Install-Restoration.html

The sooner you use it the better your chances of getting deleted files back.

BTW have you checked in the "Recycle Bin"?

If you think you have just MOVED it to some obscure place you can use the
"Search" function of Windows explorer. Enter a remembered folder or file name,
point it at the root of the disk drive (C:\) and check the "advanced" setting to
"Search Subfolders".

HTH & GL

John

--
\\\||///
------------------o000----(o)(o)----000o----------------
----------------------------()--------------------------
'' Madness takes its toll - Please have exact change. ''

[Paul]

The objective, is to treat the partition that had the accident,
as read-only.

The C: partition, while the machine is booted and Windows
is running, is constantly writing to C: . Maybe the search
indexer is running and doing writes.

If files are lost (accidental delete), you would shut down
the machine immediately. Now, we're not doing read or write.

You have other drives with a copy of the OS on them.
Imagine that drive is used to boot the computer. Now
the C: writes are happening to a partition you don't
care about. Using that drive, you download Recuva Free.
Install Recuva Free on that drive. Now you are ready to scan.

Now, connect the original drive, using a USB enclosure. There
is no constant activity to the enclosure when it is connected.
It's ready to do what you wish to it. It is treated as a data
drive, because it has not been used to boot the computer.

If you were to look in Disk Management, the swapped in drive has

+-----+-----------------+------------+
| MBR | ..."System" | ..."Boot" } <=== the drive being used to boot
+-----+-----------------+------------+ Windows writes to this C:
Recovered files go to this drive,
until recovery from the other drive
is complete.
+-----+-----------------+------------+
| MBR | | } <=== no special designations,
+-----+-----------------+------------+ now a "data" drive and ready
to be scanned with Recuva

Once you are sure you've Un-Deleted as many
files as the job requires, then it is "safe"
to write to the bottom drive, so that when
that drive becomes the main boot drive again,
the recovered materials are there for you to use.

You don't write to the bottom drive, until
you're absolutely sure each and every file
is intact, and no further forensics on the
bottom drive are needed. At that point, the
bottom drive is safe to write and update as
you wish.

Then, shut down the computer, and the bottom
drive can be put back inside the machine.

There is nothing special about being inside
or outside the machine. I'm just taking your
usual usage pattern into account. On my machines
here, pretty well all drive activity is
internal. If I needed to do this...

+-----+-----------------+------------+
| MBR | ..."System" | ..."Boot" }
+-----+-----------------+------------+
+-----+-----------------+------------+
| MBR | | } <=== needs UnDelete
+-----+-----------------+------------+

it would be done with two adjacent trays that
slide in. I would need to know the names and
sizes of the drive, so I booted from the
correct one (the un-damaged one) and not
boot from the damaged one. We don't want
writes on the bottom one.

When a file is deleted, its resources can be
reused at any time. We seek to stop writing to the
drive, to protect those resources. If the resources
have not been tampered with, Recuva simply flips
a single byte value in the $MFT and the file is
instantly available again.

If you continue to write to the drive and
don't act quickly enough (use the drive for the
rest of the day), the freed-up clusters from the
files that were deleted, they get overwritten.
Even if you flipped the byte in the $MFT, the
file is corrupt. It is for this reason that
the filenames have the colored dots next to them.
A file with a "red dot", is unfit for recovery.
A file with a "green dot" or all the files having
"green dots", means you stopped usage of the
drive soon enough to keep them green. All it
would take, is writing one giant movie file,
to overwrite all the deleted files and turn
all the dots "red" and nothing could be recovered.

You can flip the byte on a "red" file and make
the file appear again in the listing. But if you
do that, practically none of the original data
is inside it. It contains portions of other files
that have been stored. Thus, if you open the file,
your picture viewer crashes or there are other
anomalies. You have to check the files. If the
files had green dots next to them, testing the
files should take only a short time. If the
files are red, expect trouble, and the testing
is likely to fail (and hopefully, in not too
spectacular a fashion - *don't* run tools with
built-in automated repair capability because
they can make a mess of a file with random bits
of other files in it). To test a file, you want
dumb tools that don't take liberties with the files.

Your data is there, but it is only there until
the clusters get overwritten. Every write operation
on the partition with the problem, risks overwriting
the freed-up resources. That's why there is a rush
to stop using that drive for writes. And the OS
loves to write to the drive. The more modern the
version of Windows, the more it likes to write.
An accidental deletion then, the files will be
unrecoverable in a short time, if the OS is
writing stuff to C: . That's why, if you notice
files are missing several days or a week later,
it's not very likely they're coming back. They'll
all have red dots next to their name. Or, if the
$MFT entries get reused (which happens!), not even
the file names will be locatable by Recuva. I've
watched how the $MFT is used, and it really doesn't
take that long for the filename to disappear either.

The other technique is scavenging. That's when Recuva
doesn't work, the filename is missing or the filename
is there but has a red dot. You can use Photorec and
scan the drive for "fragments of files". But the
output is such a mess, don't waste the time. I tried
once. I got 100,000 chunks of stuff, that when opened
were all corrupted and useless. It's wishful thinking
to think doing more work than the Recuva approach,
is going to pay off. If the file is still mostly intact,
flipping the $MFT byte brings it back. If it's damaged,
there's a good chance it is never coming back.

I've tested undelete, by deleting a JPEG and immediately
doing a scan, and the file was located and had a green dot.
So it can work. But don't be "testing it", until your
recovery project is complete. Then you can be messing
around if you want. You'll only get the one chance to
get these back, so concentrate on that.

Paul

[Robert in CA]

OK, I understand now,.....
I did do a search after reading John's post
and I did find the missing Folder/files

https://postimg.cc/0M83SSP7

I opened the one highlighted to confirm they were there.

If I understand you I'm suppose to remove the HD and put in another
HD then download Recuva then attach my original HD via USB
and scan it that way? Is that correct? Ok,.. here I go I hope I
don't screw this up.

Thanks,
Robert

[Robert in CA]

On Wednesday, March 24, 2021 at 5:33:27 PM UTC-7, Paul wrote:

I changed HD's on the 8500 and now in Windows Boot Manager it says

Windows failed to start. A recent hardware or software change might be the cause. To fix the problem:

1. insert your Windows installation disc and restart your computer.
2. choose your language settings, and then click 'next'
3. click 'repair your computer'.

If you do not have this disc, contact your system administator or computer manufacturer for assistance.

Status 0xc000000e

Info: The boot selection failed because a required device is inaccessible.

Great, now the problem is worst than before! I knew something this would happen.
I never liked opening up the computers. I'm going to switch back the hard drives.
I sure hope I haven't lost the 8500 because of this!!

Robert

[Robert in CA]

I'm back on the 8500, that was a little scary
I was wondering if I would get the 8500
back! Whew!

Here's what I was looking at:

https://postimg.cc/Cd9M2Cfk

I think it was a bad HD. I checked and I have
(2) HD's for the 780 with Win 10 and (1) HD
for the 8500 with Win 10 but I thought we made
more than one HD for the 8500 with Win 7 Pro?

So it means I have to buy some HD's and we have
to make up at least (2) for the 8500 and (1) for the
780 although I may of just mislabeled them. I would
have to put each one in to check for sure but in any case
more Win 7 Pro OS is called for and I still need to buy
a APC surge protector.

btw how do I use CcCleaner? I seem to remember you
can really screw things up with it. Are there allot of checdk
boxes etc?

So at this point, I would rather have an operational 8500
and I can just rebuild the lost folder/files from the bookmarks
I found but there's a couple of other things that have happened.
My mouse seems over sensitive when I click it and I haven't
messed with any of the settings and I've noticed recently
that my backspace key doesn't function. It's weird how they
changed by themselves.

Thanks,
Robert

[Robert in CA]

btw, I realize I could use my Win 10 HD to do this but it seems
allot of effort just to recover bookmarks. Is there something else
were looking for?

I just would hate to loose my Win 7 on the 8500 because I depend
on it allot and I don't particularly like opening it up to change HD's
because with my past history it can create more problems.

Robert
Robert

[Paul]

There's probably nothing wrong with the hard drive, particularly.

Carefully maintain your labeling, so cloned drives are
being plugged into the correct machine.

Your favorite model of new hard drive, may have been supplanted
by a more crappy version. The three platter one you were
using, seemed to be nice. But that may have been
replaced by a two platter one, and some of those are
a bit slower and jerky when loaded up with Windows.

We know you don't like the WDC Black, because they're a bit noisy.

And they keep messing around with the models anyway, and
you have to be careful to not pick something that's taken
a turn for the worse.

*******

Using the Macrium boot CD, you can select "boot repair" while
*only* the defective 8500 drive in in the 8500 tray. And no
other drives, not even connected via USB. Just the one drive.
One of the menus has a "Boot Repair" item, and this will
locate trivially lost items and bolt them back together.

If C: on the emergency 8500 drive had been absolutely
destroyed (which could happen), then Macrium Boot Repair
will not help. The hard drive will remain unbootable
if the C: was trashed.

Using your collection of backup images, your knowledge
of which ones aren't infected, you can put back
a good copy of C: over top. But this generally requires
two drives (one USB connected), so that you have a source
.mrimg file to use to restore the C: that needs repairing.

*******

With regard to what happened to your bookmarks, either
you have the correct collection of bookmarks, or you don't.
You have to decide, whether your recovery was successful
and "the fire is out". I can't tell from here, whether
any more forensic effort is required or not. You make it
sound like this is a misplacement issue (drag and drop with
a sticky mouse button will do that). In which case, you'd
make sure your mouse was fully functional, so it doesn't
happen a second time. I had to open up my Logitech mouse
and do some cleaning up near the buttons on the casing,
to restore decent drag (without dropping). I've on occasion,
dropped a folder in some obscure spot, and yes, Agent Ransack
search finds it for me :-)

As long as you haven't deleted the files or the folder, then
we don't really need to be using Recuva. It's only if
Agent Ransack can't find the correct version, that
tools like Recuva (and the correct discipline while
using the tool) are required.

Try to keep track of your most important materials. If
C: became infected, you can restore it from backup. But if
you overwrote C: with a really old image, then your
bookmarks would take significant damage. You should
keep some sort of Exported copy of Bookmarks.html for
days like that. It should be stored separately somewhere,
and while your regular backups will capture a copy of
the bookmarks, to not lose daily bookmark changes, you'd
need a daily copy of them.

If you absolutely rely on browser-stored password management,
then the browser profile folder could be captured as a backup
item as well. An Agent Ransack search on C: for "Profiles",
will find all sorts of important profiles. Here, I've located
the one for the browser I use, Seamonkey.

C:\... \Mozilla\SeaMonkey\Profiles\1234abcd.default
--------

The Profiles folder for the various software products, has
things like key3.db or key4.db and some other file similar to
that, and that's where persistent password storage is located.
Capturing the named folder, the "1234abcd.default" style folder,
will capture individual files like key4.db . The easily infectable
prefs.js is in there too (the one the adwares like to attack).

To make sure you have the correct Profiles item, you'd
want to make sure there was a key4.db type file in it,
as that indicates it's the correct folder for the job.
That 1234abcd.default folder also has "bookmarkbackups",
which is the browser version of bookmarks. Doing an
Export of Bookmarks, reads the current file from that
collection, and delivers it as an HTML file. The HTML file
is "the one humans use". It's a wee bit more portable.

Paul

[Robert in CA]

I have to really concentrate when I read your stuff *L*

First,.. I have started to rebuild my Shopping folder/files
and part of the reason was the point you hit on. My link
to buying HD's. This is the one we've been using.

https://www.newegg.com/seagate-desktop-hdd-st2000dm001-2tb/p/N82E16822148834#

I have one Star Tech case left:

https://www.newegg.com/startech-sat3510bu3-others/p/N82E16817707227

It says they are out of stock can you suggest another case?

What happens with the mouse is that for example, if I'm in my Dell imaging
where I usually have 2 screens displayed. Lets say I open a third to do some
work but when I close it the mouse closes one of the 2 screens that were open.
It didn't use to do that. So I have to set the screens up all over like I had them.

That's what happened with the bookmarks it just kept going and did whatever it
did.

In a way I'm glad this happened because I realized I have zero HD backups for
Windows 7 Pro for either computer. I think what happened was that we did have
the Win7 Pro OS but we took advantage of the Windows 10 option. Thats why all
the HD's were Win 10. So here's the plan; around the end of April I get paid again
and will buy (4) HD's so we can create Win 7 Pro OS for both the 8500 and 780 and
we can pick up again then.

I checked and I do have rescue disks etc that we made before so I'm sure I have
something there. You made sure I did everything correct.

Oh btw what do you think of me using brushes or compressed air to clean the inside
of the computer out?

Thoughts/suggestions?
Robert

[Robert in CA]

btw I have a logitech m310 mouse and cleaned the lens with
some Windex on a q-tip. It seems to have made a difference.

Thanks,
Robert

[Paul]

Yes, test with a working mouse and see if the
symptoms of mis-behavior go away.

That would tend to support either a cleaning
issue with the defective mouse, or an electrical
issue. And if the mouse cable has an open in it,
you'd probably have a wider variety of symptoms.

The optical part of modern mice is pretty good,
when it comes to dust preventing the lens from
working. The sensor is more of an array than
a single sensor. Don't let the grotty appearance
of the plastics they use for those, deceive.
I know some people, assume the appearance is
a defect, and scrub them, but they don't really
need to be scrubbed particularly. Whoever makes
the sensor assemblies for those, just doesn't
care what the mold plastic looks like :-) Only
if some sort of foreign matter (like the mouse
fell into a bowl of chili), would it need the
real cleaning treatment. But dust does pack
in other places, especially around where the
mouse button cover plastic on top, meets the
microswitch. You can get enough dust impacted,
to prevent the microswitch from depressing.

When you disassemble a mouse for cleaning, be
careful around the scroll wheel. Some scroll
wheels have a tiny bit of a clear gel grease
on them. And you would not want to remove
stuff like that. There are all sorts of
fiddly springs on those scroll wheels. When
you tilt up the hinged cover, do the tilting
in the upright position, so the scroll wheel
doesn't fall out of its mount, onto the desk.
And all those blasted small parts with it.
I learned my lesson when I took my Logitech
apart - what I can't believe, is they design
them with that many parts inside. It must take
a ton of human assemblers to be putting those
together.

Paul

[Paul]

The Startech seems to have moved to putting fans, only
on their multi-bay enclosures. And those are too expensive
for a little occasional usage with a single drive.

There is the Rosewill one. This has a fan on it.

https://www.newegg.com/rosewill-rx304-apu3-35b/p/N82E16817182316

But it's so hard to tell how the drive installs in there,
and you know how important that is when they get it wrong.

https://www.rosewill.com/product/rosewill-armer-rx304-apu3-35b-external-3-5-sata-iii-6-gbps-hard-drive-enclosure-usb-3-0-esata-connection-aluminum-body-80-mm-variable-speed-fan-with-on-off-switch-led-display-panel/

There is a 55MB user manual with pictures. Their
download page is a bit slow, so this will take a bit of time.

https://www.rosewill.com/download/user-manual-rx304-apu3-35b-ol-pdf/?wpdmdl=37249&ind=0

( from https://www.rosewill.com/download/user-manual-rx304-apu3-35b-ol-pdf/ )

There aren't going to be as many options with fans.
They like to make enclosures without fans, to
try to cook the drives.

*******

A lot of cleaning methods, to remove dust from computers,
generate static electricity. And that isn't always the
best for the equipment. If you use the duster-in-a-can,
that's a refrigerant, and can drop the temperature of the
chips you point it at, quite drastically. They don't
have windowed DIP EPROMS in computers any more, but when
they did, the low temperature materials in spray cans
could kill those. That's the only component I know of,
that could be killed by sudden temperature shock.

A less-concentrated airflow, like maybe a reversed vacuum
cleaner, used outdoors on a table, might be a way to
dislodge the dust. Some vacuum cleaners, had fittings
so you could reverse the flow for blower applications.

Using a vacuum in vacuum mode, isn't recommended. Static
discharge can come off the barrel of the metal tube. It's
the movement of dust particulate, over the black plastic surfaces
of the ICs, that can generate static, and that is static
right next to the electrical pins on them. But some static
can also be generated on vacuum hoses or tubing, and if the
vacuum metal tube touches something, there could be a discharge.

It's really hard to give iron-clad guarantees about this
topic. If the anti-static police at work were here,
they'd be constantly rapping me on the knuckles,
for "bad technique". We had some guys, entrusted with
that role. Anti-static police.

Paul

[Robert in CA]

I read all your info,. and bookmarked the cases and the 55mb file
thanks *s*

btw I liked your comment,... if the mouse fell into a bowl of chili *L*

I was a bit premature with the mouse and my backspace key
still doesn't function. I didn't spill anything etc to cause this it
just stopped functioning like the mouse is too sensitive when I
open/close things it keeps on going and closes or opens more
than I want. Like the Dell Imaging example I gave you.

So how do I restore my backspace key and mouse so they are
back to 'normal'? hmm I have to check and see if I have a spare
mouse or maybe I should just buy a new one?

What do you think about restoring the 8500 with the last Mrimg?
wouldn't that restore all the bookmarks and maybe fix the mouse
and backspace problem or maybe do a system restore? Although
I'm a bit iffy of doing so until I have a backup Win 7 Pro created.

Ok, this just happened,.....

How weird, the 8500 just started up like it was a fan going and then
died down again! and now alls quiet! I have never heard it do that!
Whats going on ? That was very weird!!!

p.s. while were talking about mice, I haven't seen any since you gave
me the great advice 8 months ago?


Thoughts/suggestions?
Robert

[Paul]

You should open Task Manager and see if something is
using CPU cycles. Maybe you have a coin miner running
on the machine, complements of some malware or something.

Usually on Dells, the fan only goes to "high speed",
if the register that controls it hasn't been loaded yet.
When the programming logic is present, it uses lesser
setting values and does not sound like a vacuum cleaner.

Whatever is going on, it sounds like it's interfering
with hardware.

Yes, restoring from a backup might be something to try.
Maybe we're past the point of testing another mouse,
for correct operation.

Paul

[Robert in CA]

I actually tried testing with two other mouse's
but I couldn't get them to replicate what's happening
because they were too slow.

I don't know if it makes a difference but the part
that plugs into the USB port was red on the two I
tried and on the one I'm using it's white.

If we restore from a backup I would still like
to wait until I have another copy of Win 7 Pro
on another HD as a backup just in case something
goes wrong.

I opened Task Manager:

https://postimg.cc/XpYNyPST - applications

https://postimg.cc/RNpS1Tvq - processes

https://postimg.cc/kVFLsnWw - services

https://postimg.cc/zH3MqK6P - performance

https://postimg.cc/VJXhsYZ1 - networking

https://postimg.cc/34fSfWNj - users

Thanks,
Robert

[Robert in CA]

I'm on the 780 at present.
I had just run a normal scan and afterwards it suggested
a boot scan and also suggested I download paramets for
a more accurate scan.
I didn't download anything but I did select a boot scan
(which is running at present )as a good way of checking out
the system before we backup the HD.

SInce I'm on the 780 it also noticed it has the same exact
problem as the 8500 where the backspace key doesn't function.
Now thats odd,... so we have to do both computers.

Also could you give me a reliable link to download the Microsoft
4000 ergonomic keyboard manual? I searched for it but there' so
many I'm afraid of downloading some malware with my past history.
Thoughts/suggestions,.?

Robert

[Paul]

The only manual I'm finding, is references to the product guide,
which is that sheet of paper thing, written in a zillion languages,
that says not to spill orange juice on the keyboard.

I don't think a manual is going to help.

https://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/special-keys-on-natural-ergonomic-keyboard-4000/50d7f783-1c77-49d0-8be4-284a81b9f930?page=2

"FelixValentin

On Windows 7 Click Start - Right Click Computer - Click Properties - Open Device Manger
- I couldn't find the Keyboard under key boards.

I opened Other Devices and found the Natural Ergonomic Keyboard 4000 there.

I right clicked on the Natural Ergonomic Keyboard 4000 and then clicked on
Update Driver software. The drivers were updated.

All my special keys became functional again.
"

That's in the year 2016.

Another poster had a problem with backspace, and he went off to
find the Support for hardware products. Which would only be
applicable when the warranty was still in effect. There were
no additional messages indicating whether there was a
satisfactory conclusion.

You may not have sufficient computers to give the keyboard
a test on "a machine which has never seen an Intellitype
driver". It may not be possible to test that way as a result.

At the moment, rolling back the OS is as good of an experiment,
as anything else.

Paul

[Robert in CA]

I followed the instructions and instead of showing a Microsoft 4000
keyboard and logitech M310 mouse it shows HID for the keyboard
and mouse. which means the drivers aren't loaded correctly, correct?

https://postimg.cc/9DGvqbxz

Agreed, we will take this up again at the end of April when I order new
HD's (same ones we've been using Seagate 2TB) and make fresh copies
of WIN7 Pro using the Mrimgs.

Thanks,
Robert

[Robert in CA]

Ok, I'm finally back! I've bought (4) Seagate 2TB HD's, (2) for each
computer. I also bought a (2) new M310 mouse's for the computers
and (2) Patriot XT flash drives, and a new APC surge protector. It's
all here except the mouse's. They shipped the HD's in anti-static bags
inside a manila envelopes vs a box as before. I think I have some bubble
wrap holders and one of the leftover boxes and a external HD to put
them in but I think maybe I should get more external HD's. The Startech
is out of stock

https://www.newegg.com/startech-sat3510bu3-others/p/N82E16817707227

so is the Rosewill

https://www.newegg.com/rosewill-rx304-apu3-35b/p/N82E16817182316

To summarize:

• on the 780 when booting up the WBM asks which OS to choose from, but
without me selecting anything it then boots normally. When it first did this
(after I bumped against the keyboard when it was off) I choose Windows 7
but it keeps appearing whereas the 8500 just shows Windows 7 and boots.

• Also someone sent me a zipped file in email and I tried to open it on the 780
but I couldn't extract the files. When I tried to do so it gave me this:

https://postimg.cc/XXXsvcQy

then it gave me this Encrypting File system: back up your file encryption key:

https://postimg.cc/gxbsN9dv

I said yes to encrypt the files when extracting because it wasn't extracting at all
and I thought that might be the reason. Obviously not and I created another
problem by doing so. I deleted the downloaded zip files and haven't touched the
780 since. I assume once we restore the 780 all these problems will disappear?
I just checked and it's gone. Apparently it only shows during the process of trying
to extract the files?

In passing, he finally sent the screenshots one at a time each in separate emails
although I don't understand why he couldn't of sent them all in one email? I didn't
bother to ask.

•I put my a few documents I have been working on the Patriot flash drive so I
wouldn't loose any data when we restore the computers. However today I noticed
a temp file that wasn't there before WRL1011.tmp I don't know what it is but its
using 82.9MB.

https://postimg.cc/rRF4yvp1

https://postimg.cc/nCWmZSfm

but now today I don't see it? Is it some sort of Word file?

• Both the 8500 and 780 backspace key doesn't work. How is it possible that both
computers have this same problem? I barely use the 780 and only runs scans on
it and the monthly backups. Which by the way I've stopped until we fix the
problem on both computers.

• the 8500 has lost some bookmarks

• the 8500 mouse is way too sensitive. This is causing allot of problems with it opening
and closing things I don't want it to and then have to open things back up but perhaps
when the new mouse arrives it may go back to normal operation? Also the lack of a
backspace key function has made this all very frustrating. It just started doing all this
on it's own and I haven't messed around with any settings.

• Avast Smart Scan shows FF out of date but when I checked FF its up to date? I checked
to make sure Avast was also up to date.

https://postimg.cc/8FYqfbQZ

https://postimg.cc/PvWccsL7

• Also Adobe keeps sending msg's like this every once in awhile since I haven't un-installed
Adobe. I believe my Dell imaging uses it so I'm leery of un-installing it even if it's not supported
any longer as it may affect my Dell Imaging and I use it allot. What do you think? Should I remove
it and would it make my system more secure? The thing is if Dell Imaging requires it and I remove
it I can't get it back. Is there some way to check if Dell Imaging requires it?

https://postimg.cc/WdZvmK8Q

• In addition , sometimes when I'm working in Word, and I search for a document to open instead of
My Documents it opens to totally unrelated page I've never visited.

https://postimg.cc/DWTD8QHw


Lastly, should we attempt a System Restore on both computers before we try a Mrimg restore? (even
though we will still create (4) HD's with Win 7 Pro before trying to restore the present HD's.

Although the normal procedure is to just let the newly created HD boot and show the desktop and then
shutdown and remove it perhaps we should test it to see if the backspace function works first before
shutting it down and removing the HD?

Thoughts/suggestions?
Robert

[Paul]

Robert in CA wrote:
> Ok, I'm finally back! I've bought (4) Seagate 2TB HD's, (2) for each
> computer. I also bought a (2) new M310 mouse's for the computers
> and (2) Patriot XT flash drives, and a new APC surge protector. It's
> all here except the mouse's. They shipped the HD's in anti-static bags
> inside a manila envelopes vs a box as before. I think I have some bubble
> wrap holders and one of the leftover boxes and a external HD to put
> them in but I think maybe I should get more external HD's. The Startech
> is out of stock
>
> https://www.newegg.com/startech-sat3510bu3-others/p/N82E16817707227
>
> so is the Rosewill
>
> https://www.newegg.com/rosewill-rx304-apu3-35b/p/N82E16817182316
>
> To summarize:
>
> • on the 780 when booting up the WBM asks which OS to choose from, but
> without me selecting anything it then boots normally. When it first did this
> (after I bumped against the keyboard when it was off) I choose Windows 7
> but it keeps appearing whereas the 8500 just shows Windows 7 and boots.

+++++ Two disks were present when the menu was rebuilt,
and now the menu choices are both being shown.
Rebuilding the menu with one disk only present, will fix it.
Macrium boot CD has a "boot repair" menu item, which can be
used to restore normal boot behavior with one disk.

> • Also someone sent me a zipped file in email and I tried to open it on the 780
> but I couldn't extract the files. When I tried to do so it gave me this:
>
> https://postimg.cc/XXXsvcQy

+++++ https://www.technipages.com/fix-an-unexpected-error-zip

"The solution is to use an archive utility like WinZip or WinRAR
to extract the file. You’ll also need the password that was set
on the file to extract it." The strongest password on these things
now is around 128 bits (not practical to brute force), whereas
previously winzip was a joke. I don't know if I ever convinced you
to install 7-ZIP, as that's another choice where the right-click
menu has an "open archive" option.

> then it gave me this Encrypting File system: back up your file encryption key:
>
> https://postimg.cc/gxbsN9dv

+++++++ That is described here. It spread, out of the ZIP you were working on!
There are a couple things you can do. One involves a "cipher" command,
which scans the partition and offers a list of things that are encrypted.
Chances are, the output file will be empty (as in the example in this
discussion thread. Then, you have to hunt down the certificates that got
added, using another procedure here, and remove them. Then it will stop
pestering you to back them up.

https://social.technet.microsoft.com/Forums/en-US/00291b25-6610-4563-aceb-2acc737b9cfa/prompt-popping-up-to-back-up-file-encryption-certificate-and-key?forum=win10itprogeneral

> I said yes to encrypt the files when extracting because it wasn't extracting at all
> and I thought that might be the reason. Obviously not and I created another
> problem by doing so. I deleted the downloaded zip files and haven't touched the
> 780 since. I assume once we restore the 780 all these problems will disappear?
> I just checked and it's gone. Apparently it only shows during the process of trying
> to extract the files?

+++++++ That's possible, that it's only while working on the ZIP. I don't know
if there are any tools that can tell you what precisely is going on.
The sender obviously has a sense of humor.

> In passing, he finally sent the screenshots one at a time each in separate emails
> although I don't understand why he couldn't of sent them all in one email? I didn't
> bother to ask.
>
> •I put my a few documents I have been working on the Patriot flash drive so I
> wouldn't loose any data when we restore the computers. However today I noticed
> a temp file that wasn't there before WRL1011.tmp I don't know what it is but its
> using 82.9MB.
>
> https://postimg.cc/rRF4yvp1

+++++++ Normally, tools place temporary files in %TEMP%. It's possible the tool placed
the copy there, as it's more efficient to keep it on the same volume as the
source file or something. Once all your tools are closed, such a file should be
gone. Being a temporary file, it only has value if something crashed and your
work is saved in there, and the tool knows about the file and will attempt to
re-open it.

> https://postimg.cc/nCWmZSfm
>
> but now today I don't see it? Is it some sort of Word file?

+++++++ Would this have been created while you were trying to unzip that file ?
An extension of .tmp tells us nothing. The general format, the tilde on the
front, suggests it might be Office, but it's hard to say for sure without
some detective work.

> • Both the 8500 and 780 backspace key doesn't work. How is it possible that both
> computers have this same problem? I barely use the 780 and only runs scans on
> it and the monthly backups. Which by the way I've stopped until we fix the
> problem on both computers.
>
> • the 8500 has lost some bookmarks

+++++++ There are some jsonlz4 files in the Firefox profile. I have code to unpack that
format, but who knows what additional barriers are in there. Your bookmarks are
supposed to be backed up once a day (as individual jsonlz4 files).

> • the 8500 mouse is way too sensitive. This is causing allot of problems with it opening
> and closing things I don't want it to and then have to open things back up but perhaps
> when the new mouse arrives it may go back to normal operation? Also the lack of a
> backspace key function has made this all very frustrating. It just started doing all this
> on it's own and I haven't messed around with any settings.

+++++++ In control panels, there may be a Mouse panel for such things. Pointer Options,
Select A Pointer Speed ?

> • Avast Smart Scan shows FF out of date but when I checked FF its up to date? I checked
> to make sure Avast was also up to date.
>
> https://postimg.cc/8FYqfbQZ

+++++++ Firefox is up to 88.

http://releases.mozilla.org/pub/firefox/releases/

http://releases.mozilla.org/pub/firefox/releases/88.0/win64/en-US/ # 64 bit installers

> https://postimg.cc/PvWccsL7

+++++++ It's possible you have both a 32 bit folder and a 64 bit folder for Firefox.
But that's just a wild guess on my part.

> • Also Adobe keeps sending msg's like this every once in awhile since I haven't un-installed
> Adobe. I believe my Dell imaging uses it so I'm leery of un-installing it even if it's not supported
> any longer as it may affect my Dell Imaging and I use it allot. What do you think? Should I remove
> it and would it make my system more secure? The thing is if Dell Imaging requires it and I remove
> it I can't get it back. Is there some way to check if Dell Imaging requires it?
>
> https://postimg.cc/WdZvmK8Q

+++++++ That's a good question. Some things use an npapi plugin and it would sit
in a "plugins" folder for the software. Other than that, I don't know if
the stuff uses COM to communicate. I would think the path or connection
would be a more "visible" one, and a file from Adobe would have to be sitting
in the Dell Imaging folder, to be able to use it. If Microsoft wrote it
(like Silverlight), it might be easier for other sottware to get at. It
would be nice if Adobe had a way of "listing all clients", but I don't know
of any interface for that.

> • In addition , sometimes when I'm working in Word, and I search for a document to open instead of
> My Documents it opens to totally unrelated page I've never visited.
>
> https://postimg.cc/DWTD8QHw

+++++++ It looks like it has jumped to the last folder it was working in.
Not a folder you selected, but a folder it selected for temporary files.

> Lastly, should we attempt a System Restore on both computers before we try a Mrimg restore? (even
> though we will still create (4) HD's with Win 7 Pro before trying to restore the present HD's.
>
> Although the normal procedure is to just let the newly created HD boot and show the desktop and then
> shutdown and remove it perhaps we should test it to see if the backspace function works first before
> shutting it down and removing the HD?
>
> Thoughts/suggestions?
> Robert

System Restore (System Protection) restore points, are mostly
for incidents like software installs where you want to clean
up after a software removal.

For a problem like the BackSpace key, you might have to go
too far back, and the restore point might not work, and it
will tell you so when you attempt it.

Restoring from a .mrimg is a more complete solution using
a "back in time" idea, but it also upsets your Downloads folder.

I know you are mostly worried about your Bookmarks file, and that
gives you a good deal of freedom on .mrimg restoral.

To make new "backup drives with boot OSes on them", one of the
necessary materials is a golden good OS image. If every OS
installation and .mrimg has a broken backspace key, then
we would be using compromised materials for the backup
drives. I think you understand the challenge here, and need
to look at your inventory to decide what to do next.

I've never restored goods, more than 2 years old, and even
that case, it was in an attempt to "chase a certain Acronis
driver out of a system". Normally, if I have concerns that
my OS was tipped over, the backup used to restore is going
to be well less than a year old. There would be too much
damage otherwise.

Paul

[Robert in CA]

So I need to find my Macrium boot CD to correct the problem on the 780?
I thought I had 7-zip installed but I just checked and I don't. I hate zip files
and all it was was a few pictures of older catalogs. It would of been much
simplier to just send them as jpegs.
I checked again and I'm showing FF as 88 (64 bit)
So you want me to look in the external HD and the Mrimgs on it? and to show
you what I have and then we select which one and restore the present HD from
that so it's all clean again and then we create the copies?

Is that correct?
Robert

[Robert in CA]

I connected my external HD and here are the Mrimgs:

https://postimg.cc/R3XyBGz1

I found a 780 System repair disc and a 780 Rescue disk
which one should I use? Do I have to open up Macrium to
use them?

Thanks,
Robert

[Paul]

I see MRIMG files of various sizes there.

When you make backups, you could be putting comments
in the file name, such a "kbd" for the backspace-key
issue and so on. By noting the pattern of which
failures occur ("mouse_jumpy") that gives you some
minor criterion to judge the backups.

Since the main purpose of the OS you will be putting
on new disks, is as emergency boot provision, it
doesn't really matter whether your Downloads folder
is complete as such. You only use the emergency backup
OS long enough to achieve a desired result, rather than
necessarily "living there".

If the main drive fails to boot some day, then you could
"move control" to your backup drive and its operational OS.
But that would also require moving your email profile from
the old machine, moving the most recent bookmarks file, the
contents of the Downloads folder, or whatever.

So when I look at the MRIMG files on offer, my main concern
is not dragging malware onto the new disk. Some image there
has to be "clean enough, to be cloned".

Macrium_CD ==> DVD tray Optiplex780 <== the backup drive on USB
which is providing the
==> New HDD on SATA, inside source MRIMG

You have to restore a C: and a System Reserved, for the new
disk to boot. If the Macrium CD is reasonably new, it may
even have the "Power Off" option in the shutdown menu.
Handy for rearranging stuff for the "first boot" of the
new HDD.

When you're using the Macrium CD, it'll be the Restore menu,
then browsing to the external USB to find that "best" MRIMG.

Paul

[Paul]

The "encryption problem", appears to be a case of the machine
having acquired "certificates" related to the Apple crypto.
To correct the problem, most likely involves checking
for the certificates and removing them. Then the machine
will stop pestering to be doing "backups of the encryption keys".

You should be able to execute some of the recipes here.

https://social.technet.microsoft.com/Forums/en-US/00291b25-6610-4563-aceb-2acc737b9cfa/prompt-popping-up-to-back-up-file-encryption-certificate-and-key?forum=win10itprogeneral

1) The first step, is a safety procedure. The command is supposed
to scan something and located all encrypted files. In your case,
by not using encryption, the "Encrypted-Files.txt" should be an
empty file with no contents.

Command Prompt(Admin)

cipher /u /h > %UserProfile%\Desktop\Encrypted-Files.txt

2) "please navigate to:

1. Type certmgr.msc into search box, press Enter. <=== Start : Run would do...

2. In the certification management window, expand Personal ->Certificates->
There should have entry with "EFS intended Purpose", delete that certificate.

3. Same steps for Trusted People ->Certificates ->
entry with "EFS intended purposes". Delete that certificate.

After that, reboot the computer to check the result.

Things with EFS should not matter, as long as the Step (1)
shows no files are encrypted.

*******

If you want a copy of 7ZIP, select the 64-bit version here
to match your OS.

https://www.7-zip.org/

Download .exe 64-bit x64 1.4 MB

What 7ZIP does, is add some right-click context menu
entries, such as Open Archive, so you can look inside
ZIP files you receive. Clicking an item or a folder and
selecting Extract, you can deposit the extracted thing
in a location you select from a save dialog box.

To go back-a-level in 7ZIP, use the backspace key. Most
of the rest of it involves clicking.

The graphical interface on 7ZIP is an acquired taste.
Some people hate it for some reason. I don't have a
problem with it. I use that tool all the time for
forensic reasons (looking inside stuff, for hints).

HTH,
Paul

[Robert in CA]

I'm confused with what were attempting to do.

I noted the various sizes of the backups as well
but I followed your instructions you first gave me
to the letter (I have all them saved as screenshots)
and they all went smoothly. I usually make the comments
you refer to whenever I create a system restore point but I
will make it a point to add them to the Mrimgs from now on.

So which mrimg from the 8500 do you think is best to clone?
I assume that is going to be our first step. I went back to take
a look at the 8500 Mrimgs and all the recent mrimgs are about
the same size. The changes occur on early Mrimgs that I kept
'just in case' and that's the explanation of the difference in sizes.

I'm not understanding exactly what you want me to do with
the 780? Do I use the Rescue CD or System Repair CD? Or
are you saying we need to clone a new OS onto the 780 before
any of this works? In any case I want to do the 780 before the
8500.

Here are the mrimgs for the 780 and they all are around
the same size.

https://postimg.cc/sM16GLvv

The encryption problem went away on it's own . I don't see the icon
anymore. Maybe it was just during the process that it occurs?

We can download 7Zip once we get everything back working normally.


Thoughts/suggestions?
Robert

[Paul]

Main Drive (C: and System Reserved) - does drive have malware?
- a problem correctable by restore?

New drive (C: and System Reserved) - needs an OS if just for the purposes
of emergency booting and repairs

I thought those were the two classes of problems you're interested in.

*******

Generally, for the Main Drive, if the OS develops a problem, you
restore using the most recent backup. This is intended to reduce to
a minimum, the amount of "lost materials" from a Downloads folder.

If you restore the Main Drive, you have ot take precautions not to lose
any valuable files for which you don't currently have copies.

*******

The New Drives, the emergency boot could really use any version.
If you know that one of the older versions doesn't have a Backspace Key
issue, then maybe that's the file to use. Of the newer images you've
got (you seem to be taking the images once a month), it's hard to
say which of those doesn't have the Backspace Key problem.

If you install the old backup, then relatively soon when that
New Drive is booted, both the Dell Updater, the NVidia Updater,
and Windows Update are going to be working to fill the machine
with recent stuff. In which case, if any of those caused the
Backspace Key problem, the problem would soon return (just on
the New Drive).

The difference between the drives, is your Main Drive is a
daily driver and has data content. The Emergency OS on the
New Drive, does not have quite the same requirements.

You can see in this picture of the world, that keeping data
files on C: is a bit of a mistake, but the options for moving
the storage off C: are not 100% free of issues. People in the
newsgroups here do that, they move their personal storage off
C: or move their Program Files off C: and onto another partition.
I don't particularly recommend that - it just makes extra work
at times. Work that I personally can do without. My Program Files
stays on C: . But any large collection of personal files, I move
those off manually to bring down the total size of C: . I have not
undertaken to do that automatically, only manually, so I can
watch what is going on.

Paul

[Robert in CA]

Ok so we select the most recent Mrimg to avoid the loss of data
and I've already put working documents on the Patriot drive for
safe keeping. What about bookmarks? Do I have to save them as
well?

I understand what your saying and perhaps that's what I should be
doing although I'm not using much of my C: drive as you can see:

https://postimg.cc/zHFyRBNP

https://postimg.cc/Yv9vhMsb

https://postimg.cc/q6J3wn1d

https://postimg.cc/gw4dRZLh

Should we check the drive for errors on both computers before we
clone an mrimg? Should I defrag both computers?

I still have (2) Startech cases and perhaps I should dedicate one for all
my personal files as another way to protect my data and just connect it
daily to use it. I would also do it manually so I can see what's going on
but it should be an easy matter. Once we create Win 7 Pro on the spare
HD's I can use one for all my personal data. Basically, it would be the
same exact setup I have now except all my persona data would off this
computer and as you say I would free up this C: drive. Would that make
it run faster?

I went back and checked the 780 mrimgs because the ones I gave you had
old dates and as you noted I create backups every month so there should be
more current mrimgs for the 780 and I found them:

https://postimg.cc/GBDgnwdm


The most current being 3-4-21 for both the 780 and 8500 since I do them the
same day.

So should I clone the 780 ? Then if the backspace key returns we know it should
for the 8500 as well.

Thoughts/suggestions?
Robert

[Robert in CA]

I should of posted this earlier but here's the
WBM screen:

https://postimg.cc/KR22qbSQ

Robert

[Robert in CA]

My mistake, we're restoring the 780/8500? and then cloning correct?


On cloning, I don't remember that we changed the partition size I think we
did that once before but with the 8200. With the 8500 we've just done straight
cloning.


Robert

[Paul]

There is a diagram here, which helps explain the boot menu.
There really should only be one Macrium item, not two, to my
way of thinking.

https://knowledgebase.macrium.com/display/KNOW72/Rescue+Media+Builder

# At the very least, System Reserved has to be intact, for
# this menu to even appear. Hopefully, to boot the WinRE, does not
# require C: to be working. The Macrium CD on the other hand,
# doesn't have these issues, and it should always boot.

https://knowledgebase.macrium.com/download/attachments/23399244/image2018-4-10_10-6-42.png?version=1&modificationDate=1540757373870&api=v2

One question would be, if the BCD is ever rebuilt, will all
those optional materials end up in the BCD again. That I don't
know. The Macrium CD, for example, if you select boot repair,
it does not particularly preserve the structure of the existing
BCD when it builds a new one. It just does a scan, detects the
things it "sees" and adds them.

The Macrium CD should always work. Any other items with the
word "Macrium" in them, will work as long as the storage they
sit on, is not corrupted.

There is no particular performance difference. If a WinRE or
a WinPE boots, the contents are stored in RAM (drive X: ),
and all materials run at RAM speed. The largest item designed
this way so far, is a "Hirens" disc, which stores several gigabytes
in RAM (and then, the machines running such a disc, need at least
that much RAM for the boot to finish).

If you didn't have your CD, you could use a menu item like that,
but it's unclear what issues might arise. Since the OS and X: are
in RAM, you should (in theory) be able to *overwrite* the disk
drive the thing booted from. How kooky is that ? Well, maybe for
once they did a good thing. If the Macrium Restore went half way
and stopped while doing that, you could very well be screwed
(then you'd need the CD to finish the job).

Paul

[Paul]

First off, when doing your planning, for a given machine, we prefer
to have the two "working" disk drives. Say you attempt to restore over
the 780. Then we want the disk drive with that emergency OS on it,
to still be available if there is trouble.

You can restore over the existing C: on either machine and test if
you want. Determine if your backspace key is working. My suspicion is,
with the one month old backup, the backspace is still busted. But, you
can test.

You remember in the slide sets I made, you can click the "Back" button,
select a partition and edit the size. So it is possible to adjust
*any* restored OS to the size you want. When restoring the daily driver
disk for the 780, you might want a slightly larger C: than
for the emergency boot C: on the new drive.

To control the size of *all* of them, you restore the partitions
one at a time.

+-----+------------------+
| MBR | First partition |
+-----+------------------+

+-----+------------------+------------------+
| MBR | First partition | Second partition |
+-----+------------------+------------------+

+-----+------------------+------------------+-----------------+
| MBR | First partition | Second partition | Third partition |
+-----+------------------+------------------+-----------------+

You "drag and drop" a partition from the source MRIMG you browsed
to, then place it on the drive you're "building".

When you do a drag and drop restore like that, it's not likely to
boot. That's because, when you "tease" it by doing one partition
at a time, it does not engage its boot repair as a side effect.

When we get here, and have finished this much...

+-----+------------------+------------------+-----------------+
| MBR | First partition | Second partition | Third partition |
+-----+------------------+------------------+-----------------+

now, it's time to shut down and disconnect the drive with the backups
on it. We *don't* want the boot repair to see the C: on the emergency
boot. The next step is to boot with the Macrium CD again, just the
drive inside the 780 is present, now we use the menu item with
"Boot Repair" in it.

Now, we reboot and allow the 780 hard drive to boot, to prove it
all works.

Let's say the third partition was intended to hold backups.
You would likely want to avoid copying excessive amounts of
material from any backup partition. You can use Disk Management
(diskmgmt.msc) to create a new NTFS partition, call it BACKUPS
and format it, and then it's ready to take backups.

That's an example of a "custom restore". Build it in pieces
as you see fit. Click the Back button, highlight the partition,
use the button to "Edit Partition Properties" and you can set
the size you want.

You can fix drives up, after the fact, with things like the
free Paragon Disk Management 14 program, but Macrium can also
do some of these things for you.

*******

To erase the 780 main drive, you can do that as follows.

1) 780 main drive only. (*Don't* connect the backup drive, as
that would be confusing!)
2) Boot from Macrium CD.
3) There is a Command Prompt icon on the taskbar. Click it.
It runs as Administrator, so you don't need to worry about
elevation.
4) Now, run "diskpart".

diskpart
list disk # only the one disk should now show
select disk 0 # select the drive from the list, which is 0
clean # MBR and partitions blown away
exit
(Close Command Prompt window)

5) What that does, is make an unambiguously clean main drive,
now ready for Restore. Don't do this, unless you are absolutely
sure you have a good backup image to restore!

Anyway, those are some ideas for "doing things your way"
and getting what you want. Yes, we could just restore
any old thing, and "fix it later", but that takes time,
it slaps the disk heads around moving data blocks, and
it's just not very efficient.

*******

After a disk restore, you can move or resize partitions with
this, but it's a bit clunky. The first thing you have to
figure out, is (purple) "Switch to full scale launcher" before
it's ready to go to work. It's filled with features that
are not enabled (being "free"), but it can move and resize
a bit more than the Windows-provided features (which only
resize). Just use the "Move/Resize" if using this, nothing else.

https://download.cnet.com/Paragon-Partition-Manager-Free-Edition-64-bit/3000-2248_4-10904411.html

Paul

[Paul]

Robert in CA wrote:
> Ok so we select the most recent Mrimg to avoid the loss of data
> and I've already put working documents on the Patriot drive for
> safe keeping. What about bookmarks? Do I have to save them as
> well?
>
> I understand what your saying and perhaps that's what I should be
> doing although I'm not using much of my C: drive as you can see:
>
> https://postimg.cc/zHFyRBNP
>
> https://postimg.cc/Yv9vhMsb
>

> https://postimg.cc/q6J3wn1d <=== Previous Versions enabled ???
>
> https://postimg.cc/gw4dRZLh ("Check now" picture)

>
> Should we check the drive for errors on both computers before we
> clone an mrimg? Should I defrag both computers?
>
> I still have (2) Startech cases and perhaps I should dedicate one for all
> my personal files as another way to protect my data and just connect it
> daily to use it. I would also do it manually so I can see what's going on
> but it should be an easy matter. Once we create Win 7 Pro on the spare
> HD's I can use one for all my personal data. Basically, it would be the
> same exact setup I have now except all my persona data would off this
> computer and as you say I would free up this C: drive. Would that make
> it run faster?
>
> I went back and checked the 780 mrimgs because the ones I gave you had
> old dates and as you noted I create backups every month so there should be
> more current mrimgs for the 780 and I found them:
>
> https://postimg.cc/GBDgnwdm
>
>
> The most current being 3-4-21 for both the 780 and 8500 since I do them the
> same day.
>
> So should I clone the 780 ? Then if the backspace key returns we know it should
> for the 8500 as well.
>
> Thoughts/suggestions?
> Robert
>

You can do a CHKDSK if you want. In File Explorer, you highlight the partition
needing a check, do Properties on it, then under the Tools tab is "Check Now".
To be able to repair C: , the machine may tell you a reboot is required.
At the beginning of the reboot, before C: is mounted, that's when it
can run the check. That could take a while. The basic check just verifies
any linkages. It does not verify that all files are readable.

Your Previous Versions picture, is coming from System Restore points.
So that's the storage area it uses on C: . It has a limited amount of
storage for Previous Versions. The oldest Previous Version is thrown
away, to make room for the latest one.

https://www.howtogeek.com/56891/use-windows-7s-previous-versions-to-go-back-in-time-and-save-your-files/

I think that might get backed up, but I haven't verified that.
THe actual storage location, could be vaguely related to
"System Volume Information" at the top of C: , but you're not
allowed to look in there.

Taking materials off C: , the purpose of that is to de-duplicate
your backups a bit. It depends on how many copies of the
materials, make sense to keep. If you do full backups, one after
another, then every one of those has a copy of Downloads for example.

Storing materials in a separate partition, you still have to back up
the separate partition. But, you can alter the frequency of such
backups, to whatever makes sense to you. For example, I have 1.3TB
of stuff off of C: , and that might get backed up twice a year.
I could easily lose newer materials. But being as large as it is,
first I have to find space to store the output :-/

Features such as Incremental Backups in Macrium, make the storage
of backed-up material more efficient. But that's a function in the
paid version.

*******

You can do CHKDSK, before defragmenting, for safety.

When you make backups with Macrium, the clusters are recorded
in cluster-order. The hard drive head does not fly around
trying to trace down chunks in "file name order".

file1.txt cluster 1, cluster 3 <=== fragmented, two clusters
file2.txt cluster 2, cluster 5 <=== fragmented, two clusters

Macrium backup order is 1,2,3,5... to the MRIMG.

During the Restoration process, if you resize the restored partition,
it (as a side effect) can defragment a bit. So you can get a bit of
defragmentation during restore, by resizing a partition. The defragmentation
is not "done with a purpose", it's not "perfect", but you'll notice
that it's been screwed around a bit.

None of the defragmentation options work like the built-in
feature in Windows XP. There, the files were shoulder to should,
like a brick wall. The Windows 7 defragmenter doesn't do that.
The Windows XP defragmenter could easily run for 8 hours.
The Windows 7 one, maybe 10-15 minutes (because it doesn't work as hard).

https://i.postimg.cc/zDxRR4yv/jkdefrag.gif

In that example, JKDefrag is being used from the command line.
These are some examples of JKDefrag commands:

jkdefrag -a 1 -d 2 C: # Graphical representation of current fragments
# This is how I can tell how hard it will be for
# any tool to clean up.

jkdefrag -a 5 -d 2 C: # Dumb function, to consolidate free space by
# "shoving all the files downwards". Still needs
# a defrag after this!

(Now, run the Windows 7 defragmenter, which is sorta intelligent)

jkdefrag -a 2 -d 2 C: # Defrag. Run this after Windows 7 defrag for
# best results. It defragments the files larger than
# about 50MB or so, that Win7 didn't process.

-a N The action to perform. N is a number from 1 to 11, default is 3:
1 = Analyze, do not defragment and do not optimize.
2 = Defragment only, do not optimize.
3 = Defragment and fast optimize [recommended].
5 = Force together.
6 = Move to end of disk.
7 = Optimize by sorting all files by name (folder + filename).
8 = Optimize by sorting all files by size (smallest first).
9 = Optimize by sorting all files by last access (newest first).
10 = Optimize by sorting all files by last change (oldest first).
11 = Optimize by sorting all files by creation time (oldest first).

https://www.kessels.com/JkDefrag/

https://www.kessels.com/JkDefrag/JkDefrag64-3.36.zip # 64-bit version

*******

That backspace key is going to haunt you. It's some application
you've installed, and could have been one of your automatic updates.
I would be surprised, if going backwards had good odds of fixing it.

I just don't know how to debug keyboard issues. Yes, there's a translation
table, but applications can install filter drivers too, devcon might
list such things, but I don't know if there are any additional failure
modes or holes in the scheme where they are messing about. Maybe it could
be caught with ProcMon, seeing some compute activity captured at the
instant the key is pressed. But generally, I don't have a warm feeling
on the topic. ProcMon is always a "needle in a haystack" - analysis
is a pain. And I can't help you from here, because I don't know
what application is doing it, and it's pretty hard to simulate.

(The new versions are Win7 and higher)

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

I tried a fake test case here with that, and could not find
the trigger event. Already, an easy test, I can't catch it.

Paul

[Robert in CA]

> +++++ Two disks were present when the menu was rebuilt,
> and now the menu choices are both being shown.
> Rebuilding the menu with one disk only present, will fix it.
> Macrium boot CD has a "boot repair" menu item, which can be
> used to restore normal boot behavior with one disk.

I tried running the boot repair off the rescue cd (ver 7.2) to correct the
WBN screen logon on the 780 but I'm not sure which items to un-tick

https://postimg.cc/p5M2g2BZ

https://postimg.cc/GTPcRZ71

https://postimg.cc/t11pJ1Sk

https://postimg.cc/fSvhpYyz

Robert

[Paul]

If you look in Disk Management, System Reserved is marked "Active"
and "System". It is the Active (Boot Flag = 0x80) partition
that the boot process starts on.

You can see the Macrium menu identified a partition, and it
did that by looking for the Boot Flag. Sometimes the Boot Flag
is not in the right place and needs correction, but this does
not happen too often. If two disk drives were present, there
could be confusion about which one.

You will be asked to identify the Active partition, because
that's where the BCD file for the boot menu goes.

You will be asked to identify all the C: partitions, so they
can be added to the boot menu as boot-time-options.

The four tick boxes are:

Reset the Boot Disk ID

This is a four byte field in the MBR, near to the four entry
partition table. The disk may be named ABCD1234 for example.
When cloning a disk, initially two disks have the same
ABCD1234. This is bad. If left this way, the first disk is
"Online", the second disk goes "Offline". Not very useful for
daily work. If ticking this box, a new DiskID is assigned to the
drive needing boot work.

When Macrium clones, the second disk is automatically given a
new ABCD1234, so this tick box is not needed. If duplicating a
disk drive using dd.exe (Disk Dump), then, a new DiskID is needed
and the box should be ticked.

It generally does not hurt anything.

Replace the Master Boor Record (MBR)

That's the boot code, in the first 440 bytes or so.
I'd have to look up the exact number of bytes. There is
boot code in there and the four primary partition table entries,
as examples of materials that are present.

If a disk was zeroed, then partitioned, the boot code would
be missing. But Macrium prepared disks would not usually be missing
this code. If the BIOS simply won't boot from the hard disk, claiming
there is nothing there, you can tick this box.

Replace Partition Sector Boot Code

This is three sectors in the Active Partition. The MBR jumps to
that code. If a partition is "formatted" with a format routine,
the three sectors are lost. Generally, if Macrium clones a partition
or restored from backup, everything there is OK and the tick box
is not needed.

Rebuild the Boot Configuration

This is the one normally ticked. If you're going to use this
feature, Boot Repair, you tick this one, as it's the only option
that makes sense for the feature :-)

So bare minimum, tick the last box. Tick other boxes, if
the first attempt at boot repair, does not work.

HTH,
Paul

[Robert in CA]

I ran the Rescue CD again with the 'Rebuild Boot Configuration' checked
but it booted directly to the desktop and the WBM didn't appear at all. So
I ran the Rescue CD again with all boxes ticked and it still does the same
thing. It boots directly to the desktop.

https://postimg.cc/YLhK62J6

https://postimg.cc/pmNbjHkj

https://postimg.cc/V0BMF1nN

https://postimg.cc/xXWvYsfn

Thoughts/suggestions?
Robert

[Paul]

From the Rescue CD, Command Prompt window (which is administrator)...

dir /AH C:\boot\BCD # verify it is there.

bcdedit /store C:\boot\BCD /set {bootmgr} displaybootmenu True

*******

Or, from the running system, using just the regular windows stuff.
You want to run "cmd" and right-click on the returned item and
select Run As Administrator. The following is "online" editing of boot menu.

bcdedit /set {bootmgr} displaybootmenu True

*******

Using the last one from my running OS, this is my result.

https://i.postimg.cc/P5DfBhb7/boot-menu-edit.gif

Paul

[Robert in CA]

I tried it both ways:

https://postimg.cc/Jt5KGSDp

https://postimg.cc/k6c8g318

btw I like your idea of moving all the data to a dedicated external hd
but I was thinking if I do that then I'll also have to create a backup
hd for that, correct?

I realized that I don't need to move anything once we clone the drives
with Win 7 Pro. I just need to delete everything off the 8500, one folder
at a time, correct?
I thought what I would do is take a screenshot of all the folders of My
Documents from the newly created hd that we'll use as a dedicated data
drive and use it to check the folders as I delete them off the 8500 one by
one
Not get ahead of the problem were having with the 780 but how do I
create a backup if my data is on an external drive? Can I do a backup
from an external drive to an external drive? If so, could you please give
me numbered step by step instructions like you did before when we get
to that point?

Since I'm already backing up the 8500 and the 780. I think I should
buy more hd's next month so I have spare hd backup's for all the computers.

Thoughts, suggestions?
Robert

[Paul]

Robert in CA wrote:
> I tried it both ways:
>
> https://postimg.cc/Jt5KGSDp
>
> https://postimg.cc/k6c8g318

The first picture is more likely to work.

You need to put some space characters in that command,
to separate the fields.

bcdedit /set {bootmgr} displaybootmenu True

I like your enthusiasm, but you don't want to fall into
a trap like me, and end up with way too many hard drives
around the house :-)

You could partition a hard drive like this. You don't
have to keep the Downloads on an external drive,
you can just keep a partition next to C: . The
advantage of this, is with C: being unloaded occasionally,
you can keep C: from getting too big.

+-----+-----------------+-------------+----------------+
| MBR | System Reserved | C: 100GB | D: Data 800GB |
+-----+-----------------+-------------+----------------+

Maybe C: gets backed up once a month, D: is backed up once a year.
My illustration, is to show that you can have two kinds of files,
and have different backup practices for each.

But really, you have a good scheme as is. A backup is
a couple hundred GB so it hasn't gotten completely
out of hand.

If you purchased Macrium, then you could use a feature
called "Incrementals Forever", and your first backup would be
around 200GB, but the next month, the backup might only be 5GB.
That's because the combination of the two, 200+5 is read
back, to prepare the Restore later. Incremental backups
rely on more than one backup file being intact. The
"Incrementals Forever" feature, adds to that, the
squashing of the 200+5 thing, down to the
approximately 200GB it really represents, then
adding more incrementals on the end. It's
a kind of sliding window of incrementals.

The purpose of all this manipulation, is to
make the backup drive last longer, and hold
more months of backup. By not doing the Free
Version "Full" all the time, some space is
saved. Incrementals de-duplicate, so if
mypicture.png is already stored in a backup,
it does not have to be recorded a second time.
The Incremental feature keeps track of which
files belong in the Restore, based on any
time point you select for restoration.

Again, that's an example of how some people
arrange their backups.

Now, me, I just use "Full" ones like you,
and I occasionally toss some, to make room
for new ones.

But in any case, when making backups, the
temptation is to hold onto too many backup
images, buy too many hard drives, spend long
hours moving files from one big drive to another
and so on. It can easily turn into a zoo.
And I don't want you to make the same
mistakes I've made (with the buying drives thing).

When I make suggestions, I'm trying to give examples
of various ways you can slice a pie. But not
everyone likes their pie that way, and you have
to think through the consequences of these
ideas, to their logical conclusion.

You had a decent collection in that picture you
showed me, because you had a series of monthly
backups. And say the backspace key problem, wasn't
fixed by restoring last months MRIMG. You could
go back a second month, and test there.

Only on one occasion, did I need to go back
two years, and I did move forward again later,
when via Googling, I found another solution
to my problem, and then I didn't need to keep
using the two year old restore. Would I keep
monthly backups for two years ? The demonstrated
need shows that once you have a year of backups,
you can keep just one of them per year so
that is your "yearly". So maybe a couple yearly
ones, and a bunch of monthly ones.

Jan 2019
Jan 2020
Jan 2021
Feb 2021
Mar 2021

Maybe later in the year it looks like

Jan 2019
Jan 2020
Jan 2021
Apr 2021 <== ditched a few monthly ones, so quarterly
Jul 2021
Oct 2021 \
Nov 2021 \___ Monthly for the most recent
Dec 2021 /

And maybe that will fit on a single 2TB drive.
And those can be "Fulls", like you're making now,
because the storage device has just enough room
for the proposed backup set. No need to purchase
Macrium, within those constraints.

Since you're no longer using Windows XP, you
can use huge drives for backups. The ones you're
using now, seem reliable enough, and there is nothing
wrong with them. You can get drives, like 14TB,
you prepare those with GPT partitioning on
Windows 7 and you're allowed to have one giant 14TB
partition. But I don't buy drives that big, because
it takes too long to move the data off them.
The biggest drives I have today are 6TB. That's
enough to hold two 3TB sets of backups for me.

The pricing curve for drives, sometimes there's
a kink and sometimes not. When they're linear
with capacity, then there isn't a lot to be gained
from buying huge ones. If there was some economy from
the bigger ones, it might be more fun to buy them.
But if a big drive costs $500, who needs that exactly.
It's like buying a steak which is too big for one
meal, and some going to waste. And if the big drive
breaks, now you're out $500 (unless you want to
pursue the warranty, and at that price, you have
an incentive to do so).

If there was a Free backup with Incrementals,
I'd be testing that for myself :-) But that tends
to be a paid feature.

I think you're in pretty good shape as is. You're
making backups. If you get ransomware, there's a chance
you'll be able to recover from it. You won't be like
the guy in another group - he tells me he's got data
files that end in myfile.xls.osiris and that osiris
thing means "ransomware". And the guy has no backups.
It took *months* for him to do clean installs,
try and tip computers upright and so on. It was a
real mess. That's the only case of ransomware I've
heard of in the newsgroups. How did he get it ?
He opened an email from GoDaddy domain registrar,
with an attachment called "invoice" and when he
clicked on the "invoice", ransomware took over.
The email wasn't from GoDaddy, it was forged.
And why did the forgers send it to him ? When he
registered his GoDaddy domain, he used his real
email address (and the registration can be
seen publicly). The perps just grab all the
email addresses from those registrations, and
they "spray" all the victims with "invoice" emails.
That was the infection vector. Email.

Paul

[Robert in CA]

It worked!

https://postimg.cc/1fjXxbbM

https://postimg.cc/BL4Qc31Z

If I were to create a partition I still would want to backup my data
monthly because I do allot of work that requires it. It seems for my
purposes what I'm doing now is the best fit for me. As you say I 'm

in pretty good shape as is.

I thought about increasing the HD size for the external hd's but even
if I stepped up to 4 TB I would never use that much. You saw my hd
and how much free space I still have. I do the same as you and just
delete older ones as needed.

That scenario about the guy opening up the email and invoice is exactly
what happened to my sister after I told her not to open it! I'm very careful
with emails. I never open emails if I don't know who they're from and I
don't use my real name (why do people do that? Its nuts? ) I have all my
family and people I know on one email account and I have another
separate email account for everything else and I set the filters very high.
If I get any spam I block the senders so now I hardly get anything.

I learned my lesson the hard way and since you were with me every step
of the way you remember what a nightmare we went through trying to
restore the 8200 and the 300+ updates to bring it back. Luckily we found
a SP1 file so we could build off of it but afterwards I vowed never again
and you helped created the backup system I now have including the spare
power supplies, making all the backup and recovery CD''s and picking out
the 780.

So are we good to go in trying to restore the 780 with the 4-3-21 mrimg?


Robert

[Paul]

Robert in CA wrote:

>
> So are we good to go in trying to restore the 780 with the 4-3-21 mrimg?

Make a backup of what exists on the 780 first. Then, if you don't like
what happens with the 4-3-21 restore, you have options.

Paul

[Robert in CA]

The new mouse(s) arrived and I switched the 8500 mouse with a
new one thinking it might be the cause of problem I've been having
and I think it is. So far it's acting normally and not opening or closing
things I don't want it to. I did have to adjust the speed of this one as
it was way too sluggish at first and I felt it in my wrists immediately.

I started the 780 backup but ran out of space on the external hd so I
had to delete some older Mrimgs. During this process it showed this
for Mrimg 3-4-21which we wanted to use to restore the 780.

https://postimg.cc/xJ3PhGcB

So it looks as if I'll have to go back further for the 780 Mrimg 2-1-21 to
restore it.

While restoring the 780, I had a 'Build rescue media boot menu' pop up.
I didn't know what to do because this isn't in your instructions you gave
me previously so I cancelled the restore.

https://postimg.cc/nXXn00CS

Robert

[Paul]

https://forum.macrium.com/14596/XML-Validation-Error--2-1-is-not-valid

"A new Full should correct the problem
or you can edit the XML file"

If you were attempting a backup, using an existing (defined) backup
from the list of backup setups, then you need to make a new Full
and select the partitions you want backed up. You can only reuse
an existing definition from the menu, if it continues to match
the disk you are backing up. If you make too many changes, you
have to (somehow), make the disk match some definition file.
Editing the XML file sounds a bit over the top to me, when
the GUI can create another one for you.

*******

The existing backups (during Restore) are also going to be compared
to how the disk is partitioned currently. That's if you were partially
restoring the setup on there.

https://i.postimg.cc/CLQ47Rxn/restore-shows-config.gif

The image there, says "you can drag and drop". You're allowed
to restore one partition at a time, resize the partition
(don't make it too small though or there won't be enough
slack to boot).

You're in full control in a sense. But you have to keep your
wits about you.

If restoring one partition at a time, it is always possible the
system won't boot afterwards, but no problem, as the Macrium
CD has the boot repair menu, and putting a new MBR boot code
on it will probably fix it up.

When you restore, you can completely blow away the original
disk contents. Just tick all the boxes, select the disk you
want to use, click Next and away it goes. If it asks you
what configuration to keep, you would want to keep the
partition structure as defined in the backup.

But if you need to shoehorn like-partitions-in-like, you
can do that. Or even, click Back and resize the partition as
desired.

Using the Command Prompt window available in the lower left
of the Macrium screen during CD restore, you can even use
diskpart to clean off a disk drive.

diskpart
list disk
select disk 0
clean
exit
(close Command Prompt)

But if you're going to do that, you have to be damn sure
you're erasing the correct disk. The Macrium Restore is
marginally safer (as typically, the DiskID shown in the
upper pane of the Restore, will match the DiskID of the
disk you select for restore. As that's the disk it came
from in the first place.

*******

The "Make Rescue Media" thing happens, if you update the
version of Macrium, but have not made a new CD. I would
think any Version 6 CD should restore any Version 6 backup,
but I haven't tested that. But the newer versions can
have a different feature set, and if you made a backup
using Version 7 loaded on the C: drive, it would be
expecting a lot for a Version 6 CD to do the restore.
If running Version 7, I'd want at least one Version 7
CD kicking around the room. Then it's not going to
complain about the version, during the restore.

Since both my machines are roughly the same class,
a CD I make on one of them, typically works OK for the
other. Your machines would be in that ballpark as well,
as the 780 is 64-bit and has mostly modern peripheral
interfaces. Maybe the network driver might not work on
both, but then, you don't use restores from network shares,
and won't be facing a networking challenge as a result.
Your strategy uses external USB holders of backups, and
all that your CD needs as a result, is the appropriate
generic USB2 or USB3 driver (or both). And one of the
more modern choices of the list of WADK kits in the
Make Rescue Media menu, will give you something that
works on both machines. USB being generic, and say,
a Windows 8 era or Windows 10 era WADK download, will
have drivers for both USB2 and USB3 from Microsoft.

That has nothing to do with the OSes you're restoring,
which are both Windows 7. The boot CD does not "sniff"
the OS being restored, for such purposes. It's when the
Rescue CD is being prepared, some of the modern WADK
choices have the right drivers to mostly bring up the
hardware on your two machines. Then one CD is "good enough"
for both. I don't like to waste media here, as I suspect
if I go to the store, the selection will be extremely
poor. Since you can't buy a DVD drive at retail now,
there's hardly a reason for Ritek to continue making
DVD blanks. There are still some BluRay drives,
which burn all three disc types, but there aren't
a lot of choices left there either. So the small cake
box of media I have left, that's just about it.

Paul

[Robert in CA]

I don't understand what it means that the restore must be
completed in the Windows PE rescue environment? I thought
I was in the PE mode when I connected the external hd?

I understand that the partitions don't match up but I'm not
understanding what you mean by a new full? If I drag and drop
from the external to the C: drive I have to do it for all the partitions ,
making each the same size, correct?

This is getting beyond me,.... I didn't realize I had to partition.

I'm not sure how to proceed at this point.

Robert

[Paul]

First, I was hoping you'd keep a backup of todays 780,
in case of trouble.

Main drive ===> USB external
|
booted from
anything with a copy
of Macrium on it (CD or C: )

The next step is the Restore of your selected backup
onto the 780 main drive.

Main drive <=== USB external
|
booted from
Macrium CD

You want to be booted from the Macrium CD for
the bare metal restore you're doing. You can
do any kind of restore you like - drag&drop a
single partition or restore the entire MRIMG,
your choice. The version of CD should be
recent enough, to match or exceed the version
that made the backup. Macrium will tell you
if you're using the wrong version.

Macrium will allow you to make boot media with
either a USB stick or a CD, whatever you have
handy or want to sacrifice for the job. If you
didn't have any CDs, you could use a USB stick
instead.

Paul

[Robert in CA]

I did do a backup of the 780 today prior to
restoring just as you suggested.

https://postimg.cc/2bptKw4m

When you say Macrium CD I assume your referring
to the pop-up 'build Rescue Media' create one?

I'm going to try this again,..

Robert

[Robert in CA]

I understand what the PE environment is now. When I compared partitions
it should fit. So I shouldn't have to adjust the size of the partitions from what I
see. I now seem to remember you showed me how to adjust the size of the
partitions on the 8200. I remember sliding it to the right to increase the size.

I said yes to the pop-up this time and everything is going smoothly,..... I

OK it did not end normally, I had to leave the room for a few minutes but when I
came back the 780 had rebooted and the messed up WBM has returned. Avast
virus definitions were not up to date and Macrium had an update and I had a
Windows update and a optional update so it did something but the backspace
key still does not function.


https://postimg.cc/vgKNpxc7

https://postimg.cc/dDzf6dMw

https://postimg.cc/hJPZv1mb

https://postimg.cc/JHb5PsJz

So what now? try it again but it should have ended normally and didn't.


Thoughts/suggestions?

Robert

[Paul]

Robert in CA wrote:
> I understand what the PE environment is now. When I compared partitions
> it should fit. So I shouldn't have to adjust the size of the partitions from what I
> see. I now seem to remember you showed me how to adjust the size of the
> partitions on the 8200. I remember sliding it to the right to increase the size.
>
> I said yes to the pop-up this time and everything is going smoothly,..... I
>
> OK it did not end normally, I had to leave the room for a few minutes but when I
> came back the 780 had rebooted and the messed up WBM has returned. Avast
> virus definitions were not up to date and Macrium had an update and I had a
> Windows update and a optional update so it did something but the backspace
> key still does not function.
>
>
> https://postimg.cc/vgKNpxc7

"Unable to lock drive"

You tried to restore over the *RUNNING* C:

That's why I mentioned the usage of a CD for the "bare metal restore"
class of restoration.

>
> https://postimg.cc/dDzf6dMw

OK, now I'm seeing the Macrium 7 CD booting in that picture.

>
> https://postimg.cc/hJPZv1mb

Macrium CD doing a restore over C: of 156GB.
The empty space on the C: is quite large apparently.

>
> https://postimg.cc/JHb5PsJz

Since it has Restored a copy of a backup made of that
machine earlier, the *earlier* boot menu returned. That
happened, because the System Reserved was restored too
(in the previous picture as item 1 of 2).

> So what now? try it again but it should have ended normally and didn't.
>
>
> Thoughts/suggestions?
>
> Robert
>

The result is not unexpected. You've returned the 780
to the situation it was in a month ago, complete with
the boot menu it had a month ago. Sure, it will be
asking for updates and so on.

The backspace key indicates that the backspace problem
was there a month ago too.

You'll have to go back a bit further then.

If it was me, I'd leave the network cable disconnected
when it comes up after your next test restore, so it
does not immediately start loading up more stuff
and confusing the results of the test.

You can carry out your boot menu repair steps as before,
to get the (cleaner) boot menu. Macrium Reflect boot repair
for cleanup. That one command line with the displaybootmenu
in it, to return to the black colored selection screen
flavor of boot display.

I wouldn't say what has happened is "messed up". It
represents the level of work required to turn an
old restore, into a useful working environment.
There would only have been a free lunch if the
OS was "pristine" when backed up. That's the way
these things work, including having to find and
restore your Bookmarks file from the USB key.

And the reason you backed up C: *before* doing this,
is so, if you didn't like what happened, you
could roll forward again.

Welcome to Mars, astronaut. All is, as expected! :-)
Nothing ventured, nothing gained.

Paul

[Robert in CA]

OK Mission Control,.... copy

hmmmmm I think I understand, I've changed the boot menu back
as we did before , now I'll disconnect the internet connection and
insert the Rescue CD and then proceed to restore from that point
as a stand alone system. correct?

I'll give it another try with an earlier Mrimg (1-1-21)

Robert

[Robert in CA]

The restore worked but the backspace keys on both the 8500 and
780 still do not function.


https://postimg.cc/LhV4fhHw

https://postimg.cc/sv6V68GJ

https://postimg.cc/zbFNnP1K

https://postimg.cc/QVSsCPmr

https://postimg.cc/rd627LV5

https://postimg.cc/Y41BHy0Z

https://postimg.cc/SXbHD7dr

I don't remember going for this long without a backspace key and I'm
wondering how far back we'll have to go? Perhaps just another month?
but I'm wondering about the 8500 now because that means it too would
have to go back that far.

I thought of another possibility since the new mouse corrected the problem
I was having with things opening etc. Maybe the problem however unlikely
is that the keys themselves are bad on both keyboards? I think I may have
some older working ergonomic keyboards left that I could try using one of
them to test it.

Thoughts/suggestions?
Robert

[Robert in CA]

I forgot to add afterwards the messed up WBM reappeared and I had to
reset the boot menu again.

I did also some updates.

Robert

[Paul]

Robert in CA wrote:
> The restore worked but the backspace keys on both the 8500 and
> 780 still do not function.
>
>

> https://postimg.cc/LhV4fhHw Restore view
>
> https://postimg.cc/sv6V68GJ Select image to load
>
> https://postimg.cc/zbFNnP1K 1-1-21 image
>
> https://postimg.cc/QVSsCPmr A 2TB image 156GB data 2 partitions
>
> https://postimg.cc/rd627LV5 Replacing F: (system, the active boot thing) and C:
>
> https://postimg.cc/Y41BHy0Z Restore running
>
> https://postimg.cc/SXbHD7dr 2 hours 20 minutes (Optiplex 780, USB2, 21MB/sec )

>
> I don't remember going for this long without a backspace key and I'm
> wondering how far back we'll have to go? Perhaps just another month?
> but I'm wondering about the 8500 now because that means it too would
> have to go back that far.
>
> I thought of another possibility since the new mouse corrected the problem
> I was having with things opening etc. Maybe the problem however unlikely
> is that the keys themselves are bad on both keyboards? I think I may have
> some older working ergonomic keyboards left that I could try using one of
> them to test it.
>
> Thoughts/suggestions?
> Robert

Well, sure, if you have another keyboard, like a USB one,
give it a shot.

But I really don't think that's going to fix it. You could
be running an image editor, where the backspace key has been
highjacked to do something like screenshots or the like.

Maybe an instance of AutoIT (a part of some other piece of software
you loaded). But if so, we should be able to break this habit if
going back far enough.

Have a think about what your Startup Items are. Perhaps Sysinternals
Autoruns, when it makes a list of Startup Items, it will include
in the list, the guilty party stealing your backspace key. I'm pretty
sure you have one of those by now - if not, it's here.

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

*******

Some totally off-topic content...

The 780 could restore faster, with one of these in Slot 4
(the bottom PCI Express x1 slot). That's a NEC chip for a controller.
NEC was the first company to make a working USB3 (first cards $25).
I have a NEC chip and card, in the machine I'm typing on. That
would cut the restore time from 2 hours 20 minutes, to about
half an hour. Hard drives can go faster than that, but I find
my Macrium Restores never seem to be exactly Enterprise Warp 9.
More like Half Impulse Power. So this is about as much speedup
as would help, typically.

https://www.newegg.com/bytecc-model-bt-peu310-pci-express-to-usb-card/p/N82E16815283031

There is at least one card that goes faster than the NEC, but
you'd need an unused video card slot to use it. It is a card
with an x2 wired interface instead of x1, and it makes a USB3 interface
that does the full ~500MB/sec. I have one of those here, but
don't have enough slots in my other machine to be leaving the
card in the machine. The chip on this is Asmedia, and it uses
MCCI (contract-written) drivers. The x4 sized connector, won't fit
in your slot 4, but fits where the video card goes in slot 1.
The physical connector is x4 sized, but only x2 of the lanes
are wired up (that's all Asmedia put on the chip).

https://www.newegg.com/startech-com-pexusb312a3-pci-express-to-usb-card/p/N82E16815158472

Your 8500 probably has USB3 (blue connector tab), and doesn't
need such frippery. But I did add one of those to the typing
machine, because all it had was USB2. The NEC has WinXP drivers,
the Asmedia chip, driver coverage for that one starts at Win7.

That's one way to make a USB3 external drive go a bit faster.

Paul

[Robert in CA]

I tried another Microsoft 4000 keyboard I had that I replaced
because the spacebar is sluggish after I tried to clean it (big
mistake). Anyways the backspace key still did not function on
the 780. I didn't want to try this on the 8500. We can keep restoring
further back but what if they all are the same and I've lost the
back space function? Is there no way to recover it?

I did a search on the subject and these came up:

Solution 1: Turn off the Sticky Keys and the Filter Keys feature
1. Type ease in the search box from Start. Then click Ease of
Access keyboard settings.
2. Make sure the status of Sticky Keys and Filter Keys are all set
to Off. If you see On, switch to Off.
3. Your backspace key should work now.

https://postimg.cc/y3yqkpCb

https://postimg.cc/zL2GfBFg

I noticed that only the 'turn on toggle keys by holding down the NUM
LOCK, or SCROLL LOCK was switched ON. Could this be the problem?
Sometimes the driver may be corrupted or outdated, and then the
connection between the keyboard and your operating system is corrupted,
leading to the issue – Backspace, Spacebar or Enter key not working. ...
Next, click Uninstall and then restart your PC to check if Backspace,
Spacebar or Enter key could work.Dec 31, 2020

I don't understand his solution, if you uninstall the keyboard how will the
computer detect it when you re-start it? It has to have drivers to function.

1. Open the Hardware and Devices troubleshooter by clicking the Start
button, and then clicking Control Panel.
2. In the search box, enter troubleshooter, then select Troubleshooting.
3. Under Hardware and Sound, select Configure a device.
https://postimg.cc/G48jh8CW

I didn't start anything not without your saying I should.

Maybe I should try buying a new keyboard just to make sure?

I keep getting Malwarebytes updates free notifications. I think you explained it
to me once. If you click yes they stop until the trial runs out and then you have
to click yes again until it runs out again or buy premium outright, correct? It's a
lousy marketing scheme to annoy you into buying something.

Thoughts/suggestions
Robert

[Paul]

I've seen the advice about Sticky Keys and Filter Keys,
but there's never any root cause, any authoritative evidence
for it.

It's well worth turning them off, as a test.

https://download.lenovo.com/km/media/images/HT104229/a4_20180108031137.PNG

*******

We know it's not hardware, because you plug in a different
keyboard and the same thing happens. That says it's software.

There is not likely to be a "new driver" for the keyboard.
It's a generic driver for the HID device, using files
that are as old as the hills. If installing a "new driver"
is to do anything, it would be a side effect, of perhaps
causing the filter driver to be removed (filter drivers
sit in the stack of some device and don't talk directly
to hardware).

But generally, I would assign a very very low probability
to an "Update driver" attempt from Device Manager doing
anything. First off, it'll tell you "you already have
the most recent driver", so it's not even going to be
tempted to change a thing. How do you get that status
to change ?

Maybe deleting the entire ENUM registry key would work.
I've tested that on Windows 10 and it still works. That
causes all the drivers to reinstall. It's a way to
clean all the stacks, forget about all previous USB devices
and so on.

At this point, I want to keep the experiments simple,
to reduce collateral damage. And Sticky Keys and Filter Keys OFF
is a simple experiment to try.

If something is "watching" the keyboard, then even using
the ENUM trick isn't going to help, because once all
the devices have drivers again, the watcher will be armed
and waiting, to eat the backspace key.

Paul

[Robert in CA]

I tried downloading autoruns but its a zip file and I don't have
7Zip (even then I don't know how to use it) otherwise how do
I open it?

I'm not too worried about the speed of the backups but I would
like to upgrade the 780 in anyway to make it better. I have (3)
available slots for cards in the back of the 780.

https://postimg.cc/rD1fD5kR

Are you saying for me to turn on the sticky key and filter key boxes?

Robert

[Robert in CA]

What about setting up the sticky and filter keys?

https://postimg.cc/zbwLWwj6

https://postimg.cc/hQPGdkhQ

https://postimg.cc/6y8WxLZK

Robert

[Robert in CA]

I thought Autoruns sounded familiar so I checked my
downloads and sure enough I already had it.

https://postimg.cc/SnQGKRym

https://postimg.cc/MMB7LjYm

https://postimg.cc/342G1QKL

https://postimg.cc/qgXbB98X

https://postimg.cc/bsy6Z3gX

Robert

[Robert in CA]

Here are the Autoruns for the 780

https://postimg.cc/Fd9Ymdb4

https://postimg.cc/2qY6FbKZ

https://postimg.cc/t7Jg5H22

https://postimg.cc/DSrfZfwy

https://postimg.cc/TLwTCrqp

https://postimg.cc/TK6GZ8J8

https://postimg.cc/2bMNGgSK

Robert

[Paul]

Try unticking "aswkbd" in the second last picture, then reboot
and test the backspace key.

Apparently aswkbd can cause keyboard failures, but
no one lists the backspace key as the problem. But
it's the only keyboard-specific thing I can see.

The "BVTCons" in the last picture looks suspicious,
but Avast is likely to have removed that for you.

Paul

[Paul]

https://postimg.cc/qgXbB98X

AmUStor at the top, has some mis-spellings in it.
This is generally considered a sign of blackhats at work.
Although I would not put it past Alcor do to this
through stupidity :-)

It's generally considered a firing offense, to
spell your company name incorrectly.

In the same picture is an aswKbd that could be unticked
and tested for impact on the backspace key problem.

Paul

[Paul]

Robert in CA wrote:
> What about setting up the sticky and filter keys?
>

> https://postimg.cc/zbwLWwj6 Safe
>
> https://postimg.cc/hQPGdkhQ Turn that stuff off
>
> https://postimg.cc/6y8WxLZK Only turn on things you need
>
> Robert

Most of that stuff should just stay off.

While you can leave the "press Shift five times" filter
on, sooner or later you'll be alerted by the sound,
that you pressed Shift five times in a row. If you didn't
mean to enable the function, then turning off the filter
for it in the pictures you show, eliminates the middle man.

If left off, there are likely to be fewer side effects.

Paul

[Paul]

Yeah, your 780 has a video card. So that slot is out
for a USB3.1 Rev2 card with x2 wiring and x4 PCI Express connector.

But you can still stick a NEC card in the bottom slot and speed
up backups and restores to the USB3 external enclosure. That's
the card that was $12 or so.

NEC probably doesn't make those upd72xxxx chips any more, so
when cards like those show up, they won't last forever. Asmedia
still makes chips however, and they usually provide Windows 7
drivers (at least for the moment). If some extra-whizzy cards
come out (one with a USB-C connector comes to mind, one that
runs at 20Gbit/sec), then the drivers for that might
not go back to Windows 7. But generally, you can get 10Gbit/sec
USB3 functions on a Windows 7 PC (that's about 5X the speed of
a hard drive). That's still within range. I'm not planning
on going any further than that, here. As
there are no nice toys for the interfaces like that.
There might be storage toys for hundreds of dollars, but...
no thanks. My days of buying orphan hardware are pretty
well over.

The only reason I bought the Asmedia USB3.1 Rev2 capability,
is what I really wanted was a plain USB3 port that runs at the "full speed"
intended. The other USB3 ports I have, don't run flat out like
they're supposed to. The one on the typing machine, sometimes
doesn't even manage 200MB/sec. One of the reasons for this,
is when the computer boots, the slot is in PCI Express Rev1 mode
instead of PCI Express Rev2 mode. The detection doesn't seem
to be spotless in hardware. Using a card with x2 lanes, means
you get double "whatever a mess it made" delivers. If they'd
made a chip with x4 PCIe lanes (like they should have), I would
have even paid extra for that. I'm a sucker for wretched excess.
Doing the job right, means one fewer bottleneck in hardware.

Paul

[Robert in CA]

I unticked the aswkbd on the 780 and restarted it but the backspace
key still doesn't function. In addition , the messed up WBM screen
keeps returning after I fix it and Macrium keeps showing an update
when there isn't one. I tried opening up Macrium and it did nothing.

Robert

[Paul]

The aswkbd was the only candidate I could spot by examining
your pictures. It definitely wasn't a sure thing. It had fouled
up the keyboard, in the past.

Like I said before, I don't really have any solid ideas on
debugging keyboard problems back to the source. I would
need a pretty thorough technical article on keyboard traffic
to make progress. And there's never been anything like that
on any computer platform I've used.

The WBM should behave itself, once you stop doing restores
and overwriting it.

Macrium, some of the prompts that appear on the screen,
have a tick box to "don't show me this next time". You may be
able to suppress some of them. The updates will likely keep
presenting.

The Macrium updates only download when you give permission,
such as changing versions (going from 6 to 7 maybe). Changing
versions might require making more media, which isn't good if
you don't stock a big cake box of media. I think I'm all out
of CDs at the moment, and only have a mid-sized one of DVDs.
I have USB sticks, but they keep getting erased, and that's
not a good media format for me.

Paul

[Robert in CA]

I've lost all keyboard functions to the 780 after I did that. It won't respond
to anything and it won't let me log in as administrator. Great, so now what?

Robert

[Robert in CA]

I suppose the only way to get the 780 keyboard working again is to do another
restore. We've already gone back to 1-1-21 so perhaps we should try the 12-20
mrimg? Whether the backspace key works or not is irrelevant at this point if I can't
use the keyboard at all.

What do you think ?

Robert

[Paul]

Restore is very efficient as a fix. You're an expert now :-)

We just need to get you a USB3 card :-)
I wish there were more of these to choose from
at the local computer store (no NEC ones).

I've had to do multiple restores before, like that
time I had to go back two years to find a "clean" OS
for something. Most of the time, it isn't nearly
that bad though.

Paul

[Robert in CA]

Ok, I will try another restore and hope the keyboard will work
during the process.

In passing, I thought about getting another Microsoft ergonomic
4000 Keyboard (as a spare) and I'm having difficulty in finding
one because there's such a range of prices! Newegg wants $585
for one! The cheapest I found on eBay was $168.95 damn, that's
still expensive.

I'll start the restore and let you know how it turns out

Robert

[Robert in CA]

I took the 780 back to 12-1-20 for the restore and disconnected
the Internet connection as you advised. I have the keyboard back
(whew!) but the backspace key still does not function?

https://postimg.cc/tZr5FB9v

https://postimg.cc/RWrT16zm

I had to sign on again with the free version of Avast and did a update
for FF from version 83. to 88. also Macrium had an update and installed
Malwarebytes. I've changed the boot menu three times now and it still
returns to the messed up WBM. At this point I'm not going to restore the
8500 backwards because it hasn't fixed the backspacing key function on
the 780.

I'm thinking even though we tried the other keyboard it may be suspect and
I would still like to get a new keyboard as backup in any case since they are
becoming hard to get but I hadn't expected them to cost so much!

This is my present keyboard:

https://www.newegg.com/microsoft-natural-keyboard-4000-for-business-5qh-00001-usb-wired/p/N82E16823109230?Description=microsoft%20ergonomic%20keyboard&cm_re=microsoft_ergonomic%20keyboard-_-9SIAKVHAH68643-_-Product

but I also saw this for $52.99

https://www.newegg.com/microsoft-lxm-00001-usb/p/N82E16823109400?Description=microsoft%20ergonomic%20keyboard&cm_re=microsoft_ergonomic%20keyboard-_-23-109-400-_-Product

why the big difference in price?

Thoughts/suggestions,
Robert

[Paul]

The review over on the right for the lxm-00001 points out
some of the issues with it. It uses stickers on top of the keys.

The 4000 keyboard appears to be out of production and the
MSRP is $50 or so. The company that is selling those, likely
cleared out the factory that is making them.

There are certainly manufacturers who make better keys, ones that
don't wear off as quickly.

*******

Deleting this key, causes all hardware drivers to be reinstalled.
I've tested this on Windows 10 and it still works. I used the
Kaspersky rescue CD I had, which has a Registry Editor. Their
Registry Editor can edit "system" registries but not the "user"
registry. You would delete the ENUM key using their registry
editor, then reboot and watch as Windows rediscovers all the hardware.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\

That option is reserved for times when you suspect there is
something wrong in ENUM, but don't want to spend hours searching.
Using Kaspersky Registry Editor, is to make the permissions issue "easy".

*******

This article, mentions that keys can be remapped. The SharpKeys
application, displays the current remappings present. The
WindowsReport site shows a picture of what the SharpKeys
program screen looks like. You would be looking to see
if the Backspace key is remapped to nothing. That would be
the basic idea. I don't see a "nothing" option in the
interface though - I don't know how you just disable
a key. It would be naive to think this is how it was done.

https://www.theguardian.com/technology/askjack/2014/nov/06/what-can-i-do-when-pressing-a-key-produces-the-wrong-result

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout

https://windowsreport.com/software/sharpkeys/

*******

It could be that you have Microsoft Intellitype installed.
Maybe in an attempt to get some multimedia keys working.
Check Control Panels, Programs and Features, and see
if it is installed. If so, check and see if it has a
Repair option.

*******

And this article, isn't a solution as such. It's an example
of the analysis of a keylogger. It uses a BHO (browser helper object)
to log activity while Internet Explorer is used. And it registers
a COM object for some other activities.

https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Perflog-B/detailed-analysis.aspx

A helper in one of the Microsoft forums, suggests

tasklist /m bpkwb.dll

as a means of detecting which programs are injected
with the keylogger DLL file.

Now, the reason I threw that in, is to show that there
are lots of ways for individuals to interfere with keyboards,
and I don't really have a good model of all of them, and
a nice laundry list of things to check. In the above
example, that "check" only makes sense if you know
you're infected with that particular one. Malware
doesn't all go by the name "bpkwb.dll" for example.

And this is why it's hard to come up with a strategy
to detect where the interference is happening. It
could be a filter driver, perhaps using Device Manager
you could display whether there is a filter in the
keyboard item.

If the backspace key disappeared on my machine, I
would have trouble diagnosing this with it sitting
right in front of me.

Paul

[Robert in CA]

I like the Microsoft 4000 but you mentioned you know
of others like it that I could buy from other manufactures?
However remember when recommending that I have issues
with my wrists and I have to have keys that work like a 'typewriter'
if you know what I mean. That's one of the reasons why I
like the 4000.

I checked Newegg: what do you think of this one and it has
good reviews

https://www.newegg.com/logitech-k350-usb-2-4-ghz-wireless/p/N82E16823126076?Description=ergonomic%20keyboards&cm_re=ergonomic_keyboards-_-23-126-076-_-Product


To be honest I only use about half the keyboard. I don't have any
of the function keys set up and some of the keys I've never used
and have no idea what they're for. I searched for a 4000 user
manual but I'm leery of downloading anything because of my past
history. However if I get the Logitech I'll have to learn that keyboard
too and have no idea what the side keys and top keys are but its
very similar to to the 4000.

So you're saying to delete the key so the hardware drivers will be
forced to re-install.
I have a Kapersky CD (2018) but I would need instructions from you
in order to do this.


Do you want me to use Sharp keys or try my Kapersky CD?

I couldn't find Intellitype listed

https://postimg.cc/QFS0NSpj

As you say, we have something similar to an intermittent problem and
difficult to track down and your suggestion of deleting the key sounds
like a good first step. We can always restore if needed. btw can I restore
to 3-4-21 if I need to next time?

Here's the Device Manager:

https://postimg.cc/2Vt5pNtY

https://postimg.cc/gX4YNChf

https://postimg.cc/DSsntJsQ

https://postimg.cc/cKBZLpFr

Robert

[Robert in CA]

I keep forgetting were working on the 780 and not the 8500

I checked for Microsoft Intellitype on the 780 and its not there either.

https://postimg.cc/rdhT4vrs


Here's the 780 Device Manager:


https://postimg.cc/5XgWcZpg


https://postimg.cc/zb99S5Xz


https://postimg.cc/yDV2TLBZ

https://postimg.cc/p9r7wymV



Robert

[Paul]

I think SharpKeys is worth a look. To see if you can
see the miscreant, as a registry translator and not an
active agent. Since you're working in your crusty old image,
if anything breaks, you can restore a newer one. That's
why we have so many to choose from :-) There is a
download button on this page.

https://windowsreport.com/software/sharpkeys/

*******

For Kaspersky, I checked my collection, and a disc (or ISO)
after Feb.2013 or so, should have the RegistryEditor. This
is a picture of the interface when it is running (as
provided by Kaspersky).

https://support.kaspersky.com/images/krd18_14236_0213-459607.png

Now, on my ISO collection, this is what I found. When you use 7ZIP
on the ISO, you can burrow right down and into the Linux materials
for a look. That's how I located this (took a while to find it).
I needed to find this, so I would have a way of determining how
modern the CD needs to be.

H:\kaspersky_dec2013\kav_rescue_10.iso\rescue\LiveOS\squashfs.img\LiveOS\ext3fs.img\usr\sbin\
RegistryEditor 467,164 bytes

Discs shipping before 2013, don't have that file and the ISO file
is also smaller as well.

I usually write the date of preparation on the KAV CD jewel box,
to help me keep them straight.

If you had a Kaspersky subscription, I would not have you run
the LiveCD, because it copies the Base files over to the root of C:
when it is working. And that might interfere with the subscription
version for all I know. But you use Avast/AVG and Malwarebytes,
so there won't be a conflict there.

In any case, the first picture here is done with Kaspersky CD booted.
That's harder to do in a VM than it looks, and required the
services of EasyBCD 2.4 to get it to work (chainload).

The second picture shows the victim OS came up properly afterwards.
The left hand side of the second picture, shows a "real" copy
of Windows 7 has a huge ENUM. Whereas the virtual machine has
so little in the way of virtual hardware, it doesn't have a lot
of entries. That's why there is a size difference. The second
picture shows that the test OS survived the experience.

https://i.postimg.cc/Cx2vY9hz/enum-delete.gif

https://i.postimg.cc/RhGRYDpC/restart-after-enum-delete.gif

Paul

[Robert in CA]

I downloaded Sharpkeys:

https://postimg.cc/hJMTpnkq

Did you want me to load my Kapersky CD ? I'm not sure
what exactly you want me to delete or how to proceed? It
looks as though I open up HKey Local Machine, then System,
then delete Enum, exit after delete and then restart is that
correct? I could do allot of damage in there and I want to
make sure before I proceed.

I tried using the Sharpkeys but couldn't find any Hkey? I must
not be looking in the right area or something or its not showing
it.

https://postimg.cc/pm6VJXCj

https://postimg.cc/hJQDyWZ5

https://postimg.cc/bdhnt3sh

Thoughts/suggestions

Robert

[Robert in CA]

Here are the Sharpkeys for the 780:

https://postimg.cc/k6jjh41Q

https://postimg.cc/xqcg19pZ

https://postimg.cc/sMRJm7fF

https://postimg.cc/rz0CLQKX

https://postimg.cc/TpnVK1Vt

Robert

[Paul]

OK, the last picture, the blank mapping window, shows
no keys are remapped. The one on the left is for
adding new mappings, and we're not interested in that
at the moment.

So we know the Backspace is not remapped, based on the
right-most pane.

We're done with Sharpkeys and don't need to reinstall it
after any restore.

Paul

[Paul]

The SharpKeys current mapping window is blank,
and that's good, as far as it goes.

*******

You can give the Kaspersky Registry Editor a try.
Find my picture of ControlSet001 and try deleting
the ENUM from there. That's the control set when the
OS isn't running.

When the OS is running, it makes a CurrentControlSet,
which is a copy of one of the other Control Sets.
The supposition being, that if you delete ENUM from
ControlSet001, when the OS starts, it copies
ControlSet001 to CurrentControlSet, discovers
ENUM missing, then rediscovers all the hardware,
including reinstalling the keyboard driver (from
some cache, like the INF folder).

I made the two pictures, to show what offline editing
from the Kaspersky CD looks like, plus the result seen
in the OS afterwards.

[Robert in CA]

I ran the Kapersky CD and found the file and deleted it:

https://postimg.cc/hJ50TjHy

https://postimg.cc/zHmS2QDT

https://postimg.cc/V5MF0z4g

https://postimg.cc/3dFC99sD

https://postimg.cc/hXC8RvPD

https://postimg.cc/H845ZshC

https://postimg.cc/0bnD7jSY

However afterwards there was no way to exit, or to restart the computer.
I had to close it and then shut the computer down (the only option available)
but when I restarted it the same messed up WBM appeared and now the 780
has lost it's Internet connection. It can't do any updating without the Internet.

So I'm going to restore the 780 back to 12-1-21 because I'm dead in the water
right now.

Robert

[Paul]

OK.

It looks like you got as far as I did.
Your Kaspersky looks newer than my version.

The shutdown menu would likely have been in the
lower left corner.

The drivers are supposed to be cached, and I've had
the drivers reinstall themselves on two or three installs,
but then, the hardware isn't a "good mix" so this hardly
constitutes a thorough test on my end here.

On my Acer, it came with a driver disc as part of
the restore set. If it gets wedged, I can use
the driver disc and reinstall something like that.

Whereas refurbs don't come with the driver disc,
and it's one less convenience (I have one refurb
here and it doesn't come with helpful stuff
particularly). Hunting down drivers would require
having a look around on the Internet with the
other machine. And some things are easier to find
than others (like finding drivers for VirtualBox
when the need arises, for stuff over 20 years old).

Paul

[Robert in CA]

What I did was close the application vs exit since there
was none then I clicked the icon in the lower left and
selected shutdown since there was no restart option.

I restored the 780 back to 12-1-20 but if I have to restore
again (which I hope I don't) could we use a more recent
update like 3-4-21 so I don't have to do all the updates all
over again in trying to fix this. However, if I do a more
recent update won't I also have to adjust the partitions?

Instead, how about I create a new backup from 12-1-20
and restore to that instead after I've done all the updates?
That would save me from doing all the updates every time.

Whether it's the keyboard or software it's strange the same
thing has happened on both computers with the backspace
key and strange that the messed up WBM keeps coming back.
I'll try the command one more time after all these updates
finish to see if it works.

I still would like to buy a new keyboard and test it, we wouldn't
loose anything by doing so and if it doesn't work I still would
have a backup keyboard. I would still like your views on the
ones I selected.

Thoughts/suggestions?
Robert

[Paul]

At the moment, to me, you've tested a fair number of old backups
and not found a cure for the backspace key problem. This hardly
gives the old restore, anything to recommend it.

Consequently, moving to a more modern one makes sense,
even the "current" one you made before this started
would be sufficient. Then the number of updates would
be minimal.

I'm still trying to find a way of tracing keypress activity.

And you can help, by going through your Program Files
and thinking about anything you've added, that uses
hotkeys. Using a backspace key for a hotkey, seems pretty
bizarre. But what do I know.

Since you've gone backwards a few months now, this is
something you must have added a while ago. For example,
an image editor might have a hotkey to do a "screencapture",
and that is set to backspace right now.

Your Sharpkeys test, shows it's not a key that was remapped
into oblivion. You can totally disable a key by mapping it
off in there. But your table is clean, so that's not the
mechanism.

Paul

[Robert in CA]

I did a Macrium update then did a Mrimg backup (with comments)
on the 780 to the present.

I had an optional update on the 780 but it wouldn't update after trying
(3) times. It came up again when I opened the Action Center. When I
clicked 'Try Again' it came back with 'Windows is up to date' and the
optional update disappeared again. I'm sure we'll see it again

https://postimg.cc/BjWhSh0t

https://postimg.cc/1fDGHsk5

https://postimg.cc/d7Nr11yn


Honesty, I can't remember a thing I've added. I only download programs
when you give me a link because of my history with downloads and picking
the wrong one. I do get warnings occasionally even on news pages and eBay
when I haven't clicked a thing but Avast seems to take care of them and I don't
see any infections after scans but something could still be there. I thought the
Autoscans showed the problem (not verified) in the shaded areas?

Here are the 8500 program files but I have no idea which if any would
use a hotkey:

https://postimg.cc/67MqNFXs

https://postimg.cc/ykhVH2mf

here are the 780 programs files:

https://postimg.cc/grQmGPBp

https://postimg.cc/tZ8wG9Rm

In passing, the 8500 and the 780 both passed their Smart scans.

I still think we should give a new keyboard a try vs an old one. Only because
a new mouse fixed all the problems I was having and we've done allot to check
the software. I can always use a new keyboard and we have nothing to loose.
If that's it then we can proceed to create a new backup and then Win 7 Professional
clones for the 780 and 8500.

So what do you think of the keyboards? I like the Logitech the best and it's also
the cheapest.

https://www.newegg.com/logitech-k350-usb-2-4-ghz-wireless/p/N82E16823126076?Description=ergonomic%20keyboards&cm_re=ergonomic_keyboards-_-23-126-076-_-Product

https://www.newegg.com/microsoft-ergonomic-lxn-00001-usb-wired/p/N82E16823109421?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-23-109-421-_-Product&quicklink=true

https://www.newegg.com/fellowes-microban-split-design-keyboard-98915-usb-wired/p/N82E16823139007?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-23-139-007-_-Product

Robert

[Paul]

Robert in CA wrote:
> I did a Macrium update then did a Mrimg backup (with comments)
> on the 780 to the present.
>
> I had an optional update on the 780 but it wouldn't update after trying
> (3) times. It came up again when I opened the Action Center. When I
> clicked 'Try Again' it came back with 'Windows is up to date' and the
> optional update disappeared again. I'm sure we'll see it again
>
> https://postimg.cc/BjWhSh0t
>
> https://postimg.cc/1fDGHsk5
>
> https://postimg.cc/d7Nr11yn

0x80070103 is apparently thrown by an NVidia driver update.

You've probably installed something better your own self,
compared to what Windows is trying to install.

>
> Honesty, I can't remember a thing I've added. I only download programs
> when you give me a link because of my history with downloads and picking
> the wrong one. I do get warnings occasionally even on news pages and eBay
> when I haven't clicked a thing but Avast seems to take care of them and I don't
> see any infections after scans but something could still be there. I thought the
> Autoscans showed the problem (not verified) in the shaded areas?
>
> Here are the 8500 program files but I have no idea which if any would
> use a hotkey:
>

> https://postimg.cc/67MqNFXs No good candidates
>
> https://postimg.cc/ykhVH2mf No good candidates

>
> here are the 780 programs files:
>
> https://postimg.cc/grQmGPBp
>
> https://postimg.cc/tZ8wG9Rm
>
> In passing, the 8500 and the 780 both passed their Smart scans.

I thought you had a Dell Image Editor at one time. Does
that use hotkeys ?

> I still think we should give a new keyboard a try vs an old one. Only because
> a new mouse fixed all the problems I was having and we've done allot to check
> the software. I can always use a new keyboard and we have nothing to loose.
> If that's it then we can proceed to create a new backup and then Win 7 Professional
> clones for the 780 and 8500.
>
> So what do you think of the keyboards? I like the Logitech the best and it's also
> the cheapest.
>
> https://www.newegg.com/logitech-k350-usb-2-4-ghz-wireless/p/N82E16823126076?Description=ergonomic%20keyboards&cm_re=ergonomic_keyboards-_-23-126-076-_-Product
>
> https://www.newegg.com/microsoft-ergonomic-lxn-00001-usb-wired/p/N82E16823109421?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-23-109-421-_-Product&quicklink=true
>
> https://www.newegg.com/fellowes-microban-split-design-keyboard-98915-usb-wired/p/N82E16823139007?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-23-139-007-_-Product
>
> Robert

The first keyboard is wireless, and there is a Unifying receiver to plug
into a USB2 slot. Preferably, it should be line of sight, to eliminate
reception problems, and kept away from any USB3 cables (your external HDD).
The K350 may be out of production, around 2019 or 2020 or so.

The second one, i don't see any LEDs for things like Caps Lock.

The third one kinda looks slapped together :-)

IDK, I guess I'd go with the first one, maybe, but it doesn't have
status LEDs either. The Microsoft one, their key quality might
not be as good.

I try not to "invest" too much mental energy in keyboards, so
I won't be disappointed :-) I bought a keyboard during COVID, and
really didn't have a good opportunity to test it, and it has
backlighting with LEDs as well as LED status, but the clicky action
of the keys is kinda silly. I suspect they were trying to "emulate"
the noise some other keyboard makes, when you type.

The keyboard I'm typing on, is my "backup keyboard", you know,
the "one I never plan on using". One of the keys gets stuck on
the travel (it binds a bit). But, it's a keyboard, and if
that packs up, that's my last spare. That was only $20, and
the store I bought it from went bankrupt years ago.

I took a quick look around, and don't see any really hot prospects.
I did see one, but it is only available in French keys.

Paul

[Robert in CA]

I have Dell Image Expert 2000 which came with my 8200
when I bought it new. I liked it and I still have the installation
CD's for it so I put it on the 8500 and the 780. That's also how
I put Word and Excel on the 8500 because I kept all those CD's.

I don't believe it uses hot keys. I open and close and save files
like in Word. Here's the Properties of the Dell Image Expert
if that helps.

https://postimg.cc/rKSsChPX

https://postimg.cc/mh7B0PN7

https://postimg.cc/gwwP4j2X

I don't use any of my F keys on the keyboard but I would like
to get a manual which explains all the functions.

I know what you mean with keyboards. When I was searching for
other keyboards I had I found a white ergonomic 4000 with a PS2
connection. I forgot the Logitech K350 was wireless. I would prefer a
wired keyboard. So that eliminates the K350. I have to invest a little
mental thought into my keyboard because I have wrist issues.

It seems the only ones with LED's are the higher priced models. I did
another search for wired ergonomics; see what you think?

https://www.newegg.com/microsoft-rjy-00001-usb-2-0-wired/p/N82E16823109423?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-23-109-423-_-Product

https://www.newegg.com/p/0GA-0034-00B14?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-9SIAP9WE9U1968-_-Product

https://www.newegg.com/microsoft-comfort-curve-keyboard-2000-7fh-00001-usb-wired/p/N82E16823109229?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-9SIA7XZACD7464-_-Product

Once we get the 780 up and running then we can go back to the PCI cards
and find one that you think is best for the 780.

Robert

[Paul]

RJY-00001 = keyboard + mouse ? $73.08 \___ LED scroll lock indicator is embedded
LXM-00001 = keyboard ~$60.00 / in Scroll Lock key surface... 3 Status LEDs are there

RJY-00001 https://www.microsoft.com/en-us/p/microsoft-ergonomic-desktop/926gk79b71v9?activetab=pivot%3aoverviewtab
LXM-00001 https://www.microsoft.com/en-my/accessories/products/keyboards/microsoft-ergonomic-keyboard

The difference is $13 or so for the mouse part.

LXN-00001 $48 Uses *stickers* for keycaps. LXM-00001 uses molded keys.
Keyboards have same layout. First one is ahead so far.
I'm trusting my eyesight on this. When Newegg removes the
reviews for a product, we have to guess at this stuff.

Third one has no palm rest. Hard to tell if wavy, dished, or
just a regular $40 keyboard going for 3X the price.

First one seems the best of that lot. That's if you want
a mouse for $13 at the same time.

On a laptop, some of the function keys have two definitions.
Like one of the F-keys is for airport mode for Wifi ("Wifi Off").
On a desktop, it might not use such functions for shift-F5 or whatever.

Back in mainframe days, PF Programmable Function keys, you could
have them bound to anything. A typical "standard" was F1 = Help.
But again, adherence to rules like that isn't exactly
recorded in stone tablets, and a newer generation
might bind F1 to "Nothing", because computer companies
hate offering help :-) The operation of a computer
is supposed to be "Self-Explanatory".

Paul

[Robert in CA]

So if I understand you correctly you'd go with the RJY-00001?
I also like it's layout very much. I can get it at Newegg without
the mouse.

https://www.newegg.com/microsoft-rjy-00001-usb-2-0-wired/p/N82E16823109423?Description=wired%20ergonomic%20keyboards&cm_re=wired_ergonomic%20keyboards-_-23-109-423-_-Product

If were agreed then I'll get it.

Yeah it would be nice if they included instruction manuals. When
I bought my 8200 you should of seen all the stuff they gave me e.g.
manuals, a dozen or so CD's cables, etc. (which I still have) compared
to the 8500 which was practically nothing. Both bought new. I still
use the 15 inch Dell flat monitor from the 8200 for the 780.


Robert

[Paul]

One thing to avoid with the keyboards, is keyboards with stickers
on the surface. As the stickers become sticky and come off. I
tried to look as closely as I could at the pictures. It's
pretty hard to get a high res picture of rjy-00001.

Paul

[Robert in CA]

Agreed., I've never heard of such! Lets hope the RJY-00001 doesn't have stickers
but it seemed the best of what I could find.

In passing, I tried the display boot menu command after all the updates
but the messed up WBM is still there.

Robert

[Paul]

If you're doing it while the OS in question is
running, the syntax should work. An elevated (Administrator Command Prompt),
followed by

bcdedit

to display the change, should be good enough. That allows
you to verify the command worked.

Paul

[Robert in CA]

Exactly and we did it once and it worked. So I don't know why it's not working now?

I go to start and type CMD and then right click it to run as Administrator. Then the DOS
screen appears and I type (with spaces):

bcdedit /set {bootmgr} displaybootmenu True

and it comes back successfully changed. I then exit DOS and restart the
computer but for some reason it keeps giving me the messed up WBM screen?

It can't be maleware or something during startup otherwise we wouldn't of been able to
change it first time we did it so it must be something else?

Robert

[Robert in CA]

I bought the RJY-00001 on Newegg - $79.00 total with shipping.

Robert

[Robert in CA]

I just noticed that when typing my backspace key functions normally but if I am
on Google and go to Yahoo it won't backspace back to the previous site like it use
to. So how can it work when typing but not with websites?

Robert

[Paul]

OK, I tried a test here.

So I go Google, then Yahoo.com.

If the cursor is flashing, such that I'm about to enter
text into the box there on Yahoo.com, I'm in text entry mode.

In my drawing here, the letter "I" is located where the I-beam
input cursor is located. If I use the Backspace key
there, it is considered a text editing key for the box.

+-----------------------+
|I |
+-----------------------+

Now, if I use the mouse and click outside the box, the
I-beam is no longer in the box. Consequently, I'm not
editing text there. Now, the Backspace key works as
a page navigation key.

+-----------------------+
| | X<--- click some white-space away
+-----------------------+ from the box...

Now, if I type the Backspace key, I go back to the Google page,
which was the web page before I went to Yahoo.com .

Give that a try.

Paul

[Paul]

There's only one hard drive in the computer, and
we're booted from that hard drive ? Then, that
edit should have worked.

Now that you've rebooted and are back in the OS,
open an Administrator Command Prompt and
type just

bcdedit

and it will dump the current menu. There, you can
verify whether there is a "displaybootmenu" line
and the value is True. This is only if you're
curious at any time, whether the menu line is present
or not.

*******

The second activity we've done before, is booting
the Macrium CD and using the Boot Repair function.
The Boot Repair function will remove the extraneous
entries. Unfortunately, it will also remove the
DisplayBootMenu line as well :-)

*******

That means, our operation sequence is:

1) Boot Macrium CD and use Boot Repair menu. At a minimum,
the last box needs to be ticked. In the picture here,
you can see the last line is "Rebuild the BCD", and we need
to do at least that much. You can also tick all the boxes
if you want/need, but the last line is the minimum necessary
for this step.

http://kb.macrium.com/Uploads/Images/v5/FixBoot/fixboot-3-options.png

2) After the system reboots [no black menu window yet] ,
now you can open the Administrator Command Prompt and do

bcdedit /set {bootmgr} displaybootmenu True

and that will put up the traditional boot menu with the option
to press F8 for Safe Mode.

On the next reboot, the black colored menu window should be
"cleaner".

Paul

[Robert in CA]

I forgot to do the bcdedit first, However I did the boot repair
function with all boxes checked.

It came back successfully but it didn't have a counter
and I had to select Win 7 for it to respond. I tried restarting
it again to make sure it works properly. Excellent, it came back
with a normal screen and counter! Excellent!

Now we just have to figure whats going on with the backspace key?

Robert

[Robert in CA]

A new problem, while running Avast Smart scan on the 8500 it
said that the VLC was out of date. When I tried to update it I got this:

https://postimg.cc/NKqmmY5M

https://postimg.cc/18QV4HjV


What temp folder after I download and where? I checked my downloads
and all there is is the VLC installation folder.

Robert

[Paul]

The main site for VLC is here.

https://www.videolan.org/

There is a Download button. It uses a mirror server that is
closest to you.

Since I tested the Download button on a 32-bit OS, I got the 32-bit version.

vlc-3.0.14-win32.exe

Simply do a search of the C: drive for

vlc-3.0.14

and you should find it soon enough. It might be

vlc-3.0.14-win64.exe

for example.

Paul

[Robert in CA]

I downloaded the new VLC from the link your gave but when I ran Smart scan
I still get the error. I think because Smart scan is detecting a VLC with 32bit and I
have 64 bit so do I need to uninstall Avast and reinstall a newer Avast?

https://postimg.cc/B8WHF4Ln

https://postimg.cc/N20Ht0Vp

https://postimg.cc/LhyPTzY7

https://postimg.cc/w1NsgZf8

I don't seem to have a link to download Avast So could you please give me one?

In the meantime, I'm going to do another Mrimg backup on the 780 because I had
an important update. Then I'm going to see if I have older Mrimgs just in case you
want to try back further.

Thanks,
Robert

[Paul]

Try the offline installer from here, which matches your productname.

https://www.avast.com/installation-files

There's also a cleaner for it.

https://www.avast.com/uninstall-utility

*******

Check these two and see if VLC is in there.

C:\Program Files VideoLan folder ?
C:\Program Files (x86) VideoLan folder ?

Then, in Programs and Features control panel, see how
many VLC installs are sitting there.

Paul