Thursday, September 3, 2009

Recovering from a PC Virus

My family/children contaminated my PC with a nasty virus.

Here is a recipe to fix the PC.

Safe mode
Restore to a previous date.

www.Malwarebytes.com
www.CCleaner.com
www.avg.com/avgfree

This wasn't the greatest fix - It hobbled along for a while, (months) then eventually I had to clear the harddrive and start from scratch. But reformatting the hard drive and reinstalling windows is not without problems.

When I reformatted my harddrive...

I lost all my bookmarks.
I had to go to HP to download printer drives.
I had to reinstall Word and Excel.
Adobe PDF reader reinstalled...
Now I am using foxfire, because...

I still need to get the printer working,
My sound no longer works from the internet,
FTP stuff to Network. - now reinstalled from js2 email.

Photoshop had hand built custom actions from kalidescope - these were lost.

I lost fonts [INCLUDING Minnie and Mickey... :( ]
Minnie and Mickey was one of my favorite fonts.

My computer defaults were messed up: Show extensions, info on qty of harddrive, classic windows,....

TO SPEED UP A SLUGGISH PC
When you bring up the taskbar via control-alt-Del
Clicking on Processes shows processes running.

alg.exe shut it off!
wmiprvse.exe shut it off!
teatimer.exe shut it off!
Jqs.exe shut it off!

frameworkservice.exe shut it off!

So:
Start Box -- Select Run -- (type) msconfig:  Select tab Services and just turn off "Ad_Aware 2007 services"

System Configuration Utility (Msconfig.exe) automates the routine troubleshooting steps that Microsoft Product Support Services technicians use when diagnosing Windows configuration issues. You can use this tool to modify the system configuration through a process of elimination with check boxes, reducing the risk of typing errors.
You can use System Restore to undo harmful changes to your computer. To open System Restore from System Configuration Utility, on the General tab, click Launch System Restore.

______________________________________________________________________________

These are notes from the WWW, not mine.

frameworkservice.exe
http://www.processlibrary.com/directory/files/frameworkservice/
The frameworkservice.exe file is a process by Network Associates belonging to their E-policy orchestrator anti-virus suite. This program is important for the stable and secure running of your computer and should not be terminated.    (JS NOTE:  WHY DO I WANT NETW ASSOC. JUNK on MY PC?)

wmiprvse.exe
provides control and information about management in an enterprise environment.

Developers use the wmiprvse.exe file in order to develop applications used for monitoring purposes. These programs can notify users about important events related to network and file or application management right after each event occurs. With wmiprvse.exe, file managers in the enterprise environment are capable of configuring and searching for desktop system information or network and application information across the network.


wmiprvse.exe is a stupid utility from windows that is useful to developers and non-mainstreet software. What I mean by that - If you are just using the internet and simple web applications and local word-processing... functions, in a non-networked environment, this application should NEVER have to run on your PC.

Microsoft has a fix for this software that wastes Your CPU time so that others can gather information on your hardware.

Ideally I would get rid of it, but I can't make it not load, feel free to shut down.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=0638d919-109b-41c6-851d-0be19d29172e

http://www.neuber.com/taskmanager/process/wmiprvse.exe.html

http://www.exe-error-fixes.com/algexe-spyware-adware-virus/

Alg.exe
This program is part of the Microsoft Windows operating system and is critical for the Windows firewall. This should be left running, as it is part of your system and will be found on all the latest computers. Alg.exe stands for application layer gateway.

Alg.exe is a service that runs on your machine and allows you to connect to the Internet. ALG stands for Application Layer Gateway and is required if you use a third party firewall or ICS (Internet Connection Sharing) to connect to the Internet. Alg.exe

http://www.ehow.com/how_5158317_remove-algexe.html

Step 1
Press and hold "Ctrl" and "Alt" buttons and press "Delete" to open the Windows Task Manager. Click the "Processes" tab.

Step 2
Scroll through and click "alg.exe." Click "End Process" to prevent this program from running.

Step 3
Click the "Start" button; click "Run." Type "SERVICES.MSC /S" (without quotes) and press "Enter" to open the services window.

Step 4
Scroll through the right panel and double-click "Windows
Firewall." Select "Disabled" on the "Startup type," then click "OK." Close the services window. This program will be removed from startup and will not run on your computer.

http://www.what-is-exe.com/filenames/alg-exe.html

This program is part of the Microsoft Windows operating system and is critical for the Windows firewall. This should be left running, as it is part of your system and will be found on all the latest computers. Alg.exe stands for application layer gateway.

http://www.threatexpert.com/files/alg.exe.html
has info

http://www.bleepingcomputer.com/startups/alg.exe-13504.html

svchost.exe - needed but problematic, this scanner can tell you 1%
http://www.neuber.com/free/svchost-analyzer/index.html

AAWService.exe
AAWTray.exe

http://lavasoft.com/cms/support/faqs/why-does-adaware-20082007-run-as-a-service

frameworkservice.exe
http://www.processlibrary.com/directory/files/frameworkservice/
The frameworkservice.exe file is a process by Network Associates belonging to their E-policy orchestrator anti-virus suite. This program is important for the stable and secure running of your computer and should not be terminated.

http://www.neuber.com/taskmanager/process/frameworkservice.exe.html

What is Jqs.exe?
When you open the Task Manager you may note that a process named Jqs.exe is running in the background. It consumes a small part of the memory but surely a useful one. It consumes around 1.5 Megabytes of computer memory and 2 Megabytes of virtual memory.
Jqs is short for Java Quick Starter and belongs to Java. The process is required to improve the startup time of Java applets and applications by pre-fetching Java Runtime Environment files frequently into memory.
Steps to disable it
Surely the process is useless for someone who does not deal that frequently with Java applets and thus should disable it.
•    To disable just visit the Control Panel and open the Java entry.
•    Now go to Advanced tab and look for the Miscellaneous entry below.

•    Make sure to uncheck the activated Java Quick Starter entry.
That’s it the process has been disabled and removed.

I first pulled up the Windows Task Manager (hitting Ctrl Alt Del keys at once). I noticed a strange process called JQS.exe and also found that JQS.exe was running on low priority. But interestingly this strange process called JQS.exe was using 1.3 MB of computer memory and almost 2 MB of virtual memory. Also, there was a lot of activity by this process at random since it was initiating too many I/O read processes.

Well, I figured out that JQS.exe was not any virus process but was indeed Java Quick Start which was actually designed to reduce the startup time of Java applets
and Java apps by prefetching Java Runtime Environment files frequently into memory and caching it. But I'm not a person who uses Java Applets or Java Apps that often - I hardly use Java related stuff maybe once in 2-3 weeks, so there is absolutely no use for it to run all the time on my box to make a rare use app work faster!!

So here is how you can easily disable JQS.exe :
Goto the Control Panel (Start > Control Panel).
Double click the Java icon to open the Java Control Panel.
Now click on the Advanced option
Goto Miscellaneous and you will find that Java Quick Start has been enabled.
Uncheck the box to disable the JQS.exe process.

You can now see that JQS.exe has disappeared from the Task Manager.

McTray.exe file information
The process McAfee Security Agent Taskbar Extension belongs to the software McAfee Common Framework or Sony Ericsson Device Data by McAfee, Inc (www.mcafee.com).
Description: File McTray.exe is located in a subfolder of "C:\Program Files". The file size on Windows XP is 86,016 bytes.
The file is not a Windows system file. The program is not visible. Therefore the technical security rating is 38% dangerous, however also read the users reviews.
Important: Some malware camouflage themselves as McTray.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the McTray.exe process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.

FROM http://www.bleepingcomputer.com/startups/Mctray.exe-22761.html :  
Mctray.exe Information
   This is an undesirable program.

This file has been identified as a program that is undesirable to have running on your computer. This consists of programs that are misleading, harmful, or undesirable.

See if the following solution will help you.

http://forums.techarena.in/operating-systems/1215619.htm
from http://www.techsupportforum.com/microsoft-support/windows-xp-support/368781-solved-xp-search-function-not-working-only-dog-shows-up.html

i've tried everything the. When i click search in any explorer window the blue pane opens with the assistant but i have no search options or input boxes
Go to Start>Run, type cmd.
When the command dialog window opens, type the following and press enter after each command which will prompt a confirmation box as being successful after each command

regsvr32 urlmon.dll
regsvr32 jscript.dll
regsvr32 wshom.ocx

 ________________
 http://us.generation-nt.com/answer/explorer-search-pane-missing-search-options-help-159079461.html
Search doesn't work or fails

Go to Start => Run and type in - or copy/paste - each of the commands
listed below, one at a time. Hit Enter after each. Note that there is
a single space after regsvr32.

regsvr32 wshom.ocx
regsvr32 jscript.dll
regsvr32 urlmon.dll
regsvr32 vbscript.dll

-

If that doesn't fix the problem, do this:

Go to Start => Run and type in:

%systemroot%\inf {No spaces}

Click OK.

Locate the file Srchasst.inf
.
Right-click the file, and click on Install. You will be asked to
insert your Windows XP installation CD in the drive.

This will reinstall the Search Assistant.

-

One thing you could try is to turn off the file Indexing Service,
especially if you see cisv.exe grabbing a high percentage of cpu. The
data may have become corrupted. Anyway,

check if it's enabled either of these ways:

In the Search window click on 'Search Options'. Click on the 'Indexing
Service' link. If it's enabled, click the radio button 'No, do not
enable...'. Click the 'Advanced' button and in

the window that opens, right-click => All Tasks => Empty Catalog.

or ...

If you can't get access via the Search window, go to Start => Run and
type in "ciadv.msc" {without the quotes}.
In the window that opens, do as above.
Next, Go to Start => Run and type in "services.msc" {without the
quotes}
Locate the Indexing Service. If it's running, Stop it and set it to
Manual or Disabled.

If this doesn't work, you can restart it if you want.



Or, to use Classic Search instead of XP Search:

Copy the text below between the dotted lines, but not the dotted lines
themselves. Open Notepad and paste it in. Save the result in a
suitable location as search.reg - making

sure that the default .txt extension doesn't appear in the file name
(Save as type = All Files).
Double-click on the saved .reg file to merge the contents.
Restart

- cut below here

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
\CabinetState]
"Use Search Asst1"=-
"Use Search Asst"="no"

- cut above here



My problem is with the search function in my windows Xp computer.for some odd reason it is not working properly. It doesn't even start up, from either of the two spots I use it. The first is by clicking the Start Menu, and clicking Search. the second is by right clicking My Computer and clicking Search. Both do nothing when clicked. i have done all i know to solve the problem. now am washed off my hands.so am requesting to provide some inputs to make it normal
 
Do this thing for resolve this issue Start, right-click a blank spot on the left side of the Start menu, click Properties when it appears, select Start Menu, Customize, Advanced, check the Search check box and save the changes.now on Windows Explorer right-click a blank spot at the right end of the menu where the icons present Customize, highlight Search on the left, click Add.

FROM http://www.secretgeek.net/ms_search.asp 

Award for the Silliest User Interface: Windows Search

Why is a dog asking me questions?

Who's been putting the mescaline in the Microsoft kool aid?

What if google used this approach?

Would google still be number one?












Google












So you'd like to search for something!






JSNOTE Totally diff prob.  In cmd type:Sfc /REVERT

Hmm, i really dont know why it starts running by himself aawservice.exe but i can help you turn it off, and he starts when u start Lavasoft program. So:
Start --> Run --> (type) msconfig-:  Select tab Services and just turn off "Ad_Aware 2007 services"

System Configuration Utility overview

System Configuration Utility (Msconfig.exe) automates the routine troubleshooting steps that Microsoft Product Support Services technicians use when diagnosing Windows configuration issues. You can use this tool to modify the system configuration through a process of elimination with check boxes, reducing the risk of typing errors.
You can use System Restore to undo harmful changes to your computer. To open System Restore from System Configuration Utility, on the General tab, click Launch System Restore. For more information, click Related Topics.

No comments: