[Alan_B]

makai

With only 8 posts under my belt I feel I am teaching grandma to suck eggs,
but just in-case you are unaware of a little snippet I came across months ago :-

Acronis are supposed to maintain backward compatibility for two versions,
hence your version 2009 is able to restore images made by version 10,
but should you upgrade to the recent 2010 that may draw the line at version 11.

Personally I will never go above version 11 because I understand later versions malfunction should I move image files - any deletions / relocations etc. have to be handled by Acronis GUI or not at all.
I can now do a monthly FULL backup, and have a BAT script to do a daily DIFFERENTIAL backup which is fully independent of intervening backups, so much safer than the normal Acronis vulnerability - something I cannot do with 2009.

Regards
Alan

[Advertisements]

Thanks so much Makai - sorry I didn't get a chance to see this after I posted. I was sooo tired and crashed. Will stop these tonight.

Sorry about the services - completely forgot! I was distracted by the failure to upload the log I guess... LOL. It's a measure of how tired I was that it took me an hour to figure out why the file wouldn't upload. I'll do that tonight, first thing.

I do try to keep peripherals out of startup, thanks! Never can manage to get rid of em all though.

My philosophy is to disable everything I can start manually.

Ditto.
And thanks for the guide. It's such a pain googling every single program.

HP Protect tools... Don't even know what that is... Will have to check it out, but my guess is I don't use it if I don't know what it is.

The Quicklaunch buttons, I think I disabled from startup before with no problem. They're not the same as the Quickplay program though - they're the touch strip across the top of the keyboard. I can use them to play and control media files, mute sound or manipulate volume, and also to turn on my computer when it's off. I think the utility would load the minute I try and use them, but I don't remember. Will try it and re-enable if I have any problems.

Not sure what Nero would be manageing, since at the moment I've got no media files on the machine. I don't use that anyway, I think it's just a part of my program I didn't think to disable during install.

Some of these will not disable through the startmenu shortcut, no matter how I try. For instance the Adaware service. I even told it not to install anything on startup and I ended up with this anyway - disabling from start menu doesn't work, on reboot it's right back in startup again. Is it dangerous to disable from msconfig? That's what I always used to do...

Edited by n3ko, 16 September 2009 - 09:35 AM.

[n3ko]

Thanks so much Makai - sorry I didn't get a chance to see this after I posted. I was sooo tired and crashed. Will stop these tonight.

Sorry about the services - completely forgot! I was distracted by the failure to upload the log I guess... LOL. It's a measure of how tired I was that it took me an hour to figure out why the file wouldn't upload. I'll do that tonight, first thing.

I do try to keep peripherals out of startup, thanks! Never can manage to get rid of em all though.

My philosophy is to disable everything I can start manually.

Ditto.
And thanks for the guide. It's such a pain googling every single program.

HP Protect tools... Don't even know what that is... Will have to check it out, but my guess is I don't use it if I don't know what it is.

The Quicklaunch buttons, I think I disabled from startup before with no problem. They're not the same as the Quickplay program though - they're the touch strip across the top of the keyboard. I can use them to play and control media files, mute sound or manipulate volume, and also to turn on my computer when it's off. I think the utility would load the minute I try and use them, but I don't remember. Will try it and re-enable if I have any problems.

Not sure what Nero would be manageing, since at the moment I've got no media files on the machine. I don't use that anyway, I think it's just a part of my program I didn't think to disable during install.

Some of these will not disable through the startmenu shortcut, no matter how I try. For instance the Adaware service. I even told it not to install anything on startup and I ended up with this anyway - disabling from start menu doesn't work, on reboot it's right back in startup again. Is it dangerous to disable from msconfig? That's what I always used to do...

Edited by n3ko, 16 September 2009 - 09:35 AM.

[makai]

Didn't get to read your posts until I got home. So in reference to all the text.... yah!

Some of these will not disable through the startmenu shortcut, no matter how I try. sad.gif For instance the Adaware service. I even told it not to install anything on startup and I ended up with this anyway - disabling from start menu doesn't work, on reboot it's right back in startup again. Is it dangerous to disable from msconfig? That's what I always used to do...

Ummm... msconfig is where you'll want to disable Startups (HJT 04 entries)... not Services. You could disable from there, but its better done in Admin Tools/Services. No worries, we'll take care of Adaware when we get to it in Services. However, the newer Adaware versions may require the Service to run. I think I remember that from somewhere... I don't use Adaware anymore. In fact, my machine only has Malwarbytes, Spywareblaster, HJT, Avira and ZA protecting it. No Windows update, no Firewall, no Security Center running! Believe it or not, I don't even have Java installed except what comes native to FF. Oh yah, I do have noscript and adblock running if FF.

[n3ko]

Ummm... msconfig is where you'll want to disable Startups (HJT 04 entries)... not Services. You could disable from there, but its better done in Admin Tools/Services.

Oops, sorry. Not only do I think I knew that, but you state that in the doc you gave me.
I got confused because somewhere you mentioned disabling items in the systray by clicking their icons and disabling them there. This hasn't always worked for some programs, so I've been going straight to msconfig to do it for a long time now. Glad I'm doing it right.

No worries, we'll take care of Adaware when we get to it in Services. However, the newer Adaware versions may require the Service to run. I think I remember that from somewhere... I don't use Adaware anymore. In fact, my machine only has Malwarbytes, Spywareblaster, HJT, Avira and ZA protecting it.

I've been reading adaware isn't as recommended anymore. And it does run slow and is a bit bloated... Would you recommend binning it in favor of spywareblaster or super-antispyware? I've just been sticking to programs I've had good sucess with in the past, but I really wouldn't mind ditching it for something better.

For that matter, how about Spybot?

No Windows update, no Firewall, no Security Center running! Believe it or not, I don't even have Java installed except what comes native to FF. Oh yah, I do have noscript and adblock running if FF.

Windows update, firewall and Security Center are trash.
Better than nothing of course, but you might as well try and protect your PC with kleenex.

I need Java for work though. Lots of the cisco applications (including my VPN when I get around to installing it) require it. I'd rather not have it, otherwise.

I also need quicktime for some of the editing I do as a hobby. I've been looking at that alternative in the maintenance section (can't remember the name off the top of my head) but will have to test it before i can know that I really can replace QT. Another time.

OK< I think I got all the ones you recommended out of msconfig. Have attached another HjT file just to be sure. And my services screencaps, finally. Had to crop down that last one or I'd have had to attach it to another post though. Nothing missing from it.

Attached Thumbnails

• 
• 
• 

Attached Files

•  hijackthis.txt   5.12KB   167 downloads

Edited by n3ko, 16 September 2009 - 06:30 PM.

[makai]

Ok, I'm going to have to get back to you tomorrow. Gotta wake up early to work tomorrow at 1:00 AM.

[n3ko]

1 AM?

Wow!

Pleasant dreams!

[makai]

I've been reading adaware isn't as recommended anymore. And it does run slow and is a bit bloated... Would you recommend binning it in favor of spywareblaster or super-antispyware? I've just been sticking to programs I've had good sucess with in the past, but I really wouldn't mind ditching it for something better.

For that matter, how about Spybot?

I used to run Spybot, and Adaware long ago, and I've tried Super-antispyware a long time ago too. In all my computing experience, personally, I've never used any of them to remove any Malware from my own machine. But I have used them to attempt to remove malware from other peoples machines, and when I did, they sort of failed miserably... meaning they didn't work well enough to enable me to fix the machine. I guess at one time, they may have worked great had I had a need to use them at that time, but nowadays, Malwarebytes, and the many other special removal software is what I depend on. As I stated before, I only have Malwarebytes, Avira, Spywareblaster, HJT and ZA protecting me. This doesn't sound like a lot, but they all do the special things that's required of them. None of them do the same thing.

I think my luck with never getting spyware though is mostly due to my using Firefox for so long. I've been using it since it was in the .3xx version, (can't really remember), but it was very early on when FF first started, or when I first became aware of FF. It was tough back then to run FF, but I'm so glad I stuck with it. Another thing is because long ago I ran into a site called GRC which influenced me to learn a lot about Security on the internet. The owner of the site, Steve Gibson is very well known in the security world and reading his site led me to a reviews of firewalls. At the time, ZA was highly recommended by Steve and still is as the best free firewall of the lot. Many people don't know that ZA was responsible for flushing out one of the very first "call home" spyware. It was a children's game software made by Mattel (yup, Mattel toys) that was calling home reporting things on the user's computer. Since that time ZA became my first firewall, and I continue to use it today... although I don't use the free version anymore. As you know, the good thing about ZA is that it tells you not only when something is trying to come in, but also when something is trying to go out. This is something Window firewall has never done and that's why it and the Security Center are disabled on every machine I run. It hard to tell why I never got any malware... it might just be coincidence! Before we're done, I'm going to point you to some utilities on Steve's website to download, so remind me if I forget. Also, if you have time... a lot of it... read Steve's site... also visit his ShieldsUp site... you can get there from the main page I linked. There's so much security information, you'll be amazed, but be prepared to read... it's worth it!

Anyways...

To change how Services start up, just double click on the Service name, and change the Startup Type, then click on OK. Later on, check how things are running on your laptop to make sure everything runs ok. Thankfully you don't have a lot of junk, so most of the recommendations come from BlackVipers website.

Red means DISABLE
Blue means MANUAL
Green is the HP tools... If you're not using it, set it to Disable.

[n3ko]

Done! Rebooted too. Running fine.
29 processes in task manager after startup. Loads quickly. Yay! Thanks so much.

Yeah, I've really only used HJT, Spybot, Adaware, AVG and ZoneAlarm. Added Malwarebytes a few months back. I agree, Firefox is amazing, and we've used it pretty much since it came out - always hated explorer. Especially now with noscript and javaoptions, it's incredibly tight. I haven't had an infection on this laptop ever, and last on on the main desktop was a long time ago.

Thanks so much for the link! Have bookmarked the site, and i love to read! I'm happy to bin Spybot and Adaware. I'll get a look at Spywareblaster. Does it get Adware well too? I've always read you should have a discrete program for each kind of threat since scanners that do multiple types never do them all as well as a single one for a specific type will clean that type.

I've always used ZA too - it's a fantastic program.

So, I think this is pretty streamlined now. Any other recommendations? I can't thank you enough for all your help and support!

[makai]

I'll get a look at Spywareblaster. Does it get Adware well too?

Spywareblaster is not an adware program... per se. It's better you read about it than have me try to explain it.. I'll botch it up. Visit the site HERE.

As far as Adware goes, you can't really block it unless you have an application that monitors every single webpage, and every single link you click on. AVG, Avira, and many other apps nowadays include this feature, but the price you pay is slower browsing. Many adware apps come in via the browser, activeX, etc, so AVG, Avira, etc, via monitoring, and meant to block suspected problems. But, just the fact that you allow your browser full access to the internet through your firewall makes you vulnerable. I visit many, many websites, so it's not like I'm hidden from all the bad stuff out there. However, using Firefox, with noscript also helps tremendously simply because noscript is blocking access on the webpages. I know you're also using noscript, so that's a very good thing. Many users on this website still use IE as their main browser and it's no surprise to me that they probably make up the majority of people visiting the malware forum. If they were even half aware of what was going on on each webpage, they would immediately switch browsers. Even FF has now implemented site monitoring, so it's even a better browser yet!

29 processes in task manager after startup... <snip>... So, I think this is pretty streamlined now. Any other recommendations?

29 processes on a laptop isn't that bad at all. Laptops always require more processes to run than desktops, so this sounds very good! Later, I'll take another look at a HJT log. Yah, I have more suggestions, but I'll keep you in suspense for the moment as I need to go to sleep again... gotta get up early! Yah, I know, it's insane. If you haven't heard of or read up on ERUNT, it's highly recommended you do. This app will save your butt! By the way, skip NTREGOPT unless you're brave!

One recommendation before I go. Use ATF cleaner to dump your temp files... defrag your hard drive... then go ahead an download an create a full Acronis image. You've come pretty far, and while you may not be "full up" yet, it might be a good idea to make an image. You can always dump it later when you create your final full up image. If you require help, and would rather wait, I can help you with Aconis.

[n3ko]

Hmmm, if you make a backup of the registry first, is NTREGOPT still so dangerous? The write up on it doesn't seem so bad... In fact, it looks pretty good.

It says it doesn't clean or defrag the registry, but rebuilds it? Am I reading that right?

The program works by recreating each registry hive "from scratch",
thus removing any slack space that may be left from previously
modified or deleted keys.

But then it says:

Note that the program does NOT change the contents of the registry in
any way...

I'm confused. So what's the difference here? It's just compressing the files?

Now this PageDefrag program sounds really interesting! Do you know anything about it? Please tell me it's not just another "Cleaner & Optimizer"? I'd like to think there's something for the registry out there besides wiping your OS every year or so, reformatting and re-installing? I've known better than to mess with "cleaners", but I've always wondered if there was something legit out there. Just didn't know how to look.

I have Erunt now. Actually, I read the recommendation from this page on it a while ago, but never really bothered. You can bet I will now. I'm still not sure what good it will do if you can't boot into safe or regular windows, though. Should the back-up be made to a disk in that case? And if so, wouldn't it just be better for me to make a new image of my HD with my fortnightly maintenance? Sure, it's a lot of disks, but then I can just restore the whole system and don't need to mess with the registry... (still afraid of the sucker. )

I'll definitely read more on this when I get home.

So, since i'm running Firefox with those add-ons, I shouldn't need an ad-ware scanner? It's certainly true that I rarely get anything from Adaware, and that's usually a cookie I let through...

Am reading about Spywareblaster now. Thanks again for the link!

Will make that new Image when I get home. Oh - the Avira pop-up started popping again. Don't know how it managed it - maybe an update? I'll check in the folder for that exe and dll again. Still, could be worse. It seems all these programs have this advertising now...

Edited by n3ko, 18 September 2009 - 02:24 PM.

[Alan_B]

At the start of each day ERUNT spends 8 seconds making a full registry backup for me.

Nothing goes wrong with my registry, but if it does I know I can restore the registry,
and if the system is unbootable it will be restored via the recovery console.

If before the disaster I installed something that updated the registry, I prefer to recover via restoring the previous full partition C:\ image and then downloading/ installing again everything that I still want.
Simply restoring the ERUNT image would NOT get the registry information for the new installation - woe and disaster.

Alan

[makai]

Simply restoring the ERUNT image would NOT get the registry information for the new installation - woe and disaster.

I read this about five times and I'm still ...

[n3ko]

Simply restoring the ERUNT image would NOT get the registry information for the new installation - woe and disaster.

I read this about five times and I'm still ...

Me too. Alan, can you please expand on that? The documentation I read for the program says it will.

makai, do you feel acronis is a better program in all ways than macrium? I started with that because after reconciling our budget for the month of August it looks like it'll be a while before I can buy acronis... since I'll be getting replacement RAM from Crucial, I'm nervous that I may be needing to use one of these images fairly sooner should this all hit the fan again.

I'm hoping it doesn't, the lappy could really use more RAM and I don't want to buy it from HP at double the cost (at least). Couldn't afford to at the moment anyway.

For instance does Acronis allow recovery of the image if windows & safe mode won't boot, all on its own? Macrium needs a recovery disk it creates from PE...

[makai]

Hmmm, if you make a backup of the registry first, is NTREGOPT still so dangerous? The write up on it doesn't seem so bad... In fact, it looks pretty good.

Yah it does. I just skip registry optimization programs... and it's just a recommendation... so it's really up to you. Erunt is very good, and perhaps NTREGOPT is also. I just mentioned it because I pointed you to the page and I figured you'd ask about it.

So, since i'm running Firefox with those add-ons, I shouldn't need an ad-ware scanner? It's certainly true that I rarely get anything from Adaware, and that's usually a cookie I let through...

As I stated, you can't block adware because your browser has full access to the internet and that's where it comes from. Many people get adware via scare popups, and click on the popup to close it. Sometimes that's all it takes to launch the adware. Running noscript blocks scripts on the page, therefore, it basically helps to stop adware scripts from running on the page you're viewing. I have yet to see any AV, Antispyware, Adaware, Spybot, or any program provide a preemptive warning about adware trying to enter my computer. But if you feel more comfortable running adaware, spybot, etc, then by all means do so.

[makai]

I have no experience with macrium, so I can't comment on it. On acronis, I have quite a bit... so... Yes, acronis can boot even if your computer can't even get to safe mode. You can make a boot CD in acronis that will boot your computer and reimage your drive. It works very well. In fact, because acronis is a bit by bit copy, when it reimages, it actually loads the data in a contiguous manner. If you were to run defrag right after you reimaged, you'd see no fragmentation. Kinda neat actually!

As for the ram, check Newegg prices... if you're in the US. It's the only place to shop... well, actually, once in a great while (very great), Amazon.com might beat newegg price by a few dollars, so compare prices after you decide on the ram.