Page 2 - Nilpo's Ultimate Windows Troubleshooting and Security Guide

There are literally hundreds of sites on the internet dealing with spware, adware, and viruses. And this is a topic too large for a single post, so I'll just provide some good links for you.

OptimizeXP
Virus Removal 101 -- Virus Removal Primer
Windows XP Security Checklist

Direct Link: http://guide.nilpo.com/spyware

So, your just having some intermittent problem. There doesn't seem to be any rhyme or reason for it, and it happens whenever it wants regardless of what you are doing. Now what?

This is an excellent time to post in the forums. Intermittent problems that don't seem to have a direct cause are usually related to failing hardware. Maybe you've got RAM going bad or a video card that's about to quit.

Update all software and drivers in your system. Try booting into Safe Mode and letting your computer run for a while to see if the problem occurs there as well. If it does, that usually confirms a hardware issue.

Benchmark. Test your hardware, preferably with a bootable software that doesn't require Windows to operate.

And last, but not least, test your power supply unit (PSU). A failing power supply will generally underpower your PC and can cause some pretty strange things to happen.

<edit=Dngrsone>Go to DevHardware! </edit>

Direct Link: http://guide.nilpo.com/glitches

While Windows is pretty good about handing out errors when something goes awry, making any sense of the error can sometimes be quite a chore. Hopefully, I can make this a little easier for you.

First, you have to understand that there are many types of errors: General Protection Faults, Page Faults, Illegal Operations, and Fatal Exception errors just to name a few. Knowing the type of error is the first step in deciphering what it means. Windows also has various ways of throwing errors. You also need to determine if it is a program error, a module error, or a system error (kernel32.dll). Windows 2000 and XP simplified this process over earlier versions by reducing the number of error types. So we'll divide this article into two sections Windows 9x Errors (including Windows 95, 98, and ME) and Windows NT Errors (inluding Windows 2000, XP, and higher). Windows NT follows the NT system for the most part, but there is some overlapping. The 64-bit Windows releases should follow the NT model pretty closely.

General Error Information:

Windows basically uses three types of error codes: text, numeric, and hex codes.

Numeric errors, such as Dialup Networking Errors, will simply have a reference number for an error code. Numeric errors will usually also have a text descriptor associated with them. These are generally the simplest errors to troubleshoot because they simply associated a known problem with a known cause. In other words, they return a listed error code under specific circumstances. For instance, if your modem has no dial tone, it simply returns the error code that means just that.

Hexadecimal error codes are a little different. While they usually have a text descriptor, these errors are usually a little harder to decipher because they are system generated rather than listed errors. Because they are system generated errors, they often have multiple parts as well. In some cases, this is made a little easier with a text handle.

Text errors will either be a text handle appearing as all capital letters with words separated by underscores (i.e. UNMOUNTABLE_BOOT_VOLUME) or as test descriptions (i.e. Unable to connect.) While text errors don't usually occur without either a numeric or a hex code, it just wouldn't be Windows if it didn't happen once in a while.

I get asked a lot why it's so hard to research an error code. "Isn't there a list somewhere of all the possible error codes?" The answer quite simply is no. That just isn't possible. Windows is a product comprised of many parts. While many of them are made by Microsoft, still a good many are made by third parties. It would be nearly impossible to generate a list of error codes to cover all of the multitude of possibilities.

Windows 9x Errors:

• General Protection Faults
• Windows Protection Error
• Invalide Page Faults
• Stack Faults
• Invalid VxD Dynamic Link Calls
• Fatal Exceptions
• Kernel32 Errors

Windows NT Errors:

...writing in progress...

Additional Resources:

Windows 4 Support Center (Windows 9x)
Windows 5 Support Center (Windows NT)
Description of Windows Error Messages
What Are Fatal Exception Errors

Direct Link: http://guide.nilpo.com/errors

Don't wait for disaster to strike. Prepare for the worst now. Here are some simple ways to prepare for a disaster so that you can get back up and running as soon as possible.

System Restore
System Restore is a recovery tool that can come in quite handy at times. It creates system snapshots (or restore points) that can be used to roll your computer back to a previous state. If a program installation goes wrong or you catch a virus that leaves your system unusable, you can use System Restore to return computer back to a time before it happened.

• Enable System Restore
  1. Right-click My Computer and choose Properties to open the System Properties dialog.
  2. Click the System Restore tab and make sure that the checbox labelled "Turn off System Restore on all drives" is unchecked.
• Create a Restore Point
  1. ...writing in progress...
• Restoring to an Earlier Point
  
  

Description of the Windows File Protection Feature

How to Set up and Use Automated System Recovery in Windows XP

Direct Link: http://guide.nilpo.com/recovery

Okay, none of the advice here worked and you weren't able to get any help in the forums. Now what?

It's time to get some first hand support from your software or hardware's vendor. Find their tech support number and call or visit their website and look for support desk or trouble ticket link.

If, at this point, you're still unable to get operational, it's probably time to start replacing hardware. But don't give up just yet, the links below can be very useful for hard to find information.

Help and Support:
Microsoft Help and Support
Windows Support Center
Microsoft Online Crash Analysis

Technical Resources:
Microsoft Dll Help Database (Good for Identifying Windows Files)

Direct Link: http://guide.nilpo.com/answers

...writing in progress...

Direct Link: http://guide.nilpo.com/tools

...writing in progress...

Direct Link: http://guide.nilpo.com/whatelse

Okay, Class, Welcome to Virus Removal 101.

Got a nasty bug you can't get rid of? (The computer kind, I mean, lol) Here's the quickest, easiest way to rid yourself of these headaches. These are general directions regardless of which version of Windows you are using.

1. Disable System Restore.
2. Download any removal tools and patches (and my batch file below) and then kill your internet connection. If you are on a high speed connect don't just disable the connection -- actually, physically pull the plug.
3. Remove any known registry keys. Specifically any found here:
   HKLM\Software\Microsoft\Windows\CurrentVersion\Run
   HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
   HKLM\Software\Microsoft\Windows\CurrentVersion\Run Once
   HKLM\Software\Microsoft\Windows\CurrentVersion\Run ServicesOnce
   HKLM\Software\Microsoft\Windows\CurrentVersion\She llServiceObjectDelayLoad
   
   HKCU\Software\Microsoft\Windows\CurrentVersion\Run
   HKCU\Software\Microsoft\Windows\CurrentVersion\Run Services
   HKCU\Software\Microsoft\Windows\CurrentVersion\Run Once
   HKCU\Software\Microsoft\Windows\CurrentVersion\Run ServicesOnce
   HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer
   
4. Edit following files as needed (run Sysedit !!!):
   C:\Autoexec.bat
   C:\Windows\Win.ini (Look for strange entries in the [Windows] section)
   C:\Windows\System.ini (Look for strange entries in the [Boot] section)
   C:\Windows\Config.sys (Look for unusual lines beginning with device=)
   C:\Windows\Wininit.ini (you can usually just delete this one)
   C:\Windows\Winstart.bat (you can usually just delete this one, or delete any unwanted line. Lines will appear as a filename.)
5. Disable any screensavers by selecting none.
6. Be sure the SfcScan DWORD value is set to 0 under
   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
   
7. Be sure the Shell STRING value set to explorer.exe without any trailing characters under
   HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
   
8. Be sure the Userinit STRING value set to C:\Windows\System32\Userinit.exe, without any trailing characters under
   HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
   Don't forget the trailing comma. This path should be adjusted to match your system directory.
   
9. Check the following registry keys for unknown program calls, the Default string values are listed for each:
   
   HKCR\batfile\shell\open\command ("%1" %*)
   HKCR\comfile\shell\open\command ("%1" %*)
   HKCR\exefile\shell\open\command ("%1" %*)
   HKCR\piffile\shell\open\command ("%1" %*)
   HKCR\regfile\shell\open\command (regedit.exe "%1")
   HKCR\scrfile\shell\open\command ("%1" %*)
   HKCR\htafile\shell\open\command ("%1" %*)
   
   HKLM\Software\CLASSES\batfile\shell\open\command ("%1" %*)
   HKLM\Software\CLASSES\comfile\shell\open\command ("%1" %*)
   HKLM\Software\CLASSES\exefile\shell\open\command ("%1" %*)
   HKLM\Software\CLASSES\piffile\shell\open\command ("%1" %*)
   HKLM\Software\CLASSES\regfile\shell\open\command (regedit.exe "%1")
   HKLM\Software\CLASSES\scrfile\shell\open\command ("%1" %*)
   HKLM\Software\CLASSES\htafile\shell\open\command ("%1" %*)
   
10. Delete unusual links from the Startup folder under Programs (or All Programs) on the Start Menu.
11. End any unneeded processes in Windows Task Manager (including AV services which can sometimes lock deleting files).
12. Run Windows Cleanup Wizard with all items checked (except Compress Files) and delete everything.
13. Reboot into Safe Mode as Administrator
14. Run my SysClean.vbs (right-click and Save As...) or SysClean.exe batch file.
15. Run any removal tools and/or delete the virus process files cleaning infected files whenever possible.
16. Install any patches or hotfixes.
17. Run "sfc /scannow" to check the integrity of your system files.
18. Reboot in Normal Mode
19. Re-enable System Restore.
20. Install or enable a good firewall
21. Reconnect to the internet and run Windows Update.
22. Create a Restore Point if using System Restore.

NOTE: Attempting to run my SysClean scripts while your Antivirus software is enabled may result in them being incorrectly detected as malicous scripts. This is normal since they run on the Windows Script Host. You can allow them to run if your AV supports that or you can disable either your script protection feature or your AV software before running them. Just make sure to re-enable any protection once they have run.

Post back for help with any of these steps or questions/comments.

My downloads are provided as freeware with no warranty expressed or implied. Please don't hold me responsible for any damages. They are provided as a means of automation for your convenience only. I have tested them without any problems.

Direct Link: http://guide.nilpo.com/virusguide

I've provided a WSH Batch Script called SysClean.vbs (SysClean.exe is just an autoexecuting package containing the .vbs file). Before questions arise, here's what the script does.

1. Determines which version of Windows you are using by checking to see if the path "C:\Documents and Settings" is valid.
2. If the path exists if recursively searches each subfolder (User Profile) and deletes temp files and temporary internet files.
3. Determines if the path "C:\Windows\Profiles" exists. (Win9x User profiles.)
4. If the path exists, it recursively searches each subfolder and deletes temp files and temporary internet files.
5. Deletes the contents of the Windows Temp folder.
6. Deletes the contents of the Temporary Internet Files (including the hidden Content.IE5 directory).
7. Deletes the contents of Downloaded Program Files (which can sometimes house BHO exploits).
8. Clears the Windows History Folder

I goofed again. No wonder software developers have so many release versions.

In my narrow minded approach I missed a couple things. Here are the fixes for upcoming versions:

1. The script file assumes that windows is installed in the Windows or WINNT directory.
2. Force the script to disable System Restore automatically
3. Show a progress bar for users with larger harddrives
4. [EDIT]Empty User Recycle Bins[/EDIT] -- Support Added
5. [EDIT]Reset Default executable strings in the registry[/EDIT]

I've updated the Virus Removal Guide with a few more common trouble spots. I'll try to keep this as updated as possible without losing too much "generality". (Hmm, is that even a word?)

Okay, I've updated the SysClean.vbs and SysClean.exe files to include emptying the Recycle Bin. I didn't want to empty it automatically since it is a safety feature so I've used the script to invoke the "Empty Recycle Bin" prompt instead. Choosing "No" will not affect the script's completion.

I've been working on the latest updates for the cleanup script and going over some more additions to the primer when I thought of some good advice that I neglected to add.

The most common mistake made by people is jumping to conclusions about what software removal tools to use. Many people are misled by ridiculous advertisements or bad advice into using software that is worse for your system than the problems they are intended to remove.

So with that in mind, how can you possibly know what software is okay?

Well, before you download and install the latest craze in spyware or virus removal, stop by the following resource and check it out:

The Spyware Warrior List of Rogue/Suspect Anti-Spyware Products & Web Sites

or

DOXdesk.com's Disreputable Anti-Parasite Software List

Hey, don't say I didn't warn you.

Sometimes when you attempt to remove a virus you may find that certain system tools such as Regedit or Task Manager will not function. Some viruses are known to either delete them or replace them in order to make their removal harder.

Some viruses will add .com files with the same name to your system folder. When you call a file from the Run... dialog box, say regedit, it will load regedit.com before the real regedit.exe. You can try typing the filename with the .exe extension if you find that you cannot open them.

If that doesn't work, you can follow this link and use Doug Knox's utlity to create usable copies of these utilities.

Please note that the download uses Windows Script Host to create the copies so some antivirus softwares may incorrectly identify it as a "malicous script". You should disable script protection if available or use your AV's allow feature when running the download.

I've just added another known registry key to the primer. I'll do my best to always keep it up to date.