|
got a virus? 
|
|
|---|
My PC Computer Repair Diary |
||||||||||||||||||||||||||||||||||||||||||||||
| Sept. 5,6,7, 2011 |
Problem:
Customer has two computer problems - windows 7 computer cannot connect to another win 7 computer
and a separate unrelated computer that returns to the login screen whenever I try to type something.
Analysis and solution: Problem 1: The windows 7 computer ( call it A) cannot connect to windows 7 computer ( call it B). The first thing I checked was the workgroup of each computer. Ah ha, computer A was in workgroup "mshome" and computer B was in "workgourp" - Looked like an easy fix - but alas, after putting "A" into workgroup "workgroup" - the problem still existed. I noticed, however, that "A" had its computer name appear twice under the network view in explorer. The computer name for computer "B" also appeared - and several other computers on the network. I was able to 'see" all shared files of these other computers - no problem. But, when I clicked the icon for computer "B" - got an error message that it could not connect to "B". I tried to ping "B" - no problem. So the command ping "B" worked yet the attempt to access this computer gives the error message \\"B" is not accessible. By the way, this is the exact error message one gets if the other computer is not turned on. This was not the case here. So, I carefully checked the shared properties and all seemed okay. I was told that computers "A" and "B" did work until before the power went out due to hurricane Irene. This outage should not have done anything - as all the other computers were accessible with the exception of "B". One other piece of information - the computer "B" contains the central shared database for all computers on the network. So, it is imperative that I get "A" to see "B". All the other computers on the network can see this database. I looked for a solution on the internet and found exactly the same problem. Here is a screen shot of the error message ( appears exactly as my error message - different names of course) 
Now here is the image of the network view in explorer 
Exactly as my view shows ( different names of course) . The computer "A" appears twice just like SIRIUS appears twice. At this point, I had to end my diagnosis and return the next day. I decided to call Microsoft - Ha - try finding a telephone number. I bounced from web page to web page like a kangaroo rat. No soap, but perserverance wins the day - I got the phone number ( here it is 1-855-350-6401). To solve a problem MS charges $59 for one problem resolution. So, we started the problem solving exercise. The MS guy took control of computer "B" and proceeded to search for a solution. He kept getting the same error message that computer "B" could not join the "homegroup" - we set up a homegroup on "A" and with password in hand I went back to "B" and tried to join "A"'s homegroup. We tried for about 2 hours ( to no avail) and then I had to leave to come back the next day. Overnight, I thought about the problem and decided that the probelm seems to lie with the homegroup feature of windows 7. So, the next morning I went to both computers and "left" ( unjoined?) the homegroup on each. Guess what? all problems of "seeing" the database from "A" disappeared - no problem! The problem of connecting to the homegroup was not resolved - but I don't care - because I just needed "A" to see the database on "B". It seems the "homegroup" feature was an idea that microsoft thought was a good idea but from my experience and the research I did on the internet indicates there may be some issues. It looks like "homegroup" was designed to add a sub-network so computers on a network could independently share folders ( photos , music, etc. ). Anyway, the problem was solved to the client's satisfaction. Fini. Problem 2: The computer with the keyboard problem was actually solved by the client. Apparently, one key on the keyboard was stuck in the "down" position. The client got a small screwdriver and pryed it up and voila! - all was well. Again, here is an example of accepting the client's claim - he had tried another keyboard. Well, you have to take what a client says with a grain of salt - because I was going to bring the computer back to my shop and would have made this discovery myself as I would have used my keyboard and mouse and monitor and would have found that it worked. The client's keyboard would have become prime suspect #1. But, his discovery saved me a round trip and extra work. Just remember, any bizarre behavior like this - check the keyboard or mouse. If these two devices go haywire they can send spurious signals to the computer which will result in the oddball behavior. I had this happen twice about 10 years ago. 
|
| Aug 10, 2011 |
Problem:
Customer says she gets memory error
Analysis and solution: Went to customer's house to see what was wrong. The error was actually reporting low disk space and NOT memory. The disk was the "D" drive which on this Dell computer is the "Recovery" partition. I copied the D:\dell\image directory ( which contains one large file - about 3.4 gigs to the "C" drive. So now the free space showed about 3.45 gigs on the "D" drive. The used space was reported to be about 6.5 gigs. I examined each folder on the drive and it added up to about 1 gig ( checked if any "hidden" folders or files - none). So, why is the reported disk space being used is given as 6.5 gigs but the sum of all the folders only added up to 1 gig. Ah ha, must be a fragmentation problem. I used both windows and AVG defrag programs - no change in the stats. So, I copied all folders and files from the d-drive to a folder on the c-drive. A quick format of the d-drive and then copied all folders and files back to the d-drive. Voila, the stats are now correct - with about 5.6 gigs of free space. For some reason, I never seem to have any luck with defrag programs. In theory, the defrag step should have cleared up the problem - but it didn't - and I had to resort to the copy-off, reformat, copy-back steps to get the stats right. Oh god of hard drives why are ye so cruel ! 
|
| Aug 4, 2011 |
Problem:
Customer cannot connect to the internet
Analysis and solution: The network icon on the left-hand side of the taskbar reported that a network cable was unplugged. I checked the connection and all seemed okay. I then unplugged the cable from the computer and plugged it into my laptop - no problem - so It wasn't a problem with the cable. I manually set the ip address to a value within the local area network. Since, this was connected to a linksys router - I set the value to 192.168.1.160 and then tried to "ping" the router - no dice. The customer told me that a lightning storm had damaged the boiler in his house - ah ha - so I suspected the network circuit on the MB was probably wacked as well. I put in a network card in a PCI slot and disabled the onboard network adapter. The pci card had a realtek chipset. This card did not fix the problem - but I noticed that the pci card and the onboard network circuit were both realtek chipsets. So I replaced the realtek pci card with another network adapter which was not a realtek. This worked. Not sure why this worked as the pci realtek card should have been independent of the onboard circuit on the MB, but I'll take this as a fix.
|
| July 31, 2011 |
Problem:
Customer says some desktop icons not clickable
Analysis and solution: Sure enough, I tried to click on some of the desktop icons to start up an application and nothing. I then noticed that a lot of the icons appeared twice. So I tried to delete one of the shortcuts by right clicking on the icon but there was no pop-up options window. After scratching my head for a few minutes ( this is always dangerous - as I don't want to lose the 10 remaining hairs on my head) , I decided to change the background to a solid color, as the desktop looked too busy and cluttered. Well gosh-a-rootie, the duplicate icons disappeared. Now It became clear, it looked like someone had used a "screen shot" of the desktop as the background wallpaper. Of course some of the icons are not "clickable " - they are a part of the background graphic. The lesson here my children is not to let the grand kids or smartass neighbor's kids play with your computer. So don't make your screen shot of your desktop - your wallpaper.
|
| July 31, 2011 |
Problem:
Customer's printers not working.
Analysis and solution: Customer has two printers - one hooked up to a laptop the other hooked up to a desktop. Both computers are on a local network but the printers are not shared. The customer tried to get printer #1 to work but no power light. I followed the power cable to the power strip to make sure it had power. It looked okay but the printer would not turn on. I then plugged it into a wall socket and it fired up. Computer did not "see" the printer - checked the USB cable - HA - not plugged in. Plugged in the USB cable - computer now sees the printer - doesn't print - So I deleted the printer icon and downloaded the drivers for the printer - everything Okay. Now for printer #2 - which was connected to a laptop. The HP status window showed the ink levels to be zero. So, new ink cartridges were installed. No DIce. I then double checked the USB cable and it looked okay but on a closer look I saw that it was plugged into the RJ45 connector on the laptop. Yikes! - I never knew you could plug the USB cable into this interface. So I plugged the cable into a USB slot and all was well. My problem here was with the status window - as it showed empty ink levels when it should have reported the printer not connected. The other problem , and I should know better, is not to trust the user to make the connections or to at least to go over the connections very carefully. 
|
| July 22, 2011 |
Problem:
Customer's Alienware computer turns on - but no display
Analysis and solution: True enough, the Alienware computer doesn't display anything even though the computer power light is on. I then lugged this hernia maker to my car for a trip back to my house. I thought the problem was caused by a "bad" video card - so I switched cards - no dice. I then put in a pci diagnostic card and it displayed an FF code - this is bad as it means a bad motherboard or CPU. I asked the customer if they wanted a formal or informal burial for this beast. See picture below: 
The diagnostic card showing the FF hex code. It is sad to see a one time big badass computer come to an ignominious end. 
|
| July 21, 2011 |
Problem: Unable to install a custom Visual Studio application - continued from July 20, 2011
Analysis and solution: As described on July 20, I returned to client's store to install the VS application and ran into another hurdle - the computer was very slow, I could not even attempt to install anything. I took the computer home with me and ran two scans, AVG and MalwareBytes. Both found threats and were cleaned. Then, I installed Crystal Reports GAC package and finally my VS application. The application which by the way, is an inventory tracking program for an antique store. I then returned the computer to the client - the third and final trip. I did install on his computer a program called SIW.EXE - and ran it. I used this to examine the memory use and it turned out that the total available physical memory was about 180 megs out of the 1 gig or about 20% free. This may be another reason why the customer's computer runs slow. It's a lot better after the virus scans but it's still slow. The customer was satisfied with the way it is - but may opt to upgrade the memory at a later date. |
| July 20, 2011 |
Problem:
Unable to install a custom Visual Studio application - continued from July 19, 2011 Analysis and solution: Okay, as you know, I could not install a VS application on a customer's computer. The error message I got was this ( see below ) which I was able to replicate on my windows vista laptop.  I then poked around the internet and got to a web site for Crystal Solutions and I think CR is now owned by SAP. In any case, I read a pop up menu from either Business Objects or SAP ( not really interested who owns what) The quote is: "If you are developing an application using one of the Crystal Reports SDKs for Visual Studio, you need to deploy the Crystal Reports Runtime on each computer where your application is expected to run. In order to help you easily deploy the runtime on any computer running your application, Business Objects provides a set of runtime packages, i.e. redistributables, implemented using the Windows Installer technology. These packages are implemented in the form of executable Windows Installer (MSI) files or Merge Module (MSM) packages. The executable Windows Installer (MSI) packages can be used to directly deploy the Crystal Reports Runtime on the end user’s machine, for supporting thick client desktop applications, or the web server, for supporting web applications built with ASP or ASP.NET. The MSI packages can either be manually installed on the target computer, or pushed to many client computers on the network by a network administrator. They can also be embedded as part of your application’s setup in the form of a pre- requisite, custom action, or similar." So apparently, the error message has to do with updating the Global Assembly Cache (GAC). Looks like on the right track. - So I looked at my machine ( XP computer and where the VS application installs and works) and viewed the GAC - which is here C:\windows\assembly and sure enough the Crystal Reports modules are here and they have the correct version number ie, 13.0.2000.0 and this is why I had no problem installing the application on my machine. Now On my windows vista laptop the GAC modules all have a version 12.0.1100.0 which clearly tells me why I got the above error message. So now off to update the GAC. I got to this site:http://www.sdn.sap.com/irj/boc/downloads I then downloaded the first two files 1. Crystal Reports for VS 2011 - Redistributable file - 32bit 2. Crystal Reports for VS 2011 - Redistributable file - 64bit I also found another module called: 3. CRforVS_redist_install_32bit_13_0_1.zip Since I wasn't sure which one to grab, ie, #1 or #3 By the way , this third module was found here: http://www.justfilesearch.com/file/app1008221bh32i0 (just an aside - the first site I found for this file was reported as a threat - by AVG - this site is here: http://www.4shared.com/file/ DHEE2eAf/CRforVS_redist_install_32bit_1.html I closed my browser - and just to make sure - went there again - no message - could have been a fluke? - you've been warned). I decided to try to install #3 ( 32 bit ) first as #1 had in its name "SP1" the 32 bit version - which to me would be a service pack. Thus, I installed #3 and it finished the installation - okay. So just for giggles - I ran the old version of the application that was on my vista computer and it generated the reports correctly - even after updating to the new GAC modules. Now for the real test - to install the application on my vista machine while holding my breath - then BINGO - it worked !!!!!!!!!! Okay, now for some reflection on this search for a solution which took about 3 or 4 hours. My gripe is with the error message about installing the modules in the GAC. The easy way out for programmers is to always direct the user to "contact your system administrator" for a solution. This is ridiculous, either the only person to get the message is a "system administrator" ( as a corporate user most likely would not be installing new software ) or the other person to get the message would be "YOU". In my opinion, the message should read as follows: "Unable to install application - the Crystal Report modules need to be updated ( give verson number or some such indication of what needs updating) check this site http://(the download web site for the new modules) and download the zip file and run the xxxxxxx.msi file. If unsuccessful - contact 999-888-0000 technical support ( or an email web page , etc.). " The point is, the message should contain some positive action that a person can do to solve the problem and not just say "see your system admin". So tomorow, I will attempt to install the application on the customer's computer. Well, hold on cowboy - I decided to run and check the new feature I added to the application on my vista machine. Guess what - another roadblock . Here is the error message I got.  It turns out, that the new feature I added has to write a temporary text file and I choose the location to be the root directory of the "C" drive - well, no good, Vista will not allow you to write to the root directory of the c-drive. So, I changed the application to write to a sub-directroy and everything worked just fine after the rebuild and re-publish ( another 15 minutes - lost). Now off to the client - to do the install. |
| July 19, 2011 |
Problem:Unable to install a custom Visual Studio application
Analysis and solution: Last year, I developed a custom application for one of my customers. This program was written using Visual Studio/visual basic. The client wanted some additional features so he could have better control of some printed reports. Now, this application makes use of Crystal Reports. Crystal Reports is a third party add-on free of charge to owners of Visual Studio. Since the last time I built ( published ) the application ( one year ago) - I have updated the Crystal Report add-on to my copy of VS. I completed the changes to the application last week and re-published it and created an install CD. I checked that the install disk would run by installing it on my XP machine and a Windows 7 computer - no problems. So, with disk in hand, and clean shaven, I drove about 15 minutes to the client's store. About half way to my destination - I got this overwhelming feeling that this 5 minute install would not go smoothly - and guess what? - It didn't. Dispite trying to cover all bases, ie , I loaded the install disk on my two computers - and making two copies of the application (one on a CD and the other on a memory stick - just in case that the DVD drive might not work) I was ready for all contigencies. When I tried to install the application here's the message I got: ----------------------------------------------------- Application Failed to Install - reason - "CrystalDecisions.ReportAppServer.CommonObjectModel Version 13.0.2000.0 be installed in the Global Assembly Cache (GAC) first." ----------------------------------------------------- Yikes! I almost cried but my anger completely cut off this emotion and besides there's no crying in pctech services. So I packed up my bag and left my client's store to go home and research this gibberish and wondering why people waste their time writing useless error messages. I am also a little annoyed that Microsoft would produce a development product that has a CRAPPY report generator. A report generator is essential to an application development environment and to not have a robust report generator is outrageous. By not paying attention to this detail - there will always be annoying problems as I have experienced here. But, I digress - so, stay tuned - I will report back with a solution. |
| July 15, 2011 |
Problem: Client's desktop computer with windows xp
is running very slow - ie, I mean molasses slow! I mean sloooooooowwwwwww!
Analysis and solution: Sure enough, the computer is slow. So I ran a check disk command, ie , clicked on "My Computer" and right clicked on the Local Disk (C:) - then clicked on properties - then the "Tools" tab. Now I clicked on the "Check Now" button. I then checked off the two boxes - to automatically fix system errors and attempt recovery of bad sectors. Then I got this message: "The disk check could not be performed because the disk check utility needs exclusive access to some windows files on the disk. These files can be acessed only by restarting Windows. Do you want to schedule this disk check to occur the next time you restart the computer?" I then clicked "yes" and rebooted ( restarted) the computer. The check disk program ran for about two hours - while displaying all kinds of bad messages: File record segment is unreadable. Windows replaced bad clusters in file xxxxx etc............. There were hundreds of these messages. Normally, at this point, I would just stop the check disk program - and take out the disk and hurl in into a black hole ( even though Steven Hawking now says that information is NOT lost in a black hole). But my morbid curiosity wanted to see if the check disk could actually "fix" the disk. HA! Okay - the check disk has now finished - almost 4 hours later. Now, does anybody have some crow for me to eat - because, the computer re-booted and everything is now normal - the computer is really fast - programs open quickly, no delays - in fact, it may be just as it was from day one. I suppose the god of sarcasm had his/her revenge on me. Now, to make sure everything is okay - ran check disk once more. Check disk found another batch of errors, but it gave the following message: "The volume is clean" So I will return the computer to the client with the caveat that the computer may be unstable and to back up any sensitive data. I also will run the AVG anti-virus program to make sure there are no bad guys. AVG finished - no threats found - scan took 2 hours 11 minutes. And as they say in the movie business - "and that's a wrap". By the way - I ran the check disk program again - NO ERRORS !!!!!! Now I ask "stable or not stable - that is the question" |
| July 15, 2011 |
Problem: On client's computer the wireless zero
configuration service resets to manual startup after rebooting.
Analysis and solution: Oh joy of joy - another goofy anomaly with a windows service. Sure enough the WZC service resets itself to manual startup even if I change it through the services panel or set it directly to automatic using the system registry. To avoid wasting time trying to figure out why this happens ( again not a happy solution) I did the following. I created a bat file - called it "wzcstart.bat" and added it to the startup menu. The bat file contains one line of code: %systemroot%\system32\net.exe start wzcsvc which says to start the WZC service. I put the wzcstart.bat file in the root directory of the "C" drive. Now I want to run this bat file on startup so after a reboot it will get executed and the WZC service will start. To add the bat file to the startup folder I did the following. Click on start button > all programs > now right click on the startup folder and click open click on - FIle > New > Shortcut In the create shortcut window - type in the location ie, C:\wzcstart.bat Click next Then click next again - to accept the default name for the shortcut and then click finish. Now right click on the newly created shortcut and in the properties window change the run property from Run: " Normal window" ie, click on the down arrow to "Minimized" Click on OK Close the startup window. So when the system is rebooted - the bat file will execute "minimize" and not in an ugly command prompt window in the middle of the desktop. Now the chain of events goes like this. The system will try to start the wireless network but will fail as the WZC service has not started ( remember, it set itself to manual ) and will eventually time out trying to make a wireless network connection. Once it times out, the wzcstart.bat will execute (minimized) and holy moly the little icon on the right hand side of the task bar comes alive and tells you that your wireless connection has been made - Glory Hallelujah! |
| July 14, 2011 |
Problem: On client's laptop computer right click on
desktop and a barely visible dialog menu appears - mouse over this box and then it appears
correctly.
Analysis and solution: The client's computer had just been cleaned of a virus. Now a problem appears where if the user right clicks on the desktop - the menu dialog appears but it is just barely visible. I then noticed that this behavior happens after opening Internet Explorer. So I then clicked on "Tools" and then "Internet Options" and then the "Advanced" tag. Then I clicked on the "Reset" button. After IE did its thing - I closed IE and right clicked on the desktop - and now it worked normally - The dialog box appears as it should. All's well in Mudville tonight! The mighty virus has struck out! |
| July 13, 2011 |
Problem: Client's computer denied access to data base file.
Analysis and solution: The client's computer ( a new windows 7 machine) was unable to open a database on a windows xp machine - let's call this computer A. The windows 7 computer ( call this computer B) has a program on it which tries to access an access (mdb) database over a network. The folder which contains the database on A has its permission set to "share". So , from B I looked at this shared folder on A ( the folder contains not only the database file but several other folders as well ) and was able to open all files except the database file. This makes no sense, as the "share" attribute should apply to all files and subfolders given to the parent "shared" folder. I was stumped. So here's what I did ( it really was just a stab in the dark - and made no sense to do it) , from computer B, I copied the database file to the B's desktop. Then I renamed the database file in the shared folder to old.mdb and then copied the database file from the desktop to the shared folder on A. Now I was able to read the database using MS access ( why? don't know - makes no sense as I did nothing related to granting permissions ) - then of course - the network database application worked as well - no problem with permissions. Yikes! Sometimes, kids - doing irrational things - pays off. Again, an unsatisfying fix because the logic thread is in a knot. I think I need a drink! |
| July 12, 2011 |
Problem: Windows boots to desktop but most icons gone.
see July, 11 2011 below. Analysis and solution: Resolved I finally got the right tool to fix the problem. I downloaded a program from Symantec.Com. I followed the simple steps and ran the tool named FixTDSS.exe after turning off XP system restore. After the program executed - the problem was solved. Even though the problem was solved it is a bit unsettling that I really don't know the exact nature of the rootkit attack. Symantec claims a manual fix is not possible because the attack modules are not visible. I guess what this means is that the code must have been inserted into driver files and (my guess) in the master boot record. So in this case ignorance is not bliss but certainly annoying. |
| July 11, 2011 |
Problem: Windows boots to desktop but most icons gone. Analysis and solution: So I fired up customer's HP notebook (windows xp) and sure enough only a few icons and an open window labeled "Windows XP Repair" as shown here:  This looked bogus - so I opened "my computer" and looked into the C: dirve - only one file was there so I started the "run" command from the "start" button, and ran the command "cmd" to get a command prompt. Typed "dir" at the c: prompt and got only one file to display - then I typed "dir /a:h" to show hidden files - and all the files and folders in the c: drive where displayed as hidden files. I then typed in at the command prompt: attrib -h c:\*.* /s /d (this unhides all files and folders on the "C" drive where the /s says to process files in all directories as well and the /d says to process folders also all the way down the directory tree.) While this command was running - folders on the desktop popped up all over the place. I was then able to navigate all folders on the c: drive. Not finished yet, as when I tired to download "malwarebytes anti-malware" I was taken to other sites. So, from a second computer I downloaded malwarebytes to a memory stick and used this to install and run malwarebytes. It found some problems but still had problem getting to web sites. Again, from a second computer I downloaded rkill.exe from HERE. I ran this - still no luck - so I downloaded another program - tdsskiller.exe (as I suspected a rootkit) from HERE. I could not get this to run even after re-naming the program ( a trick used to 'fool' the rootkit) - still no luck. So I copied the avg free setup program from CNET and installed and ran a full scan. This found a few more things but still no luck, ie, when I did a google search - and then clicked on a results link, I was re-directed to another site ( not the one I clicked on). I then ran the "HiJackThis" program and deleted any suspicious looking entries. HJT did say that I did have an unknown module in "winsock". So I downloaded another program called "LSPFix.exe". Ran this and removed the unknown module - named "nwprovau.dll". Same problem persisted. Then I ran a program named "Taskinfo2003" ( this is my old version) - a newer version can be found HERE. This program ( which helped me in the past ) lists all running tasks and for each task it shows all associated dll files. I could not, however, find any bogus dll files. In the past, I would find a bogus module by the absence of a Description, Company, Version, etc. and usually a goofy looking module name - like ghy765re.dll or some such nonsense - certainly not a windows dll. When I did find such a module I would delete it ( sometimes I had to do this from 'safe mode'). So now I am stuck - but being a tenacious little bastard - I will look for a solution - and report back. Sorry, for the incomplete solution - but this it how it goes when troubleshooting. As Arnie would say "I'll be Back". Of course, I could do a windows clean install but this is very unsatisfying on all levels. :( |
| PREVIOUS PAGE |
 |
|
| THE GEEK SIDE |
|
|
|||