Computer Help in Port Macquarie

I now have a new web site and computer Hints & Tips newsletter available. While my 'hands on' computer services are only available to people in the Port Macquarie area on the mid north coast of NSW, Australia, I provide a free computer hints & tips newsletter which you might find useful.

I can also remove viruses & spyware and optimise you computer remotely for very reasonable rates.

Please click here for more information.

Cheers!

Problems installing Adobe Acrobat Reader 7.0.8

I worked on a client's computer today where Adobe Acrobat Reader 7.0.8 wouldn't install - it kept getting to a point where it reported that Data1.cab was corrupt. My customer also reported various errors from Internet Explorer, Mozilla Firefox and Mozilla Thunderbird.

A search of Adobe's support section came up with this page but unfortunately nothing there resolved the problem.

I then tried installing in safe mode but it reported that the Windows Installer Service was not running - as it won't in safe mode - I knew that :)

A light came on - maybe the Windows Installer Service itself was corrupt. I uninstalled it (version 3.1), it then warned me a whole host of programs wouldn't work correctly if I continued. Well, this was already happening so I threw caution to the wind and continued with the uninstallation. I then restarted Windows in normal mode and downloaded a fresh copy of the Windows 3.1 Installer installer via Microsoft's knowledge base article KB893803, and reinstalled the Windows Installer installer with the installer I'd downloaded!

After another re-start of Windows, I ran the Adobe installer and it completed correctly. Firefox, Thunderbird and Internet Explorer are all running without error now as well.

I hope this helps somebody, sometime ;)

Spyware, adware, virus and Trojan removal tools and resources

On this page, you'll find links to all sorts of utilities and tools to remove spyware, adware, viruses and Trojans. If you find any links which don't work, or you know of some great resources I could add here, please let me know via comments to this post. I'll add new links as I discover them. Cheers :)

Tool: vcleaner

Fixes: Worm/Generic.FX Agent.A-AN BackDoor.Agent.A-Z, AA-BG Downloader.Agent.AS I-Worm/Atak.A-I Bagle.DA-IU I-Worm/Bagle.A-Z, AA-JD I-Worm/Bugbear.D I-Worm/Mytob.A-GC I-Worm/Netsky.A-Z, AA-AD I-Worm/Sasser.A-F I-Worm/Zafi.A-E PSW.Bispy.A-E Win32/Gaelicum Win32/Hidrag

Provided by: Grisoft, makers of AVG anti-virus

Tool: Various

Removes: I-Worm/Bugbear.C Downloader.Stubby.A Win32/Valla.2048 I-Worm/Mydoom.F Win32/Dupator Win32/Elkern I-Worm/Ganda VBS/Iloveyou I-Worm/Lovgate.C I-Worm/Navidad I-Worm/Nimda I-Worm/Pretty_Park I-Worm/Sircam.A I-Worm/Happy99 W95/Space.1445 I-Worm/Verona.B I-Worm/Swen

Provided by: Grisoft, makers of AVG anti-virus

Spybot Search and Destroy Tea Timer display work around

In my last post I mentioned display problems in Spybot's real time spyware detection module, AKA Tea Timer. I found a work around on the Spybot forums, here. To make it easier for people to fix the problem, an industrious fellow named Murdo has created a patch (a small program to change the Tea Timer executable).

Instructions to apply the fix:

1) Download the patch here

2) Open the Zip File

3) Extract/Copy the contents to your SpyBot S&D folder (normally C:\Program Files\Spybot - Search & Destroy)

4) Close "Spybot-SD Resident" from your system tray (bottom right hand corner of screen) as follows:

Click your right mouse button on the system tray icon and choose "Exit Spybot S&D Resident"

5) Execute "S&D14 GUI PATCH.exe" from within your SpyBot folder

Press the "Start" button

Note: Remember to start "TeaTimer.exe" again!

That's it! The next time there is a notification by the tea timer, it will now look something like this:



The wonderful people at Team Spybot say that this issue will be fixed in the next release. In the mean time, many thanks to Murdo for his time, effort and bandwidth in making the patch available - also to ElPiedra for the original instructions.

Beware of rogue anti spyware programs (and some good ones you can use)

With spyware and adware being such huge problems on the Internet, it's no wonder there are so many programs around to fix and / or prevent spyware and adware on your computer. While some of these programs, even free ones, will help in the fight against spyware, there are unfortunately many rogue or suspect anti spyware programs freely available for download. Many of these are marketed aggressively, leading to many people unwittingly ending up with huge problems.

Some of the rogue or suspect programs, such as SpywareQuake, can include spyware, adware or Trojans in their installations. To see whether your anti spyware program or programs might be rogue or suspect, see this list at Spyware Warrior. The list is regularly updated and can be trusted.

Just one anti-spyware program is not enough - you really need multi-layered protection to maintain adequate coverage of new threats which are being released daily. I recommend a minimum of two spyware scanners and one which offers real-time protection.

I recommend Ad-Aware SE Personal edition as a first line of defense. The producers, Lavasoft, have been in the spyware and adware protection game almost as long as spyware and adware have been around. Their research department is always on the ball and new definition updates are available every few days. Incredibly, the personal edition is still free! The commercial versions include extras such as real-time protection and are well worth investigating.



Another must-have program is Spybot Search & Destroy. It has also been around for a long time and is completely free. The producers, Safer Networking, run on donations only, so if you use and like the program, please consider making a small contribution. Just think of the technician fees (not to mention hair) you'll save! Spybot includes browser protection via immunization and bad site blocking. It also has real-time protection (called "Tea Timer") as an option, but it does have some display issues. I'm looking for a workaround for this. In the mean time, if you enable the Tea Timer and occasionally get a dialog like this:

... the button on the right is to deny the change (if you suspect malicious intent) and the button to the left is to allow the change (if you're installing a trusted program).

Spybot's main screen looks like this:



For free, real-time protection, I recommend and use SpywareGuard by JavaCool Software. Again, this program is completely free, and does a great job of monitoring any attempts to change browser settings.



Another useful, free offering from JavaCool is SpywareBlaster, which doesn't even need to be running to provide protection.



Remember, protection software is only as good as the last update, so please do update regularly.

Latest threat - SpywareQuake

SpywareQuake is appropriately named - it masquerades as spyware removal software but it is actually spyware installing software.

When it starts up it lists 33 "threats" it pretends to have found on your system.

Update: If you have a SpywareQuake infection, or another of the SmitFraud variations (including SpyAxe, SpyFalcon and SpywareStrike), excellent and easy to follow removal instructions are available here at Castle CopsWiki.

I downloaded and installed the program from the spywarequake web site, and while it gives false indications of infection, it appears to be harmless in this form. It did change the security settings in Internet Explorer, but it actually increased the security, not the other way around. A standard uninstall from the control panel's 'Add / Remove Programs' seemed to remove the program completely.

On Spyware Confidential, Suzi Turner mentions the presence of a file in the Windows/System32 folder as stickrep.dll, but no such file is present with the installation I did. This leads me to believe that rogue affiliates are probably actually to blame for the additional spyware infections. I'm off now to find a "drive-by" installation to see what the differences are.

In the mean-time, stay clear of this program - you really don't need it. If you believe you are infected, update your anti-spyware application, or manually remove it with these instructions courtesy of Adam Thomas from Sunbelt Software. There is also a blog entry on the SunbeltBLOG.

What do I need for protection?

This simple question is actually quite complex. Many think that "I have ABC Internet Security Suite, I'm protected". This is very dangerous thinking. No single suite of security applications comes anywhere near being a total solution. In fact, I steer my customers away from them, as no company has the resources to be up to date and experts in all areas. Large companies are swallowing up previously good applications and over engineering them. Their security suites are very pretty but they are processor and memory hogs.

For basic, excellent protection, the free applications are a great solution, and what I recommend. Unfortunately, there are also free "rogue" applications, which give false indications of your security status. You can get some guidance through Spyware Warrior, one of the best resources for comparisons and listings of rogue applications. Their blog site is also very timely and informative.

To set up a good, basic security profile, you will need:

a good software firewall

a good real-time and scanning anti-virus program

a minimum of two spyware scanning programs

a real-time spyware monitoring program

As new threats are written and released every day, these programs all need to be kept up to date with definitions from their respective publishers' web sites. How often you should update depends on how much you use the Internet and how widely you travel there. If you browse the internet daily, I would check for updates and scan for problems daily. A couple of times per week, update and scan at least once per week. Fortunately, most of these tasks can be automated to some degree.

Stay tuned as I cover these topics and make recommendations, so you can check your defenses and stay safe and in control of your computer and your online experience.

Is my computer infected with spyware, adware, or a virus or trojan?

Very generally, the computer behaving in an unexpected manner is an indicator that there is the possibility of a malware infection of some sort. Almost every unprotected machine will have some 'low-level' spyware present such as undesirable tracking cookies. There is no need to be alarmed with this, however. Low level infections are easily treated with regular scans with recently updated anti-virus and anti-spyware scanners.

More specifically, the presence of spyware, adware or a virus or trojan on your computer will usually include one or more of the following symptoms:

• your computer is running more slowly than usual (often painfully so)
• you are experiencing regular program or system crashes
• you are plagued with popup windows or numerous browser windows opening automatically
• you have unusual entries in your browser toolbar
• your Internet home page has changed
• clicking on links has unexpected and unrelated results
• there are unexplained entries in your Internet favorites
• unexplained icons appear on your desktop
• your browser closes unexpectedly
• you notice some programs on the computer you don’t remember installing
• your Internet connection is painfully slow or you are receiving many “This page cannot be displayed” error pages in your browser
• your Internet usage fees have skyrocketed but you’re not doing much more on the Internet than usual
• you are receiving phone bills with unusual, unexplained and / or expensive entries
• you are receiving an unusually high number of bounced emails and / or complaints that you are emailing viruses to people
• your computer keeps re- starting on its own
• the amount of SPAM emails suddenly and dramatically increases
  

Of course, some of these symptoms may have other causes, such as hardware failure or a different user making changes to the system.

It is a fact that most computers with an internet connection will have some form of malware active on them. Even heavily protected corporate systems are vulnerable to malware installation.