pop-up issue

[PCBONEZ]

Re: pop-up issue

@ Pentium: usually zero filling clear the Smart log too, so after the operation the drive would show more "Reallocated sectors" and way less "Unstable sectors", "Uncorrectable sectors", "UDMA CRC Errors" and other bad sector related errors.

@ Scenic: I have a 3 GB IBM 2.5" drive I don't use anymore: full specs here. If you're interested, send me a PM.

Zandrax

Zero Fill does not reset SMART directly.

SMART is basically a Self Test Program.
It runs from and results are stored in an IC chip on the drive's PCB.

If SMART detects no errors (or a lower number of errors) so many times it resets itself to the new value(s).

If you take a PCB from a drive reporting SMART errors and put it on a good drive it will still report the errors from the old drive a few times until it resets.

.

[zandrax]

Re: pop-up issue

Zero Fill does not reset SMART directly.

Sorry, I wrote it badly: overwriting the whole disk with zeroes (litteral meaning of "zero filling") doesn't change SMART values, that's right.
Anyway manifacturer's tools usually clear part of the Smart log before performing a "zero fill": while writing zeros, they check bad sectors one by one and eventually repair (correctable damages) or remap them (uncorrectable ones). I noticed this behaviour with Hitachi's Drive fitness tools and Seagate's Seatools while repairing my drives: I have WD, Samsung and Maxtor disks too but they didn't have bad sectors yet or are too old to support SMART (the 1.2 GB Maxtor ) so I don't check the utilities of these manifacturers.

Zandrax

[RJARRRPCGP]

Re: pop-up issue

A pre 1998 HDD is usually too old to support SMART.

[madmax_2069]

Re: pop-up issue

i use Avast Pro and man i like it, its always cought bad sites trying to download infected crap (usually from googling around for hard to find pinouts and from casual searches from google) i am so far infection free for like 4 months now. before i used avg and i always got infected eventually.

i dont know whats up with google lately but its been coming up with a bunch of crap that has nothing to do with what your searching about ( altho the link info on google shows diffrent)

[Hondaman]

Re: pop-up issue

I had some trouble recently too. Please research "XP Activation". Something (the "volume label" or "serial number" or something) is also checked for WPA, and it must be the same (or else you get "points" against you toward having to re-activate). The "wpa.whatever" files mentioned earlier are correct, but are not the only part. It should be pretty easy to research this and record the old "volume label" or whatever it is in the correct spot at the beginning of the new disk, using a disk editor (like Norton Utilities 2001's disk editor).

I am sorry your disk is dying, but I'm grateful for the warning and for every document, spreadsheet, etc. you can remove.


As for the spyware, here's something I've used repeatedly:

"Startup Monitor" from www.mlin.net

Spyware loads every time Windows starts. This program lists every single startup item. Googling from a different computer (or going to spywareinfo dot com or castlecops dot com or whatthetech dot com [formerly TomCoyote] or bleepingcomputer dot com) lets you research suspicious ones.

Plug the drive in to a different PC* (I prefer linux, you might prefer Windows), delete the bad stuff, and put the drive back in to the "infected" computer. Make sure it is NOT connected to the net.

* (A 2.5 to 3.5 inch adapter is only about $10 and will let you plug notebook drives into a standard ribbon cable for your desktop motherboard.)

Start the (desktop) PC. Weird programs (the spyware) will complain that some file cannot be found, but Windows will *_usually_* continue without loading the file in question. IT IS GOOD that the spyware file can't be found. Registry cleaners can now be used (along with Mike Lin's program and programs found at the websites I mentioned above like "Hijack This", "Spyware Search and Destroy", etc.) will help you clean the registry and "suspicious" startup entries.

PCBONEZ was absolutely right. If you are re-infected each bootup, it is because the "nasties" load each time Windows starts because of their entries in the Windows startup process. Once loaded, they are programmed to reach out across the net to re-download themselves. Disconnecting from the Net like this lets us 'break the chain'.

Typically I alternate between deleting the bad files and deleting the startup entries with Mike Lin's tool and registry cleaners (Safe mode might work for some of this, but WILL NOT be 100 percent effective**. Put the hard drive in a different PC to do the file deletions). As you go along, all the various tools will become more and more effective.

** Windows puts some stuff to be deleted (on next bootup) in the registry, but some spyware intercepts and deletes this info from the registry before rebooting can take place, thus preserving the bad stuff on your PC.

When you boot the PC and work without a Net connection, many times a window will pop up and tell you that you are not connected, that it could not find an internet connection. Since you did not click on IE or Firefox or anything, this is likely spyware trying to reach out to re-download, so you know you are not done finding it and eradicating it.

There is one thing you cannot fix with these instructions: a rootkit. The nasty files used unofficial sneaky methods, so normal directory listings wouldn't show the files EVEN IN SAFE MODE, and registry editors would be tricked into not showing the startup entries for the evil files EVEN IN SAFE MODE (if registry editor even worked in safe mode, don't remember). I can't remember how I fixed it (it was the rootkit SRIZBI) but I can probably find it in my notes somewhere. Post again if you need.

Other suggestions here are good: A/V, firewall, using browsers OTHER THAN IE and mail clients OTHER THAN Outlook. And keep Windows patches up to date.

Creating a limited user account helps somewhat, but I've seen examples where this doesn't work. You can forbid limited users from installing random garbage that MySpace users tell them to click on, so for that alone you should do this last suggestion.

[bgavin]

Re: pop-up issue

The www.malwarebytes.org scanner works equally well in SAFE mode. This avoids loading most of the nasties.

If this fails, build a BART-PE boot cd, and install McAfee or your favorite scanner on the CD. This will get you around all boot-loaded bugs. If that doesn't work, FDISK/FORMAT works every time.

If you install fresh, GHOST your system before using the Internet. You can safely download Windows Updates, but don't go anywhere else until you image your system.