Fren Banklin

I do computer repair part-time as a hobby and to make a little side-money. I keep a lot of "tools" on my thumb-drive for working on other people's machines, and have been collecting them for about 2 years.

Every once in a while I find a very useful tool that I have never heard of, and it occured to me the other day that there might be a LOT of these tools out there, and that maybe I could benefit from other people, and they could benefit from me.

So, I've started this thread with the idea that people could post a list of there tools, or at least the cool, new and most useful tools, and maybe everyone could find something of value.

Here's (some) of mine:

Autoruns 9.33
Identifies and allows you to delete items that run during startup. Also tells who created it (like Microsoft, or whoever). GREAT tool for cleaning malware.

Magic Jelly Bean
Great tool for getting the Product ID from a computer if you are about to do a new install and it does not come with a Restore Partition or an Installation Disk.

RegSeeker
Better than MS's RegEdit, it does "batch" text searchs of the Registry and puts the results in a single common window with lots of details. Very useful for doing manual uninstalls.

Windows XP Service Pack 3 Network Installation Package for IT Professionals and Developers
Very useful for making a recently-repaired computer as secure as possible before connecting to the internet. Also saves a lot of time having to download it via Windows Update.

TweakUI
Has a nice little tool that lets you set-up a computer to "autologon", so that it boots directly to desktop, without having to click or type anything.

Unlocker
Utility that deletes files that Windows cannot/will not. If Unlocker cannot delete the file immediately, it marks it for deletion and the file is deleted at the next reboot. Great for malware removal.

WinRar
Most utilities come compressed in .rar format, and WinRar is better (I think) than WinZip. I like the command shell options, so that you can right-click a file and hit "extract here" and have the file unpacked and ready to go in a single mouse click.

Clean-Up !
I use this one to clean-up the temporary internet files and other temporary files, but tbh I really don't like it. Not only do I have to unclick the flushing toilet sound (it's disgusting), and I have to untick the "delete cookies" option, but it does not seem to do a very good job of deleting temporary files off drives that are not the Primary (boot) drive. I like to take a customer's HD and install it as secondary on my machine, and do 90% of the malware removal there. To increase the anti-virus scan time, I try to use Clean-up to delete as many of the temporary files as possible in order to reduce the number of files the AV software has to scan, but when I install the HD back to the customer's machine, there is always a significant number of temporary files that Clean-up has missed while the HD was installed as a secondary drive. So I want to fire Clean-up, and hire another utility. Any suggestions would be most welcome.

dm01

I use CCleaner to clear space on a hard disk[http://www.ccleaner.com/].

I have two Linux distros (VE DSL for diagnotics and VE Ubuntu for regular use), anti-everything, a collection of games to pass the time, a large directory of product manuals, virus removal tools, and little bits of useful information, and a nice desktop image, icons pack, and screensaver. (There has been a rather nasty virus going around in my area that replaces the desktop image, icons, and screensaver with something that is not nice at all, then deletes the ones that were there before.)

I also keep a few of the more hardcore utils on my drive that I would not like to share openly, as they can cause serious damage if used incorrectly. You know, the kind that turns your brand-new computer into your brand-new doorstop in three seconds or less. These are for such things as BIOS diagnotics and CMOS maintenance. There is also a virus on my thumb drive to encourage its safe return if it is ever lost or stolen. The virus is deleted once the drive is removed

I also keep installfiles for Spybot S&D, AVG, and SpywareBlaster to install on the machine I'm working on. You wouldn't believe the number of people who surf without protection, or who accept cookies from strange websites.

There is a large blank space left on my 4GB drive for tools and apps that are specific to a job, for example a printer driver, a device manual, or a particular virus removal tool.

Fren Banklin

I'm still interested in trading & sharing troubleshooting, diagnostic and repairing tools with people, so - BUMP !

Currently, I'm looking for an effective way to delete ALL temporary files from a secondary HD. I run CleanUp! and afterwards I navigate the "Temporary Internet Files" folder and find tons of stuff undeleted. It's getting to the point to where I want to write my own software.

Is there a temporary file clean-out utility that is accepted as "best" by professionals ?

sandman55

This is a good thread
I use Revo Uninstaller
It gives you different levels of uninstall starting with the programs own uninstall to deleting files left behind and registry entrys
One thing to watch when using one of the higher levels it first uses the programs own uninstall which will ask when it has finished if you want to restart well don't because this is where it will search for other files left behind and registry entrys. I used it to remove Norton 360 and all the garbage it left behind.

Fren Banklin

OH HOW COOL !

I was looking for a freeware alternative to "Perfect Uninstaller" just a couple of days ago. Googled, came up with "Revo", even went so far as to recommend it to someone here as a possible solution to their problem, but didn't know if it was worth installing and testing. Was hoping I could get some kind of endorsement on it, and here we are a couple of days later !


Thanks ! I'll be checking it out over the next few weeks.

sandman55

It also does a couple of other things that I haven't gone into I got it off the PC Authority Mag LINK

Fren Banklin

I'm really, REALLY, R-E-A-L-L-Y looking for a program that will delete "trash" data from a secondary (not C:\) hard drive.

sandman55

Can you give an example of what you mean. Do you mean you are backing up your My Documents to the secondary drive and when you delete files from your my documents you want your backup to keep up with it because Sync Toy will do that. It was developed by the people who worked at Microsoft in their own time for their own use and now it is freely available. If this is not exactly what you are looking for it is still worth checking out in detail because it does so many things you can I use it to first back up my firefox profiles to My Documents FF must be closed when you do this then I backup My Documents to a secondary HDD the only thing is when I do a function with it I close it down between functions because it keeps a file on My Documents.

WereBo

A useful little tool for any Mozilla products user (FireFox, Netscape, SeaMonkey, Thunderbird etc.), is ' MozBackup'.

It allows you to backup and restore bookmarks, mail, browser settings, contacts, history, extensions, cache etc. An added bonus is that it's freeware

Fren Banklin

(Regarding the deletion of data from secondary drives.)

I work on other people's computers, that are almost always infected. Rather than relying on their (usually inferior) hardware and infected HD to do the malware removal, I install their HD on my machine as a secondary drive and run the AV program first from there. This removes 90% of the infected files, which makes booting to their drive & doing the rest of the malware removal much easier.

SPEED is the name of the game. The more useless data I can delete from their HD before the scan, the faster the scan goes. Also, much of the malware is in the temporary files, so deleting all of that gets rid of the malware without having to scan it first.

Clean-Up! will delete SOME of the temporary data from a secondary drive, but it leaves about half of it behind. I always have to install Clean-Up! on the customer's HD and run it, and usually do manual removal afterwards too. CCleaner won't delete anything off the C:\ drive unless you make a special mask/filter, and I'm not confident enough about what is and is not deletable data to do that.

So I'm looking for a better temporary data deleter than Clean-Up!.

Also: ***BONUS QUESTION***

The "Holy Grail" of my current malware removal quest is to find out how to access the registry of a computer while it's boot HD is installed as a secondary drive on my machine. If I could figure out how to do this, the list of useful possiblities are endless. To include:

- Setting up the HD to boot in Selective Startup Mode, with unnecessary services & start-ups turned off, immediately after most of the malware has been removed.

- Deleting the Start-ups that are known-bad (or crapware) before the HD is even installed.

- Combing through the registry looking for problematic applications, like Norton & Mcafee.

- Getting rid of certain registry entries of known bad malware, like Anti-Virus 2009, which hides part of itself as a hidden, Non-Plug & Play driver (something like TCPI.sys).

- Doing Permissions changes, like (maybe) giving "System" "Full Control". (I've read this is a possible fix for certain issues that occur as a result of malware infection. The malware changes the permissions preventing normal operation from occuring.)

- etc...

Believe me, if I could do this, I could find a LOT more ways to make it useful.

So. Has anyone ever heard of being able to edit the registry of a HD that is off-system ?

Is the registry contained within a single file ?

Is there a utility program that will open, read and allow modifications to a registry for a HD that is off-system ?

ssj4Gogeta

Well I know the files are located in:
%windir%\system32\config\

and the file names are system, sam, security, software and default. the other files may be of importance too, but I'm not sure. I'll try to find a software which can open and edit them.

ssj4Gogeta

Got it! It's called Direct Registry Browser:
http://www.sysdevsoftware.com/soft/dreg.php

The site seems to be down. I saw a Google cache version of the page. But you can download it from here:
http://www.softpedia.com/get/System/...-Browser.shtml

PS: I haven't tested it yet. I'll test it on the registry files stored in the system restore folders and post back if it works.

Done_Fishin

I like Hirens BootCD ver 9.3 .. has most if not all the HDD mfrs test utils on it and I also have placed it on an old 256MB USB flash drive for those awkward no floppy / no CD/DVD rom drive PC's

apart from HDD it also has a lite version of win98 that will get you onto the internet (useful for checking NIC's and cabling or even get a driver or program), well there is too much to mention but they are all DOS based programs that help you to make an analysis .. including recovery tools like testdisk (great for recovering lost partitions)

ERD Commander 2007 & before that ERD Commander 5 .. only a few days ago had an old Laptop that one of my colleagues had checked out because it just wouldn't boot. It was one of those with both a floppy and a CD rom on it.

I used Hirens to check the partition using testdisk. Validated that it was teh active partition, looked at the files, figured it was NTFS partition and that ntldr , ntdetect were present but couldn't see boot.ini
I grabbed a floppy disk that I have handy with the 3 basic files on it .. ntldr, ntdetect and boot.ini with the idea of copying boot.ini across to the root of the boot drive.
booted into ERD Commander, and selected to patch into the existing Windows XP SP1 install, was told that it had found a corrupt registry and had fixed it. Checked out the root of the C drive where I saw and checked that the boot.ini file was present and readable. Checked Windows installation for corrupt files (similar I believe to sfc scannow) which found nothing wrong .. rebooted after removing both floppy & CD and the booted straight into Windows whilst getting a "red card" from my boss who asked me NOT to get involved with stuff that he hasn't asked me to do!! just can't win!!

ssj4Gogeta

Works like a charm. To test it I copied my "software" file from %windir%/system32/config to the desktop (it wouldn't let me open it from the original location probably because it was in use). from there i opened it. it lists the entries just like regedit.exe does.

Fren Banklin

Seriously, this is just about the coolest thing I have ever found ! I've been playing with it too. Thanks for the time on copying the file before editing it.

This is going to give me some serious motivation to learn the registry, cause if I can do malware removal registry changes with the HD off-system, I won't have to wait for infected computers with sub-standard hardware anymore.

This is going to be so cool ...

Thanks seriously.

ssj4Gogeta

lol I should thank you. if you hadn't asked, i wouldn't have looked for it.

Fren Banklin

I've started another thread to discuss editing the registry of an off-system hard drive here

Done_Fishin

When adding a hard drive to your PC .. if it's added as a USB drive it doesn't have the usual System Volume Information folder added

it's slower but I think less likely to cause any cross contamination

Fren Banklin

You mean the infected System Restore files ? Those are the Third thing I go after. Temporary Internet files first, run an AV scan of \System 32 second, and then to the System Restore files.

Have you ever had a situation where infected System Restore files have infected the Host computer ? I wonder if/how it could happen...

Done_Fishin

normally it shouldn't but teh point is that the host PC will WRITE to the imported drive if the drive is placed as a SATA or IDE drive .. but I have NEVER seen it happen as USB.

it's not so much a question of the Guest infecting the Host as the Host possibly, unsuspectingly, infecting the Guest.