But just to mention something about altering system files as well, I did fix a PC a couple of weeks ago that had the System Registry Hive suddenly disappear from the hard drive (I couldn’t find it anywhere!), plus the system registry hive backup in the Windows repair folder was gone as well. I had to wind up doing a nuke and pave on their PC after using Linux to back up 182GB of data from their primary hard drive to an External USB hard drive @ 25MB/s. The odd part of it was, the people whose PC I checked out had Computer Associates Anti-Virus, which I think may have been the cause of the registry being destroyed (there was a false positive going around) and they also used Firefox after I suggested it to them last year as well.

I was also fixing another PC two weeks ago that had a nice deep infection of Vundo/Virtumonde and some downloaders. That PC was a toughie to get fixed up as it turns out the user had two anti-virus programs installed (AVG and Avast!) which was causing the file permissions on everything to be denied to me until AVG was closed by killing it’s processes. That PC once I removed AVG manually using the uninstaller from the Grisoft website was a mess. I was able to get into Windows Explorer and open programs, however the trojan kept killing programs or locking them up, or showing Anti Virus XP 2009 pop ups. I would up being able to schedule a boot time scan with Avast!. Avast! after it was able to update it self, restarted the machine gracefully and when it scanned, it found about 42 infections, much of which was found in the system restore folder as every entry in System restore was infected, plus a bunch of .dll files and exe files with random names that I have seen before in the Windows folder, especially in System32 and in system32/drivers. Once Avast! cleaned those up, Windows restarted but it was still messed up. Turns out the viruses that were still in there were in pieces of files. As soon as I opened up Add/Remove Programs, Avast! pops up saying it found another exe file which it didn’t find during the start time scan. From then on, Windows was becoming functional again, but I had to run MalwareBytes, SUPERAntiSpyware, HijackThis! and Avast! once more to clean it up completely. What a mess that PC was as I spent just about the entire day at their home scanning and cleaning it up, and rushing home to get a Linux disk to delete a trojan via Linux (since it was preventing every program from opening up, it was called svchast.exe, which is a “nice try” thing to my eyes )

So I don’t know what has been up. Many of the PCs I’ve been looking at lately are either running Windows XP SP2 still, have a massive amount of malware in them or require a full nuke and pave because the OS is basically destroyed. I’ve been tracking down these viruses and where they’re coming from and they seem to all be slipping in via Internet Advertisements in JavaScript/Java/Flash files. Since then I’ve been getting people to use Firefox and in Firefox I’m installing Adblock Plus with the EasyList filter and some of my own customizations to the filter list.

Right now I’m not having much luck with this desktop PC. I’ve checked in both Knoppix and Ubuntu and I can’t read any of their data. I’ll probably have to remove their hard drive and put it into one of my older PCs here as a slave and work on the drive by hand using another PC, as the data is basically toast at the moment. But thanks and no problem

EDIT: By the way, Adblock Plus here is in fact blocking some things on Stop the cap. Most notably, it’s some Massive News images which are a part of the theme in the Stop the cap Advert folder, and it’s also blocking some Google Analytics javascript files and something in the page header.

EDIT2: Chrome, Safari and Opera are all pretty secure with their most recent versions. You’re more likely to get infected on those browsers from downloading a tainted JavaScript file from an advertisement and having Internet explorer or Windows itself execute that or from Adobe Flash than you are from anything else really.

There’s also Chrome, Opera and Safari for Windows, but I can’t really speak to those.

I’m a risk taker though, I never shut off my computers much less unplug them during storms. Of course, I try to keep an offline back up of all my important files too so I can restore if need be. 1TB drives are fairly cheap these days.