It was probably inadvertantly installed by my client by clicking on one of thos warning boxes that splash up in some browser windows warning you you have an infected machine- the box looks very like a windows error but its actually not.

An article in PC Pro recently was saying this type of malware is serviced by Russian Mafia types as a way to effectively extort sums from web users by installing their dodgy AV software which then watches their internet history recoding Credit card numbers etc and relaying to the ” mother ship”.

The PC was installed with F Secure 2010 AV but the damage was done probably byt he client authorising the install unwittingly. F Secure could detect the system modification attempt by a service effectively a random string name. But it could not detect the virus it seemed nor stop its troublesome attempts to scare the user.

It did a number of bad things.

1) It kept warning that it had detected an intrusion attempt- funny as when I had the machine it was not even connected to the internet- worth a test if you ever see such a warning- disconnect and see if it persists. I always disconnect any infected machines when I am awar eof them and recommend you do too.

2)It kept flagging up spurious process crashes.

3) It disabled access to services.msc- the control panel services applet and taskmgr.exe (so you could neither id or disable it by conventional means)

4) Once you opened a IE8 browser window it went mental – constant alerts resulting in many red shields inthe system tray, and sometimes a Windows AV type window saying AntiSpyware Soft – click to purchase and enable- to sort tht eproblem. of course you would be mental to. It also sent the web browser to dodgy websites like p*rno.com and vi*gra.com (and probably others) Heightening the fear factor or the client!

5) I did a bit research onthe web (as you do and the best info i found was on www.spywareremove.com) It gae free, manual removal instructions which were spot on and worked a treat. I would say – you need to use Safe Mode to do the steps listed and be happy inthe registry. I found a couple of key s that differed from their instructions but they were easy to spot and I put it down to the variable behaviour of the malware)

6) With the files deleted its back t normal, but I have installed Google Chrome on the machine as its less susceptible to some of the aspects of such malware.

I got hold of a utility called ShellExView from Nirsoft which allows you to see which shell extensions are running on your platform and to selectively disable them. Be warned disable them one at a time and only those you suspect. If your not sure ask a PC savvy friend!

Anyway working chronologically backwards- ie newest first I noticed an Icon Handler extension supplied by Arachnoid Biometrics Identification Group Corp. Disabling this restored the icon function onthe start button.

Unfortunately I see no easy way to uninstall this as it has no entry in the Control Panel. Looks like a manual/ registry hack job for later.

I need to look into if there is a fix for this first though. Perhaps an updated driver for the Transcend USB stick.

My workstation runs Vista Home Premium. Now really  should have Vista Business but its a long story that I am not going to go into here why I have Home premium.

I do my backups two ways, I run Sync Toy every day to an external drive and I run Windows Vista Backup to an internal drive.

Following a recent crash with my Raid array (a striped set) I went to restore my user data from a back up. I was surprised to find that none of my files with php extensions were there.

Fortunately I had the copies from by Sync Toy images so I was OK but its worth stating that unless all your interested in is the back up of “personal” files- ie images, mp3s and common file extension docs like xls or doc files you cannot rely on the back up tool for Vista to save you. Somewhat oddly it does save html files- probably due to the fact that many programs can generate html files as an output format, that are not deemed as “professional” file types.

Be warned! 

1) First issue is if you try to install it anywhere but on a c: drive expect issues. The program does not appear on the start bar, the desktop or in the games explorer in Vista (32).

All these issues can be fixed by a c: drive install.

2) Once installed, don’t expect it to run easily- you start it from the Play button fired up from the DVD menu. Then it tells you to insert a valid disc in the drive! A work round for this is to run up the menu but don’t hit play, eject the dvd and insert dvd 2 inthe drive, this seems to then work oddly. However thats not a permanent fix.

The real fix for this is to install a Vist Hot fix available from the kaos website. However you need to install the 1.0.1 vista patch first and as the game won’t load you might be stuffed as it auto updates- though see bodge round in point one. The solution is to copy down the hotfix and the 1.0.1 patch to your PC as exe’s before installing the game- do a clean install then patch it then hotfix it.

This seems to sort all these issues out.

3) Finally if you have a Nvidia graphics card you may experience the game freezing every 20 seconds or so between bursts of running smoothly. As my sons PC is base don Nvidia GT8800 in SLI mode it might be an SLI problem only- I don’t know, however the fix for this is to grabe the Nvidia beta drivers for vista from the Nvidia website version 169.28

CHARLIE DON’T SURF

The TV station: When you get into the TV station figth your way through to the technical area, and enter into the main office. You only have a few seconds before the enemy arrives so turn immediately right and run right up the side to the end of the aisle, there is a cupboard with an open door- go in.

You can now fight from this angle, taking out the RPG on the balcony and numerous other enemies, you will be grenaded frequently but just keep lobbing them back. Eventually the shooting will quieten down and you can exit to take out the remaining bad guys. The rest is easy.

THE BOG

You can get pretty stuck here, however I played this different on Vet than I did on Regular, where from the wall I went left to the buildings and fought through to the AA gun. In vet, in the dark head to the wrecked car near the entry point and then over the berm on the right- edge your way along, shooting any obvious targets util you can see the AA gun behind the house. Shoot until you kill the gunner. Its quieter now so you will find locating and killing the bad guys dead easy and you can destroy the gun. The rest is pretty much as on easler settings.

ONE SHOT ONE KILL

The fair ground: Getting to the exfil point is hard but not impossible, however waiting for and then extracting to the Chinook is tough. Before droppin goff the injured officed at th epoint he asks you to, put him down and run round and put claymores round the perimeter of the ferris wheel area. Go move the officer to the location asked and he should give you more clays. Lay these round the dodgems on the right. Now go behind the dodgems and wait for the bad guys to arrive, make sur eyou have an automatic rifle of some sort as well as the sniper rifle.

Again grenades will come thick and fast keep lobbing them back, and you will get through. When the chopper arrives run for the officer- there are at least two bad guys who appear from the grass to get you – shoot them as you run . Once you have the officer, you need to be pretty unlucky to die so head straight for the chopper. This I reckon is the second hardest level in the game.

HEAT

This is a tough level on any difficulty, but like a lot in COD4, approach it latterly and sometimes a better way emerges.

At the farm where you have to hit the tanks with the Javelin, deal with the tanks then hea dover to the hut on the right. Enemies approach through the field in to the hut. Kill as many as you can and get out the door intot he field on the right- keep as far over right as you can. Call in an air strike on the main field to the front to let your team advance. At the back of the house, you will reach take out the enemies, and start calling in strikes , bring one in just below your position to hol doff nearby enemies then start bringing them in a down the hill to the left- you can call in multiple strikes. Strike heading down behind the wrecked cars over the road and all the time hitting the houses further down the hill. The secret is to keep going, time is against you but you will get check points if you go quickly, Near th chopper use a last strike then run for it, its actually quite easy when you get it right.

ALL IN

Entering the silo complex.

There are two easy routes in this level, the first, after meeting up with the snipers outside the base- head left away from where the battle is going on and where you can see the tanks. Follow the fence round left to find a pick up truck and a wall with a flashing C4 symbol on. Blow the wall after retreating tot he pick up- getting an RPG from the back. You can shoot the BMPs out from the pick up- much easier than C4′ing them.

Fight through to the inner compound where the Captian blows the fence. you are supposed to C4 the next two tanks or RPG them but finding RPGs is hard. Easier is to go back inside the outer compound and locate the building over looking the inner compound, near the rear of the gatehouse. head onto the roof, you will find a Javelin launcher- its easy from here!

NO FIGHTING IN THE WAR ROOM

This level is mental hard. Speed is everything, as you won’t get the checkpoints unless you are fast.

Drop through from vents and turn right into right corridor. Shoot the enemies ahead and flash the entry on the right. Head forward and watch for the bad guy coming fromt he kitchen store ahead- head through behind the kitchens. Shoot through the serving counters and grenade until shooting dies down. Head through for first check point at glass wall.

Round wall into corridor there are bad guys in the dark- be quick to shppt them out moving forward to a store room wher eit gets a bit messy but a grenade or two clears them out shooting the rest. Now your top of the stairs withthe big star, head down. As long as you are at no less than 7:20 you will checkpoint.

Reload, and flashbang right up the middle, two bad guys appear- ignore them and run as fast as you can- dodging side to side, wath on the right for a cut in with missiles in racks head in ther eand right again behind the crate. Start shooting at youre 11 o’clock taking out everyone that appears- at least four bad guys. Dodge out and take out a bad guy on the opposite side of the crate accross the corridor, if you don’t he will get you. The capt should have passed by now, throw a grenade to the 11 p’clock and as soon as it goes off run forward to the space beyond. Shoot any strays, and then run for the corridor right ahead , at this point sometimes you make it sometimes not, there are 2 bad giys in the corridor you need to run and shoot them. If you make it you will check point at about 6:20.

This bit is really hard- make sure you have the SOPFOR  and a shot gun, run forward reloading, Shoot into the corridor where the bad guy runs, whne he reappears on the right, take out a further 2 who appear on the left, there are two bodies behind you at the wall- collect more flash bangs while taking cover behind crates and reloading, the team will have caught up by now. Flash bang into the corridor and run forward tot eh right sid eof the blockade, ther eis a cut in, start taking out all the bad guys down the central corridor, use no grenades, shoot everyone all the way down. Now reload and prep ‘nade launcher. Come back to the cross roads of the first two silos. Stay the blockade side of the tunnels and grenade launch down the left hand tunnel (left coming from the way in- you can see down it if your careful) Fire twince ensuring you got the two bad guys int he silo. Now turn and fire down the other side , once ies enough if you did it right, run forward, about 3/4 way down a bad guy appears on left in thte silo- make sure you get him before he gets behind missile.

Run forward and flash into the next tunnel, then shoot any stunned bad guys, if you are fast there will be a near by guy and one at the far end, try shooting them both, swap to launcher and fire a grenade either side of the missile at the back. Ready the rifle again and edge forward, there is usually one guy who jumps out.

As you ente rthe second silo do the same again, flash shoot then from behind missile fire your launcher all the way up the tunnel, if your working fast, don’t get to oworried about time, allow yourself to recover from any injuries before exposing yourself to more fire. You will be about out of nades for the launcher by now so be ready to shoot any of the two or three remaining guys at the end of the tunnel. As soon as you do run forward, and the team will reappear as if by magic (great help they were) and you will get tot he door with about 2 mins 40 on the clock, two more checkpoints will be given. The rest is dead easy you just need to wait on the door opening, kill about 5 bad guys inside the room and blow the hole in the wall. I stopped the missiles with about 20 seconds spare.

My original plan was to load the game on to my sons PC- this is much higher spec than mine- and less critical should anything bad happen. This I did and the Single player game run beautifully- looks glorious with the high spec Graphics (Twin Nvidia 8800GTS’s in SLi mode).

However Multiplayer was dire- ping was at lowest over 100ms and often more so no good. This is because his machine is on a wireless bridge. It doe snot seem to affect a lot of games but COD4 was unplayable. On the few times I got it going though I was getting kicked around 60 seconds in by Punkbuster. The error was initially indicating PunkBuster was not responding to the server.

I did a bit googling and found out that there are many and various issues here.

First Firewall: If you run one- and you probably should then you need to ensure UDP port 28962 is open both ways. If you can’t do this as you don’t understand firewalls, you don’t have the rights or whatever- the only thing I can suggest is (assuming you can) disable any firewall to all traffic while playing COD4 online. On my machine I run FSecure 2007 and I had to set up a specific service rule for Punkbuster- allow all networks bothways, All IP addresses UDP Port 28962 in and out.

Next having sorted this the reachability kicks stopped and the Restriction Service Communications Failure: PnkBstrB.exe initialisation failed errors started.

I would love to say I totally got tot he bottom of this but probably haven’t- however I do have it working.

First of version control: the version that comes with COD4 is well out of date, its meant to update automatically when online, but then if your having network problems your going to be stuffed there I reckon. You can go to the Evenbalance website and download PBSVC to install the service properly (you need to be running this as admin in Vista- right click the icon and select run as admin).

Next there is an updater which ensures you have the right versions for your game. You can download PBSETUP here. Its worth running this even if you think your installed OK because it runs through a test that dumps to your screen and lets you see any obvious issues.

Run this , select COD4 and let it do its thing- takes about 60 seconds to complete. You could if you like now try your game but I suspect you will be unsuccessful.

You probably are not aware (or maybe you are- so why read this!) but when PunkBuster installs the executables for the services reside in C:\windows\system32 (PnkBstrA.exe and PnkBstrB.exe). The former appears to be a resident service that runs all the time in your machine once its installed. The latter is initalised by the game, which in turn is detected by the former- ie, A detects the game is starting and kicks B into life. You can see PnkBstrA running as a service if you go into Control Panel/Admin tools/Services and list them alphabetically- it should be running. If its not investigate why- check the properties and ensure its running with high enough privileges, it needs admin rights. If it snot use the “log in as” tab and set it to run under an admin account.

Also there are potentially compatibility issues. You can try these- I did on the way to getting things working but have since turned them off. Righclick on your icon for COD4 Multiplayer and in the properties option, select the Compatibility Windows XP service Pack 2 Option. Also select Run as administrator in the check box at the bottom.

Do the same for PnkBstrA and PnkBstrB in your windows\system32 directory. Now as I say I have since turned off the Windows XP setting but you DO need to leave the run as admin in place. According to the Punkbuster FAQ at Evenbalance.com this is not necessary. Well I would dispute this as if I set mine back to run normally I get the error back within 60 seconds of starting a game.

Its worth playing around with these settings but just change one thing at a time to ensure you know whats having an affect.

Another factor in the problem I discovered is that in C:\windows\system32\logfiles\PunkBuster there are service logs- for the kernel, and services a and b. I found when i was getting the init error the logs were populated with the following:

[01.12.2008 21:50:34] ERROR: File “C:\Program Files\Activision\Call of Duty 4 – Modern Warfare\pb\PnkBstrB.exe” does not exist.

[01.12.2008 21:50:34] ERROR: C:\Program Files\Activision\Call of Duty 4 – Modern Warfare\pb\PnkBstrB.exe does not contain a valid certificate; Load denied.
[01.12.2008 21:50:39] ERROR: Ignoring load request coming within a few seconds of prior load

The first error seems to suggest a missing file in the COD game – and indeed it did not exist but how it gets there looks to be down to the game running under admin privs. Its not as far as I can tell just a matter of copying the file there are there appear to be other files spawned here too. Again- don’t be afraid to try at worst you can delete them again! The second error appears to indicate a security issue. You can see the certificates associated withthe programs in the Security tab in the file properties- both seem OK, again it appears to be an admin rights thing.

Having tried this the game appears to run OK, however on my first session of about 30 minutes I suffered a total hang of my PC which takes me back to my opening lines that I probably should not run this on this PC, as I ended up having to hard reset it. This is the first total hang/crash I have had under Vista I have to say. Tomorrow, armed with this info I am going to tackle my sons machine again so at least it does not get the Punk Buster Issues, the high ping will be solved when I get some Ethernet over Mains adapters this week.

Hopefully this helps someone else in a similar situation.

Anyway the deed was done and I waited it rebooting but it never. I simply kept going so far through the reboot and then restarting again. I tried evrything I know including adding a spare hard drive tot he system, loading an OS onto it and simply treating my main partition as a spare drive so I coul dget data off. But the main partition (SATA RAID based) kept showing an IO error and any attmpts to examine it from Windows Set up resulted in a BSOD saying error in ntfs.sys.

I tried a CHKDSK from Windows boot up from the spare disk, and this basically found my main RAID partition destroyed.

Fortunately I have a external Hard drive I use to run backups on and this has about 98% or my work on, up to about a week back.

So I decided to do a format and clean install. The Disk array came up fine though all my data is gone. I have also tried a clean boot of Vista on it and this went well- see other post as there is a way round the RAID driver issues.

So I have decided to do a full clean install onto Vista thus getting me back working with a swanky new interface. I have been using Vista quite a bit on my laptop but really want to get using it now so having a disaster like this is as good a time as any.

I am currently restoring data and programs, so if you are waiting on work from me , be aware I might be a bit delayed. My biggest problem is probably that I have lost all my email data., hopefully I should be back fully operational by the end of the weekend, hopefully with a slightly quicker PC seeing its now freshly rebuilt.

I also took the opportunity to install a spare 500Gig SATA disk as a system backup volume so I can use this to replicate my data to on a scheduled basis.

 Worm Detected!
[UNABLE TO SCAN] Worm Detected!
[WARNING - ENCRYPTED ATTACHMENT NOT VIRUS SCANNED] Virus Alert!
[WARNING - ENCRYPTED ATTACHMENT NOT VIRUS SCANNED] Worm Detected!
Worm Detected!
Undeliverable: Virus Det
[ATTENTION - NON TRAIT? PAR ANTIVIRUS -- WARNING - NOT VIRUS SCANNED]%s
Virus Detected!ected!
Virus Activity Detected!
Halleynet Web Media recommend you never access the internet without anti virus protection and not to use Auto Preview in Email clients. Read more on Symantecs website.