The Apheus Blog

In the course of browsing the internet, you will eventually come across a website that has been infected by some sort of malicious code – trojan viruses, malware, adware, or fake antivirus programs. Collectively, we’ll call these pesky little programs badware. Most modern web browsers have the ability to detect or prevent you from getting infected with badware. Spotting badware before it gets on your computer can be tough, but you need to be aware and practice safe web browsing.

An Innocent Looking Link

This morning, I was searching Google for some information on the typical dimensions for an elevator. So, as most of you do, I loaded up Firefox, typed my search terms into Google and was presented with a long series of links on the subject. I clicked on the first link presented on the search engine results page and then it happened – I was redirected to a badware site. Obviously the website I was trying to access had been compromised and was serving up some bad stuff. The webpage proceeded to load several thing in my web browser and finally came up with something that looked like this:

At first glance, you might think that this is a standard Windows XP window that is relaying some very important information about your computer. It appears to go through a super-fast scan of your hard drive and then comes up with a results list of infections that includes Banker.MGB, Trojan.DownLoad.37236, Win32.HLLM.Netsky.35328, Trojan.GootKit, and Nuwar.GDM. Those all sound and look pretty scare when you see that they have high or even critical threat levels.

But there are several problems with this window and I was able to spot the badware rather easily:

• The image shown is for Windows XP – I’m running Windows 7.
• I have six drives connected to my PC – this scan only shows one.
• I never requested a scan – the browser was redirected.

Just these few things should be enough to set off the warning bells in your head. Badware is tricky and they will do anything to get you to download their software.

Don’t Load the Badware!

The fact is that the results shown on the screen are there to scare you. I cannot stress this next statement enough:

Whatever you do, don’t load the badware!

Most badware gets onto a computer through a user-initiated response. That means that the user actually allows the badware to get onto their computer system, usually by downloading the badware or clicking a button that they shouldn’t. Many websites infected with badware trick the user into downloading the software and once you get it on your computer, its usually very difficult to get rid of it.

When you try to navigate away from the badware website, you may see boxes like those shown below. Whatever you do, don’t click on the “Save File” or “OK” buttons. I don’t even trust the “Cancel” button, so I always click the X in the upper right corner just to be sure. In the first box, the infected website is trying to download something called packupdate107_2124.exe. While that may sound official, it most certainly is not.

Escaping the Badware

If you have been redirected to a website infected with badware, there are several things that you can do to prevent the badware from installing on your computer. Most of the time, the infected website will try to “lock” you in with an impossible loop of clicks that won’t allow you to leave. Short of simply unplugging the computer from the wall, there are some steps you can take to break the loop and keep the badware from downloading onto your computer:

1. In Firefox, go to the File menu and click “Work Offline.” This will prevent Firefox from reloading the websites you currently have open, including the badware site.
2. We need to forcibly quite Firefox, so press CTRL+ALT+DELETE on your keyboard to bring up the task manager.
3. Find the instance of Firefox running in the list, click on it once to highlight it.
4. Click the “End Task” button and a confirmation window will appear.
5. Click the “End Now” button and Firefox will be shut down.

Once you’ve shut down Firefox, you have effectively prevented the badware from downloading. Now you have to prevent Firefox from reloading the same window and taking you back to the website where the badware is located. When you restart Firefox, the “Well, this is embarrassing” screen will appear with a list of tabs you had open at the time Firefox was shut down. You have two choices: you can either unselect the badware site or you start a new session and remove it from the restart list or you can start a new browsing session. I prefer to start a new session, so I recommend that you click the “Start New Session” button.

Removing Badware

If you made a mistake and you actually downloaded the badware thinking that you had a virus when you really didn’t, then you may have a bigger problem. If you have antivirus software on your computer, hopefully it will catch it. If it doesn’t then there are several programs available to help you get rid of the badware. I recommend the following programs to help prevent badware and remove it from your computer:

• AVG Free Antivirus
• Spybot Search & Destroy
• Malwarebytes
• ZoneAlarm Firewall
• CCleaner

If none of these programs work to get rid of the badware, then I recommend that you consult your local computer expert and they will be able to assist you.

For whatever reason, the fine people at Firefox have decided to remove the “Properties” menu item from the right-click menu of their latest version 3.6. Maybe I use the Properties menu a little more than the average person, but I just had to have this feature back

The Properties menu gives you access to all kinds of important details about various elements on a webpage. For example, if you right click on image and choose “Properties” you can view the ALT text of the image, its file location, image dimensions, and more.

As a web designer, I use the Properties menu quite frequently to examine various webpage elements. Fortunately, somebody came up with a handy add-on that puts the Properties menu back in the right-click menu.

I must say that I’m slightly disappointed in Grisoft – the makers of AVG antivirus software. I’ve successfully used the free version of their software for several years and have praised their product, turning many free versions into paid versions for them. But recently, I have to question: what is going on with AVG updates? The last two major automatic updates have caused major problems with my computer system at home. Basically, AVG updated itself in the wee hours of the morning and afterwards I was unable to access the internet or my POP email. What a drag!

I’m not the only person experiencing this problem. Many people I know personally that use AVG have had the same problem. A quick search of various AVG forums reveals that this is definitely not an isolated incident. The solution to the problem:

1. Completely uninstall AVG.
2. Download the latest version.
3. Install the new version.

I realize that the free version of AVG doesn’t come with any warranties, but come on! Since I updated to AVG 9, I’ve experienced several update issues. Back in the old days of version 7, we had trouble just getting the software to update itself automatically, now this? It doesn’t instill much confidence in an otherwise very good product. I’ll continue to use AVG and I will continue to recommend it to friends and family, but I will be keeping my eye out for another free antivirus program. Sorry, AVG…

It’s just one of those little things that most people don’t normally notice. When your computer starts up, you will probably recognize the familiar Windows start up sounds. But, did you know that those little beeps when you first push the power button actually mean something?

When your computer performs a power on self test (POST), it basically runs a short diagnostic to make sure that everything it needs to run is present and functioning correctly. Most computers will start up with no beeps or a single beep, giving you the satisfaction in knowing that your computer is functioning and has just passed its POST (depending upon your BIOS, you may get a different set of beeps).

But what happens if your computer doesn’t pass its POST? Well, your BIOS is setup to help you isolate the source of the hardware problem with a series of short and long beeps, which are known as beep codes. Different BIOS manufacturers have different beep codes, so you’ll have to first determine what type of BIOS you have on your mainboard. The most common types are AMI, Award, and Phoenix.

If you get a strange set of beep codes, then you are going to want to write them down and call your preferred computer technician. It helps computer techs to know what the problem is when you call them up rather than just saying, “my computer won’t start.” Press the power button and wait for the mainboard to sound off. Some mainboards are very quick, so an extra set of ears may be helpful in counting the beeps, especially if there are a lot of them. Write them all down, using dots and dashes – kind of like Morse code for your computer. Long beeps get a dash while short beeps get a dot. All of this information is extremely helpful to your computer technician. He’ll probably want to confirm the beep codes himself when he visits, so don’t be offended.

You can look up the BIOS beep codes yourself by looking at the charts below or call your IT guy. He’ll be able to decode the dots and dashes and tell you what may be the problem. Multiple problems can sometimes be difficult to diagnose, so while these charts have been setup to be a general troubleshooting guide, they should not be considered accurate for all problems in every situation.

AMI BIOS Beep Codes

Award BIOS Beep Codes

Phoenix Beep Codes

Phoenix BIOS beep codes are a series of beeps followed by a pause, then another series of beeps. In the chart below, the pauses are indicated by a dash (-) and the number represents the number of beeps. The following Phoenix BIOS beep codes are for version 4 or greater. Please note that many of these beep codes (in addition to the problem indicated) may also indicate a general mainboard failure or a problem that isn’t even listed.

Most IT guys take pride in being able to fix any computer problem that may crop up over time. But sometimes you run across that one little problem that doesn’t seem to have a real solution, no matter how hard you try. Such was my luck today. My Achilles’ heel for the day was an eMachines W3611 with an Intel 945G chipset on the mainboard. What was irritating was the fact that the when I first got my hands on this computer, it booted directly into Windows Vista without any trouble. I gave the computer back to the client and said, “I can’t find anything wrong.” But something most definitely was wrong. After about an hour, the client brought the computer back, but this time with all of the symptoms (the same symptoms I hadn’t been able to duplicate before). This time I was able to see the problem first hand.

The computer would POST then immediately go to the BIOS settings screen. Normally, you have to hit F2 or some other function button in order to gain access to the BIOS at start up, but not in this case. When you exited out of the BIOS screen (either saving or not saving the settings) it would immediately take you to a black screen that said Turn power off and reinstall the jumper in Normal mode position. Well, Mister Jumper – that sounds like an easy fix. The only problem was that the jumper to clear the CMOS was already in the correct place (between pins 1 & 2). After doing a great deal of tinkering with the jumper setting, CMOS, components, battery, etc. – I was stumped. Everything on the computer seemed to work fine, except for the same darned error that popped up every time the computer powered on. Again, this was very irritating since the computer started up fine for me when I first looked at it.

I’ve worked with a lot of computers over the years – some well maintained, but most of them in horrible condition. This computer was actually in pretty good shape with no visible problems. I pondered the problem for several hours and began pouring over the online computer help forums.

Generally, when you can’t figure something out on your own, a quick Google search will reveal that hidden answer. To my surprise, the forums were absolutely useless! In fact, most of the answers pointed to the a little yellow jumper. Well, I can tell you that the little yellow jumper wasn’t the problem. Something else was going on, but do you think the forums were any help? Of course not – they just made me realize that there are a large number of people who post to the forums that are condescending, rude, and incapable of admitting that they don’t know the answer to a problem. Well, not wanting to be one of those people I just described, I’ll admit when I’m beat! I don’t know what is causing this problem other than most likely there is an error with the Intel mainboard.

I even contacted a friend of mine who works in the IT field and he also pointed to the possibility of a faulty mainboard. While I would like to say I can fix almost any computer problem, I have to admit when I’m beat. In this case, I have to chalk it up to hardware failure until I can determine “if” there is another solution. It’s never easy to tell someone that their computer has died, and this case will be no different. You can’t win ‘em all…

I recently ran across a problem with the DNS from my ISP. One of my clients moved their main website from one server to another and I waited for the DNS to propagate. And I waited and waited and waited some more. After four days, I was starting to get worried. Generally, the rule of thumb is that it takes a maximum of 48-72 hours for a domain name to become fully propagated across the various domain nameservers (DNS) on the internet. I contacted my ISP and they resolved the issue, but I was still bothered by the wait time and I know other people in the world must have experienced the same issue at one point or another. That’s when I decided to look into this whole DNS issue with my ISP. Let’s be honest – most people don’t care whether or not their using their ISP’s DNS or not. And probably 99.9% of the people out on the internet don’t even know what a domain nameserver is or does. I happen to be in that .1% that does know and care.

I work with a lot of websites and pointing domains from one server to another is a pretty common practice. I know from past experience that after pointing a domain to a new server, it’s often available within four or five hours. Because I’m in the website design and development business, getting an updated DNS is very important to minimize downtime when moving websites. So I started looking into the problem and the solution was much easier than I had anticipated – use a third party DNS! I started looking around and I found that there were two services out there that could really help me out. One was OpenDNS and the other was Google Public DNS. Both services are free, so I decided to try them out and compare them to my ISP.

The first service I tried was OpenDNS. I was a little confused when I first signed up for the OpenDNS Basic, but I quickly found that they offer a huge number of features that could be very useful. OpenDNS Basic has content filtering, phishing protection, botnet protection, stats, logs, shortcuts, and more. With all those features, I was impressed. With OpenDNS, you gain additional protection from problem websites, which is always a good thing. I think they’ve done an excellent job of creating a service that many people can really enjoy having – especially with that zero dollars price tag. The only problem I had is that I thought my computer was slightly slower when “looking up” websites. Perhaps it was just my imagination, but I’ll get to the DNS speed test results later.

My next test was with Google Public DNS. Google apparently launched the service in December 2009, but I hadn’t heard about it until I started looking into it. You don’t have to sign up for anything at Google, you just plug in your numbers and away you go. There are no fancy features like you’ll find with OpenDNS and that may appeal to some people. Again, Google Public DNS doesn’t cost anything, so that is always a pleasing feature. Beyond that, everything is no-frills. The Google DNS seemed to function without any problems, although it seemed to be a little slower than what I was used to.

I decided to test the speed differences between my ISP’s DNS, OpenDNS, and Google Public DNS using a program called namebench and another program called DNS Benchmark. Depending upon the time of day, configuration of the test, and the program used, my ISP generally beat OpenDNS and Google in response times.

Just from experience, I knew that my ISP was slighter faster than either of the other nameserver services. However, since my primary concern is with how often the DNS is updated, I needed to do a little more research. Each nameserver has its own update frequency specified by the person who installed the DNS and the Time to Live or TTL settings. While I don’t know the exact interval my ISP updates their nameservers, I do know from experience that it can sometimes take several days to resolve a proper domain. Again, since I frequently move websites from one server to another, I need quicker access.

OpenDNS seems to resolve their DNS’s rather frequently and they also have a neat tool called CacheCheck that can actually force them to update their DNS before the TTL expires. That is a really neat feature! I couldn’t find any information on how often Google updates their cache, but I’ve seen reports on the internet that they take slightly longer than OpenDNS. From what I can tell, OpenDNS and Google Public DNS refresh their caches far more frequently than my ISP.

So what am I to do? My ISP is definitely faster, and many other testers have discovered the same results. However, I need a DNS that resolves a recently moved website more quickly than my current ISP. Based upon my own DNS performance tests and the features benefits, I’m going with OpenDNS. If I decide later that I don’t like the service, then I always have the option of switching back to my ISP or choosing Google instead. Right now, I think I’ve made the right decision.

A friend of mine brought over his aunt’s computer not too long ago (running Windows XP Professional). She was complaining about various virus-related problems and not being able to browse the internet because of popup windows. The first thing I noticed when I booted the computer was that her desktop icons were split in half and flipped. Strange, but not entirely unexpected on a computer heavily infected with malware. The icons kind of looked like this:

After I cleaned up her virus problem, I went ahead and looked for a quick fix for this problem. I was surprised at how quick the fix actually was! Microsoft has a tutorial on how to rebuild the icon cache, but as with most tutorials, there are lots of small steps. Basically, here’s what you need to do:

1. Right-click on the desktop and choose “Properties.”
2. Click on the “Settings” tab and find the “Color Quality” menu (see below).
3. Choose the 16-bit setting and click “Apply.” (Accept any changes that may appear.)
4. Change the color quality back to 32-bit and click “Apply” again. (Again, accept any changes that may appear.)
5. Click “OK” to exit from the Display Settings and you should be done!

Those steps worked like a charm to restore the desktop icons back to normal on that particular computer. However, when dealing with any computer, your results may vary.

If you’re like me, then you use social networking websites to keep in touch with your friends and family. My favorite is Facebook – that was until recently. For some reason, whenever someone started to chat with me, the browser window would “steal focus.” Well, even though I enjoy chatting with people, I want to do it my terms – meaning I’ll look at the chat window when I get a chance – not when Facebook wants me to. I experienced this problem many times while running Firefox and today, enough was enough! I started looking into the problem and discovered that I was not the only one who had experienced this problem. Fortunately, someone else had already come up with the answer – turn off the Facebook chat sound – a simple, yet effective solution. Here’s how you do it:

1. Log into Facebook.
2. Go to any page on Facebook and find the chat menu in the lower right-hand corner.
3. Open the chat menu and find the Options button.
4. Click on the Options button and uncheck the box “Play sound for new messages.”

While I prefer to have the sound enabled in Facebook chat, the stolen focus problem was just too much to bear any longer. Hopefully, Firefox or Facebook will fix the problem in the near future, but until then, this workaround is the way to go!

Check out the YouTube video I made about this subject:

For no apparent reason, I could no longer login to my IM programs such as MSN Live Messenger or Yahoo Messenger. I looked into all of the ususal suspects (malware infections, firewall issues, my ISP, etc.) but I couldn’t quite put my finger on the problem until I did a search for “Netgear MSN problems” on Google. I quickly realized that it was my router most likely the culprit. I purchased a new Netgear WGR614 Wireless-G Router a couple of months back and everything seemed to be working fine up until recently. I have all of the latest firmware upgrades and nothing has changed on the router since I installed it. My IM programs had previously worked using this router, but for some reason I suddenly had a problem.

My Yahoo just wouldn’t connect at all – the program would sit idle and act like it was connecting, but wouldn’t. MSN would at least give me an error message (that sometimes changed), but the message proved to be almost useless. When I tried to diagnose the connection problem with MSN Live Messenger’s connection troubleshooter, it would say that there wasn’t a problem!

Apparently a Common Problem

After doing my search on Google, it became quite apparent that this is a common problem among people using all different types of Netgear routers, not just the WGR614 like I have. I browsed the forums and could the feel the anguish of other Netgear owners who simply couldn’t find a good solution to the problem. I felt their pain, but continued to trek on to find the solution – after all, I use my instant messenger programs to communicate with my clients, friends, and family – so it was imperative that I get this problem fixed!

The Solution to the Netgear Problem

After reading through several wise suggestions, I finally came up with a solution that worked for my Netgear router problem:

1. Open a browser window and type the IP address of your Netgear router into the URL bar (my router’s IP address is 192.168.1.1). Don’t enter a “www” or anything like that, just type in the numbers.
2. Enter your username and password information when prompted to access your router settings.
3. Select WAN Setup in the left-hand column under the Advanced section.
4. Find the MTU Size option and change the value to 1400.
5. Click the Apply button.
6. Restart your router.

Test the Results

After you restart your Netgear router, open up one of your instant messenger programs (such as MSN) and hopefully everything will now work. The solution was much simpler than I had expected but it did work for me. I can’t guarantee that these same steps will work on every Netgear router, but its a step in the right direction. If this doesn’t solve your problem, click on one of the links below for more help:

• Netgear IM Problem
• Netgear Yahoo Problem
• Netgear MSN Problem

Occassionally, I’ll run across a virus that takes away some or all of your admistrative rights on a Windows XP machine. Not only is it frustrating for the end user, but its frustrating for me as well. Recenently, I customer brought in a computer with several problems, the majority of which were caused by viruses, spyware, and adware programs.

General practice for me is to first check the Windows registry with a “regedit” from the Run option under the Windows Start button to see what I’m dealing with. On this computer, I couldn’t access the registry and got this error instead: “Registry editing has been disabled by your administrator”. Needless to say, I hate when that happens. Fortunately, it’s a pretty fast and simple fix.

How to Enable the Registry Editor

To enable your registry editor after its been shut down by a malware program, follow these simple steps:

1. Click on the Windows Start button.
2. Select the “Run” menu item.
3. Type the following string into the box:
   REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
4. Click the “OK” button and you’re done!

You should now be able to access your registry editor.