Eric TheTechGuy

Thursday, July 28, 2011

Office 2007 downloads

If you have your key but not your disk these links are for you:

Microsoft Office Professional 2007
http://msft-dnl.digitalrivercontent.net/msoffice/pub/X12-30196/X12-30196.exe
Microsoft Office Small Business 2007
http://msft-dnl.digitalrivercontent.net/msoffice/pub/X12-30283/X12-30283.exe
Microsoft Office Standard 2007
http://msft-dnl.digitalrivercontent.net/msoffice/pub/X12-30263/X12-30263.exe
Microsoft Office Home & Student 2007
http://msft-dnl.digitalrivercontent.net/msoffice/pub/X12-30107/X12-30107.exe
Microsoft Office Ultimate 2007
http://msft-dnl.digitalrivercontent.net/msoffice/pub/X12-30307/X12-30307.exe

Tuesday, June 28, 2011

Microsoft office 2010 downloads

Monday, June 13, 2011

.Exe files open the "Open With" dialog box

This is a common problem seen after removing some viruses.
The virus inserts itself into the registry as the default file handler
for .exe files.

Some people may recommend using system restore to revert
the registry to a date before the infection happened, but
you may not have a restore point that works, and you may
not know when you got infected (some malware will infect
then wait before becoming active).

I usually try to remove the problem manually first.

This usually requires some registry editing, but the default
registry editor is also an .exe file.

The work around I use is to open a command prompt using
command.com (instead of cmd.exe), then changing to the
windows directory, copying regedit.exe to regedit.com,
then running regedit.com.

I prefer to do this in "safe mode" as it prevents some other
annoyances associated with some malware that is not fully
removed. (press f8 when starting up, choose "safe mode" from
the menu that appears, and if the login screen appears choose
the infected user profile).

So in XP goto the start button, choose run, then type
command.com.

In vista/7 the start orb (usually the bottom left corner
of your screen), and type command.com.

In the black window that opens type the following:

cd /
cd windows
copy regedit.exe regedit.com
regedit.com

This should open the regedit program.
Search for the infected file name that was removed and
fix the registry keys that were modified. If you dont know
what the file name is, you can check the following key
and try to get the file name from it:
HKEY_CLASSES_ROOT\exefile\shell\open\command
The value should be:

"%1\" %*

but the virus may change it to be:

virusname.exe "%1\" %*

so you can search for the virusname.exe (or whatever
the virus was calling itself).

You can also try to download the .reg fix and import it.
The fix will be a text file with a .reg file extension
and the XP version looks like this if you open it in notepad:

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"
[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"
[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"
[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"
[HKEY_CLASSES_ROOT\exefile\shell]
[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
[HKEY_CLASSES_ROOT\exefile\shell\runas]
[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"
[HKEY_CLASSES_ROOT\exefile\shellex]
[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"

You can cut and paste the above code and save it as XP_exe_fix.reg and use that
by going to file then import in the regedit program.

Another method (for XP) is to recreate the file type using windows explorer.
Open the File Types dialog box from Windows Explorer, My Documents or My
Computer by selecting Tools -> Folder Options -> File Types.
Click on the New button and the Create New Extension window will open up
Next, click on the Advanced button.
Type in EXE for the extension and select Application from the drop down
list if it doesn’t appear automatically.
Click OK and reboot the machine.

Sunday, June 5, 2011

How home users can (possibly) remove malicious software

Malware is a generic term describing spyware, worms, viruses, trojans, adware, keystroke loggers, homepage hijackers, search engine redirectors, and anything else that may have been installed by deceptive means.

I could try to make a comprehensive guide on how to remove malware, but there are several already out there that are better supported than I could ever do myself.

Two of the best ones I have found are combofix and MalwareBytes antimalware

Combofix is quick and easy to use, typically taking about 10 minutes and sometimes gets the job done where others fail. It can be found here:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

The guide there is comprehensive and is a good first step.

The biggest weakness of combofix (and ironically not really their fault) is that some antiviruses will block some of their processes. One antivirus in particular is so bad that combofix will refuse to run until it is uninstalled.

I also tries to install the recovery console as a bootup option, which will be helpful if the virus (or its removal) makes any bootup problems.

They have forums to analyze the final logs, but unless you want to spend a lot of time and effort I would suggest holding onto it for now.

Next is MalwareBytes antimalware. (I suggest the free version):

http://www.malwarebytes.org/products/malwarebytes_free

Install it, update it, run a scan.

Remove everything it detects (this may disable software that requires advertising to run, but you can reinstall those items if you still need them later).

Their forum has better instructions for it here:

http://forums.malwarebytes.org/index.php?showtopic=69723

And they also tell you how to run several other scanners, install and use a free antivirus, and post to their forums if it didn't all get removed.

What if I can't get on the internet?

Get a thumbdrive, usb memory stick, flashcard, sd card, blank cd, etc. and take it to a computer that can get on the internet, download the software, and bring it back to the infected computer to run.

What if it doesn't work?

If you have more time than money, check out the forums and tutorials at Malwarebytes. You can start with the forum link above (http://forums.malwarebytes.org/index.php?showtopic=69723).

Otherwise I suggest taking it into a repair shop.

What if my computer will not boot at all or will not let me run any software (because of a virus)?

I suggest getting an antivirus boot disk (several antivirus vendors have one).

I recommend using one from a vendor you recognize. Here are links to some I have used in the past:

http://www.avg.com/ww-en/avg-rescue-cd

http://www.f-secure.com/en_EMEA-Labs/security-threats/tools/rescue-cd

http://www.avira.com/en/support-download-avira-antivir-rescue-system

What if my files are missing (because of the virus)?

The malware may have hidden your files. Try this page to view hidden files:

http://www.bleepingcomputer.com/tutorials/tutorial62.html

once you can see them you can right-click on them, go to properties on the drop-down menu, and un-check the hide box selection.

p.s. I am not a paid advertiser for any products listed above nor do I have any association with them. They are just tools I have used in the past that have worked for me.