Lexington Computer Repair Blog

I talked a customer into upgrading her Dell 1525 to Windows 7 64-bit instead of the 32-bit version yesterday. It’s not that I think the 64-bit version is vastly superior, but it does offer some protection from viruses to I think it is worth considering. The upgrade went fine, between the install disc and Windows Update the machine found all but one of the drivers it needed to run. The one remaining driver just complains about “Base System Device”, as usual, not a very helpful message to figure out what is missing. As it turns out, and as usual, it is the memory card reader that is missing a driver.

Dell’s site does not even list any 64-bit drivers (Windows 7 or Vista) for this machine, but you can download the proper Ricoh diver here. After runnning this, you’ll have all your devices and 64-bit drivers.

There are a lot of reasons (apparently) that Windows 7 might not resume from standby. Here is a fix to try but probably only if you are desperate and have these exact symptoms.

My customer brought in a Lenovo X200 laptop, a very nice laptop indeed, that would not boot. In fact after turning on the computer, the dash lights would like but the display would not even flicker, it was completely dead. If it weren’t for the fact that the computer wasn’t booting (and the customer insisted it had not been immersed in water) I would have thought the display had gone bad. However, I knew it wasn’t just a display problem because if it had been a) the machine would have continued to boot and b) we would have been able to see something by connecting an external monitor.

Interestingly, if I removed all the RAM, the machine would provide the beep codes associated with, “Hey stupid, you’ve removed all the RAM”. Replacing one stick at a time did not fix the problem, replace the HDD did not fix the problem. The machine does not have an internal CD, but if it did, replacing it would not have helped.

So, here is a summary of the symptoms:

• Black screen, no flicker or change in state
• Dash lights light but HDD light does not show sustained activity
• Bluetooth light illuminates and stays lit
• No POST
• No BIOS screen
• No beep codes (unless all RAM is removed)
• Same result with battery in and out

This looked like a dead system board and that’s what the repair manual indicated as well. But as it turns out, it was just a hosed CMOS. On this particular machine, the only way to reset the CMOS (that I could find) was to partly disassemble the computer, unplug the CMOS battery then put everything back together. Many machines have a simpler method that can be done using the power button (that did not work on this machine) or some other key combination. If you have a different machine, Google for “CMOS reset” and the model of your computer and you should find a way to do this.

As anyone who has had this problem and consulted Google can attest, there are a lot of reasons why a PC may boot to a black screen with a blinking cursor. I have a list of 15 fixes that I use when I get a Vista computer with this problem (I’ll publish it some day). I recently wrote a post about  solving the blinking cursor problem in Windows 7 and wanted to follow it up with another solution that is pretty simple to implement and worth trying if you have this problem in XP, Vista or Windows 7.

This morning I was testing a composite video to USB connector on my Windows XP laptop. I needed to copy some files from a USB thumb drive over to the laptop. I rebooted the machine after installing the drivers and accidently left the USB thumb drive connected. Normally this wouldn’t be a problem but this particular thumb drive is a boot drive for Ubuntu Linux and so my machine accidentally booted into that instead of back into XP. To make a long story short, I got impatient with the shut-down process in Ubuntu and hit the power switch before it was completely shut down. The result was that my trusty Thinkpad would no longer boot, it just sat there with a blinking cursor. I got a similar result trying to boot to Safe Mode.

OK, I admit that a little panic set in as I thought about all the un-backed-up pictures of my daughter on that drive, but I kept my cool (I ain’t no fool), let me tell you what happened then. I removed the drive from the laptop and attached it to a SATA-to-USB cable and connected to my Windows 7 machine and ran a CHKDSK on the drive. Sure enough, that was the problem, CHKDSK found a few errors in the file system, fixed them and upon reinsertion, the drive booted like a champ.

Conclusion: Quite often you can start to solve a compound problem by doing a CHKDSK on your boot drive. If your PC has recently had a BSOD or shut down abruptly, and then subsequently will not boot, it may have hosed the file system, run a CHKDSK. You don’t even have to take the disk out of the machine the way that I did to accomplish this. You can use your Windows XP installation disk to boot to the Recovery Console and run a CHKDSK from there. Vista and Windows 7 installation DVD let you boot to a pretty nice set of tools that allow you to open a recovery window as well (just open a Command Prompt). Just put your installation disc in the drive and turn on the computer, you might have to hit F12 to get the boot menu to force it to boot from the CD/DVD player.

Microsoft has recently introduced their latest iteration of virus protection called Microsoft Security Essentials (MSE). I have read reports, largely anecdotal, that it is a pretty good product and in fact it has got good ratings for its virus removal ability (NOT necessarily detection) from AV-Comparatives. I have been a fan of Avira Anti-Vir for some time now based both on their excellent independent test results and my own experience with cleaning up customers’ PCs. I expect I will continue to use Avira, but I’m having second thoughts about installing it on customer machines. The problem is that Avira has this nagware component on their free version. The nagware pops up every day suggesting that you buy the product, this is OK as far as I’m concerned but I believe that naive users may not be able to quickly distinguish between this legitimate advert and a pop-up for one of the nasty Fake Anti-virus products.

Yesterday I had a customer bring me a laptop infected with a very recent and particularly nasty set of viruses. The viruses prevented installation and/or execution of all of the key malware removal tools (for example, I installed Malwarebytes and while it was getting ready to run, the viruse(s) killed it and rendered it thereafter unusable – impressive). In addition, Task Manager was disable and Safe Mode disable (by BSOD).

I always start a virus removal by making an image of the drive I will be working on. That image can be mounted on my computer just as if the original drive was attached. I decided to use this image as a test to see what MSE would find on it compared to Avira and thereby get a datapoint for myself on just how good MSE is compared to what I consider the best antivirus program available.

Test Environment

The scans were run on a machine that dual boots between Windows 7 and Windows XP Pro. I have a licensed version of Avira AntiVir on the Windows 7 drive and MSE loaded on the XP Drive. I use ShadowProtect Desktop from StorageCraft Technology for imaging drives. The Avira scans were run with virus definitions from 3 November and the MSE using definitions from 4 November. The initial infection of the drive was reported to have occurred on 2 November with the machine having around 3 minutes of internet access on 3 November.

Baseline – Avira

During its scan, Avira identified 19 instances of malware, they were:

• TR/Agent AH.313 Trojan x2
• TR/FraudPack.yox Trojan x4
• TR/Crypt.ZPACK.Gen Trojan x3
• TR/Crypt.XPACK.Gen Trojan
• TR/Agent.AH.312 Trojan
• ADSPY/Wheatesbug.A adware
• TR/Agent.AH.337 Trojan x2
• TR/Agent.AH.319 Trojan
• TR/Crypt.ZPACK.Gen Trojan
• TR/Agent.AH.308 Trojan
• TR/Agent.AH.310 Trojan

Microsoft Security Essentials

Initially, I installed MSE on a laptop that is on the same network where the infected image resides. I then shared the image, gave the share a drive letter on the laptop and told MSE to do a custom scan on that drive letter. The scan ran for about 15 minutes and found nothing, zero, zilch, nada – YIKES! I was a bit surprised by this initial result but decided to consider it an unfair comparison as Avira was tested on the resident machine (but took note that an over-the-network scan by MSE is probably useless). I then installed MSE on the test machine’s XP drive so I could run a local apples-to-apples comparison.

On this second configuration, which took just over an hour to run, MSE found the following 22 items:

• Trojan:Win32Meredrop
• TrojanDownloader:Win32/Renos.JM x4
• TrojanDownload:Win32/Resno.JI x4
• TrojanDropper:Win32/Sirefef.A!dll (Avira missed this one)
• Trojan:Win32/Fakeinit
• Virus:Win32/Alureon.A
• VirTool:Win32/Obfuscator.HG x10

Conclusions

While my methodology contains at least one glaring flaw, that MSE had 1 day’s newer data, the comparison was still sufficiently valid for my purposes. Here is what I have drawn from the comparison:

• MSE found problems in 7 individual files that Avira did not (these details are not listed above)
• Avira found problems in 3 files that MSE did not (also not detailed above)
• While MSE had the advantage of 1 day over Avira which is a little unfair, it acquitted itself well in the test
• I would be comfortable installing MSE on customer computers

Errata

I have not taken into account the possibility of false positives in these tests. It’s possible that either of these scanners appear to be better than they really are because they are finding problems that aren’t really there. Generally I don’t concern myself with FPs as I would rather err on the safe side anyway. Having said this, MSE found ATAPI.SYS, EVENTLOG.DLL and LSASS.EXE to be infected, deleting these programs will pretty much screw your Windows installation so an FP here could be a problem. I also have concerns about MSE on a low-spec machine, it seams to command a lot of processor power even when it is doing nothing, it took 100% CPU cycles on my PIII laptop and virtually shut down the machine for 30 seconds when I merely tried to open Control Panel.

On the other hand, Microsoft, who can’t produce a secure operating system do seem to have a very good handle on finding the viruses and trojans that take advantage of their deficiencies (in a 1.0 version product no less). If I combine MSE’s excellent virus removal results with my quasi-scientific malware discovery results described here, I think it is a very recommendable product and I will keep an eye out for some more scientific studies from AV-Comparatives and others.

Addendum 12 May 2010: I am continuing to install MSE on customer computers. I like it because it is very easy to maintain and that’s quite important for many users. However, MSE does has its flaws that have come out in using it over time and I do not install it on every computer.

First, anecdotally, I do not think it finds all the viruses that Avira does. On occasion I have run MSE first, the Avira and Avira still found items or traces of virii. Secondly, MSE is not very good on a low-specification machine. If the computer has 500MB of RAM or less or it has a slow processor, I find that often MSE drags the machine to a crawl either by monopolising RAM or the CPU.

Well, I’ve had my first Windows 7 problem. I did a clean install “upgrade” of a machine to Windows 7 Home Premium, tested the machine and turned it back over to the customer. He called me two days later when he experienced the infamous (Vista) KSOD. He described the symptom this way: the machine was working fine the night before, but when he turned it on in the morning, it came up with the BIOS screen then went straight to a black screen with a blinking cursor. Yikes, I thought, this is too close to Vista for my tastes.

The machine is a Toshiba Qosmio A45-411 laptop. I’m not actually positive that this is strictly a Windows 7 problem. It turns out that the issue has to do with the computer not finding the hard drive after it wakes up from hibernation. To fix the immediate problem, I removed the hard drive from the machine and turned it on. With no hard drive it the machine, it tries to boot from the network (for some reason it skips over the CD drive which is first on the list). After the unsuccessful network boot, I turned off the computer and re-inserted the hard drive. Hit the power switch and it will again try to boot from the network, then, after a moment, will successfully resume using the HDD.

This particular computer had some problems with SATA LPM (Linked Power Mode) which were supposed to be fixed with a BIOS update. I have a suspicion that this is where the problem lies but I don’t have the time right now to fully sort this. My workaround for the problem is to disable hibernation on this machine as the customer is OK with that. You can read about how to disable hibernation in Windows 7 here. If you use the GUI method Brink describes here, there is a setting for disk power that might be interesting to fool with if you have the time.

EDIT: I’ve added another simple solution for the blinking cursor problem that is not Windows 7 specific.

I’ve never seen the comparison in writing but I can’t be the first person to compare Microsoft’s Windows Vista to the Ford Edsel. Wikipedia says of the ill-fated Edsel:

There is no single reason why the Edsel failed, and failed so spectacularly. Popular culture often faults the car’s styling. Consumer Reports cited poor workmanship. Marketing experts hold the Edsel up as a supreme example of corporate America’s failure to understand the nature of the American consumer. Business analysts cite the weak internal support for the product inside Ford’s executive offices. According to author and Edsel scholar Jan Deutsch, the Edsel was “the wrong car at the wrong time.”

Reading this today, I couldn’t help thinking of the comparison with the equally ill-fated Vista. Maybe it’s the workmanship, maybe it was the design, I don’t know; but I do know that I get a significant number of customers who say that they want their current computer running Windows XP to be fixed because they don’t want Vista. What a nightmare it must be to be the Vista product manager in Redmond.

A former colleague of mine, David Craig who is now Chief Strategy Officer at Thomson Reuters, always liked to compare building software to building cars. I think using computers is a lot like using a car, there are certain things you want:

• Familiar and easy to use – don’t fool around with the controls, put the steering wheel and the brake and the clutch where I expect them. Don’t make me have to learn to drive all over again just so you can prove how clever you are.
• Works as expected – when I turn the key the engine should start when I push the switch on my door the window should open, when I reach under the seat I should find that thingie that lets it move up and back (right next to the old Coke can and stray Cheetos)
• Is dependable – always starts, never stalls, doesn’t make funny noises.

This brings me around to Windows 7. I’ve been using it as my main OS here at Chaos House* since the beta became available earlier this year. I can report that it is not nearly as annoying as Vista and makes some nice improvements over Windows XP. It has been very stable, although the Release Candidate I am using now has ironicly been less stable than the beta. I would be very hesitant to recommend to a customer that s/he use a beta version of software, especially something as important as an operating system, but for a customer that really dislikes using Vista, I would say that help is on the way (toward the end of 2009).

* Referenced with a tip of my cap to Jerry Pournelle who I think was the first, best blogger ever.