Fix a Windows boot loop with AHCI

My wife’s computer was stuck in a Windows boot loop. We’d get the Windows 7 boot screen, and it would display a single pixel of the Windows 7 logo, then reboot itself endlessly. Booting in safe mode made it fail on classpnp.sys.

Any number of things can cause this, and it usually happens after you swap a motherboard. Enabling AHCI turned out to be the fix. Enabling AHCI also can be easier said than done, but I figured it out. She’s running Windows 7 (for now) but these same tricks should also work for Windows 10.

Read more

Deconstructing my conversation with “Computer Maintenance Department”

My tell-all about my encounter with “Computer Maintenance Department” was a little heavy on the jargon yesterday. It occurs to me that explaining what some of the terminology means, and the problem with their reasoning, may be helpful. I’ve also heard a few questions through various channels, and I think those are worth answering. Read more

This “Computer Maintenance Department” sure doesn’t know much about computer maintenance

“Peggy” from “Computer Maintenance Department” (1-645-781-2458 on my caller ID) called again. Lots of people are aware of these phone calls. They call, make vague claims about receiving a report that your computer is running slow and giving you errors, and are very careful not to say who they are or who they work for. Usually I just do whatever I can to get them off the phone.

But after having lunch with some other computer security professionals last week, a couple of them talked me into finding out how these guys operate. So I fired up a PC that turned out to have a real, legitimate issue. After resolving that issue myself, I turned the caller loose on my semi-functional PC so I could see what these scammers actually do. He had me connect to Teamviewer.com and run their remote access software. I followed his instructions, watched him connect, then slyly unplugged my network cable.

When my network connection dropped, “Peggy” quickly transferred me to a “senior technician” who used the name “Roy.” Read more

How I accidentally found a way to mess with “Peggy”

“Peggy” from “Computer Support Department” just won’t give up. He called me again at about 8 PM this evening. This time, I played along. I had a thrift-store junker PC for him to infect with his malware. The only problem was, the hard drive wasn’t connected and neither was the power cord. So I quickly hooked all that up, booted up, and then played along.

“I want you to click on Internet Explorer.”

“OK.”

“What do you see?”

“Page cannot be found.”

Thus I learned that Peggy isn’t very good at troubleshooting network issues. Read more

Unlocking the Malicious Software Removal Tool

When Microsoft’s monthly security patches come down, if you’ve ever clicked on the button to see what it’s installing, you may have noticed the Malicious Software Removal Tool.

If you’re wondering, it’s a rudimentary antimalware tool that removes selected vermin from your system. It doesn’t remove all known malware. And I don’t know exactly how Microsoft decides what to remove and when. But given the number of people who don’t run any kind of antimalware software, it probably seemed like a good idea when they rolled it out in 2005. And in the first 15 months they pushed the tool out with the monthly patches, it removed 16 million instances of malicious software. Not bad.

The tool has some power that you can unlock that normally isn’t exercised when you do your monthly updates.

Note: In a corporate environment, you may not get the Malicious Software Tool automatically if you’re managing Windows updates yourself. Microsoft has instructions for deploying it to your enterprise.

Read more

How to use your computer skills to earn some extra money

If you’re in need of some extra money and you’re computer-savvy, the scumbags of the earth have a deal for you. You see, they load unwitting computer owners’ PCs up with loads of junk, and they can render a new, state of the art computer useless very quickly. That’s an opportunity for you to use your computer skills to earn some extra money.

If you can learn to clean up the mess, you can probably have as much after-hours work as you want.Assuming you’re pretty good at fixing your own computer (don’t go into business fixing computer problems if your computer runs like garbage), cleaning it up is pretty easy.

Keep copies of Ad-Aware, Spybot Search & Destory, Bazooka, and Avert Stinger handy on a CD or USB flash drive. Install the programs and then run them. I run Bazooka first and last because it’s fast and gives a good overview of the health of the system.

Run all of the antispyware programs and let them do their thing. Then run Stinger in case they aren’t keeping up with their virus definitions. Once you clean the system up, update the virus defs (install antivirus software if they don’t have any–AVG strikes a good balance between effectiveness and ease of use, and it’s free) and defragment the hard drive.

Most IT people I know charge about $50 for the service. Have the customer bring the PC to you since a good spyware scan takes several hours. Let Spybot scan overnight, then clean it, then led Ad-Aware run while you’re at work and let it clean.

Keep an extra monitor, keyboard and mouse around so you can just plug in your customer’s CPU and go.

If the computer is in such bad shape you don’t get a start menu, boot it in safe mode and clean from safe mode.

And there you go. An easy side business. Hopefully you’ll have a booming business so fewer people will call me.

How to defrag when defrag just keeps starting over and over

I’ve seen many spyware-infested Windows 95/98 boxes that just won’t defrag no matter what you do. Defrag starts, gets part of the way through, then the disk changes and it starts over again. Leave the system alone for dozens of hours and it might finish, but probably not.Microsoft has some remedies, starting with hitting ctrl-alt-del and killing everything except explorer and systray, and disabling your quick launch bar (right-click on the gray bar on the bottom of the screen, select Toolbars, and de-select Quick Launch). That can help, but not always.

I’ve also heard of downloading the Windows ME version of Defrag.exe and running that instead of the older version if you’re running an older version of Windows 9x, since Windows ME’s defrag is supposed to work better. I guess that and the USB support were the only things in Windows ME that worked better.

Disabling your antivirus realtime scanning also helps, since it’s always accessing the disk.

But sometimes even doing those things won’t work. The system in my living room is a prime example. It’s clean, has no spyware or anything else but still won’t defrag. I could blow it away and reinstall, but I’m too lazy. For the most part the system works well enough for what I need it to do, so I’d rather not mess with it too much.

One thing you can do is reboot the system into safe mode, and run Defrag from there. The performance won’t be stellar since Windows will be using generic drivers rather than the optimized drivers for your particular computer, but Windows won’t be running anything else special, so the process will be able to finish without interference. Boot in safe mode, give your computer a few hours, and it will at least have a chance to finish.

Another option is to boot off a live CD, such as BartPE, and run JKDefrag on it. This would give you the advantage of a fully 32-bit environment with better drivers than Windows 9x safe mode, so the defragment will finish more quickly.

Defragmenting this way is terribly inconvenient of course, but like I’ve said before, it’s something you don’t have to do very often. Once a year will probably keep your computer running acceptably.

Upgrade diary: Gateway G6-400

I recently had the displeasure of working on a Gateway G6-400. I’ll relate some of the experiences here, in case you ever have the same misfortune.
The G6-400 looks good on paper. This particular configuration had a P2-400 in it on an Intel mobo (BX chipset), a 16-meg 3dfx video card (hot for the time), and a DVD drive. The owner complained it was slow and unstable. The usual cure for that is to remove the extra crap Gateway installs on all their PCs.

Unfortunately, this one wouldn’t boot to let me do that. Not even in safe mode. Nice, eh?

Memory problem? I tried several known-good DIMMs. Same results.

Power supply? I tried a known-good, brand-name power supply. Same results.

At some point, the hard drive made an ominous noise. I replaced the hard drive and attempted a clean install of Win98SE. It bombed out at random points during installation. Just in case it was the DVD drive, I tried several different CD-ROM drives. (Hey, I was desperate.) Same result.

Out of curiosity, I put the suspect hard drive in another computer and tried to boot it in safe mode (I didn’t want Windows to mess up the configuration). It worked fine. Rats.

So by now I’d replaced everything in the box–everything important, at least–except the mobo and the processor. I spied an FIC P2 mobo with a BX chipset at Software and Stuff for 30 bucks. I bought it. I was playing the odds. Mobos go bad more often than CPUs do, especially when you’re not overclocking. And if I was wrong, I have other Slot 1 processors. The only other Slot 1 mobo I have is one of the really old LX-based boards that only has a 66 MHz bus.

Why pay $30 for an obsolete mobo when you can get a modern board for $50 or $60 and put a nice Duron or Athlon CPU on it? I doubted the power supply would handle it well. Spend $30 more on a mobo, and $30 more on a new CPU, then you have to replace the power supply as well. Suddenly $30 more has become $100.

The FIC is a much nicer board, even though the specs are very similar. It has one more DIMM slot than the Intel board had. It has no onboard sound, but it has one more available PCI slot. Expandability comes out a draw (you’ll use the extra PCI slot to hold a sound card), but you get your choice. You can put in something equivalent to the midrange Yamaha sound built into the Intel board. Or you can put in a high-end card. The board itself has a lot more configuration options, and even with the default options it boots a lot faster.

This G6-400 has a microATX power supply in it. At least it looks like a microATX power supply, and a lot of people who sell eMachines-compatible microATX boxes claim they’ll also fit a G6. Why Gateway put a small-form factor, low-power power supply in what was at the time of manufacture the second-fastest PC on the market, I have no idea. Unless the idea was to make lots of money selling replacement power supplies. The plus side is, at least it really is ATX, unlike Dell, who uses something that looks like ATX but isn’t. (You’ll blow up the mobo if you plug an ATX power supply into a Dell mobo or a Dell power supply into a standard ATX mobo.)

Fortunately, this case has screw holes in the standard ATX places as well. Unfortunately, the opening in the back isn’t big enough to accomodate any standard ATX power supply I’ve ever seen (the opening blocks the power plug). Someone willing to resort to violence with a hacksaw, Dremel (or similar tool), or tin snips could hack an opening big enough to accomodate a replacement box. More on that in a bit.

I pulled the Intel mobo and dropped in the FIC replacement. Unfortunately, the case used one big block for all the case switches. Since nobody’s ever standardized the header block for the and reset switches and lights, that’s a problem unless you’re replacing boards with a board from the same manufacturer (assuming manufacturers never change their header block pinouts, which isn’t exactly a safe assumption). But that wasn’t the only problem I ran into with this motherboard swap.

Remember that power supply I told you about? Turns out the power lead on it is just long enough to reach the power connector on the Intel mobo the machine came with, in front of the memory slots. FIC put its power connector on the other side of the CPU, and the cable is about half an inch too short to reach. Good luck finding an ATX power extender cable. Directron.com has one for $5, but the minimum order is $10 and that’s before shipping. A search on Pricewatch.com only listed a couple of places having them. Pricing was under $10, but then there’s shipping. I found one computer store in south St. Louis County that had ONE in stock. “They’re not cheap,” the salesperson warned me. I asked how much. $16.95. “You’re not kidding,” I said. That’s half the price of a new 300W power supply. Of course, by the time you pay $5 online and $10 to ship it, $16.95 looks a lot more reasonable, doesn’t it? And if your case won’t accomodate a standard ATX power supply, either buying one of these or buying a similarly overpriced microATX power supply may be your only choice.

To get things up and going, I just jerry-rigged it. I ran the power cables and found a place to rest the power supply where it wouldn’t short out anything. Then I shorted the power leads on the mobo with a screwdriver, and booted Windows 98 in safe mode. It booted up just fine, after insisting on running Scandisk. I booted into regular mode, which insisted on running Scandisk again. It worked beautifully. I did some very minor optimizations (Network server in filesystem settings, turning off Active Desktop, etc.) and rebooted a few times. No problems. No weirdness. Everything was smooth and fluid.

The chances of me ever buying a Gateway (new at least) already approached zero before this adventure. The few Gateways I dealt with in my years doing desktop support always had goofy problems that I usually had to reinstall the OS to resolve. Meanwhile, the Micron or Dell in the next cubicle over kept on chugging away, never needing anything more than basic maintenance.

This motherboard swap is easily the most painful swap I’ve ever done. It worked in the end, but the power supply was an annoyance and an unplanned expense. The header block was an annoyance.

So if you’re thinking about a motherboard swap in a Gateway, particularly a G6 series, don’t plan on it being a walk in the park.

A nice upgrader’s motherboard and a cheap fan

I already talked about the $35 Foxconn 3400ATX case, so I might as well start talking about the other parts I used to build a very nice $200 upgrade last week.
Shuttle AK32L. It’s a very basic Socket A motherboard, using the VIA KT266 chipset. It plays both kinds of music, country and western–I mean, it supports both kinds of memory, PC133 SDRAM and DDR266, and CPU-wise it’ll work with everything from a 500 MHz Duron, if you happen to have one around, to the fastest Athlon XP you can get your hands on at the moment.

By today’s standards it’s a very basic motherboard. Aside from AC97 audio, there’s nothing built in besides the obligatory parallel, serial, USB, and PS/2 ports on the outside and a floppy and a pair of ATA100 connectors on the inside. It sports an AGP slot and six PCI slots (the last is shared with an AMR slot you won’t use). This plus its ability to use either DDR or PC133 (or even PC100) makes it an ideal upgrade board. But if you’re looking for serial ATA or IDE RAID or Firewire, then you’d best move along, there’s nothing to see here.

Performance-wise, I didn’t run any benchmarks on it. But let’s say this: I booted up Win98 in safe mode on this board with a Duron 1.3 in it, and it felt fast. That says something when a board will run Win98 safe mode fast.

Being more concerned with stability than with speed, I loaded up the BIOS with relatively conservative settings, but noted that there are plenty of features to keep a tweaker happy–memory timing, FSB and voltage adjusting, etc.

The lack of an AGP Pro slot and presence of only two DDR slots will keep this from being a performance freak’s board, however.

But if you’d like to goose the performance of a tired K6-2 or Pentium II system, you should be able to pick up an AK32L with a 1.3 GHz Duron and a decent fan for around $100. That’s what I paid at Newegg for a Duron 1.3 ($41), the AK32L ($55), and a Cooler Master DP5-6I11A fan ($3!).

Cooler Master DP5-6I11A fan. It’s a big heat sink. It’s got a fan on it. It keeps your CPU cool. It works. What else do you want to know?

The amount of noise it makes isn’t obnoxious. I didn’t do any tests on it to find out its heat dissipation capabilities — leave that to Dan Rutter, but he’s never tested this model.

It cost me three bucks. What I got was an aluminum heat sink with a decent-sized fan on it that doesn’t make a huge amount of noise. It had a nice thin layer of heat-sink grease applied to it already, a fact I found out accidentally when I looked down at my thumb after handling it. That’s a nice touch though–it saves you from having to buy a tube of the stuff and fumble around with it.

It’s marketed as an AMD Socket A fan, but it’ll work on Socket 370 and Socket 7 systems as well. It’s serious overkill for all but the very last Socket 7 CPUs, but for $3, I doubt many people will complain. It’s been a really long time since I last opened the case of a Pentium-133 or similar and found a working fan, so if you’ve still got something of that ilk hanging around, this would be a good pickup.

Ghosts from the past…

Wednesday night, 6:35 PM: I was in my South St. Louis County apartment, getting ready for church, when my phone rang. I’d had at least one telemarketing call that night already, but I picked up the phone anyway.
“Hello?” I said, maybe slightly agitated.

“Dave?” a female voice asked. So much for a telemarketer. I recognized the voice but didn’t place it immediately. And obviously she knew me.

“Yes?”

“It’s Wendy.” Ah, Wendy from church. OK.

“What’s up?” I asked. She doesn’t routinely call me–she doesn’t routinely call anyone, I don’t think–so I figured she probably needed something. That’s OK. I take care of my friends.

“What’s it mean when your computer says, ‘Bad or missing command interpreter. Enter path of a valid command interpreter, e.g. c:windowscommand.com’?”

“Oh. That means one of the files your computer needs to get started is blitzed,” I said. “What happens if you type it?”

“You’re gonna hate me,” she said as she typed the filename. “You deal with this stuff all day and now I call you wanting computer advice.”

I could never hate her. She’s too nice. Besides, guys like fixing things, especially for people they like. I probably should have told her that.

“It just repeats the same thing again,” she said.

“I see.” I had her try a couple of other locations–Microsoft OSs have always installed command.com in too many places. But no go.

“Are my other files OK?”

“Hopefully,” I said. “My computer used to do this to me once a year.”

“My whole life is on this computer, Dave,” she said, sounding a little distressed. My heart melted. I hate it when bad things happen to good people. I especially hate it when bad things happen to good people and one of Bill Gates’ or Steve Jobs’ toy operating systems is involved. But sometimes it’s just a minor inconvenience. I hoped this was one of those instances.

“I just need to boot your computer off a floppy, type a command or two, and it’ll probably come right back to life,” I said.

“Do you have time to do this? I mean, really have time to do this?” She didn’t want to inconvenience me.

“Yeah, I’m on my way to church, and you’re on the way, and it should only take me a couple of minutes,” I said as I formatted a disk and copied sys.com to it.

After assuring her again that I was sure, I told her I’d be there in about 10 minutes. I hopped in my car, disk in hand, ready to go be a hero and still make it to church on time. I rang her bell, heard her dog scream bloody murder, and she opened the door. As soon as she let me in, her Labrador warmed up to me. She led me to the computer room, where I sat down and popped in a disk. She yanked on her Lab’s leash, trying to keep her away from me. She wasn’t having much luck.

“That’s OK,” I said to Wendy. “I like dogs.” Then I turned to the dog and started scratching behind her ears. “I’ll bet the most dangerous part of you is your tail. You just like people so much you thump ’em to death, don’t you?” I turned to the computer and booted off the floppy. It didn’t work. So I restarted, and when it asked for a command interpreter, I typed “a:command.com” and got a command prompt. Meanwhile, her dog grabbed onto my hand with her paw so I wouldn’t go anywhere. Shadow, the Cocker Spaniel/Irish Setter mix I had growing up, used to do that.

I ran sys.com and rebooted, expecting to be a hero. Instead, I got the dreaded invalid media type reading drive C error.

I told Wendy I’d need the heavy artillery to fix this problem. I kicked myself for not bringing any more sophisticated tools like MBRWORK. It looked like a blitzed partition table to me.

I rebooted a couple more times to try to get symptoms. The Windows logo splashed up ever so briefly. The drive didn’t make any weird noises. That was good. That meant the boot record was intact, and that some data was intact–obviously, because it was reading the Windows logo. It looked just like the time my Pentium-75 crashed and forced me to cycle power, then didn’t come back up. I didn’t know how to fix a blitzed partition table then. But that was a long time ago.

By now, it was 7:20. “I can go get some more tools,” I offered.

“Go to church,” she said. “I’d feel really bad if you miss church. Tell Pastor John it’s my fault.”

I did my best to reassure her that I could get her data back. I told her the odds looked like about 50/50. In reality I was more confident than that, but unless I’m about 99% certain, I won’t say the chances are any better than 50/50. There’s nothing I hate more than disappointing people.

I went to church mad at myself that I hadn’t gotten her data back. I came home from church, got ready to gather up my tools, and checked my messages. It was Wendy. She said she’d gone to school to work on a paper, that we’d worry about the computer tomorrow but it wasn’t a big deal.

Maybe it wasn’t to her. But it was to me. I hate losing, especially to a computer. I have since I was in first grade and played Atari at my neighbors’ house. True, back then I got mad when I lost at Donkey Kong, but in my mind there’s no difference. Even though it’s a different game today and I lost a lot then and I rarely lose now, it doesn’t make me hate losing any less. Especially when I’m playing with other people’s stuff. Her words echoed in my mind: “My whole life is on this computer, Dave.”

I wasn’t going to let her down. I wasn’t going to let myself down by letting her down. I was going to get that data back, and I didn’t care what I had to do to get it.

I called her back, expecting her not to be there. Her mom, Debby, answered the phone. She gave me a few more clues, told me she didn’t expect Wendy home until late, said one or the other of them would be home about 3:30 the next day. I’d been at work until close to six on Wednesday and saw the possibility of having to stay that late on Thursday. I didn’t make any hard and fast promises about when I’d be there, but I started plotting how I would escape work by 4:15.

On Thursday, I loaded up floppies containing all the standard Microsoft disk tools, plus Norton Disk Doctor, plus Spinrite, plus MBRWORK and a few other partition recovery tools, along with a Windows 98 CD, and took the whole wodge of stuff to work. At 4:20, I called. Debby answered. I told her I was leaving work and I’d probably get there in about 20 minutes.

Along the way, I listened to a bunch of punk rock, really loud, and got myself pumped up. Whether it’s stepping up to the plate in the bottom of the seventh with runners on second and third and two out, or just a tricky computer problem, I get myself into the same mental place. The world fades away and I see nothing but the challenge. By the time I got to their house, I was in the zone. I was so in the zone that I walked up to the front door of the wrong house. Wendy’s Lab was in the front yard giving me the “I know you! What are you doing over there? Get over here and pet me!” look. I didn’t notice. The neighbor pointed next door. Feeling stupid, I walked over. The dog congratulated me on getting smart, Debby greeted me, and I went another round with her computer, running MBRWORK. It recovered the partition successfully, it said. I got excited. I rebooted and the computer asked me for a command interpreter again.

Cantankerous computer 2, Dave 0.

I went home, fixed myself a little something to eat, pondered the situation, and wrote my Bible study for Friday night on my company laptop. That calmed me down enough to let me think rationally again. I packed up everything I could possibly need: Norton AntiVirus, Ghost, an extra hard drive, two laptops, a couple of Linux CDs, both versions of Windows 98, utilities disks…

I booted off my disks and tried a few things. Nothing. I booted my company laptop up with the disks–that laptop doesn’t have DOS installed–and added a couple more toys. They didn’t help. Wendy got home and asked if it was a bad sign I was there. I muttered something and probably came off as rude. I was in the zone, after all. I asked her if she had any floppies she wanted me to scan for viruses. She handed me one, and I tried to boot my laptop into Windows. It showed the very same symptoms as her computer.

I’ve said it before and I’ll say it again. Virus writers, PLEASE get a life. Get interested in girls or something. Anything!

Wendy didn’t like the look on my face. I told her what happened. She said a phrase I won’t repeat here, then apologized. There was no need. I felt like saying it too. Or something worse.

For grins, I tried booting the laptop into Linux. It booted up like it was cool. Hmm. Boot sector viruses that kill Windows dead don’t even make Linux flinch. I owe Linus Torvalds a beer.

I tried mounting my main Windows partition. Linux reported NTFS errors. Visions of virus writers getting beaten to a bloody pulp danced in my mind.

Since I was now convinced we were dealing with a boot sector virus, I replaced the MBR. No joy. I booted off a Linux CD, switched over to a console, ran cfdisk, and viewed the partition table. One 4-gig partition, FAT32. No problems. Odd.

Wendy started fretting. “You’ve spent all this time and you’ve lost your laptop. I’m about to start to cry.”

I stopped what I was doing, turned to her, and looked her straight in the eye. “I take care of my friends.”

She looked back at me like she thought that was kind of cool.

“I don’t care about the laptop. I can fix that later. I can rewrite the Bible study that was on it. It took me 20 minutes to write, so it’ll take me 15 minutes to rewrite. I’m going to get your data back.”

The Bible study I lost indeed took me about 15 minutes to rewrite, and the second version was a lot better. But I didn’t get her data back that night. Eventually I gave up, pulled her drive, installed a new drive, and installed Windows and Office on it so they’d have a computer that was useful for something. Debby walked in as I was switching drives, noticed the dust inside the case, and gave it a disgusted look. She came back with a rag and Wendy started laughing at her.

“She can’t stand dust anywhere. I guess not even inside electronics,” Wendy said.

Debby lit up when she walked in the room and saw the Windows 98 screen on her computer. Later when Wendy walked back in, she let out a whoop and told her mom she was missing beautiful things in the computer room. I was pretty happy about it too. Windows 98 didn’t install easily–the intial reboot failed and installation didn’t continue until I booted it in safe mode, then rebooted. I gave the computer a lecture as I booted it, reminding it that I have enough spare parts at home to build a computer like it and would have no qualms about destroying it and replacing it with something else. I know it didn’t hear or understand a word I said, but I felt better afterward.

I felt bad about not getting the data back that night. Wendy and I talked for about 45 minutes about other things. I felt better afterward. I forgot to thank her. Around midnight, I packed up the stuff and drove home.

Wendy and I talked the next day over e-mail. I’d taken my disks to work and scanned them on a non-networked PC nobody cared about and found the Form virus. Wendy had taken some disks to school and had them scanned. They contained both Form and antiCMOS. Since antiCMOS resides in the MBR and Form resides on the primary partition, the two viruses can coexist. Form was relatively harmless on FAT16 drives, and although antiCMOS was potentially destructive in 1991, it’s much less so now that PCs autodetect hard drives at boot rather than relying on parameters stored in CMOS. My work the night before would have eliminated antiCMOS, which explained why it wasn’t present on my disks. I did a Dejanews search on Form and FAT32, to see if that would explain the apparent partition corruption. I found that the symptoms were exactly what Wendy was showing. And I found recovery methods that had a high success rate.

I haven’t put Wendy’s drive in one of my PCs yet to recover it. But I’m pretty confident I’ll get her data back. That’s a good thing. I’ve met nicer people than Wendy and Debby. But only once or twice. People like them don’t come around very often, so I’d like to do something nice for them.

Bringing their data back from oblivion would do.

WordPress Appliance - Powered by TurnKey Linux