Cleaning up virus infections is part of the normal life for many IT professionals. Sometimes you get one that is more of a pain than others in fixing. I recently had a few computers with the same ‘Fake AV’ type as the rest. Easy to clean clean up. Just log in as another user, other than the affected account. Run Malwarebytes and it will find something in the affected users appdata\temp folder that is a virus. You will then have to fix the registry EXE settings as they will be broken.

However this one was different and where real fun comes is when your AV software and the windows Firewall service no longer work. This virus deletes the Windows Firewall and BFE services from the computer registry. You could try a system restore point if you have a clean one or you could manually restore your system registry hive and hope they work. I Came up with this as an easy way to restore the services. (please see warning at the bottom of the page)

Fix Firewall service by creating a txt file called firewall.reg, edit it and paste the following code into it, save and then double click the .reg file and say yes you want to import it into the registry:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc]
“DisplayName”=”@%SystemRoot%\\system32\\FirewallAPI.dll,-23090″
“Group”=”NetworkProvider”
“ImagePath”=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,6f,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,00,00
“Description”=”@%SystemRoot%\\system32\\FirewallAPI.dll,-23091″
“ObjectName”=”NT Authority\\LocalService”
“ErrorControl”=dword:00000001
“Start”=dword:00000002
“Type”=dword:00000020
“DependOnService”=hex(7):6d,00,70,00,73,00,64,00,72,00,76,00,00,00,62,00,66,00,\
65,00,00,00,00,00
“ServiceSidType”=dword:00000003
“RequiredPrivileges”=hex(7):53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,\
00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,75,\
00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,\
00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,\
00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,\
65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
“FailureActions”=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc\Parameters]
“ServiceDll”=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
“ServiceDllUnloadOnStop”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc\Parameters\PortKeywords]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc\Security]
“Security”=hex:01,00,14,80,b4,00,00,00,c0,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,84,00,05,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,28,00,15,00,\
00,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,\
0e,a7,8b,eb,ca,7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,\
00,00,00,05,12,00,00,00

The do the same thing for the BFE service using a different file name such as bfe.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE]
“DisplayName”=”@%SystemRoot%\\system32\\bfe.dll,-1001″
“Group”=”NetworkProvider”
“ImagePath”=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,6f,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,00,00
“Description”=”@%SystemRoot%\\system32\\bfe.dll,-1002″
“ObjectName”=”NT AUTHORITY\\LocalService”
“ErrorControl”=dword:00000001
“Start”=dword:00000002
“Type”=dword:00000020
“DependOnService”=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
“ServiceSidType”=dword:00000003
“RequiredPrivileges”=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
“FailureActions”=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters]
“ServiceDll”=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
62,00,66,00,65,00,2e,00,64,00,6c,00,6c,00,00,00
“ServiceDllUnloadOnStop”=dword:00000001
“ServiceMain”=”BfeServiceMain”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Provider]
“{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}”=hex:01,10,08,00,cc,cc,cc,cc,f0,00,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,d0,00,00,00,01,10,08,00,cc,cc,cc,cc,c0,00,00,00,00,00,00,00,00,\
00,02,00,ca,16,cc,de,33,3f,46,43,be,1e,8f,b4,ae,0f,3d,62,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,18,00,00,00,00,00,00,\
00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,6c,00,41,00,\
50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,00,30,00,31,\
00,00,00,18,00,00,00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,\
77,00,61,00,6c,00,6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,32,00,33,00,35,00,30,00,32,00,00,00,07,00,00,00,00,00,00,00,07,00,00,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,00,00,00,00,00,00,00,00
“{4b153735-1049-4480-aab4-d1b9bdc03710}”=hex:01,10,08,00,cc,cc,cc,cc,f0,00,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,d0,00,00,00,01,10,08,00,cc,cc,cc,cc,c0,00,00,00,00,00,00,00,00,\
00,02,00,35,37,15,4b,49,10,80,44,aa,b4,d1,b9,bd,c0,37,10,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,18,00,00,00,00,00,00,\
00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,6c,00,41,00,\
50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,00,30,00,31,\
00,00,00,18,00,00,00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,\
77,00,61,00,6c,00,6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,32,00,33,00,35,00,30,00,32,00,00,00,07,00,00,00,00,00,00,00,07,00,00,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,00,00,00,00,00,00,00,00
“{1bebc969-61a5-4732-a177-847a0817862a}”=hex:01,10,08,00,cc,cc,cc,cc,58,02,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d0,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,d0,00,00,00,01,10,08,00,cc,cc,cc,cc,c0,00,00,00,00,00,00,00,00,\
00,02,00,69,c9,eb,1b,a5,61,32,47,a1,77,84,7a,08,17,86,2a,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,18,00,00,00,00,00,00,\
00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,6c,00,41,00,\
50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,00,32,00,31,\
00,00,00,18,00,00,00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,\
77,00,61,00,6c,00,6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,32,00,33,00,35,00,32,00,32,00,00,00,07,00,00,00,00,00,00,00,07,00,00,00,\
4d,00,50,00,53,00,53,00,56,00,43,00,00,00,00,00,68,01,00,00,01,00,04,8c,50,\
01,00,00,5c,01,00,00,00,00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,00,10,\
18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,10,18,\
00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,28,00,\
ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,57,a8,\
ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,\
00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,\
56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,41,bb,\
45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,00,01,\
06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,ff,1b,\
c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,\
00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,28,00,\
f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,b1,4a,\
3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,00,00,\
00,01,00,00,00,00,01,01,00,00,00,00,00,05,13,00,00,00,01,01,00,00,00,00,00,\
05,13,00,00,00
“{aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}”=hex:01,10,08,00,cc,cc,cc,cc,50,02,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,c8,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,c8,00,00,00,01,10,08,00,cc,cc,cc,cc,b8,00,00,00,00,00,00,00,00,\
00,02,00,87,7d,6a,aa,8f,7f,2a,4d,be,53,fd,a5,55,cd,5f,e3,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,14,00,00,00,00,00,00,\
00,14,00,00,00,40,00,70,00,6f,00,6c,00,73,00,74,00,6f,00,72,00,65,00,2e,00,\
64,00,6c,00,6c,00,2c,00,2d,00,35,00,30,00,31,00,33,00,00,00,14,00,00,00,00,\
00,00,00,14,00,00,00,40,00,70,00,6f,00,6c,00,73,00,74,00,6f,00,72,00,65,00,\
2e,00,64,00,6c,00,6c,00,2c,00,2d,00,35,00,30,00,31,00,34,00,00,00,0c,00,00,\
00,00,00,00,00,0c,00,00,00,50,00,6f,00,6c,00,69,00,63,00,79,00,61,00,67,00,\
65,00,6e,00,74,00,00,00,68,01,00,00,01,00,04,8c,50,01,00,00,5c,01,00,00,00,\
00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,00,10,18,00,ff,07,0f,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,10,18,00,ff,07,03,00,01,02,00,\
00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,28,00,ff,07,03,00,01,06,00,00,\
00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,57,a8,ae,0b,70,25,21,04,42,84,\
4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,\
9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,56,00,10,28,00,f4,03,02,\
00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,41,bb,45,ba,a8,7a,6c,bd,92,68,\
f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,\
00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,ff,1b,c4,5f,fd,d9,e0,4a,00,10,\
28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,0a,d8,62,3a,d9,c6,0f,\
18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,28,00,f4,03,02,00,01,06,00,00,\
00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,b1,4a,3b,45,db,50,5b,43,27,04,\
58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,00,00,00,01,00,00,00,00,01,01,\
00,00,00,00,00,05,14,00,00,00,01,01,00,00,00,00,00,05,14,00,00,00
“{38b977e7-40a1-446a-bd7f-6ab5980c5d16}”=hex:01,10,08,00,cc,cc,cc,cc,68,02,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d8,00,00,00,04,00,02,00,6c,01,00,00,\
08,00,02,00,d8,00,00,00,01,10,08,00,cc,cc,cc,cc,c8,00,00,00,00,00,00,00,00,\
00,02,00,e7,77,b9,38,a1,40,6a,44,bd,7f,6a,b5,98,0c,5d,16,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,16,00,00,00,00,00,00,\
00,16,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,\
43,00,6f,00,72,00,70,00,6f,00,72,00,61,00,74,00,69,00,6f,00,6e,00,00,00,29,\
00,00,00,00,00,00,00,29,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,\
66,00,74,00,20,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,56,00,50,\
00,4e,00,20,00,52,00,65,00,63,00,6f,00,6e,00,6e,00,65,00,63,00,74,00,20,00,\
50,00,72,00,6f,00,76,00,69,00,64,00,65,00,72,00,00,00,00,00,00,00,00,00,6c,\
01,00,00,01,00,04,8c,50,01,00,00,60,01,00,00,00,00,00,00,14,00,00,00,02,00,\
3c,01,09,00,00,00,00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,00,10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,\
2c,02,00,00,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,\
41,10,b8,36,fc,4d,57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,\
03,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,\
0e,a7,8b,eb,ca,7b,42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,\
50,00,00,00,44,3e,41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,\
10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,\
ed,d8,54,5e,32,f4,ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,\
00,00,00,00,05,50,00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,\
78,83,39,5c,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,\
bf,1b,bb,45,ef,d2,b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,\
00,00,01,01,00,00,00,00,00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\SubLayer]
“{b3cdd441-af90-41ba-a745-7c6008ff2300}”=hex:01,10,08,00,cc,cc,cc,cc,c0,00,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,41,d4,cd,b3,90,af,ba,41,a7,45,7c,60,08,ff,23,00,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,03,00,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,30,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,35,37,\
15,4b,49,10,80,44,aa,b4,d1,b9,bd,c0,37,10,00,00,00,00,00,00,00,00
“{b3cdd441-af90-41ba-a745-7c6008ff2301}”=hex:01,10,08,00,cc,cc,cc,cc,c0,00,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,41,d4,cd,b3,90,af,ba,41,a7,45,7c,60,08,ff,23,01,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,02,00,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,30,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,ca,16,\
cc,de,33,3f,46,43,be,1e,8f,b4,ae,0f,3d,62,00,00,00,00,00,00,00,00
“{b3cdd441-af90-41ba-a745-7c6008ff2302}”=hex:01,10,08,00,cc,cc,cc,cc,28,02,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,41,d4,cd,b3,90,af,ba,41,a7,45,7c,60,08,ff,23,02,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,04,00,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,30,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,35,37,\
15,4b,49,10,80,44,aa,b4,d1,b9,bd,c0,37,10,00,00,00,00,68,01,00,00,01,00,04,\
8c,50,01,00,00,5c,01,00,00,00,00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,\
00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,\
28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,\
57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,\
00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,\
42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,\
41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,\
00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,\
ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,\
00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,\
28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,\
b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,\
00,00,00,01,00,00,00,00,01,01,00,00,00,00,00,05,13,00,00,00,01,01,00,00,00,\
00,00,05,13,00,00,00
“{9ba30013-c84e-47e5-ac6e-1e1aed72fa69}”=hex:01,10,08,00,cc,cc,cc,cc,28,02,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,13,00,a3,9b,4e,c8,e5,47,ac,6e,1e,1a,ed,72,fa,69,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,01,a0,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,32,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,69,c9,\
eb,1b,a5,61,32,47,a1,77,84,7a,08,17,86,2a,00,00,00,00,68,01,00,00,01,00,04,\
8c,50,01,00,00,5c,01,00,00,00,00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,\
00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,\
28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,\
57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,\
00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,\
42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,\
41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,\
00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,\
ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,\
00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,\
28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,\
b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,\
00,00,00,01,00,00,00,00,01,01,00,00,00,00,00,05,13,00,00,00,01,01,00,00,00,\
00,00,05,13,00,00,00
“{9367171b-3264-4f09-a0e8-81b38c162f17}”=hex:01,10,08,00,cc,cc,cc,cc,20,02,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,90,00,00,00,04,00,02,00,6c,01,00,00,\
08,00,02,00,90,00,00,00,01,10,08,00,cc,cc,cc,cc,80,00,00,00,00,00,00,00,00,\
00,02,00,1b,17,67,93,64,32,09,4f,a0,e8,81,b3,8c,16,2f,17,04,00,02,00,00,00,\
00,00,01,00,00,00,08,00,02,00,00,00,00,00,00,00,00,00,06,00,00,00,17,00,00,\
00,00,00,00,00,17,00,00,00,56,00,50,00,4e,00,20,00,52,00,65,00,63,00,6f,00,\
6e,00,6e,00,65,00,63,00,74,00,20,00,53,00,75,00,62,00,6c,00,61,00,79,00,65,\
00,72,00,00,00,00,00,e7,77,b9,38,a1,40,6a,44,bd,7f,6a,b5,98,0c,5d,16,00,00,\
00,00,6c,01,00,00,01,00,04,8c,50,01,00,00,60,01,00,00,00,00,00,00,14,00,00,\
00,02,00,3c,01,09,00,00,00,00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,00,10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,\
00,00,00,2c,02,00,00,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,\
00,00,f1,41,10,b8,36,fc,4d,57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,\
00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,\
dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,\
00,00,05,50,00,00,00,44,3e,41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,\
70,e9,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,\
b5,af,a1,ed,d8,54,5e,32,f4,ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,\
01,06,00,00,00,00,00,05,50,00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,\
6d,2f,8b,78,83,39,5c,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,\
00,00,6e,bf,1b,bb,45,ef,d2,b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,\
00,50,00,00,00,01,01,00,00,00,00,00,01,00,00,00,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,00,00,00,00

Now the BFE Service needs some registry changes to assign the proper permissions using regedit. In Regedit go to ‘HKLM\System\CurrentControlSet\Services\BFE\Paramaters\Policy’ and change the permission on this and all sub keys by adding ‘NT Service\BFE’ (on a domain computer make sure to change location to the local computer rather than the domain) to the permissions list and making sure the special permissions of “Query Value” “Set Value” “Create Subkey” “Enumerate Subkey” “Notify” and “Read control” are assigned like the following image.

bfe service

Reboot your computer and the Firewall and BFE services should work correctly now and your AV software should be happy. I know that ESET Smart Security, ESET NOD32, and AVG are all affected by these services not running and assume there are more.

Please be warned that you can break your computer and that I nor Asset Technology take any responsibility if you break your computer  trying these repairs.  This is just documenting how I fixed some computers and passed the information along to my co-workers with good success.

I was trying to print an image full page and the printer jammed. The paper was stuck as it was exiting the fuser, about a half inch of paper crumpled up. I remove the paper, make sure there is no pieces in the fuser cartridge, close the printer and it proceeds to automatically reprint. Once again a jam, same situation, the paper is jammed at the fuser. I removed the fuser, the drum clean everything, blow out with air, check all of the rollers and cannot find a flaw. Auto reprint when I closed it back up and yet again a total fail. After a little while of doing some searching on Google, I found reference to this series printer having problems printing heavy/dark images at the top margin of the page. Turns out the toner sticks to the fuser roller and starts to wrap around rather than exiting the top of the printer. I cancel the print job and print a normal text page, no problem. I edit my image and cropped the top of the picture off which was a dark area of brown and black which I did not need, and what do you know, the image printed just fine.

We’ve had some requests recently to get involved in the servers of a few medical/health care firms, as well as some publicly-traded companies’ networks and storage systems, both of which require certain protocols for compliance with federal laws.

Anyone who’s been working with a specialty practice or something as large as an HMO network knows that governmental requirements for storage and access to patient data are more stringent now than they have ever been – and that’s good.

The problem, as we see it, is not that there aren’t “cheat sheets” or access to the necessary information to be “in compliance” with the associated regulations, rather, that there are SO MANY different rules to follow, depending on the industry.  And that’s what bugs us.

So much, in fact, that we’re interested in what YOU think the most challenging compliance regulation is, and we want you to fill out the poll on our Facebook page:

http://www.facebook.com/AssetTechnology?sk=wall

Oh, and if you can, see if there’s a way to get all these government-types to play nicely with each other. It would really make this IT guy’s day.

ASSET TECHNOLOGY JUST HAD A DRIVE BY!!!

That’s right – our Phoenix office on Sheridan Street was passed by on multiple occasions this morning by a car that never stopped shooting. Fortunately, no one in the line of fire was hurt, and the driver and her car has been clearly identified.

Now, we know these pictures aren’t the best, but you can clearly make out the suspect vehicle’s camera on top (it’s painted Red), and the unmistakable vehicle wrap that delineates it as a vehicle that means to stick out while cruising neighborhoods.

The suspect is no other than the notorious Google.

You’ve heard of Google’s “Street View”, right?  You know, the army of fuel-efficient cars with a long pole and “soccer ball” on top that drive around your city snapping photos of where stuff is?  You can read more about the concept and technology here and here, but the bottom line is that we’ve been caught in the crossfire of Google’s assault on lack of visual proof that the Asset Technology office is part of Phoenix’s Coronado District. (They’re making a concerted effort to capture the view of the neighborhood that surrounds our renovated 1930’s church-turned-studio that houses our architecture partners as well as our IT team!)

In an effort to provide proof that the elusive Google cars DO exist, here are other photographs to prove it:

Look out! Here comes Google's best shooter!

Screamin' around the corner to take another shot!

What does this mean to us? Well, for one thing, we know we’re not the only ones being stalked, here.  It also means our Tucson office on Broadway Boulevard will also be a prime target since Google mentions it’s in several of our Arizona counties right now with their fleet of photo-taking machines.

If you see one in your neighborhood, be aware, and be fast with the photos!

We’re saddened to see another year’s conference come and go.  We had the opportunity to meet some great IT professionals, learn from industry leaders of IT and non-technology businesses, and gain insight into up-and-coming trends, which will be the talk of the business community in a very short time.

The Robin Robins Big Seminar (called “Boot Camp” and “Technology Marketing Speedway”) is our chance to get outside our business and understand that we’re not the only ones trying to keep our company headed in the right direction during the tumultuous events unfolding right now.  It’s been an odd decade, with many major companies disappearing and smaller ones being gobbled up by conglomerates interested primarily in the bottom line. Our goal is not just to survive, but thrive.

Our business is growing because we allow ourselves the opportunity to attend events and trainin that makes us better business owners and Technology Specialists.  Sure, we could use that money for other things (such as new laptops or cushy chairs), however, we’ve discovered there’s more to gain from investing in ourselves than in things that don’t return an investment.

That being said, if you are in the Information Technology field and own your own business, then you should consider attending events like this so you can become a stronger, more resilient company for the future.

On an older install of Windows the hard drive is probably pretty full. On culprit maybe orphaned installer msi files in the c:\windows\installer folder. Deleting files directly out of any windows folder could be dangerous and is not recommended. However there are ways that are safe. There is a tool from Microsoft “MSIzap.exe” which will do this when ran with these options: msizap.exe !G

Sadly Microsoft has removed this from being an easy download and is no longer sharing this tool directly. Fortunately they still use it and you can get it by downloading the Live One Care cleanup tool from here http://download.microsoft.com/download/4/c/b/4cb845e7-1076-437b-852a-7842a8ab13c8/OneCareCleanUp.exe and then extracting the msizap.exe using your favorite compression tool such as 7zip.

On the most recent computer I cleaned up using this tip I am sharing, I recovered 10GB of drive space on the computer. Good luck with your quest for more space.

The hottest news so far this quarter isn’t the Motorola Xoom or the new Apple MacBook Pro refresh, but the iPad redux – affectionately called the iPad 2 (very clever).  Since we at Asset Technology didn’t get invited, we’re following several sources for the press event scheduled today.

Follow MobileCrunch and their live blog of the event here:

MobileCrunch iPad 2 Press Event Coverage

Have you found a place in your heart yet for the iPad?  Or an Android-powered device?

I recently purchased a Droid X phone from Verizon. For the most part it is great, but I use it for business quite a bit and have noticed some issues that need to be addressed asap. One of those issues is the fact that every time I set an appointment on my Droid, it marks it as a “private” appointment in my Outlook calendar. If you are experiencing this problem then i have a work-around for you. When you setup a new appointment on you Droid, you can hit the menu button and select “show extra options.” Now your appointment that you are creating will have a privacy setting at the bottom of it. By defualt it is set to private, simply change it to “public” and it will show correctly in your Outlook.
I have not found any way to make this change permanent so I guess we are all going to have to deal with these extra steps until an update comes out…

If you are interested in using the internet to market for you, then you need to know the basics first.
Basic #1: Your website needs to be setup to close the deal. If you are successful in markting through the internet then the final stop is your website. Don’t do all that work just to get someone interested and then have them pull out at the last minute because your site is lacking…
Basic #2: The rule of thumb for marketing is that no ONE thing works, but rather a combination of things. This rule applies just the same for internet marketing. Be sure you are doing a combination of things to get business on the internet.
Basic #3: Make sure you can TRACK your progress. If you don’t know where that client came from then how do you know if your markting is working? There are many different ways (tools) to track internet marketing progress. Don’t skip this..

Now that the basics are out of the way I will give you a 40,000ft. picture of what IS working right now:
-Pay Per Click (make sure you are using landing pages)
-Search Engine Optimization (this means internal site optimization, external optimization (blogs, articles, press releases), and local optimization (Bing local, Google Places))
-Video (this brings emotion to your site and can also be a way to make your marketing viral)
-Email (not to be confused with SPAM – there is a HUGE difference)
-Socail Media (Facebook, Twitter, LinkedIn, Youtube, etc.)

If you need someone to look at your business to help you develop an Internet Marketing Strategy, feel free to call us. We specialize in business to business Internet Marketing services.
Asset Technology – 888.627.7381

It’s officially “un-official.” Verizon is NOT going to have an iPhone for a while…
We recently heard hype about Verizon selling iPhones in January of 2011. I believe that is all a HUGE conspiracy! Hear me out..
Droid smart phones have recently taken some major market share from iPhone (especially in light of the recent iPhone 4 “problems). So what do you do if you are apple? I know. You “leak” some hearsay about Verizon getting the iPhone in a few months!
Now you’re thinking, what would that accomplish? Well let me tell you..
Everyone knows that Verizon is the largest mobile phone network, everyone also knows that IF Verizon had iPhones it would crush AT&T/Sprint. So… you have all these people ready to upgrade their smartphone or get their first one. Should I get a Droid X or an Incredible? Should I renew my contract with AT&T/Sprint?  Oh wait.. maybe if I hold out a few months I can get a Verizon iPhone! Ding ding ding! See where I am going with this?

Please let me know if you agree with this or feel that I am just on another one of my tangents by COMMENTING THIS POST.
-Greg