Asset Technology Tech Blog

Pesky Virus infections

Britt — Wed, 14 Dec 2011 04:18:18 +0000

Cleaning up virus infections is part of the normal life for many IT professionals. Sometimes you get one that is more of a pain than others in fixing. I recently had a few computers with the same ‘Fake AV’ type as the rest. Easy to clean clean up. Just log in as another user, other than the affected account. Run Malwarebytes and it will find something in the affected users appdata\temp folder that is a virus. You will then have to fix the registry EXE settings as they will be broken.

However this one was different and where real fun comes is when your AV software and the windows Firewall service no longer work. This virus deletes the Windows Firewall and BFE services from the computer registry. You could try a system restore point if you have a clean one or you could manually restore your system registry hive and hope they work. I Came up with this as an easy way to restore the services. (please see warning at the bottom of the page)

Fix Firewall service by creating a txt file called firewall.reg, edit it and paste the following code into it, save and then double click the .reg file and say yes you want to import it into the registry:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc]
“DisplayName”=”@%SystemRoot%\\system32\\FirewallAPI.dll,-23090″
“Group”=”NetworkProvider”
“ImagePath”=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,6f,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,00,00
“Description”=”@%SystemRoot%\\system32\\FirewallAPI.dll,-23091″
“ObjectName”=”NT Authority\\LocalService”
“ErrorControl”=dword:00000001
“Start”=dword:00000002
“Type”=dword:00000020
“DependOnService”=hex(7):6d,00,70,00,73,00,64,00,72,00,76,00,00,00,62,00,66,00,\
65,00,00,00,00,00
“ServiceSidType”=dword:00000003
“RequiredPrivileges”=hex(7):53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,\
00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,75,\
00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,\
00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,\
00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,\
65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
“FailureActions”=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc\Parameters]
“ServiceDll”=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
“ServiceDllUnloadOnStop”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc\Parameters\PortKeywords]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc\Security]
“Security”=hex:01,00,14,80,b4,00,00,00,c0,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,84,00,05,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,28,00,15,00,\
00,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,\
0e,a7,8b,eb,ca,7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,\
00,00,00,05,12,00,00,00

The do the same thing for the BFE service using a different file name such as bfe.reg:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE]
“DisplayName”=”@%SystemRoot%\\system32\\bfe.dll,-1001″
“Group”=”NetworkProvider”
“ImagePath”=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,6f,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,00,00
“Description”=”@%SystemRoot%\\system32\\bfe.dll,-1002″
“ObjectName”=”NT AUTHORITY\\LocalService”
“ErrorControl”=dword:00000001
“Start”=dword:00000002
“Type”=dword:00000020
“DependOnService”=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
“ServiceSidType”=dword:00000003
“RequiredPrivileges”=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
“FailureActions”=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters]
“ServiceDll”=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
62,00,66,00,65,00,2e,00,64,00,6c,00,6c,00,00,00
“ServiceDllUnloadOnStop”=dword:00000001
“ServiceMain”=”BfeServiceMain”

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Provider]
“{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}”=hex:01,10,08,00,cc,cc,cc,cc,f0,00,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,d0,00,00,00,01,10,08,00,cc,cc,cc,cc,c0,00,00,00,00,00,00,00,00,\
00,02,00,ca,16,cc,de,33,3f,46,43,be,1e,8f,b4,ae,0f,3d,62,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,18,00,00,00,00,00,00,\
00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,6c,00,41,00,\
50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,00,30,00,31,\
00,00,00,18,00,00,00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,\
77,00,61,00,6c,00,6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,32,00,33,00,35,00,30,00,32,00,00,00,07,00,00,00,00,00,00,00,07,00,00,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,00,00,00,00,00,00,00,00
“{4b153735-1049-4480-aab4-d1b9bdc03710}”=hex:01,10,08,00,cc,cc,cc,cc,f0,00,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,d0,00,00,00,01,10,08,00,cc,cc,cc,cc,c0,00,00,00,00,00,00,00,00,\
00,02,00,35,37,15,4b,49,10,80,44,aa,b4,d1,b9,bd,c0,37,10,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,18,00,00,00,00,00,00,\
00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,6c,00,41,00,\
50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,00,30,00,31,\
00,00,00,18,00,00,00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,\
77,00,61,00,6c,00,6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,32,00,33,00,35,00,30,00,32,00,00,00,07,00,00,00,00,00,00,00,07,00,00,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,00,00,00,00,00,00,00,00
“{1bebc969-61a5-4732-a177-847a0817862a}”=hex:01,10,08,00,cc,cc,cc,cc,58,02,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d0,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,d0,00,00,00,01,10,08,00,cc,cc,cc,cc,c0,00,00,00,00,00,00,00,00,\
00,02,00,69,c9,eb,1b,a5,61,32,47,a1,77,84,7a,08,17,86,2a,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,18,00,00,00,00,00,00,\
00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,6c,00,41,00,\
50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,00,32,00,31,\
00,00,00,18,00,00,00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,\
77,00,61,00,6c,00,6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,32,00,33,00,35,00,32,00,32,00,00,00,07,00,00,00,00,00,00,00,07,00,00,00,\
4d,00,50,00,53,00,53,00,56,00,43,00,00,00,00,00,68,01,00,00,01,00,04,8c,50,\
01,00,00,5c,01,00,00,00,00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,00,10,\
18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,10,18,\
00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,28,00,\
ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,57,a8,\
ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,\
00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,\
56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,41,bb,\
45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,00,01,\
06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,ff,1b,\
c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,\
00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,28,00,\
f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,b1,4a,\
3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,00,00,\
00,01,00,00,00,00,01,01,00,00,00,00,00,05,13,00,00,00,01,01,00,00,00,00,00,\
05,13,00,00,00
“{aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}”=hex:01,10,08,00,cc,cc,cc,cc,50,02,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,c8,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,c8,00,00,00,01,10,08,00,cc,cc,cc,cc,b8,00,00,00,00,00,00,00,00,\
00,02,00,87,7d,6a,aa,8f,7f,2a,4d,be,53,fd,a5,55,cd,5f,e3,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,0c,00,02,00,14,00,00,00,00,00,00,\
00,14,00,00,00,40,00,70,00,6f,00,6c,00,73,00,74,00,6f,00,72,00,65,00,2e,00,\
64,00,6c,00,6c,00,2c,00,2d,00,35,00,30,00,31,00,33,00,00,00,14,00,00,00,00,\
00,00,00,14,00,00,00,40,00,70,00,6f,00,6c,00,73,00,74,00,6f,00,72,00,65,00,\
2e,00,64,00,6c,00,6c,00,2c,00,2d,00,35,00,30,00,31,00,34,00,00,00,0c,00,00,\
00,00,00,00,00,0c,00,00,00,50,00,6f,00,6c,00,69,00,63,00,79,00,61,00,67,00,\
65,00,6e,00,74,00,00,00,68,01,00,00,01,00,04,8c,50,01,00,00,5c,01,00,00,00,\
00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,00,10,18,00,ff,07,0f,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,10,18,00,ff,07,03,00,01,02,00,\
00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,28,00,ff,07,03,00,01,06,00,00,\
00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,57,a8,ae,0b,70,25,21,04,42,84,\
4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,\
9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,56,00,10,28,00,f4,03,02,\
00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,41,bb,45,ba,a8,7a,6c,bd,92,68,\
f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,\
00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,ff,1b,c4,5f,fd,d9,e0,4a,00,10,\
28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,0a,d8,62,3a,d9,c6,0f,\
18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,28,00,f4,03,02,00,01,06,00,00,\
00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,b1,4a,3b,45,db,50,5b,43,27,04,\
58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,00,00,00,01,00,00,00,00,01,01,\
00,00,00,00,00,05,14,00,00,00,01,01,00,00,00,00,00,05,14,00,00,00
“{38b977e7-40a1-446a-bd7f-6ab5980c5d16}”=hex:01,10,08,00,cc,cc,cc,cc,68,02,00,\
00,00,00,00,00,00,00,02,00,00,00,00,00,d8,00,00,00,04,00,02,00,6c,01,00,00,\
08,00,02,00,d8,00,00,00,01,10,08,00,cc,cc,cc,cc,c8,00,00,00,00,00,00,00,00,\
00,02,00,e7,77,b9,38,a1,40,6a,44,bd,7f,6a,b5,98,0c,5d,16,04,00,02,00,08,00,\
02,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,16,00,00,00,00,00,00,\
00,16,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,\
43,00,6f,00,72,00,70,00,6f,00,72,00,61,00,74,00,69,00,6f,00,6e,00,00,00,29,\
00,00,00,00,00,00,00,29,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,\
66,00,74,00,20,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,56,00,50,\
00,4e,00,20,00,52,00,65,00,63,00,6f,00,6e,00,6e,00,65,00,63,00,74,00,20,00,\
50,00,72,00,6f,00,76,00,69,00,64,00,65,00,72,00,00,00,00,00,00,00,00,00,6c,\
01,00,00,01,00,04,8c,50,01,00,00,60,01,00,00,00,00,00,00,14,00,00,00,02,00,\
3c,01,09,00,00,00,00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,00,10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,\
2c,02,00,00,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,\
41,10,b8,36,fc,4d,57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,\
03,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,\
0e,a7,8b,eb,ca,7b,42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,\
50,00,00,00,44,3e,41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,\
10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,\
ed,d8,54,5e,32,f4,ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,\
00,00,00,00,05,50,00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,\
78,83,39,5c,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,\
bf,1b,bb,45,ef,d2,b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,\
00,00,01,01,00,00,00,00,00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\SubLayer]
“{b3cdd441-af90-41ba-a745-7c6008ff2300}”=hex:01,10,08,00,cc,cc,cc,cc,c0,00,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,41,d4,cd,b3,90,af,ba,41,a7,45,7c,60,08,ff,23,00,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,03,00,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,30,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,35,37,\
15,4b,49,10,80,44,aa,b4,d1,b9,bd,c0,37,10,00,00,00,00,00,00,00,00
“{b3cdd441-af90-41ba-a745-7c6008ff2301}”=hex:01,10,08,00,cc,cc,cc,cc,c0,00,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,00,00,00,00,\
00,00,00,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,41,d4,cd,b3,90,af,ba,41,a7,45,7c,60,08,ff,23,01,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,02,00,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,30,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,ca,16,\
cc,de,33,3f,46,43,be,1e,8f,b4,ae,0f,3d,62,00,00,00,00,00,00,00,00
“{b3cdd441-af90-41ba-a745-7c6008ff2302}”=hex:01,10,08,00,cc,cc,cc,cc,28,02,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,41,d4,cd,b3,90,af,ba,41,a7,45,7c,60,08,ff,23,02,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,04,00,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,30,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,35,37,\
15,4b,49,10,80,44,aa,b4,d1,b9,bd,c0,37,10,00,00,00,00,68,01,00,00,01,00,04,\
8c,50,01,00,00,5c,01,00,00,00,00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,\
00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,\
28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,\
57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,\
00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,\
42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,\
41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,\
00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,\
ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,\
00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,\
28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,\
b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,\
00,00,00,01,00,00,00,00,01,01,00,00,00,00,00,05,13,00,00,00,01,01,00,00,00,\
00,00,05,13,00,00,00
“{9ba30013-c84e-47e5-ac6e-1e1aed72fa69}”=hex:01,10,08,00,cc,cc,cc,cc,28,02,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,a0,00,00,00,04,00,02,00,68,01,00,00,\
08,00,02,00,a0,00,00,00,01,10,08,00,cc,cc,cc,cc,90,00,00,00,00,00,00,00,00,\
00,02,00,13,00,a3,9b,4e,c8,e5,47,ac,6e,1e,1a,ed,72,fa,69,04,00,02,00,08,00,\
02,00,01,00,00,00,0c,00,02,00,00,00,00,00,00,00,00,00,01,a0,00,00,18,00,00,\
00,00,00,00,00,18,00,00,00,40,00,46,00,69,00,72,00,65,00,77,00,61,00,6c,00,\
6c,00,41,00,50,00,49,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,33,00,35,\
00,32,00,31,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,69,c9,\
eb,1b,a5,61,32,47,a1,77,84,7a,08,17,86,2a,00,00,00,00,68,01,00,00,01,00,04,\
8c,50,01,00,00,5c,01,00,00,00,00,00,00,14,00,00,00,02,00,3c,01,09,00,00,00,\
00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,00,00,00,2c,02,00,00,00,10,\
28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,f1,41,10,b8,36,fc,4d,\
57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,00,ff,07,03,00,01,06,00,00,\
00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,\
42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,44,3e,\
41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,70,e9,00,10,28,00,ff,07,03,\
00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,b5,af,a1,ed,d8,54,5e,32,f4,\
ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,\
00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,6d,2f,8b,78,83,39,5c,00,10,\
28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,00,00,6e,bf,1b,bb,45,ef,d2,\
b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,00,50,00,00,00,01,01,00,00,\
00,00,00,01,00,00,00,00,01,01,00,00,00,00,00,05,13,00,00,00,01,01,00,00,00,\
00,00,05,13,00,00,00
“{9367171b-3264-4f09-a0e8-81b38c162f17}”=hex:01,10,08,00,cc,cc,cc,cc,20,02,00,\
00,00,00,00,00,00,00,02,00,02,00,00,00,90,00,00,00,04,00,02,00,6c,01,00,00,\
08,00,02,00,90,00,00,00,01,10,08,00,cc,cc,cc,cc,80,00,00,00,00,00,00,00,00,\
00,02,00,1b,17,67,93,64,32,09,4f,a0,e8,81,b3,8c,16,2f,17,04,00,02,00,00,00,\
00,00,01,00,00,00,08,00,02,00,00,00,00,00,00,00,00,00,06,00,00,00,17,00,00,\
00,00,00,00,00,17,00,00,00,56,00,50,00,4e,00,20,00,52,00,65,00,63,00,6f,00,\
6e,00,6e,00,65,00,63,00,74,00,20,00,53,00,75,00,62,00,6c,00,61,00,79,00,65,\
00,72,00,00,00,00,00,e7,77,b9,38,a1,40,6a,44,bd,7f,6a,b5,98,0c,5d,16,00,00,\
00,00,6c,01,00,00,01,00,04,8c,50,01,00,00,60,01,00,00,00,00,00,00,14,00,00,\
00,02,00,3c,01,09,00,00,00,00,10,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,00,10,18,00,ff,07,03,00,01,02,00,00,00,00,00,05,20,\
00,00,00,2c,02,00,00,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,\
00,00,f1,41,10,b8,36,fc,4d,57,a8,ae,0b,70,25,21,04,42,84,4f,11,31,00,10,28,\
00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,\
dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,56,00,10,28,00,f4,03,02,00,01,06,00,00,00,\
00,00,05,50,00,00,00,44,3e,41,bb,45,ba,a8,7a,6c,bd,92,68,f4,ad,64,8f,d5,e6,\
70,e9,00,10,28,00,ff,07,03,00,01,06,00,00,00,00,00,05,50,00,00,00,79,09,78,\
b5,af,a1,ed,d8,54,5e,32,f4,ff,1b,c4,5f,fd,d9,e0,4a,00,10,28,00,ff,07,03,00,\
01,06,00,00,00,00,00,05,50,00,00,00,0a,d8,62,3a,d9,c6,0f,18,1b,65,b5,eb,d6,\
6d,2f,8b,78,83,39,5c,00,10,28,00,f4,03,02,00,01,06,00,00,00,00,00,05,50,00,\
00,00,6e,bf,1b,bb,45,ef,d2,b1,4a,3b,45,db,50,5b,43,27,04,58,d8,6b,00,10,14,\
00,50,00,00,00,01,01,00,00,00,00,00,01,00,00,00,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,00,00,00,00

Now the BFE Service needs some registry changes to assign the proper permissions using regedit. In Regedit go to ‘HKLM\System\CurrentControlSet\Services\BFE\Paramaters\Policy’ and change the permission on this and all sub keys by adding ‘NT Service\BFE’ (on a domain computer make sure to change location to the local computer rather than the domain) to the permissions list and making sure the special permissions of “Query Value” “Set Value” “Create Subkey” “Enumerate Subkey” “Notify” and “Read control” are assigned like the following image.

bfe service

Reboot your computer and the Firewall and BFE services should work correctly now and your AV software should be happy. I know that ESET Smart Security, ESET NOD32, and AVG are all affected by these services not running and assume there are more.

Please be warned that you can break your computer and that I nor Asset Technology take any responsibility if you break your computer trying these repairs. This is just documenting how I fixed some computers and passed the information along to my co-workers with good success.

Are You Listed?

Zary — Sat, 04 Jun 2011 01:22:38 +0000

When you’re promoting the services, products, or influence your company provides, it’s important to remember that your target audience is going to be “checking you out”.

Whether you’re posting an event on Facebook, sharing a particularly delightful event on Twitter, or managing to enter another blog post (ahem!), people will often do a bit of searching to find out more about your business. Your visibility and the things people find about you and your firm will sometimes mean the difference between a closed sale or a missed opportunity.

This is the part where we tell you about how our Internet Marketing services are the greatest thing ever, right? Nope.

This is where we tell you the even the most insignificant bit of information published about you and your company can be a great boon to your credibility. Asset Technology markets itself across many platforms, many sites, and uses many methods. We like to think we have our “ducks in a row”, so to speak. Occasionally, however, we miss something, and it reminds us to pay more attention to minute details. Here’s a perfect example:

In today’s case of “how did we miss this?”, I discovered we weren’t listed in one of the biggest directories for businesses that you can find on the ‘net. This directory comes up in the top 10 in almost any search for a known business, big or small. As a matter of fact, this site is so big, it crawls the Internet and finds you, lists you in its directory, and publishes the info whether you’re an active participant or not. So you’d think we’d be actively involved in listing our company with them, right?

Nope. Didn’t even think of it.

I found out we missed this opportunity quite by accident. I was “ego-surfing” for our company name, and discovered the listing by catching an odd keyword in the search results. Clicking the link, I discovered we hadn’t taken time out to research the reason this site had inaccurate information about us in its listings, and decided to fix it. Here is the result:

http://www.manta.com/c/mtgpztq/asset-technology-llc

Now you can clearly see we’ve put some effort into this, simply to clarify what we do and where we are, but also to touch on the key element of marketing: Give them a reason to contact you. I believe we’ve accomplished that by simply highlighting our affiliations, our skills, our products, and the areas we service. The rest is gravy.

As you can learn from our oversight, there are plenty of places to brag about yourself and the wok you do, and there are even more where you can fly the company colors. But none of that can happen if you aren’t diligent about checking your company’s information out on the web.

Odd product flaw HP 4650 color laser printer

Britt — Wed, 04 May 2011 05:03:09 +0000

I was trying to print an image full page and the printer jammed. The paper was stuck as it was exiting the fuser, about a half inch of paper crumpled up. I remove the paper, make sure there is no pieces in the fuser cartridge, close the printer and it proceeds to automatically reprint. Once again a jam, same situation, the paper is jammed at the fuser. I removed the fuser, the drum clean everything, blow out with air, check all of the rollers and cannot find a flaw. Auto reprint when I closed it back up and yet again a total fail. After a little while of doing some searching on Google, I found reference to this series printer having problems printing heavy/dark images at the top margin of the page. Turns out the toner sticks to the fuser roller and starts to wrap around rather than exiting the top of the printer. I cancel the print job and print a normal text page, no problem. I edit my image and cropped the top of the picture off which was a dark area of brown and black which I did not need, and what do you know, the image printed just fine.

We Don’t Know What’s Worse – You Tell Us!

Zary — Fri, 08 Apr 2011 00:31:41 +0000

We’ve had some requests recently to get involved in the servers of a few medical/health care firms, as well as some publicly-traded companies’ networks and storage systems, both of which require certain protocols for compliance with federal laws.

Anyone who’s been working with a specialty practice or something as large as an HMO network knows that governmental requirements for storage and access to patient data are more stringent now than they have ever been – and that’s good.

The problem, as we see it, is not that there aren’t “cheat sheets” or access to the necessary information to be “in compliance” with the associated regulations, rather, that there are SO MANY different rules to follow, depending on the industry. And that’s what bugs us.

So much, in fact, that we’re interested in what YOU think the most challenging compliance regulation is, and we want you to fill out the poll on our Facebook page:

http://www.facebook.com/AssetTechnology?sk=wall

Oh, and if you can, see if there’s a way to get all these government-types to play nicely with each other. It would really make this IT guy’s day.

What AA Battery Lasts the Longest?

Zary — Thu, 31 Mar 2011 19:59:12 +0000

Have you ever wondered which brand of battery will last the longest? In a test of AA batteries from several different makers (such as Rayovac, Energizer, Duracell), a test conducted at Worcester Polytechnic Institute concluded several very interesting things.

Dealnews features this article about it here:

http://dealnews.com/features/Test-Results-That-Will-Change-the-Way-You-Buy-Batteries-Forever/449005.html

While some manufacturer’s tout how great their battery is and how long it will last, the report indicates a couple of eyebrow-raising differences between battery types, including alkaline and lithium.

Our opinion notwithstanding, it’s sometimes just a matter of how you store your electronics when not in use that will dictate how long the batteries last.

Asset Technology Witnesses Drive-By Shooting in Phoenix…

Zary — Tue, 29 Mar 2011 20:48:29 +0000

ASSET TECHNOLOGY JUST HAD A DRIVE BY!!!

That’s right – our Phoenix office on Sheridan Street was passed by on multiple occasions this morning by a car that never stopped shooting. Fortunately, no one in the line of fire was hurt, and the driver and her car has been clearly identified.

Now, we know these pictures aren’t the best, but you can clearly make out the suspect vehicle’s camera on top (it’s painted Red), and the unmistakable vehicle wrap that delineates it as a vehicle that means to stick out while cruising neighborhoods.

The suspect is no other than the notorious Google.

You’ve heard of Google’s “Street View”, right? You know, the army of fuel-efficient cars with a long pole and “soccer ball” on top that drive around your city snapping photos of where stuff is? You can read more about the concept and technology here and here, but the bottom line is that we’ve been caught in the crossfire of Google’s assault on lack of visual proof that the Asset Technology office is part of Phoenix’s Coronado District. (They’re making a concerted effort to capture the view of the neighborhood that surrounds our renovated 1930’s church-turned-studio that houses our architecture partners as well as our IT team!)

In an effort to provide proof that the elusive Google cars DO exist, here are other photographs to prove it:

Look out! Here comes Google's best shooter!

Screamin' around the corner to take another shot!

What does this mean to us? Well, for one thing, we know we’re not the only ones being stalked, here. It also means our Tucson office on Broadway Boulevard will also be a prime target since Google mentions it’s in several of our Arizona counties right now with their fleet of photo-taking machines.

If you see one in your neighborhood, be aware, and be fast with the photos!

Another Informative Seminar by Robin Robins…

Zary — Sun, 27 Mar 2011 19:37:59 +0000

We’re saddened to see another year’s conference come and go. We had the opportunity to meet some great IT professionals, learn from industry leaders of IT and non-technology businesses, and gain insight into up-and-coming trends, which will be the talk of the business community in a very short time.

The Robin Robins Big Seminar (called “Boot Camp” and “Technology Marketing Speedway”) is our chance to get outside our business and understand that we’re not the only ones trying to keep our company headed in the right direction during the tumultuous events unfolding right now. It’s been an odd decade, with many major companies disappearing and smaller ones being gobbled up by conglomerates interested primarily in the bottom line. Our goal is not just to survive, but thrive.

Our business is growing because we allow ourselves the opportunity to attend events and trainin that makes us better business owners and Technology Specialists. Sure, we could use that money for other things (such as new laptops or cushy chairs), however, we’ve discovered there’s more to gain from investing in ourselves than in things that don’t return an investment.

That being said, if you are in the Information Technology field and own your own business, then you should consider attending events like this so you can become a stronger, more resilient company for the future.

The Conference Goes On!

Zary — Fri, 25 Mar 2011 19:35:59 +0000

The end of the week is here, but it’s not the end of the Robin Robins seminar. We’ve already heard from powerful speakers such as Bill Rancic, Dick Ruhe, Sean Stephenson, Robert Stevenson, and Kent Erickson. Our seminar is currently featuring John Jantsch, and a little later Robin Robins herself will jump on stage and help us learn how to gain sales and profits in our business. Tomorrow we’ll see and hear from Nido Qubein and Ken Glickman before we jump on a plane and head home.

It’s been an adventure and we’ve met some great people at Robin’s Big Seminar, also known as Technology Marketing Speedway this year. Participation is high, the energy is good, and there are lots of great ideas being exchanged about how to improve our marketing efforts, realign our thinking about planning the direction of our business, and generally improve our daily business behavior.

If you haven’t taken part of a business marketing and growth seminar, then you should check out the Technology Marketing Toolkit website and see if it’s a good fit for your managed service or traditional IT business.

Here We Go!

Zary — Wed, 23 Mar 2011 15:15:29 +0000

Today’s the big day – we’re off to Nashville for Robin’s Big Seminar, and this year it was sold out WAY ahead of time! Naturally, we planned ahead this year because we enjoyed and got so much out of last year’s event, and boy, we’re glad we did.

The agenda’s posted on her site at Robin Robin’s Website, but since the flight is about to board, it’s best for you to check it out on your own.

Updates after we land, but first, a nap!

See ya on the ground!

Bloated Windows folder cleanup

Britt — Sat, 19 Mar 2011 08:05:07 +0000

On an older install of Windows the hard drive is probably pretty full. On culprit maybe orphaned installer msi files in the c:\windows\installer folder. Deleting files directly out of any windows folder could be dangerous and is not recommended. However there are ways that are safe. There is a tool from Microsoft “MSIzap.exe” which will do this when ran with these options: msizap.exe !G

Sadly Microsoft has removed this from being an easy download and is no longer sharing this tool directly. Fortunately they still use it and you can get it by downloading the Live One Care cleanup tool from here http://download.microsoft.com/download/4/c/b/4cb845e7-1076-437b-852a-7842a8ab13c8/OneCareCleanUp.exe and then extracting the msizap.exe using your favorite compression tool such as 7zip.

On the most recent computer I cleaned up using this tip I am sharing, I recovered 10GB of drive space on the computer. Good luck with your quest for more space.