Advise and assistance needed.

[mona7865]

I recently acquired a HP Compaq mini-PC 730 EB and spent the best part of last weeks' evenings configuring and updating it. Firstly I installed OA Firewall 3.5.0.14 (free version), Avira Antivir Premium, MBAM (paid version), Winpatrol and Spywareblaster.

Then I started on Windows updates (there were around 56) and this went well apart from KB 928416, NET Framework 3, which fails to install (Error Code: 0x643). I've been searching the internet to find more information and a solution (one of them was to reinstall NET Framework 3, but then I got the message "a newer version has already been installed on your system".)

I also ran Secunia PSI which gives the all clear (all programs fully patched).

So I would like to know:

- is it necessary to have this KB installed?

- if so, do I have to uninstall NET Framework 3.5 and NET Framework 3.0 and then try to reinstall them?

- if not, why does Windows update keep telling me I have to install it?

I would be very grateful for any given advise and assistance.

Edited June 26, 2009 by mona7865

[exile360]

It's a good idea to install all .NET framework patches, as many are security related as well as bug fixes. Check out this page to see if it's helpful or not.

edit: I also found this, but I think you tried that already. To uninstall an older version of .NET (3.0 in this case) you'll most likely have to remove 3.5 first, then uninstall 3.0 per the instructions on that page.

[mona7865]

I already tried the suggestion on Lancelhoff.com but I'll follow your advise and will uninstall NET Frame 3.5 and 3.0 and then reinstall and try to update again.

I'm at the office right now so I'll do this first thing this evening and I'll let you know the results.

Thank you very much!

[exile360]

I also noticed here (in a thread you've no doubt already read through) that one user had success simply by rebooting and rechecking for updates a few times. You might also post the info from the install log referred to in the second post there as it might have a clue to the cause as well .

[mona7865]

Exile, problem is solved after four (!) attempts of uninstalling and reinstalling NET 3.5 and 3.0 (with running CCleaner and restarting after each uninstall/reinstall). The odd thing is this KB928416 was an optional update (language pack and didn't include Dutch) perhaps this is why it failed to install; also Secunia PSI kept giving the "all clear".

One shouldn't look a gift horse in the mouth but this one appeared to be a stubborn little mule.

Thanks again for your help.

[exile360]

Yeah, these .NET installation issues come up a lot (so much so that Aaron Stebner has a blog dedicated to dealing with them ). I'm glad you finally got it working. If you need anything else, just let us know.

[mona7865]

Exile, I need your kindly help again with the HP Mini PC: yesterday, I updated Jave to jre-6u15 (after uninstalling 6u14, running CCleaner and rebooting). Afterwards, I ran Ssecunia PSI, which found 6u14 in: C:\System Rollback Data\Restore\Current\52171\9\Target\PROGRAM FILES\Java\jre6\bin\java.exe and C:\System Rollback Data\Restore\Current\52171\9\Target\WINDOWS\sytem32\java.exe. I then ran JavaRa and rebooted. Ran Secunia PSI again but it still detected those two in "patched programs". I'm not at all familiar with this "System Rollback Data" (don't have it on my Dell) and I just don't have a clue how I can fix this (I went to the map suggested by Secunia but it is a mystery to me what to delete and what to leave untouched).

Heartfelt thanks.

[exile360]

That's just the leftovers in SystemRestore. They're harmless there, but if you're really determined to remove them just disable System Restore, reboot, then turn System Restore back on . Just make sure everything is working OK before you do so that you don't end up removing the restore points only to find that you need one .

[mona7865]

Exile, I'm so sorry to take up your valuable time: I just got a brainwave and ran disk clean (let it remove all system restore points exept for the last one), rebooted, and, as you stated, they are gone now. I should have done more research before bothering you (I'm at the office now and decided to take a very early lunchbreak to search for more information ) It's back to work for me now .

Reason for edit: typing error.

[Tarun]

Good move Mona, that's the correct way to clean out old system restore points. Safe, no risk.

[mountaintree16]

Sorry for buttin' in.

I have turned system restore off and then back on on a couple machines, didn't know I should reboot in between. Does that make a big difference?

That's just the leftovers in SystemRestore. They're harmless there, but if you're really determined to remove them just disable System Restore, reboot, then turn System Restore back on . Just make sure everything is working OK before you do so that you don't end up removing the restore points only to find that you need one .

[DaChew]

Normally there's no need for a reboot when purging old system restore points, but remember to only do it when you are reasonably sure you don't have any problems. I have started telling posters to defrag after purging restore.

[DaChew]

Remove all but the most recent Restore Point on Windows XP

You should

Create a New Restore Point

to prevent possible reinfection from an old one.

Some of the malware you picked up could have been saved in System Restore.

Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.

Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to

"roll-back"

to a clean working state.

The easiest and safest way to do this is

:

• Go to
  Start
  >
  Programs
  >
  Accessories
  >
  System Tools
  and click "
  System Restore
  ".
• If the shortcut is missing you can also click on
  START
  >
  RUN
  > and type in
  %SystemRoot%\system32\restore\rstrui.exe
  and click OK
  
  
• Choose the radio button marked "
  Create a Restore Point
  " on the first screen then click "
  Next
  ".
  
  
• Give the new Restore Point a name, then click "
  Create
  ".
  
  
• The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  
  

• Then use the
  Disk Cleanup
  to remove all but the most recently created Restore Point.
• Go to
  Start
  >
  Run
  and type:
  Cleanmgr.exe
  
  
• Select the drive where Windows is installed and click "
  Ok
  ". Disk Cleanup will scan your files for several minutes, then open.
  
  
• Click the "
  More Options
  " tab, then click the "
  Clean up
  " button under System Restore.
  
  
• Click Ok. You will be prompted with "
  Are you sure you want to delete all but the most recent restore point?
  "
  
  
• Click
  Yes
  , then click Ok.
  
  
• Click
  Yes
  again when prompted with "
  Are you sure you want to perform these actions?
  "
  
  
• Disk Cleanup will remove the files and close automatically.
  
  
• On the
  Disk Cleanup
  tab, if the
  System Restore: Obsolete Data Stores
  entry is available remove them also.
  
  
• These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.
  
  

Additional information

Microsoft KB article: How to turn off and turn on System Restore in Windows XP

Bert Kinney's site: All about Windows System Restore

[mona7865]

I usually work like this (on my Dell laptop): the last day of the month I run Disk Cleanup and let it remove the old restore points except te last one (but only when everything runs smoothly and I haven't had any problems), run disk defrag and then do a back up on an external drive.

I'm still configuring the HP mini to my liking so that involves installing some programs, testing them out for a couple of days, and then I either keep them for further use or uninstall them.

I've figured out though that no systems are alike so I still have a lot to find out about the proper working of the HP mini (with a lot of help from the experts here ).

[mountaintree16]

Thanks DaChew

[mona7865]

As I mentioned in a previous post, I've been installing/uninstalling (using Revo Uninstaller mostly) quite a lot of programs to configure this HP mini to my liking. I would appreciate it very much if someone could have a look at the autoruns.arn file which I created, after being advised to run this app by Exile, to see whether there are any leftovers left to be removed.

Heartfelt thanks once more.

[exile360]

Hi Mona .

Looks like something went haywire. The zip file you uploaded is empty (no Autoruns.arn file in it ). Please try again, thanks .

edit: Here's the instructions again in case you need them:

Please download Sysinternals Autoruns from here.

• Save Autoruns.exe to your desktop and double-click it to run it.
  
• Once it starts, please press the Esc key on your keyboard.
  
• Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures
  
• Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
  
• When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop.
  
• Now right-click on the Autoruns.arn file located on your desktop and highlight Sent To and select Compressed (zipped) Folder
  
• Please attach the Autoruns.zip file you just created to your next post.
  

[mona7865]

Hi Exile, sorry for the late reply (was out doing my weekly shopping). I repeated the whole procedure exactly as asked and I hope it turns out to be alright now.

Thanks again for your time.

[exile360]

Hi Mona. It appears you have both AVG and Avira installed. If that's the case I'd highly recommend removing one of them as you should only have one antivirus installed at a time (my preference is Avira, but keep whichever you'd like).

As for leftovers from other software I see some leftovers from Norton. These should be easily removed by the Norton Removal Tool. Just run it, and reboot when it finishes.

To verify that it removed them, run Autoruns again and verify that the following do not exist:

• Under HKLM\System\CurrentControlSet\Services:
  

  
  

• NAVENG
  File not found: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS
  
  
• NAVEX15
  File not found: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS
  
  
• SRTSP
  File not found: C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSP.SYS
  
  
• SRTSPX
  File not found: C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSPX.SYS
  
  

  
  

If they do still exist, simply right-click on each entry and select Delete.

[mona7865]

Exile, I ran the Norton uninstall tool as advised, rebooted and those four entries are gone now, thanks.

Wat surprises me is that it seems I have both AVG and Avira installed as antivirus programs as the only program I had installed was AVG Linkscanner, which could be downloaded as a standalone (free) program.

For good measure I uninstalled it (using Revo Uninstaller), rebooted, ran the AVG uninstall tool and rebooted once more so I hope it's completely gone now.

I didn't realize it might have been detected as an antivirus though.

Thanks again for your time and invaluable advise, it is greatly appreciated.

Have a nice weekend.

[exile360]

Oh, ok. I didn't realize it was Linkscanner. It shouldn't conflict with Avira at all, but there are certainly better similar tools out there to Linkscanner such as Web Of Trust that you can use to warn you about malicious websites .

[mona7865]

Well, I have both WOT and Finjan installed but, since I intend to use the mini to visit websites such as Facebook, Twitter and My Space and use it to chat with some friends I installed Linkscanner as well (better safe than sorry).

[exile360]

Have you had a look at HostsMan yet?

[mona7865]

I have HP hosts on the mini (I tried HostXpert - which I use on my Dell - but that froozes so I opted for HP hosts only). I'll give it a try.

[YoKenny1]

I prefer HostsMan and its browser speedup proxy HostsServer plus I use its logging with Log referrer selected to show the effectivness of the HOSTS file and set On site blocked, dispay: message

I am using HostsMan 3.2.71 Beta7

I gave up on WOT ages ago as its ratings are to subjective.