Adventures in cleaning (my cranky) computer

[TaoPhoenix]

I decided I had a bit of energy to spare so I decided to at least start the ugly grind of cleaning some junk off my computer.

A few things had been creeping in, and I won't be done today, but I figured my notes might help at least one other person out there!

1. Getting started

I started with this decently thorough looking overview of some of the standard tools.

http://malwaretips.c...e-exe-virus-removal/

This all started not from the browser side, but because separate from "plugin-container", I noticed "PluginService.exe". According to the guide it's not a full virus itself, but apparently "accessory to other crimes". On a whole other note, I'd noticed that some random program hijacked my zip file association. It's supposed to be Chris G's Fast Unzip Snack we'd worked on here, but a week or two ago something jumped up in there so I figured I'd go skeet shooting today and try to get at least a little stuff done.

Courtesy of Shades reminding me of Process Explorer, I also just now identified "WinZiper" - and Process Explorer does a good job with "name" so it has some def suspicious weird looking Chinese name.

So I set out first downloading the following tools:
adwcleaner
Junkware Removal Tool
Malware AntiMaware (I went with the free version)
Hitman Pro

Elsewhere I (think) have Hijack This which I might run later.

First Step was Add/Remove programs in Windows. I'm on XP. The PluginService thing hid itself from uninstall, but Karen Directory Reader found it easily enough. It's currently sitting at:
C:\Documents and Settings\All Users.WINDOWS\Application Data\IePluginServices\PluginService.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\IePluginServices\update\conf

AdwCleaner certainly found that and WinZiper.
WinZipper/WinZiper does at least seem/pretend to play fair. I just now removed it from Add/Remove Programs. ReRunning adwcleaner .... survey says ... that it might be gone for now. So far so good enough.

Onward with trying to remove PluginService with adwcleaner.

[MilesAhead]

I envy those who have a stable setup.  They install their programs, configure them, then make an image before the system gets loaded with bloat.  Every so often they restore from the image(having their data on an external drive most likely.)

I wish I could do that.  But I'm always trying freeware I see and tweaking settings, changing browsers and AddOns etc..  Plus writing small utilities.  I don't have a stock setup that I can save as backup.  Just make another image every so often.

I know you have your work ahead of you.   

[TaoPhoenix]

Well, the first round seems to have gotten rid of most of that "Babylon"/other browser hijacker stuff.

Somehow Microsoft's "disk cleaner" stopped working, but ccCleaner claims to have done that part, deleting some 700 megs of temp files and stuff.

Next up and more disturbing is there seems to be X amount of stuff that isn't getting pulled by add-delete programs. Dooble Web browser is the first one I just uninstalled by hand. (It seemed to do so, so far.) A quick glance sez there's more stuff in there.

Hey, by the way, I don't see any of those "Welcome to enhanced Firefox with sponsored ads" pages right now. Did they get such a vicious backlash that Mozilla removed them?

[MilesAhead]

I just uninstalled by hand

-TaoPhoenix (April 07, 2015, 02:55 PM)

I find CCleaner Registry Cleaner very useful after having to remove programs manually.  It does a good job of getting rid of no longer supported file type associations, missing handlers etc..

I always save the .reg backup file it makes.  I only got burned on one version of CCleaner messing up my Registry.  But you never know when that bug may pop up.

I forgot about the FF ads.  I hope that means they're gone.  Out of sight out of mind. 

[TaoPhoenix]

CCleaner

-MilesAhead (April 07, 2015, 03:12 PM)

I trust you!

I've known what registry cleaners do for a decade. But I didn't want to risk just a cheap lookup on the web. But yes, my copy of ccCleaner has the registry module - I just ran it now, and since it's basically the first time ever, it fixed some 2000 issues!

I'm also installing those "alt xp updates" from that tip a way back. No, I don't have a full alt image backup, but I checked the web and didn't see any rash of horror stories either.

Though as part of "simplifying" I deleted FF regular and Nightly (and Chrome!), and am just keeping PaleMoon and FF Dev Edition.

So I am just about done I think. The big browser hijacks seem to be mostly gone, and this should last me for a while.

[Shades]

Be wary of any registry cleaner. If you have a program that didn't make proper use of the registry, the registry cleaner could mark this as something to fix or remove. Result? Your application wouldn't work anymore.

Not all programs are written properly and registry cleaners have a notion to be over-zealous in getting the highest number of "errors" they need to fix. Once you hit the 'Fix all errors'-button, you could be going from a (reasonably) working system to making a recover attempt from a restore point or even re-installation of Windows in just a minute.

Personally, I haven't used a registry cleaner in years. Sorry for being harsh, but I am inclining to say that you deserve whatever misery you get into after a registry cleaning.

Your registry won't be much smaller or faster or stored more optimal on disk. Only that last item could make some (debatable) difference.

The best advice? Leave the registry alone. Better keep a tool that makes a snapshot of your system (including registry) running in the background when you install some new piece of software. Once you want to get rid of this software, use that same tool again to revert all changes this new piece of software made. This is the better way to keep your system lean and mean. I believe Comodo offers such a tool as (limited) freeware and commercially licensed.

[TaoPhoenix]

Be wary of any registry cleaner. If you have a program that didn't make proper use of the registry, the registry cleaner could mark this as something to fix or remove. Result? Your application wouldn't work anymore.

Not all programs are written properly and registry cleaners have a notion to be over-zealous in getting the highest number of "errors" they need to fix. Once you hit the 'Fix all errors'-button, you could be going from a (reasonably) working system to making a recover attempt from a restore point or even re-installation of Windows in just a minute.

Personally, I haven't used a registry cleaner in years. Sorry for being harsh, but I am inclining to say that you deserve whatever misery you get into after a registry cleaning.

Your registry won't be much smaller or faster or stored more optimal on disk. Only that last item could make some (debatable) difference.

The best advice? Leave the registry alone. Better keep a tool that makes a snapshot of your system (including registry) running in the background when you install some new piece of software. Once you want to get rid of this software, use that same tool again to revert all changes this new piece of software made. This is the better way to keep your system lean and mean. I believe Comodo offers such a tool as (limited) freeware and commercially licensed.

-Shades (April 07, 2015, 09:27 PM)

Well, let's call this a draw.

First, I was definitely wary. My first goal of spending a full half day on stuff I kept putting off, was that those browser hijackers had taken several steps to inject themselves into stuff, worse than I've seen in a long time. I know articles range from useful to placebo to downright "invented content horror", but the rough gist was that these thingies had registry components running around, and I think I got just about all of them.

After that, I did take a medium look at the proposed list, and big chunks of the suggested ones were items that belonged to programs that I had uninstalled. Microsoft Silverlight left behind something like thirty of them all by itself even after the official uninstall. I don't feel a rabid need to do this very often at all, but once for the first time in years myself, seemed decent enough. I don't wildly test software like I used to, so this is probably quite plenty for a long time to come.

As for your suggestion about the snapshot software, I'll take suggestions for an easy one that can modularly reverse each software's changes. I thought broadly that's what add-remove uninstall was supposed to do - but apparently it doesn't. One of the hours I spent today was stuff that was not even registering in the add-remove list, which I'm pretty fuzzy on how that happens.

So I did just grand this time, but I also don't feel I need to tempt fate much either. So I'll prob just stay here for a chunk of time as I change from more comp curiosity to life direction changes.

[tomos]

As for your suggestion about the snapshot software, I'll take suggestions for an easy one that can modularly reverse each software's changes. I thought broadly that's what add-remove uninstall was supposed to do - but apparently it doesn't.

-TaoPhoenix (April 08, 2015, 01:57 AM)

sounds more like system restore - dont use it often but it has usually worked well for me...

[Curt]

One of the hours I spent today was stuff that was not even registering in the add-remove list, which I'm pretty fuzzy on how that happens.

-TaoPhoenix (April 08, 2015, 01:57 AM)

-are you sure they were installed and not just unpacked? I know that I soon will have forgotten if I installed or merely unpacked a program. One way to have a clue is, if a proper folder has been created (by the program in question) in Start > All programs, or if you merely have a shortcut somewhere.

[MilesAhead]

It is good to have Registry backup short of Restore Points, although I use those too.  I have used ERUNT for years.  Read the readme as it has dense information packed in.  A bit wordy.  But this utility has worked for me in every NT based OS.

Of course I use Restore Points and image backups also.  Many who say never clean the registry probably only have Windows clean installed off the CD/DVD and don't suffer the crapware leftover crud we who buy at Best Buy getting preloaded OS have to suffer.  I've had this Laptop since October 2014 and just last week I found Norton still had a task in Task Scheduler even though I uninstalled it, ran the removal tool many times, and cleaned it out of the Registry.

As I mentioned, I got complacent after running CCleaner Registry Clean across dozens of minor version updates with no issues.  I had one bad minor version update where it caused a problem.  I restored the Registry using a Restore Point.  The next CCleaner update the bug was fixed.  So now I always make the .reg file backup before cleaning as well as having current ERUNT saves etc..

Especially file associations will leave a bunch of crap in the context menu.  Again, for those who run servers with a stable assortment of software it's not the same as for those of us who try every new freeware that pops up on Softpedia.  Likewise I cannot do an image save of a clean fresh install and just lay it back on every few months to freshen up the Windows install.  I'd lose a lot of tweaks and tinkering.  I have to make an image every couple of weeks or so as well as backing up files.  It's different than running a stable system setup.

However I do agree that when I see ads to speed up your system by cleaning the registry and other tweaks I move on.  Cleaning the Registry should only be donewhen fixing it by hand would likely cause more errors than fixed.  Sometimes uninstall programs just leve the settings assuming eventually you will install a newer version of their wonderful software.

[TaoPhoenix]

One of the hours I spent today was stuff that was not even registering in the add-remove list, which I'm pretty fuzzy on how that happens.

-TaoPhoenix (April 08, 2015, 01:57 AM)

-are you sure they were installed and not just unpacked? I know that I soon will have forgotten if I installed or merely unpacked a program. One way to have a clue is, if a proper folder has been created (by the program in question) in Start > All programs, or if you merely have a shortcut somewhere.

-Curt (April 08, 2015, 02:28 AM)

I'm not sure what this question means. Dooble Browser, as an example, had a full folder in C/Program Files, and it loaded, but it wasn't pulled for Add/Remove Programs. I don't "unpack" things to C/Prog Files, so it could only have gotten there with an installer.

Sometimes I do advanced installs and don't put in start menu shortcuts, but there's no clear reason why it shouldn't get pulled for add/delete programs unless it's just a cute .exe that just sits there and does stuff, but that's not what this case situation is because I put those kinds of things on desktop/subfolder, not C/Prog Files

[TaoPhoenix]

Some of y'all are talking about images - that's not the tool I wanted. I mentioned earlier about "modular" - if I install five things and later want to remove #2, images aren't going to help me - what I want is a tool that captured the full changes caused by prog install #2, that then correctly reverses it, registry and all. More like a super-uninstaller, since I am getting quite tired of "Windows uninstalled X, some things have to be deleted manually". That's where all of this junk ended up from to begin with.

(And I still can't get about five things out of there, "because a script / file is missing" - there's manual stuff on the web but I ran out of energy this time. EMET is one of them, and that program gave me problems through its entire life cycle.)

[MilesAhead]

Some of y'all are talking about images - that's not the tool I wanted. I mentioned earlier about "modular" - if I install five things and later want to remove #2, images aren't going to help me - what I want is a tool that captured the full changes caused by prog install #2, that then correctly reverses it, registry and all. More like a super-uninstaller, since I am getting quite tired of "Windows uninstalled X, some things have to be deleted manually". That's where all of this junk ended up from to begin with.

-TaoPhoenix (April 08, 2015, 10:06 AM)

The trouble with uninstall utilities that take a snapshot during install to get rid of everything during uninstall is if you install other stuff between those 2 events.  The uninstall can munge what got installed in the middle.  It's ok for a test where you install using the snapshot utility, run it and test it, then remove it, without installing anything else.  At least I haven't heard of one that works perfectly.

[Giampy]

I constantly use certain programs in virtual environment. No trash in my PC.
Virtualization is sometimes a solution.

[anandcoral]

Hi Tao, what Miles says is right. I remember using a utility, can not remember the name properly now, something like ATTUNE or so. I used it during Win98. It had options to run before installing a program, when it created snapshot of the current system files, registry etc. Then after installing the program, run ATTUNE (?) which again creates the snapshot of the files and registry changes.

Now when I need to uninstall the program, I run ATTUNE (?) and it restores the system and registry changes. But this caused problem if I have installed some other programs in between or Win updates happened etc. This program (ATTUNE ?)did not work in new Win version and I did not find the updated so I left it.

At present I think you can use Sanboxie, as per your requirement. Your main system remains clean when you remove the program in Sandboxie. I have not used it but others here may have idea of it.

Regards,

Anand

[MilesAhead]

For trying utilities without risking messing up your system both virtualization and Sandboxie will work.  Another quick and dirty free way to accomplish this is to use ToolWiz TimeFreeze.  It protects the system partition by using shadow service to fake programs out.  The program saves files, changes Registry etc. but this is all redirected to a cache file by the shadow service.  When you reboot the installed program and all its settings are gone.  This is good for a one off trial.  If you want to use the program for some length of time the other options are more suitable.

I have used Snadboxie for years.  It is especially effective on a 32 bit Windows since it can patch the kernel in memory. On x64 Windows it does other things but they aren't as elegant a solution as the patch.  Win64 has PatchGuard so the Sandboxie simple method to protect the system is stymied.  But it uses other stuff like Drop My Rights etc..


Edit:  right now the link seems to take awhile to load.  But it did load.  If not you can get it from SnapFiles:
http://www.snapfiles...et/twtimefreeze.html