1. Basic Computer Cleanup plus Data Recovery procedures on PC and MACs or “How to raise a computer from the dead” Larry James University of Nebraska Chris Marsh Gettysburg College

2. UNL stats 24,500 Students (Undergrad and Grad). 6000 Living in Residence Halls on 2 campuses. Wireless in all Residence Halls since Oct. 2009 Full-time Manager plus 2 Student Workers. We supplement the Computer Help Center. Started with SafeConnect, August 2010 We Generally Don’t: –Fix hardware. –Make room visits.

4. G-Tech 2,600 Undergrad students Live on campus and/or college owned off campus housing Over 250 wireless access points on campus Full – time manager/supervisor tech plus up to 14 student workers We manage all personal computer software and hardware issues for students No room visits other than first year move-in day aka blitz Only escalate computing issues if found necessary.

6. Diagnosing and Documentation

7. Clearing out unneeded files CCleaner is our staple utility. Uncheck “Autocomplete Form History”. Run CCleaner. Go to “Registry”. “Scan for issues”. “Fix selected issues”. “Backup changes to the registry?” Yes the first time. Scan again. Fix again. Go to “Tools”.

8. CCleaner continued Go to uninstall. Look for obvious malware/spyware and remove. Look for old versions of Java and remove. Go to Startup. Look for startup items that don’t work. Disable or delete them.

9. Disable System restore Disable recycle bin Erase Temp files Check AV History (may need to re-install) Check regedit (run files) –HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run –HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Internet issues – check hosts file for changes –C:\windows\system32\drivers\etc\host –hijackthis Prep for cleanup

10. Other tools you might want: Revo Un-installer MSICUU2 Killbox TDSSKiller Exefix.reg Panda USB vaccine Unhide Tweaking.com All-in-One (similar to Dial-a-fix)

11. Tools Most used Hijackthis Malwarebytes Spybot Combofix Reg cleaner –Ccleaner, AWC, Glary utilities Used as needed Process Explorer Autoruns AV rescue disk D.A.R.T Various small tools e.g., Kaspersky scan, gmer, blacklight, etc. (FSS)

12. Obvious removal O2 - BHO: (no name) - {1A214F62-47A7-4CA3-9D00-95A3965A8B4A} - C:\PROGRAM FILES\POPUP ELIMINATOR\AUTODISPLAY401.DLL (file missing) Overview of items in the HijackThis logs http://www.pchell.com/support/hijackthistutorial.shtml http://forums.majorgeeks.com/showthread.php?t=38752 Tutorial of features http://www.bleepingcomputer.com/tutorials/how-to-use-hijackthis/#HTRestore How to use

15. http://www.bleepingcomputer.com/forums/topic441075.html Farbar Service Scanner is a small, portable and free application that gives a detailed report on the files, registries and services that are responsible for network connectivity

16. Other resources & tips Microsoft Support “Fix-it”s Major Geeks Bleeping Computers You may have to rename some tools to allow them to do their work. Typically I rename mbam.exe and combofix.exe to fred.exe and cfix.exe. You may have better luck pulling the hard drive and installing it as a slave to a secure computer.

17. Fake Antivirus (ransomeware) Best tool found is Malwarebytes and/or Combofix. May need to copy over the malwarebytes folder from another computer to get the latest updates. Important to educate the student body about NOT clicking on the “click here to download a program that will clean up your computer” pop-up.

18. Backup Unbootable hard drives (virus or failing) WinPE(WinPE (http://www.mydigitallife.info/official- windows-7-sp1-iso-from-digital-river/)http://www.mydigitallife.info/official- windows-7-sp1-iso-from-digital-river/ MS DaRT Linux USB to Sata adapter cable Mac computer*(exFAT)

19. ‘Dead’ Windows Computers Don’t overlook the basics! F8 “Repair your Computer” Startup Repair Command prompt chkdsk c: /r System Restore is your friend. You may need an install disc to get there. Windows fresh install is usually worth trying unless it’s a hardware problem for sure. Windows Universal Boot Disc + External HD can save a student’s grade. Also big bucks! $$$$ Same with pulling the HD

20. ‘Dead Apple Computers There is a nice net boot diagnostic available. It takes an apple server and works on the LAN. This helps us diagnose even MACs still under warranty and tell if it’s just a bad battery or charger. UNL’s Hardware Repair is Apple Certified, the ResNet Office defers to them for any serious MAC issues.

22. Apple Target mode (also used to re-install MacOSX) Single user mode (fsck –fy) Option + D ( diagnostics – built into systems July 19, 2011) Disk Warrior Onyx –System must be bootable Apple Jack –must be installed prior –Access only from single user mode

23. Checklist for giving computer back System Restore on All critical MS updates Remote Access disabled* Drivers updated Log on password discussed *Unless they have a legitimate use for it and understand the risks.

24. Student Education at pickup Show them what you’ve added. (Symantec, Malwarebytes.) Have them open, and manually update each one. Have them find the ‘scan’ button. Talk about regular scans. (Timing, what to look for, etc.) Have them check for MS Updates. Finally let them go.

25. Questions? Comments? Overripe produce? Job Offers?

26. ©2007 The Board of Regents of the University of Nebraska. All rights reserved. Thanks for listening. Our email: ljames2@unl.edu cmarsh@gettysburg.edu Please complete the on-line evaluation at: http://resnetsymposium.org/rspm/evaluation/