O.T. Avast pop-up

Robert in CA wrote:

My fault, I forgot to boot from the Macrium Rescue CD
So I tried it again.... but this time I could not locate
the mrimg files because the drive wasn't highlighted. It
had every other drive except the one I needed. I went back
to re-check the path.

http://i66.tinypic.com/5uee5x.jpg

I tried again but the drive I was not accessible.

http://i64.tinypic.com/33l0706.jpg

http://i67.tinypic.com/2daxf8z.jpg

Also when restarting it gave me this message:

Windows 7
build 7601
This copy of Windows is not genuine.

So why isn't drive I accessible and why did I get the message
my Windows7 is not genuine. This is the first time I ever saw
such a message and I bought this Dell 8500 new and I have the
key codes and everything.

Thoughts/Suggestions?

Robert


Would that be a drive for the 780 ?

Do you have the drives labeled, as to which
machine they go with ?

That sounds vaguely like the Win7 Refurbisher OS
on the 780, being run on the 8500.

If you run Device Manager (devmgmt.msc) and
look at the condition of Device Manager, there
could be a few missing drivers as well, as proof
the disk came from the wrong machine.

Paul

I have read all your posts along with Pauls
I did not know that the drive letters would
change but I still cannot find the Mrimgs.

Thanks,
Robert


On Monday, June 24, 2019 at 8:55:31 PM UTC-7, J. P. Gilliver (John) wrote:
My apologies: ignore my post timed at xx:0:59 [xx may vary with timezone
where you are reading and with what newsreader] telling you to make the
Macrium CD if you haven't already; it crossed with your post below. I
know you _have_ made the Macrium CD. (Read on.)


[]
My fault, I forgot to boot from the Macrium Rescue CD
So I tried it again.... but this time I could not locate
the mrimg files because the drive wasn't highlighted. It
had every other drive except the one I needed. I went back
to re-check the path.

http://i66.tinypic.com/5uee5x.jpg

I tried again but the drive I was not accessible.

Note that drive letters in a system booted from the Macrium CD will
almost certainly not be the same as those in a system running Windows
booted from the HD as usual. Identify which drive (partition, really) is
which by giving them volume names, and/or looking at the model numbers
(I see one of yours is WDC something), and/or looking at the capacities
and how full they are.

I presume the above is a screenshot of Macrium running under Windows;
you appear to be imaging three partitions from MBR Disk 1 (that's
physical disc, model number starting ST1000): a tiny (39 MB!, only 1K
used) one with no letter, a "RECOVERY" one with no letter (24G, 13瘦
used), and "Win7 New" alias C:, of 907G, 142G used. You seem to be
putting the image on what Windows is calling partition I (which is
presumably not on the same physical disk; I can see from the
partially-obscured bit behind that you have a Disk 2 which is WDC
something. I don't know if that's the one with what Windows is calling
partition I on it).


http://i64.tinypic.com/33l0706.jpg

I can't see that image (-:


http://i67.tinypic.com/2daxf8z.jpg

That, I presume, is a camera shot of Macrium having booted from the
Macrium CD. You can see it's playing with the partition letters - for
example, the "RECOVERY" partition (which is one of those you would be
restoring from the image), which didn't have a letter when you made the
image, it has this time given the letter J, and the CD drive it has
given the letter K. I presume there are drive/partition letters G, F, E,
and D, at least, off the top of your window. One of those _should_ be
what was partition I: when you made the image. [That's another reason I
could give for booting from the CD even when _making_ the images: the
drive/partition letters are more likely to remain the same (though still
not what they are in Windows)!] If you try each in turn, hopefully on
one of them, it'll find the .mrimg file you made.


Also when restarting it gave me this message:

Windows 7
build 7601
This copy of Windows is not genuine.

So why isn't drive I accessible and why did I get the message

It is, I hope - Macrium is just not _calling_ it drive I, but another
letter. You'll know it's the right one, I hope, because you find the
relevant .mrimg file on it. (And possibly by its size, label [name], and
amount free.)

If you still don't find it, it's possible you need drivers, depending
where your drive with the image on actually is - is it over your
network? I just use an external drive connected via USB, which even
Macrium 5 finds without drivers. When the Macrium CD is booting, it does
ask me if I need certain drivers, and I say no; I presume Macrium 7 does
something similar.

my Windows7 is not genuine. This is the first time I ever saw
such a message and I bought this Dell 8500 new and I have the
key codes and everything.

I've never seen that message during a Macrium recovery. Anyway, looks
from the photograph as if the Macrium CD is working regardless of that
message.

Thoughts/Suggestions?

Robert

If you _do_ find the image file, it'll show you the partitions it
contains (presumably the same three you left ticked when you made the
image), and ask you which ones you want to restore - which will be all
of them.

Good luck!
--
J. P. Gilliver.

On Monday, June 24, 2019 at 8:54:24 PM UTC-7, Paul wrote:
Robert in CA wrote:

My fault, I forgot to boot from the Macrium Rescue CD
So I tried it again.... but this time I could not locate
the mrimg files because the drive wasn't highlighted. It
had every other drive except the one I needed. I went back
to re-check the path.

http://i66.tinypic.com/5uee5x.jpg

I tried again but the drive I was not accessible.

http://i64.tinypic.com/33l0706.jpg

http://i67.tinypic.com/2daxf8z.jpg

Also when restarting it gave me this message:

Windows 7
build 7601
This copy of Windows is not genuine.

So why isn't drive I accessible and why did I get the message
my Windows7 is not genuine. This is the first time I ever saw
such a message and I bought this Dell 8500 new and I have the
key codes and everything.

Thoughts/Suggestions?

Robert


Would that be a drive for the 780 ?

Do you have the drives labeled, as to which
machine they go with ?

That sounds vaguely like the Win7 Refurbisher OS
on the 780, being run on the 8500.

If you run Device Manager (devmgmt.msc) and
look at the condition of Device Manager, there
could be a few missing drivers as well, as proof
the disk came from the wrong machine.

Paul

No the WD is expressly for the 8500 and yes, I do
have them labeled.

I checked device manager and it seems the Network Controller
and Universal Serial Bus (USB) Controller have issues.

http://i65.tinypic.com/nx4d4w.jpg

I didn't know the drive letters would change
after backup and restore so should I try again
and see if I can get this to work?

Thanks,
Robert

In message ,
Robert in CA writes:
[]
I didn't know the drive letters would change
after backup and restore so should I try again
and see if I can get this to work?

Thanks,
Robert

Just to be clear: a system, before and after imaging and restore, will
have the same drive letters. It is only _while you are booted from the
Macrium CD_ - i. e. while you are _doing_ the restore (and the imaging
if you do that while booted from the CD) that the letters will appear
different.

What sort of drive are you putting the image on - I don't mean what make
or size (though that information might be relevant too), I mean how is
it connected to the computer you are imaging (and restoring to)? Is it a
hard drive inside the computer case anyway, connected by SATA (or
EIDE!), or is it in an external case (or dock) that connects by USB, or
is it something over your network? Does it have more than one partition
on it?

If it's another internal drive, or in most cases if it's connected by
USB, Macrium should be able to "see" it.

When you say you can't find the .mrimg file (from within the
booted-from-CD environment), have you at least managed to identify the
correct drive/partition (e. g. by its volume label)?
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

"Purgamentum init, exit purgamentum." Translation: "Garbage in, garbage out."

I finally found the Mrimgs they were on the C: partition,.
that's what threw me. I started the process but don't know
if I should proceed since I didn't resize the partition as
in your example and then got the pop-up of over writing.
Should I continue?

http://i68.tinypic.com/294kry0.jpg

http://i67.tinypic.com/2aiigzs.jpg

http://i63.tinypic.com/eg3bev.jpg

http://i65.tinypic.com/qpjc3o.jpg

http://i66.tinypic.com/154btb4.jpg

Thanks,
Robert

Robert in CA wrote:
I finally found the Mrimgs they were on the C: partition,.
that's what threw me. I started the process but don't know
if I should proceed since I didn't resize the partition as
in your example and then got the pop-up of over writing.
Should I continue?

http://i68.tinypic.com/294kry0.jpg # Collection of MRIMG 6/2/2019

http://i67.tinypic.com/2aiigzs.jpg # Dell svc, Recovery 14GB, 119/907GB C:

http://i63.tinypic.com/eg3bev.jpg # Backup is 119GB, curr disk is 142GB !!!

http://i65.tinypic.com/qpjc3o.jpg # Ready to run...

http://i66.tinypic.com/154btb4.jpg # Restore started...

Thanks,
Robert

As long as you know that the June25 contents on the disk
today are not being lost by writing a June2 image over
top, you're ready to go.

I see a difference of 119GB on June2 in your pictures,
versus 142GB on June25.

If you're confident nothing is being lost, then click continue.

*******

Your Device Manager entries are weird, in that it
seems a USB controller and Network controller have
a yellow mark. You'd need to get the Code value
from those, by doing properties.

At this point though, since you're restoring, and
you're pretty confident of your lineup (putting
correct restore over current system), you'll need
to re-check Device Manager (devmgmt.msc) later
after the restore is finished. As the situation
will have changed at that point. With a yellow
mark on the main network controller, you wouldn't
really be able to use the machine for surfing
and such...

*******

You seem to be following the restore recipe OK.

Paul

Robert in CA wrote:


I have read all your posts along with Pauls
I did not know that the drive letters would
change but I still cannot find the Mrimgs.

Thanks,
Robert

You should read the report today about Dell SupportAssist.

https://www.forbes.com/sites/gordonk...pgrade-windows

SupportAssist = PC-Doctor Toolbox

You're in no immediate danger. It's the notion
of the level of elevation, that the program could
be used (by a bad actor) if they know the program
is there, to potentially elevate themselves.
At *might* be an attack surface.

Would Dell be clever enough to tell people to remove it ?

Or would Dell keep trying to patch the **** out of it ?

Who knows what Dell will do ?

This is why "cruft" on computers is such a bad idea.

Since you normally use a LimitedUser account for
safety, that has to count for something :-)

I can't see how that could auto-elevate with your
LimitedUser account.

Of course, the PC-Doctor could also have services loaded,
and those could run as SYSTEM account. Which is still
pretty powerful. Developers should not put crap into
Services, unless there's a good reason to do so.

Paul

On Tuesday, June 25, 2019 at 11:57:14 AM UTC-7, Paul wrote:
Robert in CA wrote:
I finally found the Mrimgs they were on the C: partition,.
that's what threw me. I started the process but don't know
if I should proceed since I didn't resize the partition as
in your example and then got the pop-up of over writing.
Should I continue?

http://i68.tinypic.com/294kry0.jpg # Collection of MRIMG 6/2/2019

http://i67.tinypic.com/2aiigzs.jpg # Dell svc, Recovery 14GB, 119/907GB C:

http://i63.tinypic.com/eg3bev.jpg # Backup is 119GB, curr disk is 142GB !!!

http://i65.tinypic.com/qpjc3o.jpg # Ready to run...

http://i66.tinypic.com/154btb4.jpg # Restore started...

Thanks,
Robert

As long as you know that the June25 contents on the disk
today are not being lost by writing a June2 image over
top, you're ready to go.

I see a difference of 119GB on June2 in your pictures,
versus 142GB on June25.

If you're confident nothing is being lost, then click continue.

*******

Your Device Manager entries are weird, in that it
seems a USB controller and Network controller have
a yellow mark. You'd need to get the Code value
from those, by doing properties.

At this point though, since you're restoring, and
you're pretty confident of your lineup (putting
correct restore over current system), you'll need
to re-check Device Manager (devmgmt.msc) later
after the restore is finished. As the situation
will have changed at that point. With a yellow
mark on the main network controller, you wouldn't
really be able to use the machine for surfing
and such...

*******

You seem to be following the restore recipe OK.

Paul

I finished the resto

http://i65.tinypic.com/1zgf21e.jpg

I hope this resolves the problem.

Many thanks,
Robert

On Tuesday, June 25, 2019 at 12:07:26 PM UTC-7, Paul wrote:
Robert in CA wrote:


I have read all your posts along with Pauls
I did not know that the drive letters would
change but I still cannot find the Mrimgs.

Thanks,
Robert

You should read the report today about Dell SupportAssist.

https://www.forbes.com/sites/gordonk...pgrade-windows

SupportAssist = PC-Doctor Toolbox

You're in no immediate danger. It's the notion
of the level of elevation, that the program could
be used (by a bad actor) if they know the program
is there, to potentially elevate themselves.
At *might* be an attack surface.

Would Dell be clever enough to tell people to remove it ?

Or would Dell keep trying to patch the **** out of it ?

Who knows what Dell will do ?

This is why "cruft" on computers is such a bad idea.

Since you normally use a LimitedUser account for
safety, that has to count for something :-)

I can't see how that could auto-elevate with your
LimitedUser account.

Of course, the PC-Doctor could also have services loaded,
and those could run as SYSTEM account. Which is still
pretty powerful. Developers should not put crap into
Services, unless there's a good reason to do so.

Paul

I did read the link but I don't have Windows 10
pre-installed and all were going to be doing is
getting the key to install Win 10 so that at a
later date if and when Win7 doesn't function and
I need to upgrade.

If I do go to Windows 10 then I will be sure not
to go to the Support Assist/Doctor Toolbox. In any
case, if I have problems I usually come here.
Especially as you know my history with programs
better than anyone.

Many thanks,
Robert

Although I haven't responded to everyone I
want to thank you for your input. I do read
all the replies it's just that Paul knows my
system and past history very well and has helped
me many times through some tough spots.

However, I want to thank you all for your input.

Thanks,
Robert

On Tuesday, June 25, 2019 at 11:57:14 AM UTC-7, Paul wrote:
Robert in CA wrote:
I finally found the Mrimgs they were on the C: partition,.
that's what threw me. I started the process but don't know
if I should proceed since I didn't resize the partition as
in your example and then got the pop-up of over writing.
Should I continue?

http://i68.tinypic.com/294kry0.jpg # Collection of MRIMG 6/2/2019

http://i67.tinypic.com/2aiigzs.jpg # Dell svc, Recovery 14GB, 119/907GB C:

http://i63.tinypic.com/eg3bev.jpg # Backup is 119GB, curr disk is 142GB !!!

http://i65.tinypic.com/qpjc3o.jpg # Ready to run...

http://i66.tinypic.com/154btb4.jpg # Restore started...

Thanks,
Robert

As long as you know that the June25 contents on the disk
today are not being lost by writing a June2 image over
top, you're ready to go.

I see a difference of 119GB on June2 in your pictures,
versus 142GB on June25.

If you're confident nothing is being lost, then click continue.

*******

Your Device Manager entries are weird, in that it
seems a USB controller and Network controller have
a yellow mark. You'd need to get the Code value
from those, by doing properties.

At this point though, since you're restoring, and
you're pretty confident of your lineup (putting
correct restore over current system), you'll need
to re-check Device Manager (devmgmt.msc) later
after the restore is finished. As the situation
will have changed at that point. With a yellow
mark on the main network controller, you wouldn't
really be able to use the machine for surfing
and such...

*******

You seem to be following the restore recipe OK.

Paul



I will continue to monitor the system and hope the
pop-up is gone. I seriously don't know what else we
could do at this point.

Thanks,
Robert

Robert in CA wrote:
Although I haven't responded to everyone I
want to thank you for your input. I do read
all the replies it's just that Paul knows my
system and past history very well and has helped
me many times through some tough spots.

However, I want to thank you all for your input.

Thanks,
Robert

I'm not very good with the AV stuff, so if someone
else knows what to look for... be my guest :-)

Paul

On Tuesday, June 25, 2019 at 5:17:18 PM UTC-7, Paul wrote:
Robert in CA wrote:
Although I haven't responded to everyone I
want to thank you for your input. I do read
all the replies it's just that Paul knows my
system and past history very well and has helped
me many times through some tough spots.

However, I want to thank you all for your input.

Thanks,
Robert

I'm not very good with the AV stuff, so if someone
else knows what to look for... be my guest :-)

Paul



I did loose some information but I would rather have that
and fix this problem and I can retrieve most of the information.
I updated my VLC player, Macrium and Avast and have run all
the scans and checked for Windows update of which there were
2 important updates and 2 optional updates and installed all of
them after checking what they were.

I'm still monitoring the computer to make sure everything is OK
so far things seem normal.

Thanks again,
Robert

On Tuesday, June 25, 2019 at 11:57:14 AM UTC-7, Paul wrote:
Robert in CA wrote:
I finally found the Mrimgs they were on the C: partition,.
that's what threw me. I started the process but don't know
if I should proceed since I didn't resize the partition as
in your example and then got the pop-up of over writing.
Should I continue?

http://i68.tinypic.com/294kry0.jpg # Collection of MRIMG 6/2/2019

http://i67.tinypic.com/2aiigzs.jpg # Dell svc, Recovery 14GB, 119/907GB C:

http://i63.tinypic.com/eg3bev.jpg # Backup is 119GB, curr disk is 142GB !!!

http://i65.tinypic.com/qpjc3o.jpg # Ready to run...

http://i66.tinypic.com/154btb4.jpg # Restore started...

Thanks,
Robert

As long as you know that the June25 contents on the disk
today are not being lost by writing a June2 image over
top, you're ready to go.

I see a difference of 119GB on June2 in your pictures,
versus 142GB on June25.

If you're confident nothing is being lost, then click continue.

*******

Your Device Manager entries are weird, in that it
seems a USB controller and Network controller have
a yellow mark. You'd need to get the Code value
from those, by doing properties.

At this point though, since you're restoring, and
you're pretty confident of your lineup (putting
correct restore over current system), you'll need
to re-check Device Manager (devmgmt.msc) later
after the restore is finished. As the situation
will have changed at that point. With a yellow
mark on the main network controller, you wouldn't
really be able to use the machine for surfing
and such...

*******

You seem to be following the restore recipe OK.

Paul



I went back to check the device manager
and it still shows the same yellow triangle
with exclamation marks. I went into the
Administrator Account to try and automatically
update the drivers but it couldn't find anything
then tried it manually with the same result.

Apparently the drivers are from Realtek at least
that was what was highlighted when I tried to do it
manually but had no idea what to search for?

http://i64.tinypic.com/oab22e.jpg

http://i68.tinypic.com/1178w9t.jpg

So should I proceed with this?

Thanks,
Robert

In message ,
Robert in CA writes:
[]
I did loose some information but I would rather have that
and fix this problem and I can retrieve most of the information.
I updated my VLC player, Macrium and Avast and have run all
the scans and checked for Windows update of which there were
2 important updates and 2 optional updates and installed all of
them after checking what they were.

I'm still monitoring the computer to make sure everything is OK
so far things seem normal.

Thanks again,
Robert

It's worth keeping a log (just a text file, a diary/journal) of things
like the above - as well as any actual downloads, if you do them outside
the prog.s (I know VLC does the update inside itself, and Avast probably
does too) - somewhere that _isn't_ overwritten if you do a
restore-from-image, so if you have to do another one, you know what
updates you have to do again. That's one of the reasons I have most of
my drive as a D: (data) partition, with C: as just holding Windows and
installed software. (Another reason is it makes C: smaller so imaging is
quicker so I might do it more often. Though of course D: needs backing
up too, which I do - but just by copying, not imaging.)

Of course, as soon as you're reasonably sure all is well, make another
image: then if you subsequently have to do another restore-from-image,
you won't have as much updating to do.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

If you want to make people angry, lie to them. If you want to make them
absolutely livid, then tell 'em the truth.