O.T. Missing Folder/files

Robert in CA wrote:
I thought Autoruns sounded familiar so I checked my
downloads and sure enough I already had it.

https://postimg.cc/SnQGKRym

https://postimg.cc/MMB7LjYm

https://postimg.cc/342G1QKL

https://postimg.cc/qgXbB98X

https://postimg.cc/bsy6Z3gX

Robert

https://postimg.cc/qgXbB98X

AmUStor at the top, has some mis-spellings in it.
This is generally considered a sign of blackhats at work.
Although I would not put it past Alcor do to this
through stupidity :-)

It's generally considered a firing offense, to
spell your company name incorrectly.

In the same picture is an aswKbd that could be unticked
and tested for impact on the backspace key problem.

Paul

Robert in CA wrote:
What about setting up the sticky and filter keys?

https://postimg.cc/zbwLWwj6 Safe

https://postimg.cc/hQPGdkhQ Turn that stuff off

https://postimg.cc/6y8WxLZK Only turn on things you need

Robert

Most of that stuff should just stay off.

While you can leave the "press Shift five times" filter
on, sooner or later you'll be alerted by the sound,
that you pressed Shift five times in a row. If you didn't
mean to enable the function, then turning off the filter
for it in the pictures you show, eliminates the middle man.

If left off, there are likely to be fewer side effects.

Paul

Robert in CA wrote:
I tried downloading autoruns but its a zip file and I don't have
7Zip (even then I don't know how to use it) otherwise how do
I open it?

I'm not too worried about the speed of the backups but I would
like to upgrade the 780 in anyway to make it better. I have (3)
available slots for cards in the back of the 780.

https://postimg.cc/rD1fD5kR

Are you saying for me to turn on the sticky key and filter key boxes?

Robert


Yeah, your 780 has a video card. So that slot is out
for a USB3.1 Rev2 card with x2 wiring and x4 PCI Express connector.

But you can still stick a NEC card in the bottom slot and speed
up backups and restores to the USB3 external enclosure. That's
the card that was $12 or so.

NEC probably doesn't make those upd72xxxx chips any more, so
when cards like those show up, they won't last forever. Asmedia
still makes chips however, and they usually provide Windows 7
drivers (at least for the moment). If some extra-whizzy cards
come out (one with a USB-C connector comes to mind, one that
runs at 20Gbit/sec), then the drivers for that might
not go back to Windows 7. But generally, you can get 10Gbit/sec
USB3 functions on a Windows 7 PC (that's about 5X the speed of
a hard drive). That's still within range. I'm not planning
on going any further than that, here. As
there are no nice toys for the interfaces like that.
There might be storage toys for hundreds of dollars, but...
no thanks. My days of buying orphan hardware are pretty
well over.

The only reason I bought the Asmedia USB3.1 Rev2 capability,
is what I really wanted was a plain USB3 port that runs at the "full speed"
intended. The other USB3 ports I have, don't run flat out like
they're supposed to. The one on the typing machine, sometimes
doesn't even manage 200MB/sec. One of the reasons for this,
is when the computer boots, the slot is in PCI Express Rev1 mode
instead of PCI Express Rev2 mode. The detection doesn't seem
to be spotless in hardware. Using a card with x2 lanes, means
you get double "whatever a mess it made" delivers. If they'd
made a chip with x4 PCIe lanes (like they should have), I would
have even paid extra for that. I'm a sucker for wretched excess.
Doing the job right, means one fewer bottleneck in hardware.

Paul

I unticked the aswkbd on the 780 and restarted it but the backspace
key still doesn't function. In addition , the messed up WBM screen
keeps returning after I fix it and Macrium keeps showing an update
when there isn't one. I tried opening up Macrium and it did nothing.

Robert

Robert in CA wrote:
I unticked the aswkbd on the 780 and restarted it but the backspace
key still doesn't function. In addition , the messed up WBM screen
keeps returning after I fix it and Macrium keeps showing an update
when there isn't one. I tried opening up Macrium and it did nothing.

Robert

The aswkbd was the only candidate I could spot by examining
your pictures. It definitely wasn't a sure thing. It had fouled
up the keyboard, in the past.

Like I said before, I don't really have any solid ideas on
debugging keyboard problems back to the source. I would
need a pretty thorough technical article on keyboard traffic
to make progress. And there's never been anything like that
on any computer platform I've used.

The WBM should behave itself, once you stop doing restores
and overwriting it.

Macrium, some of the prompts that appear on the screen,
have a tick box to "don't show me this next time". You may be
able to suppress some of them. The updates will likely keep
presenting.

The Macrium updates only download when you give permission,
such as changing versions (going from 6 to 7 maybe). Changing
versions might require making more media, which isn't good if
you don't stock a big cake box of media. I think I'm all out
of CDs at the moment, and only have a mid-sized one of DVDs.
I have USB sticks, but they keep getting erased, and that's
not a good media format for me.

Paul

I've lost all keyboard functions to the 780 after I did that. It won't respond
to anything and it won't let me log in as administrator. Great, so now what?

Robert

I suppose the only way to get the 780 keyboard working again is to do another
restore. We've already gone back to 1-1-21 so perhaps we should try the 12-20
mrimg? Whether the backspace key works or not is irrelevant at this point if I can't
use the keyboard at all.

What do you think ?

Robert

Robert in CA wrote:
I suppose the only way to get the 780 keyboard working again is to do another
restore. We've already gone back to 1-1-21 so perhaps we should try the 12-20
mrimg? Whether the backspace key works or not is irrelevant at this point if I can't
use the keyboard at all.

What do you think ?

Robert

Restore is very efficient as a fix. You're an expert now :-)

We just need to get you a USB3 card :-)
I wish there were more of these to choose from
at the local computer store (no NEC ones).

I've had to do multiple restores before, like that
time I had to go back two years to find a "clean" OS
for something. Most of the time, it isn't nearly
that bad though.

Paul

Ok, I will try another restore and hope the keyboard will work
during the process.

In passing, I thought about getting another Microsoft ergonomic
4000 Keyboard (as a spare) and I'm having difficulty in finding
one because there's such a range of prices! Newegg wants $585
for one! The cheapest I found on eBay was $168.95 damn, that's
still expensive.

I'll start the restore and let you know how it turns out

Robert

I took the 780 back to 12-1-20 for the restore and disconnected
the Internet connection as you advised. I have the keyboard back
(whew!) but the backspace key still does not function?

https://postimg.cc/tZr5FB9v

https://postimg.cc/RWrT16zm

I had to sign on again with the free version of Avast and did a update
for FF from version 83. to 88. also Macrium had an update and installed
Malwarebytes. I've changed the boot menu three times now and it still
returns to the messed up WBM. At this point I'm not going to restore the
8500 backwards because it hasn't fixed the backspacing key function on
the 780.

I'm thinking even though we tried the other keyboard it may be suspect and
I would still like to get a new keyboard as backup in any case since they are
becoming hard to get but I hadn't expected them to cost so much!

This is my present keyboard:

https://www.newegg.com/microsoft-nat...8643-_-Product

but I also saw this for $52.99

https://www.newegg.com/microsoft-lxm...-400-_-Product

why the big difference in price?

Thoughts/suggestions,
Robert

Robert in CA wrote:
I took the 780 back to 12-1-20 for the restore and disconnected
the Internet connection as you advised. I have the keyboard back
(whew!) but the backspace key still does not function?

https://postimg.cc/tZr5FB9v

https://postimg.cc/RWrT16zm

I had to sign on again with the free version of Avast and did a update
for FF from version 83. to 88. also Macrium had an update and installed
Malwarebytes. I've changed the boot menu three times now and it still
returns to the messed up WBM. At this point I'm not going to restore the
8500 backwards because it hasn't fixed the backspacing key function on
the 780.

I'm thinking even though we tried the other keyboard it may be suspect and
I would still like to get a new keyboard as backup in any case since they are
becoming hard to get but I hadn't expected them to cost so much!

This is my present keyboard:

https://www.newegg.com/microsoft-nat...8643-_-Product

but I also saw this for $52.99

https://www.newegg.com/microsoft-lxm...-400-_-Product

why the big difference in price?

Thoughts/suggestions,
Robert


The review over on the right for the lxm-00001 points out
some of the issues with it. It uses stickers on top of the keys.

The 4000 keyboard appears to be out of production and the
MSRP is $50 or so. The company that is selling those, likely
cleared out the factory that is making them.

There are certainly manufacturers who make better keys, ones that
don't wear off as quickly.

*******

Deleting this key, causes all hardware drivers to be reinstalled.
I've tested this on Windows 10 and it still works. I used the
Kaspersky rescue CD I had, which has a Registry Editor. Their
Registry Editor can edit "system" registries but not the "user"
registry. You would delete the ENUM key using their registry
editor, then reboot and watch as Windows rediscovers all the hardware.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\

That option is reserved for times when you suspect there is
something wrong in ENUM, but don't want to spend hours searching.
Using Kaspersky Registry Editor, is to make the permissions issue "easy".

*******

This article, mentions that keys can be remapped. The SharpKeys
application, displays the current remappings present. The
WindowsReport site shows a picture of what the SharpKeys
program screen looks like. You would be looking to see
if the Backspace key is remapped to nothing. That would be
the basic idea. I don't see a "nothing" option in the
interface though - I don't know how you just disable
a key. It would be naive to think this is how it was done.

https://www.theguardian.com/technolo...e-wrong-result

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Keyboard Layout

https://windowsreport.com/software/sharpkeys/

*******

It could be that you have Microsoft Intellitype installed.
Maybe in an attempt to get some multimedia keys working.
Check Control Panels, Programs and Features, and see
if it is installed. If so, check and see if it has a
Repair option.

*******

And this article, isn't a solution as such. It's an example
of the analysis of a keylogger. It uses a BHO (browser helper object)
to log activity while Internet Explorer is used. And it registers
a COM object for some other activities.

https://www.sophos.com/en-us/threat-...-analysis.aspx

A helper in one of the Microsoft forums, suggests

tasklist /m bpkwb.dll

as a means of detecting which programs are injected
with the keylogger DLL file.

Now, the reason I threw that in, is to show that there
are lots of ways for individuals to interfere with keyboards,
and I don't really have a good model of all of them, and
a nice laundry list of things to check. In the above
example, that "check" only makes sense if you know
you're infected with that particular one. Malware
doesn't all go by the name "bpkwb.dll" for example.

And this is why it's hard to come up with a strategy
to detect where the interference is happening. It
could be a filter driver, perhaps using Device Manager
you could display whether there is a filter in the
keyboard item.

If the backspace key disappeared on my machine, I
would have trouble diagnosing this with it sitting
right in front of me.

Paul

I like the Microsoft 4000 but you mentioned you know
of others like it that I could buy from other manufactures?
However remember when recommending that I have issues
with my wrists and I have to have keys that work like a 'typewriter'
if you know what I mean. That's one of the reasons why I
like the 4000.

I checked Newegg: what do you think of this one and it has
good reviews

https://www.newegg.com/logitech-k350...-076-_-Product


To be honest I only use about half the keyboard. I don't have any
of the function keys set up and some of the keys I've never used
and have no idea what they're for. I searched for a 4000 user
manual but I'm leery of downloading anything because of my past
history. However if I get the Logitech I'll have to learn that keyboard
too and have no idea what the side keys and top keys are but its
very similar to to the 4000.

So you're saying to delete the key so the hardware drivers will be
forced to re-install.
I have a Kapersky CD (2018) but I would need instructions from you
in order to do this.


Do you want me to use Sharp keys or try my Kapersky CD?

I couldn't find Intellitype listed

https://postimg.cc/QFS0NSpj

As you say, we have something similar to an intermittent problem and
difficult to track down and your suggestion of deleting the key sounds
like a good first step. We can always restore if needed. btw can I restore
to 3-4-21 if I need to next time?

Here's the Device Manager:

https://postimg.cc/2Vt5pNtY

https://postimg.cc/gX4YNChf

https://postimg.cc/DSsntJsQ

https://postimg.cc/cKBZLpFr

Robert

I keep forgetting were working on the 780 and not the 8500

I checked for Microsoft Intellitype on the 780 and its not there either.

https://postimg.cc/rdhT4vrs


Here's the 780 Device Manager:


https://postimg.cc/5XgWcZpg


https://postimg.cc/zb99S5Xz


https://postimg.cc/yDV2TLBZ

https://postimg.cc/p9r7wymV



Robert

Robert in CA wrote:
I like the Microsoft 4000 but you mentioned you know
of others like it that I could buy from other manufactures?
However remember when recommending that I have issues
with my wrists and I have to have keys that work like a 'typewriter'
if you know what I mean. That's one of the reasons why I
like the 4000.

I checked Newegg: what do you think of this one and it has
good reviews

https://www.newegg.com/logitech-k350...-076-_-Product


To be honest I only use about half the keyboard. I don't have any
of the function keys set up and some of the keys I've never used
and have no idea what they're for. I searched for a 4000 user
manual but I'm leery of downloading anything because of my past
history. However if I get the Logitech I'll have to learn that keyboard
too and have no idea what the side keys and top keys are but its
very similar to to the 4000.

So you're saying to delete the key so the hardware drivers will be
forced to re-install.
I have a Kapersky CD (2018) but I would need instructions from you
in order to do this.


Do you want me to use Sharp keys or try my Kapersky CD?

I couldn't find Intellitype listed

https://postimg.cc/QFS0NSpj

As you say, we have something similar to an intermittent problem and
difficult to track down and your suggestion of deleting the key sounds
like a good first step. We can always restore if needed. btw can I restore
to 3-4-21 if I need to next time?

Here's the Device Manager:

https://postimg.cc/2Vt5pNtY

https://postimg.cc/gX4YNChf

https://postimg.cc/DSsntJsQ

https://postimg.cc/cKBZLpFr

Robert


I think SharpKeys is worth a look. To see if you can
see the miscreant, as a registry translator and not an
active agent. Since you're working in your crusty old image,
if anything breaks, you can restore a newer one. That's
why we have so many to choose from :-) There is a
download button on this page.

https://windowsreport.com/software/sharpkeys/

*******

For Kaspersky, I checked my collection, and a disc (or ISO)
after Feb.2013 or so, should have the RegistryEditor. This
is a picture of the interface when it is running (as
provided by Kaspersky).

https://support.kaspersky.com/images...213-459607.png

Now, on my ISO collection, this is what I found. When you use 7ZIP
on the ISO, you can burrow right down and into the Linux materials
for a look. That's how I located this (took a while to find it).
I needed to find this, so I would have a way of determining how
modern the CD needs to be.

H:\kaspersky_dec2013\kav_rescue_10.iso\rescue\Live OS\squashfs.img\LiveOS\ext3fs.img\usr\sbin\
RegistryEditor 467,164 bytes

Discs shipping before 2013, don't have that file and the ISO file
is also smaller as well.

I usually write the date of preparation on the KAV CD jewel box,
to help me keep them straight.

If you had a Kaspersky subscription, I would not have you run
the LiveCD, because it copies the Base files over to the root of C:
when it is working. And that might interfere with the subscription
version for all I know. But you use Avast/AVG and Malwarebytes,
so there won't be a conflict there.

In any case, the first picture here is done with Kaspersky CD booted.
That's harder to do in a VM than it looks, and required the
services of EasyBCD 2.4 to get it to work (chainload).

The second picture shows the victim OS came up properly afterwards.
The left hand side of the second picture, shows a "real" copy
of Windows 7 has a huge ENUM. Whereas the virtual machine has
so little in the way of virtual hardware, it doesn't have a lot
of entries. That's why there is a size difference. The second
picture shows that the test OS survived the experience.

https://i.postimg.cc/Cx2vY9hz/enum-delete.gif

https://i.postimg.cc/RhGRYDpC/restar...num-delete.gif

Paul

I downloaded Sharpkeys:

https://postimg.cc/hJMTpnkq

Did you want me to load my Kapersky CD ? I'm not sure
what exactly you want me to delete or how to proceed? It
looks as though I open up HKey Local Machine, then System,
then delete Enum, exit after delete and then restart is that
correct? I could do allot of damage in there and I want to
make sure before I proceed.

I tried using the Sharpkeys but couldn't find any Hkey? I must
not be looking in the right area or something or its not showing
it.

https://postimg.cc/pm6VJXCj

https://postimg.cc/hJQDyWZ5

https://postimg.cc/bdhnt3sh

Thoughts/suggestions

Robert