O.T. deleted bookmark, can't sign-on to FF

Mark Twain wrote:
With regard to disk space and partitions
shouldn't cloning negate the need for
all that? The Seagate should end up as
an exact copy of the 1TB in the 8500. correct?


Robert

Yes.

The advantage of adjusting partition sized for
the destination drive, has to do with avoiding
the need for a later Partition Manager program,
to do the resizing.

If you have a Partition Manager product installed,
then you have all the options you need there.

The main benefit from adjusting destination size
with Macrium, has to do with partition shrinkage.
You're getting shrinkage for free. Expansion
of a partition, on the other hand, isn't nearly
as expensive in terms of time and disk operations.

Paul

Mark Twain wrote:
This picture, you were "on track" and were in the
confirm/advanced dialog of the Clone operation.
If you clicked Finish, you might have got your
clone out of it, as the Destination disk is the
ST2000DM001.

http://i63.tinypic.com/723jmt.jpg

I did click finish and I just tried
it again and it gave me the same result.
That's what I'm trying to show you.

The Cloning is taking me to the backup
dialog box whether clicking next or
finish at the schedule screen.

Where you have the question marks
is when it asks where to clone to and
this is the only option.

I opened up the Advanced Options to
show you:

http://i67.tinypic.com/24od2dk.jpg

Either somethings not working or I'm doing
something wrong. As I remember the 2TB WD
was a snap and didn't have any issues like
we're having. Why is this different?

Robert

OK, try this photo. Report back if it doesn't work.

This is supposed to be a direct link to the photo.

http://s22.postimg.org/487zw4g1d/Clone_Disk.gif

This page might have more advertising.

http://postimg.org/image/soq5qlgrx/

HTH,
Paul

Success!@!!!!!

http://i63.tinypic.com/25i6hk5.jpg

http://i67.tinypic.com/2hci9s1.jpg

http://i64.tinypic.com/j9837d.jpg

http://i66.tinypic.com/157dnxh.jpg

I tried twice by first connecting the USB cord
then powering up the drive and each time it
made the tone but the icon didn't appear and
the Rundll32 could not remove it.

http://i64.tinypic.com/59ukh.jpg

So I had to restart the computer each time but
the third time I forgot to power off the drive
and this time it connected with no problem with
the icon present.

Now that it's cloned I have to install it in
the 8500 for it's first boot, correct? Then I
would like to make it's first image backup to
serve as a master.

What do you think?

Many thank,
Robert

Mark Twain wrote:
Success!@!!!!!

http://i63.tinypic.com/25i6hk5.jpg

http://i67.tinypic.com/2hci9s1.jpg

http://i64.tinypic.com/j9837d.jpg

http://i66.tinypic.com/157dnxh.jpg

I tried twice by first connecting the USB cord
then powering up the drive and each time it
made the tone but the icon didn't appear and
the Rundll32 could not remove it.

http://i64.tinypic.com/59ukh.jpg

So I had to restart the computer each time but
the third time I forgot to power off the drive
and this time it connected with no problem with
the icon present.

Now that it's cloned I have to install it in
the 8500 for it's first boot, correct? Then I
would like to make it's first image backup to
serve as a master.

What do you think?

Many thank,
Robert


I see the clone is nicely extended to the end of the
partition, so now the C: on the new drive has plenty of
room.

You would move the Seagate 2TB to inside the 8500 for
its first boot. While it is booted from the 2TB, the
1TB original Seagate drive would be unplugged.

If you want to make a backup of the new 2TB immediately,
you can. The clone took 15 minutes, so the backup should
take an equal amount of time. Since the backup command
you were running previously, expected a different hard
drive, you may need to define a backup command (XML) anew.
This will be a test of what you learned about backups.

Paul

I am now typing this on the 2TB
Seagate HD, It had 13 Updates but
the NVidia failed. So 12 out of 13
and(2) optional updates.

In passing, the Seagate is very quiet.

I'll attempt the image backup a little
later after I've rested some and will
let you know how it goes.

So far everything is looking good.

Thanks,
Robert

I had run Avast with no problems and
updated Spywareblaster and was going
to run Malwarebytes and then SuperAntispyware
and then switch the drives and do a
image update.

However when running Malwarebytes it
found this:

http://i68.tinypic.com/eb7a0x.jpg

I tried to have malwarebtyes delete it
and it shows that it did but every time
I restart it comes back.

So this must be on the 1TB also. So I
need to clean both drives.

Robert

Mark Twain wrote:
I had run Avast with no problems and
updated Spywareblaster and was going
to run Malwarebytes and then SuperAntispyware
and then switch the drives and do a
image update.

However when running Malwarebytes it
found this:

http://i68.tinypic.com/eb7a0x.jpg

I tried to have malwarebtyes delete it
and it shows that it did but every time
I restart it comes back.

So this must be on the 1TB also. So I
need to clean both drives.

Robert


Those are registry entries, right ?
Findopolis by Yontoo.

Have a look in Regedit.

My guess would be, they're owned by TrustedInstaller
(the registry keys are), which is making it tough to
remove them. These registry keys are only "dangerous"
if something actually uses them. Registry entries
by themselves, are just pieces of data, and only
become dangerous if something uses them to launch
stuff.

HKLM\system\currentcontrolset\services\eventlog\ap plication\Update findopolis

HKLM\system\currentcontrolset\services\eventlog\ap plication\Util findopolis

Keys related to programs, tend to get owned by TrustedInstaller,
rather than by the Administrator or the End User. Only on a
couple of occasions, have I needed to change the ownership of
a key like that to delete it.

For the first registry key, the value of the
key is likely assigned this value. You would
check to see if there is a findopolis program
folder, to understand whether the adware is
still present. Unless they've decided to switch
to another way of hiding it.

S2 Update findopolis; "C:\Program Files (x86)\findopolis\updatefindopolis.exe"

This article lists some of the other characteristic
parts of Findopolis.

http://www.enigmasoftware.com/findopolis-removal/

And don't download anything from that site, OK ?
You're just supposed to read the text, and use the
hints when looking around your computer for trouble.

If you still had a "C:\Program Files (x86)\findopolis" folder chock
full of stuff, then I would be worried.

Paul

I had a look at Regedit but I really don't
understand what I'm looking for aside from
findopolis especially when I open the Keys.

http://i65.tinypic.com/2z8uqvt.jpg

http://i67.tinypic.com/2uo3tbc.jpg

http://i66.tinypic.com/jqswb9.jpg

http://i65.tinypic.com/2mutd.jpg

http://i63.tinypic.com/2pt53ba.jpg

http://i66.tinypic.com/iz9pna.jpg

I tried to go to the article in the link but
and this is a first, the link didn't connect
and I tried it twice.

I checked to see if the findopolis program was
where you thought it might be (last picture)

The only thing I've downloaded recently is the
USBSafelyRemove program. I run scan regularly
though so this must of happened recently.

So how do I get ride of this?

Thanks,
Robert

I also tried using Agent Ransack to locate
findopolis but perhaps I'm not using it
correctly?

Robert

Mark Twain wrote:
I also tried using Agent Ransack to locate
findopolis but perhaps I'm not using it
correctly?

Robert

Normally, you'd try something like AdwCleaner
if you thought there was an adware problem. But
no program like that is perfect.

You don't have to use Agent Ransack. I happen
to like it, because it is more likely to
"search everywhere" than the built-in Windows 7
search would. I really cannot trust the
Windows search, when I need to be absolutely
sure the whole disk is searched.

You can "calibrate" Agent Ransack, by search
for known objects on C:. Your bookmarks file
for example. If Ransack finds the bookmarks,
maybe it can find the findopolis if present.

The "link you could not access", could have
been stopped by your plethora of protection
tools. If so, good work :-)

As I explained previously, a couple registry entries
is not the end of the world. They can be remnants
not properly cleaned by some removal tool. If I managed
to locate the actual EXE files the adware is using,
then I *would* be concerned.

And Findopolis, if present, would also be
modifying the browser. In which case, the
AdwCleaner "prefs.js" scan would identify
hijacking if present. That's about as good
a check for symptoms as anything, having
a scanner tool check out your browser, and
see if stuff is messed up. You remember the
wad of stuff found in prefs.js the last time.

Paul

I ran a Agent Ransack scan for prefs.js

http://i63.tinypic.com/1fgymo.jpg

then I ran a scan for bookmarks:

http://i67.tinypic.com/2cer9qx.jpg

but when I ran a scan for findopolis
is showed nothing.

I then ran AdwareCleaner:

http://i68.tinypic.com/1ytk78.jpg

I didn't know whether to clean the
checked entries or uninstall them
or which ones.

Robert

I was searching for it wrong; so I
re-ran Agent Ransack for findopolis.

It's still running, but so far,....

http://i64.tinypic.com/6odaj4.jpg

http://i66.tinypic.com/qmxunl.jpg

Robert

It completed:

http://i65.tinypic.com/121d5k2.jpg

http://i67.tinypic.com/29xsthv.jpg

Robert

Mark Twain wrote:
It completed:

http://i65.tinypic.com/121d5k2.jpg

http://i67.tinypic.com/29xsthv.jpg

Robert

The 29xsthv.jpg shows the results of a "content" search.

That means each and every file, the contents were checked
for "findopolis" as a text string.

I was thinking more along the lines of using the filename
line to do the search. (I.e. Use "File name:" rather
than "Contains text:", because it takes forever to
do text searches like that.)

In any case, the results are interesting, because you
can see Findopolis was contained in your cleanup efforts
Aug24, 2014 (Bleepingcomputer).

*******

Try a search with just the "File name:" field being used.
Put the "findopolis" in there. That should complete in
a couple minutes.

Paul

Mark Twain wrote:
I ran a Agent Ransack scan for prefs.js

http://i63.tinypic.com/1fgymo.jpg

then I ran a scan for bookmarks:

http://i67.tinypic.com/2cer9qx.jpg

but when I ran a scan for findopolis
is showed nothing.

I then ran AdwareCleaner:

http://i68.tinypic.com/1ytk78.jpg

I didn't know whether to clean the
checked entries or uninstall them
or which ones.

Robert

OK, in the very last photo, that is evidence you
have a Yahoo toolbar. That's the same people
who provide your News page. Did you see a dialog,
asking you to agree to something, and you clicked "Yes" ?

The small Purple logo below the URL bar, is the Yahoo toolbar.
It has a yellow "Search" button. But some other bar probably popped
up, exhorting you to install it. Might have said something about
installing a plugin to view content or similar. That kind
of bar.

http://cdn.ghacks.net/wp-content/upl...oo-toolbar.jpg

*******

Your bookmark search, using file-name-only looks OK.

In the prefs.js search, putting both file name and
"contents" to the same value, will mean very few files
would match that set of specifications.

There is a place for content searches, but generally not
without narrowing the search a bit first. I use content
searches when searching the source code of programs,
but most of my daily searches are by file name only.
As the file name, if carefully chosen, identifies the
file I want.

One problem with content searches, is they are far from
perfect. Microsoft uses 8 bit ASCII for some stuff, and
double byte characters for other stuff, and not all
content searches handle double byte properly. I've had
to write small C programs to do searches, when I know
the item is on disk and I still cannot find it, whether
using Windows search or Agent Ransack. Some things require
even more effort, because they're not classical "text strings"
we would have used in 1990.

Paul