 SidPremium
join:2002-11-29
Santa Maria, CA | Emergency Repair Kit for your PC Heres some great info on creating a First Aid kit for your PC which is installed on a small flash drive.
Emergency Repair Kit
Most people wouldnt think of driving their car without a jack and spare tire in the trunk. Computers break down more often than cars, yet many people arent prepared for PC trouble the way they are for car trouble. So this month Ill show you how to put together a great emergency repair kit. You can use it for your own computers or take it with you to rescue friends who are having trouble. Be sure to put your kit together now, before trouble strikes. Sometimes, viruses and spyware can block access to Web sites or even break your Internet access completely. If youve downloaded the tools you need, you can be up and running in no time.
Desert Island Dilemma
When stocking the repair kit, remember that you may not be able to trust any of the programs that are on the PC you are trying to fix. They may not work, or perhaps theyre infected with a virus. So the kit needs to have tools for editing configuration files, cleaning off viruses, finding and removing spyware, and the like. Think of your repair kit as an uncharted desert island, and you have to bring everything you need especially if youre helping friends. (Bring the right tools so you can look like a Professor, not a Gilligan.) below lists the tools that I recommend you put in the kit; theyre all free downloads from their respective sites.
Also, youll need a safe and portable place to put the files in your kit. You can burn them to a CD-R, which offers plenty of space and is also pretty inexpensive. However, you should frequently update some of the files in the kit, and youll need to burn a new CD-R every week or two to make sure you are fully up-to-date. Human nature being what it is, that is a chore that you probably wont get around to until its too late. Also, CDs are a bit cumbersome to carry around, since you cant just drop them in your pocket.
I prefer to use a USB flash drive that has 64MB or more flash memory. They easily fit on a key chain or in your pocket, which makes them convenient for offering roadside assistance to friends. Windows 98/Me/XP include built-in support for flash drives, and drivers are available for older Windows versions. You can buy USB flash drives for as little as $20, sometimes less. If possible, get a model that includes a write protect switch so that you can be extra careful that your files are changed only when you want them to be.
Prepare To Repair
Part of the preparation for the repair kit is to preinstall and/or unzip any applications that require setup. A few of the files are downloaded as Zip files that dont require any installation; just unzip them to the flash drive. For programs that you do need to install Ad-Aware, CCleaner, Spybot, and SpywareBlaster on the list below tell the installer to use a directory on the flash drive and skip any options to create Start Menu items or other system hooks.
If you decide to add other programs to the flash drive, dont use any that have options for continuous background operation. For example, dont install Norton AntiVirus to a flash drive because it has several scanning components that start when the system boots and are always running. You wouldnt ever be able to remove the flash drive from its USB connection without crashing the application.
Another useful thing to have on the flash drive is a browser. Several types of spyware can cripple Internet Explorer, so you can dodge the problem by installing the Mozilla Firefox browser on the flash drive. You can find instructions on how to do this at »www.texturizer.net/firefox/tips.html#oth_usb. Because youre going to run Firefox from a flash drive, youll want to set the cache to a small value (say, 2MB) in the dialog box youll find by clicking Tools and Options. You dont want the browser cache to fill up the flash drive! (PC Today subscribers can read more about Firefox at our Web site in Browser Showdown: IE vs. Firefox, a Web-only article in November.)
After adding all those tools, Im still only using about 45MB of a 64MB flash drive (and most of that is the Firefox browser). With the space thats left, make backups of critical files from the My Documents folder or elsewhere on your drive. Because 128MB flash drives are plentiful and cheap, you shouldnt have any trouble fitting your repair kit and backups onto a typical flash drive.
For burning a CD instead of using a flash drive, unzip any files that require it to a folder on your hard drive, say C:\REPAIRKIT. For programs that require setup, tell the setup program to install in its own folder under Repairkit instead of the default, which is usually Program Files. Then burn the entire Repairkit folder and subfolders to a CD.
Test The Toolkit
Once everything is set up, its time to see if it works. First, run the scanner and cleaner tools: Avast Cleaner, McAfee Stinger, Ad-Aware, Spybot Search & Destroy, and CWShredder. Remove any software they advise and reboot the system. Rescan with each utility to make sure everything was cleaned properly. Then, run SpywareBlaster to prevent Internet Explorer from catching any nasty spyware again.
The repair kit files easily fit on a 64MB flash drive. The files in the Downloads folder let you install the utilities onto other systems so theyll be protected, as well.
For really stubborn problems, there are some tools here that require an experts judgement: Autoruns, ListDLLs, ShareEnum, and Process Explorer. All these tools let you save their results to a text file. Run each utility and save the results to the flash drive, and you can use that later as a normal baseline. Even if the information there is over your head, it can come in handy if youre passing it on to someone whos had more experience in virus hunting.
Quite often, a lot of junk is left behind due to errors caused by spyware and viruses. Thats why CCleaner is on the flash drive. It can clean out a lot of the garbage in the Registry and on the drive. One important note, though: By default, it deletes all your cookies. If you have some sites that use cookies to automatically log you in, you should not select CCleaners option to remove all cookies.
When theres a sign of trouble on a PC yours, your friends, or one at work pop your repair kit flash drive into a USB port. If you need to get to the Internet during this process, try using the copy of Firefox that is on the flash drive to protect yourself from spyware or viruses that may be installed on that PCs browsers. For the same reason, use the Notepad2 program on the flash drive to edit or view text files.
At least once a month, pull out your repair kit and update it. For the programs such as Ad-Aware and Spybot, use the option to retrieve the latest signature files. This is easy because the applications are actually installed on the flash drive. When you retrieve the latest version, it will update the files on the flash drive. For utilities such as McAfee Stinger, just download the latest version and replace the old one. Then use the tools to scan for problems, just to make sure youre safe. If everything seems OK, pop out the flash drive and put it in a place where you can grab it when you need it.
Repair Kit Supplies
Avast Cleaner: »www.avast.com/eng/down_cleaner.html
McAfee Stinger: »vil.nai.com/vil/stinger
Spybot Search & Destroy: »www.spybot.info
Ad-Aware: »www.lavasoftusa.com/
HijackThis: »www.spychecker.com
CWShredder: »www.softpedia.com
Notepad2: »www.flos-freeware.ch/notepad2.html
Autoruns, ListDLLs, ShareEnum, Process Explorer: »www.sysinternals.com
CCleaner: »www.ccleaner.com
SpywareBlaster: »www.javacoolsoftware.com
Norton tools: »securityresponse.symantec.com/av···ist.html
Firefox Browser: »www.mozilla.org/products/firefox/index.html
Myself, I left out the Norton tools. Its a personal thing I have against symantec and prefer not to use any of their AV products. 
--
WinXP,PC-Cillin IS, SpySweeper,Opera, M2 for Email |
|
| Excellent article, thanks. One question though - I've been thinking of setting up the same sort of "USB flash rescue/repair drive", but I haven't been able to resolve the issue about write-protection for the drive, and bootability.
You mention using a drive with a write-protect switch, but then go on to imply allowing writing to the drive, what with the browser disk cache not disabled, and updating the programs, etc.
This seems like a non-trivial problem to solve, and until it is, a USB flash memory drive cannot be used securely for the various uses mentioned in your article. I've been toying with the idea of using two USB flash drives, one read-only, with the programs, and one as a "data drive". A slight added expense and hassle, but it would solve the problems resulting from requiring write-protection for security purposes, and yet still allow writing to the drive.
Another is whether or not you choose to store personal info on the drive, like cookies/bookmarks for Mozilla if you are going to be plugging the drive, even read-only, into a potentially infected/trojaned system that could steal your data and your cookies (if they contain account login info, for example).
So that seems to require a third "personal data" USB flash drive, so at this point might as well carry a pocket 4-port USB hub too to connect all of these.
Ideally, there would be a way, to get the USB drive's flash-controller to be able to write-protect linear ranges of sectors, so that you could have several write-protected partitions to contain program files, and then a write-enabled partition for storing unsecured data.
I don't know if any of the USB flash drive mfg's have considered such a thing yet. I know that many support two seperate partition areas, at least my Lexar 128MB USB 1.1 JumpDrive does, and that one of them can be "protected" using their software. (I would much rather just a password-protected partition that would require the password for either read access or read-write access, much like MS file-sharing does.) |
|
 RactMicrosoft Certified Systems CrasherPremium
join:2004-01-07
Philippines | reply to Sid
Hey mods! hubba hubba! can someone include this is the FAQ section?  :D |
|
 EGeezerSummertimePremium
join:2002-08-04
Midwest
kudos:7
 ·Callcentric
1 edit | reply to Sid
Nice article - my "thumbs up" is in!
For those interested, this portable firefox is handy.
»johnhaller.com/jh/mozilla/portab···ault.asp
Anyone have specific USB dongles with write protect capability? Links/model info welcome!
edit - added I also exported critical bookmarks into the USB drive for easy reference.
--
O sibili si ergo,
fortibuses in ero,
O nobili demis trux;
sewatis enim?
cowsendux
|
|
| said by EGeezer:
Anyone have specific USB dongles with write protect capability? Links/model info welcome!
I have a PNY Attache 512MB USB 2.0 flash drive here, and it has a physical write-protect switch on it. Model P-FD512U20-CP
Also have a Lexmark JumpDrive Secure 128MB USB 1.1 flash drive, model JDS128-04-500E, that does not have a write-protect switch. But it does support two partitions, possibly only if you use their software, which has to be installed onto every system that you plug the drive into, for it to function properly.
I just dont see these things having a full spectrum of security-related utility, until they implement multiple partitions, some that can have access restricted to read-only or no-access, unless a proper password is supplied to the onboard interface controller chip. |
|
SidPremium
join:2002-11-29
Santa Maria, CA
1 edit | reply to EGeezer
said by EGeezer:
Nice article - my "thumbs up" is in!
Anyone have specific USB dongles with write protect capability? Links/model info welcome!
I think most USB flash drives now have the write protection switch on the side. At least the ones I have seen. A good place to pick one up is at »www.newegg.com
My Repair kit is on a lexar jump drive 128mb one which I picked up for $26 »www.newegg.com/app/ViewProductDe···5&depa=1
--
WinXP,PC-Cillin IS, SpySweeper,Opera, M2 for Email |
|
| reply to Sid
Just a quick note on something to add to the rescue kit....
trend micro pattern file:
»www.trendmicro.com/download/pattern.asp
Trend micro damage cleanup template/engine (sysclean package)
»www.trendmicro.com/download/dcs.asp
and dont forget some type of zip/unzip utility
winzip, powerarchiver, pkzip, winrar, etc etc
--
Muskegon Picture Gallery Still Under Construction |
|
|
|
2 edits | reply to Sid
Yeah great article I created such a repair kit a while ago on a 128meg wrist-watch / USB Drive.
I would also suggest a couple more to add:-
1. IE/SPYAD.
2. A copy of your Hosts file.
3. A copy of the either MVPS/HPgurus hosts file.
4. ISPfix. |
|
EGeezerSummertimePremium
join:2002-08-04
Midwest
kudos:7 Reviews:
·Callcentric
| reply to VirtualLarry
Thanks to both for the information - I have a Sandisk 128 I use for similar purposes that has a password/encryption feature to prevent casual attempts to read the files, but it isn't a write protect.
Until partitioning comes along, as cheap as they are it can be handy to have one of each - One kept write protected for SW installation and one R/W for using portable Firefox etc. If the system has two extra USB ports(or you use a USB hub), I can have both..
Next, NTFS? or do they do that now? (Mods, if this is too far OT I can start another thread)
EG
--
O sibili si ergo, fortibuses in ero, O nobili demis trux;sewatis enim? cowsendux |
|
 janderso1JimPremium,MVM
join:2000-04-15
Saint Petersburg, FL | reply to Sid
In addition to those tools a Bartpe CD will give you network connectivity and read write access to NTFS partitions on a system that won’t boot/run. An XP install CD with the latest SP slipstreamed will allow you to run the recovery console. A Knoppix CD also has some useful recovery tools.
--
Jim Anderson |
|
 jig
join:2001-01-05
Hacienda Heights, CA |
i think that i also would probably go with a bootcd rather than the thumb drive...
too often a clean, bootable platform is required for a quick recovery, either of data on the machine, or of the system itself.
|
|
1 edit | reply to Sid
Here are a few I carry with me that seem notable.
A2 - malware scanner
»www.emsisoft.com/en/software/free/
Ewido - malware scanner
»www.ewido.net/en/
7-zip - open source compression
»www.7-zip.org/
Foxit PDF Reader
»foxitsoftware.com/pdf/rd_intro.php
EZ Cleaner - registry/temp file cleaner
»personal.inet.fi/business/toniarts/
Sygate Firewall
»smb.sygate.com/
SpaceMonger - graphical hard drive usage
»www.werkema.com/software/spacemonger.html
Process Explorer 98 & NT - much more informative than taskmon
»www.sysinternals.com/ntw2k/freew···xp.shtml
Driver Cleaner - clean out old Nvidia and ATI drivers
»www.driverheaven.net/cleaner/
OffByOne Browser - The smallest stand alone browser I have found
»www.offbyone.com/
Filezilla - FTP, incase I need to grab something from my server. No install required.
»filezilla.sourceforge.net/
Im sure I'll come up with more later
. These all have freeware versions, by the way. I like to stay out of trouble. |
|
 RhobitePremium
join:2002-02-24
Cambridge, MA
1 edit | reply to VirtualLarry
Larry, since you mentioned you had the Lexar drive with encryption, I thought you might be interested in this: »slashdot.org/article.pl?sid=04/09/14/1855232
It appears they use XOR "encryption" to verify your password, making it trivial for someone to read or modify the stuff on the protected partition.
--
Jimmysquid.com - I take pictures. |
|
| reply to Sid
Great article! As a substitute for Windows Explorer there is no better file manager than ZTreeWin from ZedTek. »www.ztree.com/html/ztreewin.htm This is a Console-mode Windows program inspired by the venerable XTreeGold for DOS. This however is a full-blown Windows program that requires no registry entries. It will take less than 2 MB on your USB or CD, even if the extensive Help file is included. It displays all directories (folders) in a tree-like structure. You can display all files on the drive or a branch and quickly sort them in name, date, size or other sequences. It has very powerful mass-copy, move and rename capabilities, and other features too numerous to list here. You can hook in your favorite editor for editing, and can use its powerful "application menu" as a main menu to launch all your other recovery tools. As a computer technician I would not be without it in any emergency repair situation. At $30 it's a true bargain.
|
|
| reply to Sid
I have a 256MB Lexar JumpDrive USB keyring drive and using it as a keyring-repair kit is a very good idea. However this particular device may not be the best candidate for use under Win98. I have a Win98se box here for testing, and the first time I plugged in the drive Win98 went on a fruitless search for a driver. The driver is available for download from the Lexar web site and of course you can carry the driver files on a floppy if the target machine is Win98. But that does mean one more thing that you have to remember to carry in your "kit".  |
|
 Rally1
join:2000-06-12
Long Beach, CA
1 edit | reply to Sid
Here's another thread that went this direction too:
»Tools i must have on my spyware disc
You should also carry a CD with the drivers for your USB flash drive on it, for Win98 and other OS's , it does no good to have those drivers on the USB key.
What I do is make use of the "briefcase" tool in windows to keep my flash drive updated. Latest virus defs, and software is always downloaded to the briefcase, then it's a simple sync/update to get the USB drive up to date. |
|
1 edit | I hadn't thought of the briefcase feature, it certainly will make updates easy. Thanks
Also, does anyone know of a good registry editor to use. I really want one that doesn't have to be installed and can display multiple search results at one time, to get rid of programs that can be a pain to remove sometimes ( such as Norton) |
|
Rally1
join:2000-06-12
Long Beach, CA | reply to Sid
I have been using RegSeeker »www.hoverdesk.net/freeware.htm |
|
| reply to Rhobite
said by Rhobite:
Larry, since you mentioned you had the Lexar drive with encryption, I thought you might be interested in this: »slashdot.org/article.pl?sid=04/09/14/1855232
It appears they use XOR "encryption" to verify your password, making it trivial for someone to read or modify the stuff on the protected partition.
Thanks for bringing that up, I did see that. I never enabled that feature, as I don't trust trivial vendor software like that; it seems in hindsight that my hunch was right.
Ixthus, what is your feeling on the importance of bootability of a USB flash drive? I assume that your article was mainly focused on a toolkit, and that it would be run via the existing OS installation, but that of course has security drawbacks if the existing OS has been severely compromised. Have you investigated the possibility of an entire bootable rescue OS from a USB flash drive? (Or would carrying a BartPE or Knoppix "LiveCD" in addition, perhaps on a mini-CDR or business-card CDR, be enough?) |
|
| What about a boot able flash drive? T
hat would be awesome! You could stick Astrumi (»http://cyti.latgola.lv/ruuni/index_en.html) on there and still have room left for say the f-prot virus scanner or some other utilities.
It would be easy to carry around and easy to keep updated. |
|
