Tuesday, August 5, 2008

Worry-Free PC (as close as you can get) - Part 2 (cure)

My last post discussed some programs which pro-actively monitor your PC and alert you to any changes which may, if not from a source you recognize and trust, indicate the existence of
malware which I called "before programs".

In this post I want to talk about programs which remove all traces of a program when you want to remove it from your PC (for whatever reason), or "after programs".

Windows has its own has its own uninstaller (see Diagram 1) but this program does not search out ALL files associated with the program being uninstalled and so, in many cases leaves modifications which the program being deleted made to your PC intact and does not restore your PC to its former state.

Diagram 1

Enter two programs which DO remove all traces (sometimes shortcut icons remain but they don't affect your PC much). One costs money - Total Uninstaller. The other - Revo Uninstall is free. Total Uninstall (more on Revo below) works by taking a snapshot of your PC before installing the program. When you uninstall the program it takes a new snapshot and notices any changes the program made and reverses them. This way, removing a program really does remove all traces of that program.

To run Total Uninstall you simply right-click the downloaded program file (usually located on the desktop) and select "Monitor with Total Uninstall" (see Diagram 2). Total Uninstall then takes a snapshot before prompting you to install the program. After installation a new snapshot is taken which notes any changes the program made to the PC.

Diagram 2






Last time I checked, Total Uninstall cost $30. It works well, but there's a program which I think is even better and it's free. It's called Revo Uninstaller. Revo can ALSO reverse ALL changes made by an installed program. I think it's better that Total Uninstaller because unlike Total Uninstaller, you don't need to do anything BEFORE you want to remove the program. Simply install any software however you would normally do that. REVO does all its work when you want to UNinstall the program. As you can see from Diagram 3 below there are four uninstall options or "modes". the "Built-in" mode does exactly what the default Windows uninstaller does. But there are THREE MORE uninstall levels beyond that. I have personally only ever used the "Advanced" mode which has a few, easy to follow stages. (See below)

Diagram 3

Revo first analyzes your PC (like Total Uninstall does, but BEFORE you installed the program) in four stages as per Diagram 4 below.







Diagram 4


Usually Revo finds debris from the program scattered in various places throughout your hard drive. Below (Diagram 5) is an image of what Revo found when I uninstalled a (perfectly respectable) program called Handbreak. All files and folders which need to be deleted (remember this is ADVANCED mode) are highlighted in bold. YOU need to check the relevant boxes manually - make sure only to check the bolded boxes, otherwise files you need may be deleted. It's pretty straightforward. Just make sure you check before hitting the 'delete" button. The effort is worth it - this is how you make sure all junk gets removed along with the program.

Diagram 5
Once you check the relevant boxes and Revo uninstall those files in most cases (not all) Revo will find some more files and folders which need to be deleted. (See Diagram 7) Again the boxes - this time ALL of the boxes - need to be checked and again double check before hitting delete. (Check that you don't see the names of some other program there) As you can see below all the folders say "Handbreak" so this should be pretty straightforward.

Diagram 6







You can download Revo for free here.

Sandboxie, plus WinPatrol plus Revo should make life for a PC user pretty secure. (No guarantees of course, but my PC's have been doing fine).

Revo is compatible with: Windows 2000/XP/2003 Server/Vista

Subscribe by EMAIL

Site Feed (get updates as they happen)

What is a "feed" or "RSS"??

Add to Google Bookmark and Share

Worry-Free PC (as close as you can get) - Part 1 (prevention) (2000, XP, Vista)

One of my recent posts discussed the virtues of running your browser sandboxed.

I mentioned in that post that if you tell it to, a sandbox will let you download files and programs onto your PC and if you want to install software or edit and print a file you will have to let things out of the sandbox and into your PC where you are of course vulnerable to attack.

So how do you protect yourself from threats OUTSIDE the sandbox?

This post (and the next one) will discuss two different kinds of programs which might be called "before" and "after".

The "before" programs monitor your hard drive for suspicious looking activities (e.g. logging keystrokes, changes to certain files on your hard drive) and alter you to the requested changes asking you to approve or abort.

One free program which does this is ThreatFire AntiVirus (previously called "Cyberhawk"). I used to use this program but I found the warnings uninformative - which means that you are told something is wrong and can't really work out if the reported alarm is a threat or not. As a result I didn't allow some changes which needed to be made to run legitimate programs).

However, I found another free application called WinPatrol which does this job and gives you enough information to tell whether the changes that a program wants to make come from a trusted or malicious source. Win Patrol. (They have a "Plus" version which apparently tells you more, but I've been doing fine with the free version.)

Here (Diagram 1) is a screenshot of WinPatrol's control panel. (It includes options like scheduling tasks, control of which programs run at start up etc.)

Diagram 1


When WinPatrol spots something suspicious it alerts you.
Here (Diagram 2) is the alert I got when Windows Live Mesh tried to add itself to the progams running at start-up. (As it happens this change is acceptable, but if you received such a message from a program which you didn't want to allow to make this change you would simply hit the "No" button instead of the "Yes" button).

(Diagram 2)













The bonus of programs like Win Patrol (as opposed to re-active programs - see below for examples) is that they are pro-active - catching things before they happen - rather than re-active - catching problematic changes after they have happened. So WinPatrol etc. give protection in real time.

I also run Spybot Search and Destroy and Lavasoft's Ad-Aware (two "re-active" programs) just to make sure that nothing got through inadvertently.
(Lavasofts paid versions apparently offer real-time protection, but we're looking for FREE software)

In my next post I will discuss the free programs which remove all traces of any installed programs.

(By the way the "barking dog" sound which is set as a default can be neutralized on the control panel)

WinPatrol can run on: Windows 95/98/Me/NT/2000/XP/Vista


Subscribe by EMAIL

Site Feed (get updates as they happen)

What is a "feed" or "RSS"?? Add to Google Bookmark and Share