I googled but cannot find how to do this.
I believe it can be done.

History and FYI
My Win XP Pro x32 got a virus that I could not get rid of.

Fortunately I had Macrium Reflect Free (MRF) create an image when I
first got this very lightly used Lenovo T500 Win XP Pro laptop. Bare
bones image. Laptop is is mint condition.

Nothing I could do on this laptop would allow me to scan for viruses or
download virus updates or restore the image from my saved image. MRF
MRF from here failed every way I tried.

So I went to another of the same laptop model to create a MRF restore
disk and that worked to restore the image on the virused PC! Wow was it
easy. MRF immediately found the image I ad on a NAS. Yes I could get
to my LAN and NAS on this virused PC. Wish I had thought of that
earlier otherwise the store was to charge me $80 to install Win XP Pro
on this virused laptop.

BTW I cannot find Malwarebytes that will run in this Win XP Pro x32 laptop.

Link Please.

I really appreciate all of you lifesavers.

Thank you.

On 9/25/2022 1:46 PM, MyName wrote:
>
> History and FYI
> My Win XP Pro x32 got a virus that I could not get rid of.
>
> Fortunately I had Macrium Reflect Free (MRF) create an image when I first got this very lightly used Lenovo T500 Win XP Pro laptop.   Bare bones image.  Laptop is is mint condition.
>
> Nothing I could do on this laptop would allow me to scan for viruses or download virus updates or restore the image from my saved image.  MRF MRF from here failed every way I tried.
>
> So I went to another of the same laptop model to create a MRF restore disk and that worked to restore the image on the virused PC!  Wow was it easy.  MRF immediately found the image I ad on a NAS.  Yes I could get to my LAN and NAS on this virused PC.     Wish I had thought of that earlier otherwise the store was to charge me $80 to install Win XP Pro on this virused laptop.
>
> BTW I cannot find Malwarebytes that will run in this Win XP Pro x32 laptop.
>
> Link Please.
>
> I really appreciate all of you lifesavers.
>
> Thank you.

Normally, Firefox is only too happy to set the Default Browser preference.

Tools : Options : General : "Make Default" button on the top-right

With any backup software, you always always always make the "rescue CD"
that comes with it. The rescue CD allows you to boot the infected
computer, go to your NAS, and restore from backup. This is called
"bare metal restore", an essential feature for any purported backup software.

Macrium has a "verify MRIMG" feature -- you can check and see if
the MRIMG has been tampered with. The hash in Macrium probably
isn't all that good (I would expect a heavier CPU load if it was
a good one). But, the test is mainly to check for physical hardware
problems. This is how I detected I had bad RAM in the computer,
when Macrium verify said the last two backups were corrupted.

Note that, for any decent virus, a home network is full of holes to
exploit. (WinXP has a patch for its SMBV1 you can install, as an
example.) In particular, a virus could delete every file on your NAS.
Your backup image should be on cold storage, a removable drive that
sits on the shelf until needed. A NAS is a wonderful invention, but
in 2022, it needs a backup too.

A poster in another group, got ransomware via a phishing attack, by
double clicking what he thought was a Go-Daddy Invoice. The ransomware
*wiped out everything on his network at the time*. He had no backups.
It took months, to put "something" on the machines. He didn't even
know which license keys, went with which machine. I would be similarly
unprepared, as I don't keep good records here, not good enough
to recover from ransomware.

If your LAN is wiped out, unplug all machines, disable the Wifi,
and restore each machine in isolation using the Macrium CD. Do not reconnect
equipment, until all equipment has been thoroughly cleaned. This
includes taking the files off the NAS, and reflashing the NAS
as best you can. NAS boxes have a poor security record, so you
have to assume they will do something to your NAS. It's not
even close to being a fortress, closer to a sand castle.

Kaspersky Rescue CD : Offline AV scanner, linux based, works
Bitdefender Rescue CD : Offline AV scanner, linux based, X11 video driver broken
can be fixed with enough effort but not worth it. Uses
"mode setting" for its video driver, not good enough.
Will pull fresh signatures, before scan.
Microsoft Rescue CD:

https://support.microsoft.com/en-au/windows/help-protect-my-pc-with-microsoft-defender-offline-9306d528-64bf-4668-5b80-ff533f183d6c

https://go.microsoft.com/fwlink/?LinkID=234123 # 32 bit
https://download.microsoft.com/download/E/6/E/E6E97483-62D8-4BAE-8493-F3790AE681EB/mssstool32.exe # stub, makes CD
# on clean machine

https://go.microsoft.com/fwlink/?LinkID=234124 # 64 bit
https://download.microsoft.com/download/E/6/E/E6E97483-62D8-4BAE-8493-F3790AE681EB/mssstool64.exe

That might use IMAPI2 for burning the CD, in which case if you use
RW media (erase-able optical media), you must erase the media first
before presenting it to the program. You can erase a disc using Imgburn,
as it has a menu item buried for such a purpose. A CD-R or a DVD-R
needs no prep, to be useful.

Note that, none of the scanners remove anything. They may give you
an ID of sorts. Googling IDs is more or less useless these days,
most of the good removal recipes are gone. Leaving only scammer
recipes of various sorts. Some people post recipes (boring unfocused
recipes), just to earn advertising clicks, and those dudes don't
give a rats ass about the misery you face.

*******

Malwarebytes would offer its "trial version" software, which
reverts to free version behavior ("on demand scan") after enough
days have passed. If you paid for it, it includes a signature scanner
for real time. The heuristic behavior is still there. I don't know,
these days, how good it would be about "burrowing into" an infected machine.

https://malwaretips.com/blogs/downloads-malwarebytes-for-windows/ # stub

http://downloads.malwarebytes.com/file/mb4_offline # 276MB

Usually, the offline is not fully up-to-date, so it may still require
a network connection to get today-signatures. Also of note, that
is the "trial version", loaded with cruft. I can see "VPN blahblah"
in there, while sniffing with 7ZIP, so it's got all of the
trial toys inside. Still, when a virus blocks attempts to use
the stub, the bigger version might work. But no guarantees.

My algo would be:

1) Have backup of C: in hand.
2) Run intrusive tool, collect forensics.
3) Restore from backup, to flush intrusive tool.
Deal with pest (if possible).

A very few pests, have a dedicated remover. But with the quality
of Google searches these days, you'll never find those. And with
consolidation of the AV industry, there will be fewer and fewer
people to help out, by posting such things from their smaller
companies. For example, Kaspersky made a TDSS remover, which still
works today (that's a rootkit AFAIK). Malwarebytes makes MBAR,
which also hunts for rootkits, but articles a number of years
back, claimed new rootkits in the wild were rare. More ordinary,
money making pests, are the norm now. Vandalism only happens
rarely (Sality class pest, cannot be removed, nuke and pave,
would trash a NAS for fun). Vandalism might be more common
than a rootkit.

Paul

That was 2017 when I got the laptop and the MRF Rescue Disk got
misplaced after a home cleanup. Oh well.

Thanks for all the info that will surely take me ages to decipher.
I will get on it.

Thank you.

Paul wrote:
> On 9/25/2022 1:46 PM, MyName wrote:
>>
>> History and FYI
>> My Win XP Pro x32 got a virus that I could not get rid of.
>>
>> Fortunately I had Macrium Reflect Free (MRF) create an image when I
>> first got this very lightly used Lenovo T500 Win XP Pro laptop.   Bare
>> bones image.  Laptop is is mint condition.
>>
>> Nothing I could do on this laptop would allow me to scan for viruses
>> or download virus updates or restore the image from my saved image.
>> MRF MRF from here failed every way I tried.
>>
>> So I went to another of the same laptop model to create a MRF restore
>> disk and that worked to restore the image on the virused PC!  Wow was
>> it easy.  MRF immediately found the image I ad on a NAS.  Yes I could
>> get to my LAN and NAS on this virused PC.     Wish I had thought of
>> that earlier otherwise the store was to charge me $80 to install Win
>> XP Pro on this virused laptop.
>>
>> BTW I cannot find Malwarebytes that will run in this Win XP Pro x32
>> laptop.
>>
>> Link Please.
>>
>> I really appreciate all of you lifesavers.
>>
>> Thank you.
>
> Normally, Firefox is only too happy to set the Default Browser preference.
>
>    Tools : Options : General : "Make Default" button on the top-right
>
> With any backup software, you always always always make the "rescue CD"
> that comes with it. The rescue CD allows you to boot the infected
> computer, go to your NAS, and restore from backup. This is called
> "bare metal restore", an essential feature for any purported backup
> software.
>
> Macrium has a "verify MRIMG" feature -- you can check and see if
> the MRIMG has been tampered with. The hash in Macrium probably
> isn't all that good (I would expect a heavier CPU load if it was
> a good one). But, the test is mainly to check for physical hardware
> problems. This is how I detected I had bad RAM in the computer,
> when Macrium verify said the last two backups were corrupted.
>
> Note that, for any decent virus, a home network is full of holes to
> exploit. (WinXP has a patch for its SMBV1 you can install, as an
> example.) In particular, a virus could delete every file on your NAS.
> Your backup image should be on cold storage, a removable drive that
> sits on the shelf until needed. A NAS is a wonderful invention, but
> in 2022, it needs a backup too.
>
> A poster in another group, got ransomware via a phishing attack, by
> double clicking what he thought was a Go-Daddy Invoice. The ransomware
> *wiped out everything on his network at the time*. He had no backups.
> It took months, to put "something" on the machines. He didn't even
> know which license keys, went with which machine. I would be similarly
> unprepared, as I don't keep good records here, not good enough
> to recover from ransomware.
>
> If your LAN is wiped out, unplug all machines, disable the Wifi,
> and restore each machine in isolation using the Macrium CD. Do not
> reconnect
> equipment, until all equipment has been thoroughly cleaned. This
> includes taking the files off the NAS, and reflashing the NAS
> as best you can. NAS boxes have a poor security record, so you
> have to assume they will do something to your NAS. It's not
> even close to being a fortress, closer to a sand castle.
>
> Kaspersky Rescue CD   : Offline AV scanner, linux based, works
> Bitdefender Rescue CD : Offline AV scanner, linux based, X11 video
> driver broken
>                         can be fixed with enough effort but not worth
> it. Uses
>                         "mode setting" for its video driver, not good
> enough.
>                         Will pull fresh signatures, before scan.
> Microsoft Rescue CD:
>
>
> https://support.microsoft.com/en-au/windows/help-protect-my-pc-with-microsoft-defender-offline-9306d528-64bf-4668-5b80-ff533f183d6c
>
>
>        https://go.microsoft.com/fwlink/?LinkID=234123       # 32 bit
>
> https://download.microsoft.com/download/E/6/E/E6E97483-62D8-4BAE-8493-F3790AE681EB/mssstool32.exe
> # stub, makes CD
>                                                                                                               # on clean machine
>
>        https://go.microsoft.com/fwlink/?LinkID=234124       # 64 bit
>
> https://download.microsoft.com/download/E/6/E/E6E97483-62D8-4BAE-8493-F3790AE681EB/mssstool64.exe
>
>
> That might use IMAPI2 for burning the CD, in which case if you use
> RW media (erase-able optical media), you must erase the media first
> before presenting it to the program. You can erase a disc using Imgburn,
> as it has a menu item buried for such a purpose. A CD-R or a DVD-R
> needs no prep, to be useful.
>
> Note that, none of the scanners remove anything. They may give you
> an ID of sorts. Googling IDs is more or less useless these days,
> most of the good removal recipes are gone. Leaving only scammer
> recipes of various sorts. Some people post recipes (boring unfocused
> recipes), just to earn advertising clicks, and those dudes don't
> give a rats ass about the misery you face.
>
> *******
>
> Malwarebytes would offer its "trial version" software, which
> reverts to free version behavior ("on demand scan") after enough
> days have passed. If you paid for it, it includes a signature scanner
> for real time. The heuristic behavior is still there. I don't know,
> these days, how good it would be about "burrowing into" an infected
> machine.
>
> https://malwaretips.com/blogs/downloads-malwarebytes-for-windows/   # stub
>
> http://downloads.malwarebytes.com/file/mb4_offline                  # 276MB
>
> Usually, the offline is not fully up-to-date, so it may still require
> a network connection to get today-signatures. Also of note, that
> is the "trial version", loaded with cruft. I can see "VPN blahblah"
> in there, while sniffing with 7ZIP, so it's got all of the
> trial toys inside. Still, when a virus blocks attempts to use
> the stub, the bigger version might work. But no guarantees.
>
> My algo would be:
>
> 1) Have backup of C: in hand.
> 2) Run intrusive tool, collect forensics.
> 3) Restore from backup, to flush intrusive tool.
>    Deal with pest (if possible).
>
> A very few pests, have a dedicated remover. But with the quality
> of Google searches these days, you'll never find those. And with
> consolidation of the AV industry, there will be fewer and fewer
> people to help out, by posting such things from their smaller
> companies. For example, Kaspersky made a TDSS remover, which still
> works today (that's a rootkit AFAIK). Malwarebytes makes MBAR,
> which also hunts for rootkits, but articles a number of years
> back, claimed new rootkits in the wild were rare. More ordinary,
> money making pests, are the norm now. Vandalism only happens
> rarely (Sality class pest, cannot be removed, nuke and pave,
> would trash a NAS for fun). Vandalism might be more common
> than a rootkit.
>
>    Paul

MyName <MyName@NoSpam.com> wrote:

> My Win XP Pro x32 got a virus that I could not get rid of.

Not even if you use the boot-time option to restore the factory image?
that requires a non-assigned partition to store the restore image.
Alternatively, the setup CD that came with the laptop often will create
restore image CDs.

> Fortunately I had Macrium Reflect Free (MRF) create an image when I
> first got this very lightly used Lenovo T500 Win XP Pro laptop. Bare
> bones image. Laptop is is mint condition.

https://www.youtube.com/watch?v=j7G93cWDVqo

Although it shows "Windows is loading files", that would be from a WinPE
image, not from the Windows installation.

You don't want to use the remnant Windows installation on a used
computer that you get from someone else. You want a fresh install of
the OS, and the factory image restore is what the computer originally
came with, and before the prior user got it infected. Besides the
viruses (I say plural because if the prior user got the computer
infected then they probably got several), you don't know what registry
tweaks and other changes to the OS or apps that would make them
problematic.

> Nothing I could do on this laptop would allow me to scan for viruses or
> download virus updates or restore the image from my saved image. MRF
> MRF from here failed every way I tried.

Did you boot using the MRF bootable CD? Or using the MRF (WinPE with
MRF added) boot image as an option in the boot-time menu?

> BTW I cannot find Malwarebytes that will run in this Win XP Pro x32 laptop.

https://downloads.malwarebytes.com/file/mb3_legacy

Version 3.5.1. Last version of MBAM that supports Windows XP or Vista.
It is now up to version 4.5.14, see:

https://support.malwarebytes.com/hc/en-us/sections/360005863113-Release-History-News

I did not find a version history that listed versions before 4.0, but I
quit using MBAM many years ago, so I have to impetus to dig further.

On Sun, 25 Sep 2022 10:35:24 -0700, MyName wrote:
> I googled but cannot find how to do this.
> I believe it can be done.

There's a set of internal settings to control that:

https://kb.mozillazine.org/Network.protocol-handler.external.%28protocol%29

But the application seems to ignore the settings for `http` and `https`
protocols. As if both of those protocols are hardcoded to be handled
internally instead of externally.

MyName wrote on 26/9/22 3:35 am:
> I googled but cannot find how to do this.
> I believe it can be done.
>
Myname, I certainly know that *it was* possible to use SeaMonkey for
your Mail and News but then use Firefox for Browsing .... by going into
SeaMonkey's preferences at about:config, accepting the warning then
searching for prefs that dealt with the browser, but I haven't been able
to find the relevant pref in quite some time.

Maybe that function has been removed.

You might get better advice if you were to ask your question in the
alt.comp.software.seamonkey UseNet group.
--
Daniel

On Sun, 25 Sep 2022 10:35:24 -0700, MyName <MyName@NoSpam.com> wrote:

>I googled but cannot find how to do this.
>I believe it can be done.

You want to use a browser for newsgroups? Google groups? Something
else? It's your choice, of course, but In my opinion that's the worst
possible way to do newsgroups. It's far better to use any of the
several good newsreaders out there. I use Agent, but Thunderbird is
also a good choice, and there are lots of others.

Barebones laptop with no Win partition and no CD !

Otherwise pristine laptop that fully functions and has a new battery.

That is why I used MRF to create my own "partition".

Whatever was acquired into my laptop was my fault and it blocked every
way I tried to overcome it.

Fortunately I had another of the same model laptop and I created a
recovery disk and it worked. Lost original recovery dis in a house
cleanup.

I have added most all apps back in and will use MRF again to create a
"complete partition" image.

VanguardLH wrote:
> MyName <MyName@NoSpam.com> wrote:
>
>> My Win XP Pro x32 got a virus that I could not get rid of.
>
> Not even if you use the boot-time option to restore the factory image?
> that requires a non-assigned partition to store the restore image.
> Alternatively, the setup CD that came with the laptop often will create
> restore image CDs.
>
>> Fortunately I had Macrium Reflect Free (MRF) create an image when I
>> first got this very lightly used Lenovo T500 Win XP Pro laptop. Bare
>> bones image. Laptop is is mint condition.
>
> https://www.youtube.com/watch?v=j7G93cWDVqo
>
> Although it shows "Windows is loading files", that would be from a WinPE
> image, not from the Windows installation.
>
> You don't want to use the remnant Windows installation on a used
> computer that you get from someone else. You want a fresh install of
> the OS, and the factory image restore is what the computer originally
> came with, and before the prior user got it infected. Besides the
> viruses (I say plural because if the prior user got the computer
> infected then they probably got several), you don't know what registry
> tweaks and other changes to the OS or apps that would make them
> problematic.
>
>> Nothing I could do on this laptop would allow me to scan for viruses or
>> download virus updates or restore the image from my saved image. MRF
>> MRF from here failed every way I tried.
>
> Did you boot using the MRF bootable CD? Or using the MRF (WinPE with
> MRF added) boot image as an option in the boot-time menu?
>
>> BTW I cannot find Malwarebytes that will run in this Win XP Pro x32 laptop.
>
> https://downloads.malwarebytes.com/file/mb3_legacy
>
> Version 3.5.1. Last version of MBAM that supports Windows XP or Vista.
> It is now up to version 4.5.14, see:
>
> https://support.malwarebytes.com/hc/en-us/sections/360005863113-Release-History-News
>
> I did not find a version history that listed versions before 4.0, but I
> quit using MBAM many years ago, so I have to impetus to dig further.
>