Dell Latitude E7470 false overheat shutdown

My new-to-me E7470 is beautiful but is shutting down on its own. Ran the event viewer and quickly found an error alert saying system executed a shutdown do to a critial thermal event, TCPU _CRT = 373K. There are a ton of google hits for these (although it's monstly for E5570's). The common consensus is that there is a driver error in a newer windows update that is affecting only these machines. Links:

This one was a good start but didn't have a lot of answers. One answer did have a nice link to the HWiNFO utility which I tried and found that my temps are usually pretty reasonable: https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/windows-10-system-keeps-initiating-unexpected/07a3b3f6-e2cf-4af9-bf04-22244850a050

Here one from a guy with some E5470's. He solved his problems by rolling back the drivers, but it was so obvious to him how to do it that he doesn't go into detail about how to do it and only discusses the trick necessary to keep them from re-updating: https://community.spiceworks.com/topic/2258120-false-overheating-on-dell-latitude-e5470s

There are a lot of theories around about uninstalling the Intel Dynamic Platform and Thermal Framework or rolling it back to an earlier version. This forum thread goes into excellent detail about how to do that: https://www.dell.com/community/Latitude/E5470-overheating/td-p/7516623

Laptop shuts down when sleep is selected

Investigating the issue of my work laptop sometimes rebooting when I try to use Sleep for travelling it. This is because Windows took the "Hybernate" option away, however I learned that it is possible to manually call the hyberbnate function from a CMD window using "shutdown /h". The rebooting while sleeping seems most likely to be due to damage to the laptop's motherboard.

This is an article titled with the exact problem that I was trying to solve. It had pretty much the same solutions as a lot of other related pages, which were to fiddle with power settings most of which I couldn't touch due to the group policy settings on my laptop: https://www.guidingtech.com/fix-windows-10-shuts-down-instead-sleep-hibernating/

I was unable to get around the group policies to try to turn off "fast startup". Here are a few searches that I tried on the topic. The hints, while unsuccessful, were interesting and I'd like to learn more:

turn off fast startup from command prompt: https://www.bing.com/search?q=turn+off+fast+startup+from+command+prompt&qs=AS&pq=turn+off+fast+startup+from+c&sk=AS1&sc=2-28&cvid=7C0CE2BE4176472982CB018F0BAC4ACA&FORM=QBRE&sp=2&ghc=1

powercfg -h off unable to perform operationhttps://www.bing.com/search?q=powercfg+-h+off+unable+to+perform+operation&cvid=de3e7676a2b54113b4fc6159bdf1b712&FORM=ANAB01&PC=U531

30Gbytes in AppData\Local\Microsoft\Windows\Temporary Internet Files

Initially found this by hunting around with "Properties". Clearing temporary internet data seemed to have no effect and looking at the properties of all files and directories visible in the browser at this level didn't show where the 30GBytes were.

There are many, many people with this problem begging for help in forums.

Here's one with a wide variety of ideas, many of which ended up being suggestions that I could incorporate, at least partially:https://answers.microsoft.com/en-us/windows/forum/windows_7-files/very-large-temporary-internet-files-cant/7f09329b-e4fd-4386-bdea-f23689c05799

I tried messing around in these directories in safe mode with a command line. I very tentatively tried using del /f/s/q and it seemed good. It prints out messages for each file deleted which I found helpful rather than trying to send it to > null (or nul?) It turns out that the hidden Content.IE5 folder didn't have a whole lot of files in it.

I had a bit of a panic trying to get out of safe mode, but when I did CTRL-Shift-ESC to start the Task Manager I was able to find the Log Out button, and when it went back to the safemode log in screen there was a restart option. https://www.google.com/search?q=how+to+exit+safe+mode+with+command+prompt&rlz=1C1CHBD_enUS730US730&oq=how+to+exit+safe+mode+with+command+prompt&aqs=chrome..69i57j0l5.9337j0j7&sourceid=chrome&ie=UTF-8

There was a folder called "Virtualized" which seemed to have a mirror of the windows directory tree and seemed to have some large files. A bit of research seemed to indicate that this is for caches that older programs used to save outside the user's directory that's not allowed anymore. And these can be safely deleted, so I did it.

This has some explanations although it's a bit brief: https://answers.microsoft.com/en-us/windows/forum/windows_7-performance/virtualized-folder-in-temporary-internet-files/34b442ce-0036-44d5-85ae-00ec39971298

Here is a lot more information which provides better reassurances that it would be ok to delete these files: https://answers.microsoft.com/en-us/windows/forum/all/virtualized-temporary-internet-files-eating-up/828a81bb-a11e-4c23-b033-316cfb638f3a

The previous link provided greater reassurances for trying TreeView, which turned out to be AWESOME. I checked it out, downloaded it, and immediately it showed me that the files were actually hiding in AppData\Local\Microsoft\Windows\Temporary Internet Files\Low. It didn't seem to have any problem finding hidden directories in its scans. I gave clearing the temporary internet files one last try, then did a big del /f/s/q and that fixed it.

The instructions on clearing temporary internet files from the control panel. It did seem to something but didn't touch the 30Gbyte: https://community.f-secure.com/t5/Common-topics/Cleaning-temporary-Internet/ta-p/18280

Where to get Treeview: https://www.jam-software.com/treesize_free/features.shtml

how to disable a user account in windows 7 home premium

Found the same answer several places, the DOS command to disable a user account without deleting it. The link that I used is this one:

dmmthinksitsfunny.blogspot.com/2011/08/disable-user-account-in-windows-7-home.html?m=1

Google chrome exiting tabs when I click on themk

There are many, many google hits on this problem. Most of them agree that the issue is that somehow the middle mouse button (or mouse wheel button) has been stuck down, causing each left click to register as a middle click. Apparently Chrome has a bunch of middle click behaviors, one of which is closing a tab with one middle click. Since the mouse drivers on my laptop routinely go awry when I've overloaded it, this is fairly likely to be what happened. Also I'm getting other middle click behaivors, probably my only recovery option is to reboot the stupid thing. Some links:

https://productforums.google.com/forum/#!topic/chrome/Ok8jGiAXU00

How to get a list of com ports in Windows 7 without being administrator

Thanks to my job treating employees like preschoolers, I no longer have the ability to view the device manager on my laptop. I am trying to use the laptop to control a remote device through USB, how to I tell what COM port my USB device has been assigned to? There might be better ways, but what I found is using the heretofore unknown "MODE" command in a DOS window. This will list all printer and com ports with lots of info.

Sources:

This had the key info, although some users on this thread also mention powershell which was the commonly supplied answer on other threads also:

http://superuser.com/questions/835848/how-to-view-serial-com-ports-but-not-through-device-manager

This thread beats on the problem a lot with powershell and some visual basic scripts, but does not reference the MODE command which seems like such an easy solution:

http://empegbbs.com/ubbthreads.php/topics/352184/Windows_command_to_quickly_lis

Why does Movie Maker Suck So Much?

I downloaded Movie Maker for Windows 7 and a whole bunch of features that various forums discuss (for example, http://jtoolkit.com/video/strip_Audio_WMM.pdf) don't seem to be there. It turns out that M$ eviscerated Movie Maker for its newest release, but it is still possible to get the old version! Download it from here:

http://windowsmoviemakers.net/Forums/ShowPost.aspx?PostID=126998

As described here:

http://www.windowsmoviemakers.net/Forums/ShowPost.aspx?PostID=253275

Now with Movie Maker 6 it is possible to get the timeline view, and drag a video onto the audio pane to get the audio track only, and have multiple video clips open and place them on the timeline.

As an aside, this seems to be a tortuous way to extract audio from a video using the new feature-limited version of Movie Maker:

http://www.thewindowsclub.com/extract-audio-from-video-windows-movie-maker

How to list what ports are open on a Windows PC

You can run netstat from the DOS command window:

https://answers.yahoo.com/question/index?qid=20080810132332AAr5nSv

This may return an error message "The requested operation requires elevation". What this is trying to say is that you have to be Administrator to run it. This turns out to be easy to solve; when starting the command window, right click on the launch icon and select "Run as Administrator". If you have the admin password or are a Power User this will work easily:

http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/error-the-requested-operation-requires-elevation/cdd97f8c-7f58-e011-8dfc-68b599b31bf5

Hay Day for Windows

It turns out that while there isn't a Windows "version" of Hay Day, there is an Android emulator for Windows that will run the Android version of Hay Day. The emulator is called Bluestacks.

http://www.bluestacks.com/

There's a ton of hits for "Hay Day for Windows" that all point back to downloading bluestacks. The sheer number of different web pages suggesting this after indirectly promising a windows version of the app is suspicious. Here is review of bluestacks by a reputable site that convinced me that it might not be a scam after all:

http://www.tomsguide.com/us/how-to-run-bluestacks,review-1912.html

A lot of reviewers on Cnet were convinced that bluestacks introduced viruses to their systems, while others mocked those reviews and indicated that if they declined bundling options (a step which does not seem to exist in the most recent release) that they had no issues:

http://download.cnet.com/BlueStacks-App-Player/3000-18513_4-75593133.html

Python 2.5 get text string dialog box

Research from trying to figure out how to write something in python 2.5 to create a dialog box for inputting a text string that I can then parse. Shouldn't be too hard you'd think. But, I don't seem to have access to any Tk libraries and am pretty sure that installing them isn't an option in my environment. So far I have a lot of stubby leads and no answers. What I've tried so far:

Things would be so easy if I could just use wxPython:

http://www.wxpython.org/what.php

http://wiki.wxpython.org/MessageBoxes

http://www.yolinux.com/TUTORIALS/PyGTK.html

http://stackoverflow.com/questions/13470927/taking-many-inputs-from-user-to-receive-input-as-string-like-file-names-directo

Python 2.5 has a built-in text entry prompt called raw_input() (changed to just input() in python 3). The problem is that running it in the GSEOS python console gets me an error "EOFError: EOF when reading a line". The best that I've been able to figure out is that if my python is configured a certain way, raw_input will open a console window for the new input, or something like that, but I don't know how to get there. Apparently a text file can be piped into raw_input(), which doesn't help me but is interesting. In my case, I won't be running python in what is normally entitled a "python window" anyhow, I really want a pop-up dialog box.

http://stackoverflow.com/questions/10044413/python-console-better-than-raw-input-how-to-offer-editable-default-values

http://stackoverflow.com/questions/4280889/raw-input-causing-eoferror-after-creating-exe-with-py2exe

This thread had a fascinating example where the win32console functions were directly manipulated, there must be some clues in that, but I couldn't import win32console in my python.

http://stackoverflow.com/questions/2533120/show-default-value-for-editing-on-python-input-possible

I also learned that ctypes() can be used to access the windows win32dll which has basic prompt boxes accessible, very nice but I can't seem to find a text input dialog, just various OK/Cancel boxes.

http://stackoverflow.com/questions/2963263/how-can-i-create-a-simple-message-box-in-python

http://stackoverflow.com/questions/4485610/python-message-box-without-huge-library-dependancy

http://stackoverflow.com/questions/14648448/string-problems-with-python

http://bytes.com/topic/python/answers/164237-simple-dialogs

http://win32com.goermezer.de/content/view/288/243/

http://techietrivia.blogspot.com/2012/07/python-message-box-in-windows.html

Here's M$'s own manual on MessageBoxA:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms645505%28v=vs.85%29.aspx

Root of the above article with more directions to read:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms632588(v=vs.85).aspx

This article has a lot of technical stuff that may contain an important clue:

http://docs.python.org/release/2.5.2/lib/ctypes-function-prototypes.html

Edit ID3 tags

More on ID3 tags, just helpful general information about editing the tags. Find my other post about all the different version types and which do and don't work on my phone.

Here's a lovely list of ID3 tag editors, along with several pages of interesting comments below the original article. The article mentions the editor that I tried out before, mp3tag.de:

http://lifehacker.com/5266613/six-best-mp3-tagging-tools

The following page maintains that it is possible to edit tags in Windows Media Player 12, but it probably only edits the tags that are windows compatible or something like that. Plus the lack of a discrete save step is a disturbing sign:

http://kb.sandisk.com/app/answers/detail/a_id/8029/~/editing-id3-tags-in-windows-media-player-12

That having been said, I recalled that the last time I was stuck on a problem with ID3 tags, I downloaded Mp3tag and it worked well. It looks sort of like the older, easier to use iTunes tag editor with the added bonus of being able to select and save in old tag formats. Being able to see all the tags at once, poke those that need changing or do a batch change, is nice. Once I changed all the tag names to include track number, and fixed the track number tags, the files began to play in the correct order for the album I had imported from analog.

http://www.mp3tag.de/en/

Windows 7 Remote Desktop with Dual Monitor

Works great! It seems that a key to getting it to work is to have both monitors on the local system set to identical resolution.

Here is a very nice write-up. This blog, like others, seemed to hint that this will only work if both system are "Ultimate" or "Enterprise", however, it worked well for me and my remote system was "Professional"

http://www.techrepublic.com/blog/windows-and-office/use-multiple-monitors-with-windows-7s-remote-desktop-connection/

One key not mentioned in the above link is to run the remote desktop app in /span mode, which seems to mean starting it in a cmd window with this command:

mstsc /span

This link goes into setting up the two monitors to be identical in size:

http://www.splitview.com/using-remote-desktop-with-dual-monitors-in-span-mode

Here's the same info from M$:

http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/windows-7-remote-desktop-with-multi-monitor/6bf0d5e3-644f-404e-baaf-ff2085e1c2c2

Using gnuwin32 find and grep

My issue is that I've just been too lazy to set up my $PATH correctly on my windows system, so I have to call out the full executable path thusly:

"C:\Program Files\GnuWin32\bin\find" . -name "filename.txt" -exec "C:\Program Files\GnuWin32\bin\grep" -H Keyword {} ;

How to change the windows 7 desktop clock to show 24 hour time

It's not as simple as clicking on it and finding the control for this, but it's not that far off either. This configuration has to be accessed via the control panel. Apparenly what you're doing is changing globals that apply for all software on the machine. Here's the link with nice screensnaps:

http://answers.microsoft.com/en-us/windows/forum/windows_vista-desktop/control-panel-change-12-hour-clock-to-24-hour/490a874b-7d3a-4fa4-ad38-c6ebc24a854a

Disable middle mouse button closing tabs in IE

This "feature" in Windows 7 has caused me more trouble that you'd think would be possible. With my work laptop, the placement of the mouse buttons under the track pad makes it super easy to hit the middle button when I meant to hit the left button, and boom the tab is gone.

It turns out that the answer is simply to edit the mouse setup properties for the track pad; the definition of each button is fully configurable. I made the middle button the same function as the left button and my problem was solved.

Here are some links. This first link describes the problem perfectly but not the solution so much:

http://www.xyplorer.com/xyfc/viewtopic.php?f=3&t=8148

Here's the (in retrospect, not very related) link that got me to realize that I could just change the mouse button settings through the control panel:

http://www.sevenforums.com/general-discussion/34877-middle-mouse-button.html

Remote Desktop to a mac from Windows

Summary: OS X has remote desktop built in (it's called VNC), you just have to set it up and then get a 3rd-party client to run on the Windows system. However, there seems to (as usual) be restrictions on how it works for the exact release of OS X that we're running on the MacBook.

There are several blogs and forum threads that recommend running TightVNC:

http://www.trickyways.com/2010/06/how-to-remotely-access-mac-from-pc/

TightVNC comes from here:

http://www.tightvnc.com/download.php

The problem that I encountered once I got everything set up has lots of Google hits.
I could make the connection to the remote mac, but then nothing would happen. Apparently there is something wrong with how our particular version of OS X implemented VNC, and remote logins require that no other users be logged in, including on the actual machine. Most people complaining about this problem had their VNC working prior to upgrading to OS X Lion and found that it was broken as a result:

http://help.edovia.com/kb/screens/screens-for-ios-and-os-x-lion

https://discussions.apple.com/thread/3190260?start=120&tstart=0

The quick workaround for me is simply to log out of my active session on the Mac and let the remote session be the only login. Apparently another app called RealVNC is also supposed to fix the problem, although I never got around to trying it.

http://www.realvnc.com/products/vnc/

Update: I gave TightVNC and RealVNC a spin using the above hints and it went pretty well. RealVNC still required that no other logins be active on the machine, so that didn't "fix" that problem. It has taken me a while to work out some kinks though with using VNC. The two biggest problems were that over my pathetic DSL at home the connection is agonizingly slow, and the problem of VNC only working if there are not other logins.

I found a bunch of hints to deal with the slowness. Primarily, I have to use TightVNC, which has the highest level of compression. It turns out that VNC is a surprisingly primitive system compared to something like X or Remote Desktop. It apparently ships desktop screenshots whole between the two machines (at whatever is the highest rate possible for the connection), compressing them as .jpegs and using further compression on the data channel. So, the best suggestion that I found was to set the desktop image to a plain color; given the above mechanism it is easy to see why this would help.

The following link had a bunch of suggestions for what to do about the slowness. The most interesting suggestion was to try to use "Remote Assistance", but that sounds like something that I don't have the administrative privs to do on my work mac. The same problem exists with other alternate software which requires installing a server on the mac. Lastly, apparently there's something called "UltraVNC" that is similar to the two clients that I have been using, but I've also seen negative reviews for it elsewhere:

http://superuser.com/questions/285250/vnc-on-windows-why-is-it-so-slow

Here is another great list of suggestions, most of which are for alternate VNC servers. Logmein is mentioned here as well:

http://superuser.com/questions/15337/how-can-i-make-vnc-faster

Here is the link where changing the desktop image was suggested. The comments here have other nice alternative software suggestions as well, inclulding Timbuktu:

http://hints.macworld.com/article.php?story=20050915061927686

Here's where it is revealed that with OS X you can't use the trick of setting the color resolution to 256 to speed up the VNC connection; the built in mac VNC server simply doesn't support this option and fails silently. The alternative sofware suggestions in this thread include VineServer and TeamViewer also mentioned in earlier links:

http://superuser.com/questions/28546/fast-vnc-from-windows-to-mac

Now, the problem with having to have the mac clear of other logins before the VNC connection can be made has been particularly troublesome because TightVNC occasionally just crashes, leaving my login intact on the mac but now no way to get in remotely. After a bit of searching, I found that it is possible to configure a user login on the mac to log out automatically if idle. It seems to be working; I have at least intentionally killed the TightVNC connection without logging out, and after the timeout period I connected back up to find the login prompt awaiting me. To my surprise, I also found the IDL program that was running at the time to be still up; I'm not sure how that worked.

Here's a nice tutorial on how to set up auto-logout:

http://www.ehow.com/how_4577940_set-mac-log-out-automatically.html

Too bad my screens didn't look like those in the above tutorial. The missing piece was probably a result of differences in OS X revision. It turns out that my system has a "lock" icon that I had to click to get to the "Advanced Features" screen:

http://support.apple.com/kb/PH4014?viewlocale=en_US

BTW, here are a few more links about how much Apple sucks for breaking VNC:

https://groups.google.com/forum/?fromgroups#!topic/macenterprise/UqUflFr3icg
http://apple.stackexchange.com/questions/54001/several-users-simultaneously-on-a-mac-mini

How to tell what process is preventing my USB drive from ejecting

Results from the above query actually led to an answer, finally.

First of all, I found, downloaded, and tried DevEject, which has a nice GUI that identifies the reason why the "cannot eject xxxxx right now, try again later" message is coming up.

http://www.technostarry.com/windows/how-to-solve-usb-drive-is-in-use-problem-prevent-usb-locking/

http://deveject.com/

In my case, this led to the discovery, obvious in retrospect, that the TortoiseSVN cacheing process (tsvncache.exe) was the process grinding away in the directories on my USB backup drive. Further queries revealed that it's pretty easy to curtail this cacheing to just the directories on my main drive that I need it to show the SVN status of. This has the fortunate side effect of eliminating a lot of unnecessary system load as well. I am far from the first person to have had this problem, and there are lots of forum threads and web pages discussing how to do this:

http://assorted-experience.blogspot.com/2008/03/optimizing-tsvn-cache.html

Note that the above link hints that Process Explorer might have accomplished what DevEject does.

http://superuser.com/questions/69699/prevent-tsvncache-from-running

http://www.paraesthesia.com/archive/2007/09/26/optimize-tortoise-svn-cache-tsvncache.exe-disk-io.aspx

Windows restart hangs on zombie process

Thanks to the indefensibly badly written drivers in QuickUSB, the workstation froze when I tried to reboot it. Here are the spoils of a half a day trying to find some solution. The short answer is that I was hosed without any recourse the moment the driver failed to get a response. All I have to console myself with is having learned a few things.

First off, taskman fails to kill the process that calls the QuickUSB libraries; the process just continues on.

The basic alternative tools available apparently do the same things that taskman would try, so they don't work either. Here's a few forums that pointed the start of this path.

This author suggested pskill, and the remainder of the post is frustrated users hurling insults at the author when it didn't work.

http://www.watchingthenet.com/how-to-kill-windows-processes-that-wont-die-or-terminat.html

This author suggested taskill, and the remainder of the post is frustrated users hurling insults at the author when it didn't work.

http://www.tech-recipes.com/rx/446/xp_kill_windows_process_command_line_taskkill/

pskill and taskkill are very nice utilities, however, and ship standard with XP pro. I tried using taskkill with parameters to operate on all processes for my userID and it still wouldn't kill the dead I/O processes; it killed everything except those. I eventually got taskman to launch, and used it's "run" function to get some IE's, cmd windows, and file explorers going even without a desktop! At some point the desktop just magically reappeared.

One of the commenters in the above threads suggested a fancy piece of freeware that has something like 16 kill methods, called apt for Advanced Process Termination. I tried it but it didn't work for me.

http://www.pendriveapps.com/advanced-process-termination-kill-running-processes/

Here is the best forum thread that I found on the topic, containing some actual signal. Some commenters futilely attempt to explain how a driver that's waiting on a response causes this problem (which matches what I'm dealing with) and exactly why normal process killing tools don't affect it. The thread is several dozen pages long and I was hoping that somebody somewhere would reveal a magic bullet for this kind of "zombie thread" but sadly nobody seems to have anything aside from cursing microsoft up and down.

http://social.technet.microsoft.com/Forums/en-US/w7itproperf/thread/598fe2b4-844d-412d-b195-5fa53dc62661

Someone mentioned Process Explorer, which suspiciously somebody before me had already put in the downloads folder on this workstation. I tried it, it could find the zombie thread, but it couldn't terminate it. Hoever, Process Explorer sure is gorgeous.

http://social.technet.microsoft.com/Forums/en-US/w7itproperf/thread/598fe2b4-844d-412d-b195-5fa53dc62661

Oh yeah, I also tried attaching debuggers to the processes, calling the debugger from a cmd window using the -p option but they said access denied.

Windows detected a hard disk problem

This morning, Lisa's laptop was thoroughly hosed. After the initial alarm wore off, it was clear that this was just another fake "error fixer" virus like Windows 7 Security 2012. Here are some of the plethora of error messages from this virus:

Windows detected a hard disk problem

Windows - Delayed write failed to save all the components for the file \\System32\\0005382. The file is corrupted or unreadable. This error may be caused by a PC hardware problem

System Error - Critical Error. hard drive critial error. Start a system diagnostics application to scan

Critical error Windows OS can't detect a free hard drive space. Hard drive error (This one is my favorite)

Clicking the Windows Detected a hard disk problem balloon gets:
System Check - with 4 categories including My computer Relate Problems. HDD related Problems. It "scans" and produces a results window with nearly laughable over-the top error messages.

Another clue: Task manager is suppressed when summoned using ctl-alt-del.

Anyhow, this here is definitely the one. Looks nasty:

http://www.bleepingcomputer.com/virus-removal/remove-system-check

The cleaning procedure involves MalwareBytes tools and looks pretty similar to the removal instructions for the Windows 7 Security 2012 virus.

Google redirect virus TDSS

After a few funny redirects, I began to suspect that Lisa's laptop had another virus, and sadly found it to be true. Not only is this a virus, but it's an extremely dangerous rootkit and proving difficult to remove.

First, I keyed in some searches to the sites that I was being redirected to. Many of the results identified the virus as TDSS and revealed that it's more than just your average values. Many victims complained that their virus detection and removal software was not working on it. I got the following two links:

This one seems a little too simple to be correct, it just says to turn off JavaScript and then runTDSSKiller. Later it suggests hints to thwart DNS redirections:

http://www.computing.net/howtos/show/how-to-remove-the-google-redirect-virus/415.html

This link is also untrustably simple sounding, claiming that TDSSserve.sys will be hiding in the device manager and you can just disble it? Then just install your favorite antivirus tools and declare victory? Apparently there's something called "Google-Redirect-Virus-Remover' by name? MalwareBytes and SuperAntiSpyware were both famililar names recommended. Then it also goes into hints for thwarting redirection, particularly in checking for proxy server settings. The final hint, however looks useful, an also-familiar package called "UnHackMe" which apparently detects rootkits.

http://www.ehow.com/how_5842581_remove-google-redirect-virus.html

After refining my searches better, I began to get more serious postings on the topic.

The following link is to 6 pages of directions with screenshots of each step, most of which concern checking for DNS redirection, false host tables, Proxy servers, etc. Then it recommends TDSSKiller.exe. Then it recommends resetting the router, which I can believe although it would make me sad to have to figure out how to re-setup my network afterwords. After the post though are 32 pages of comments full of other hints and tips which I've only skimmed through so far. After reading this, I did everything up to TDSSkiller.exe. The name of the identified virus came back as Win32.ZAccess.k. After running, I rebooted, ran TDSSkiller again, and it found it again, probably indicating that it's refreshing itself through the registry or Master Boot Record.

http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html



I also kept getting results back for the "atechjourney" blog's posts about this, which seemed knowlegable but was vague and seemed to be hawking "optimizer" tools. The same vague hints were reiterated in other posts which also seemed like a bad sign. Lastly, it recommends a paid online removal service, also a bad sign but which has also been echoed by other blogs:

http://atechjourney.com/google-redirect-virus-remove-manually.html/

Hints in this forum about what to do if TDSSkiller not working include renaming TDSSKiller (doesn't seem to be something I need), run Hitman and/or ComboFix (both highly recommended on other forums too), and running TDL-4 from bitdefender:

http://answers.yahoo.com/question/index?qid=20110726110537AADZ9zp

Holy how, here's a video by a guy who did it. I know that getting rid of this thing would make anybody want to put in the extra hours to help others do it too. The comments are the usual mix of thanks and unsatiated frustration. I expect that I would find several dozen videos on this topic on youTube:

http://www.youtube.com/watch?v=N4zs42gO_fs

Update: I removed the most recent "scareware" but the rootkit seems to still remain. VERY interesting links from searching on the rootkit's name:

First off, this forum, where a user gets superlative service and is talked through a bunch of fancy ComboFix moves with log after log posted, and the "Kiss ZeroAccess Goodbye" tool is mentioned:

http://www.bleepingcomputer.com/forums/topic413198.html

Here's the link to KISS. It also mentions having to fix ACLs (Access Control Lists) which I guess I'm going to have to learn what those are:
http://blog.webroot.com/2011/08/03/new-tool-released-kiss-or-kick-zeroaccess-goodbye/

The comment section at the bottom of the release announcement lead to another page where the authors of the Anti-ZeroAccess tool revealed how much work they've put into decompiling and understandig how the malware works.

http://blog.webroot.com/2011/07/19/zeroaccess-gets-another-update/

and

http://blog.webroot.com/2011/08/08/tdl3-and-zeroaccess-more-of-the-same/

Anyhow, about to try this webroot tool, since ComboFix continues to be too scary lookng to try.

Ok, it found it in netbt.sys, which I recall seeing mentioned somewhere else regarding this rootkit. Rebooting now.

Still there. Now it's in cdrom.sys I think that I followed this one around this path before.

Here's an AMAZING link from a guy who has to fix this all the time. This is clearly a lot of work and I'm going to have to try this later. Definitely dreading the moment this leads to loss of network access which seems to be the hell that many users end up encased in when they scrub this bug out:

http://remove-malware.com/malware/rootkits/rootkit-zero-access-max-notes/