My related essay on virus recovery is here: Virus Recovery in Windows 7
Go to homepage

Recovering from a computer crash --- My adventure replacing my 'dead' hard drive (Dec 2012)
        Did a trojan virus cause my computer crash?

FBI computer lock virus -- How to recover (Aug/Dec 2012)
Kill annoying popup ads --- from Yield.manager (Nov 2012)
Microsoft 'System File Checker' tool --  Windows 7 can fix its own files

My XP to Windows 7 'upgrade' Adventure
Printer installation nightmare
Hassling with the TV tuner
Struggling to get old programs to run on Windows 7 (Home Premium)
Is Windows 7 stable? --- Paint Shop Pro 8 instability
10 day 'upgrade' status report
Getting 16 bit code to run
      Microsoft XP Mode
      DosBox
      DosBox + Windows 3.1
Scanner update -- Cannon Lide 210  (9/23/10)
      My Amazon review of Cannon Lide 210 scanner
Checking out Explorer Sort
Windows 7 Search misses files and is a disorganized mess
UBS disk drive plug and play bug (9/7/11)
Continuing Window's annoyances

My Amazon HP computer/Win7 upgrade review
         Good hardware, XP to Windows 7 is a nightmare
          XP to Windows 7 upgrade is a nightmare

Appendix
      Scanner photography with HP 5470c scanner
      Read Errors --- Why my computer won't boot (update 3/30/11)
      Catastrophic Window7 crash (update 4/9/11)
      System Restore fails me ---  twice!
      2nd Catastrophic Window7 crash (4/6/12)

        I posted the review(s) below on the Amazon site under HP Pavilion p6510f desktop computer and (minus the hardware section) Microsoft Windows 7 upgrade disk. In one review Amazon removed the URL to my homepage and in the other they didn't.

My Amazon HP computer/Win7 upgrade review (9/10/2010)
        I summary of this essay can be found in my Amazon reviews for HP p6510f computer and Microsoft Windows 7 Home Premium Upgrade where I posted the review below.  (12 of 13 people have found it helpful).

Title(s): Good hardware, XP to Windows 7 is a nightmare
                XP to Windows 7 upgrade is a nightmare

Hardware
-------------
This is a good fast machine available, if you look around, at a good price (450). A very nice feature is that dual monitor support (VGA and HDMI) with extended desktop is built-in. But there are some Cons:

1) Comes loaded with useless and trial programs that take hours to delete using Windows uninstall. I found uninstall could not remove Norton. To get rid of Norton I had to go to the Norton site and download and run a Norton removal program!

2) After a few days I started getting a black 'death' screen at boot that said, Read Error (hit Ctrl + Alt + Del). A google search said this is bios sequence problem. You need to go into 'Setup' then Bios at boot to set your hard drive first in the boot sequence, and this seems to have fixed the problem. But it brings up an interesting questions: Why is it necessary on a new computer to have to play with the bios settings? Is the bios memory not stable? Fixing this is techie and no doubt beyond the capability of many computer users.

3) I was replacing a four year old HP computer with this HP machine. I slipped in the new machine and found I could not plug in my miniature keyboard or mouse extension cable, because HP has changed the connectors from Ps2 to USB. I was unable to plug in my old Laserjet printer, because this machine has no parallel port.

(Intro to Windows 7 upgrade review --- This review is for upgrading from XP to Windows 7 preinstalled on a new machine, but the problems I found apply to upgrading on the same machine.)

XP to Windows 7 'upgrade'
--------------------------------
If you're a serious computer user with a lot of accessories or a long time computer user with some old programs you don't want to abandon, be prepared for an 'upgrade' nightmare. Attached to my XP I had two printers, a scanner, and TV tuner. Only the TV tuner installed correctly on Windows 7. One of my printers, supposedly "100% Windows 7 compatible" says Microsoft, I finally got installed after six hours work. My scanner and other printer look like they are never going to work with Windows 7 and will need to be replaced.

Trying to get old programs (> 15 years old) to run is another nightmare. There are some fixes and workarounds possible, but it is a techie task and very time consuming. Every old program seemed to need a different fix. The root problem with old programs, those written to run under Win 3.1 and Dos, is that they are 16 bit code and 16 bit code will not run on 64 bit Windows 7. Most versions of Windows 7 including Windows 7 Home Premium (? above) are 64 bit. Even some 32 bit programs, which can run on Windows 7, won't install because they come with 16 bit installers.

With many, many hours of work researching and running tests I have gotten most of my old programs to run on Windows 7. Here are the tricks and workarounds I have used:

-- I got a couple of programs to work by copying over the directory from another computer rather than installing the program. This is one way to circumvent the 16 bit installer problem. One of the programs I rescued this way was my favorite html editor Composer, part of Netscape 4.8, which refused to install. (A newer html editor very similar to Netscape 4.8 Composer is SeaMonkey Composer. SeaMonkey is a free download and installs normally on Windows 7.)

-- One of my old technical programs (Vissim) I found had two .exe's, a 16 bit and 32 bit. Only the 32 bit exe runs on Windows 7, so the fix here is to disable (rename) the 16 bit .exe.

-- I got a Dos editor to run using a free, open source emulator called DosBox (www.dosbox.com). DosBox will run hundreds of Dos games and programs written in QBasic, but like most emulators it takes some dedication to use.

-- By far the most difficult old programs to get running on Windows 7 are early (16 bit) Windows programs written for Win 3.1 (1993 to 1996). This is a problem I am still working. Microsoft has a fix for these 16 bit programs ('Windows XP Mode'), but it's expensive (in more ways than one). Microsoft has a ('free') downloadable emulator and a downloadable XP OS that you load into it. However, there are two big caveats: It's not available to Home Premium users. Home Premium users can get it only after paying Microsoft an extortionate $90 fee to upgrade (Home Premium => Professional), which (I suspect) will also introduce a new set of password and permission hassles. The best that Microsoft will guarantee about XP Mode is that 'might' (or probably) will get your XP programs to run, and you need to try it. An alternate if you own disks for Win 3.1, is to install Win 3.1 onto a free emulator like DosBox or Oracle's VirtualBox.

While Windows 7 has some nice features, it has some major flaws too. Search for files using partial filenames (based on my tests) just does not work right. If XP Search finds (say) 30 files in a partial filename search, the best Windows 7 Search will do (partial match is on) searching the same directory is find (say) 6 files, missing about 80% of the files with the embedded partial name! This pattern of missed files on Windows 7 happens again and again. Online I have seen dozens of posters complain about Windows 7 Search with most preferring XP search. In its layout Windows 7 Search is a disorganized mess (search options are scattered all over the place) and unlike XP it does not tell you the number of files it finds. Another dubious 'upgrade' of Windows 7 (? Vista) is how Explorer sorts filenames. Filenames beginning with numbers are sorted differently in Windows 7 and XP making the comparison of directories a real joy.

I kept a running log of my XP to Windows 7 'upgrade' adventure. The full story is on my home page (http://twinkle_toes_engineering.home.comcast.net/xp_to_windows7_nightmare.htm). If Amazon removes the URL you can find it by Googling "Twinkle Toes Engineering" (with quotes), look for 'XP to Windows 7 Upgrade, What a Freaking Nightmare'.
---------------------------------------------------------------------------------------------------------------------
Summary
        If you're a serious computer user with a lot of accessories or a long time computer user with some old programs you don't want to abandon, be prepared for an 'upgrade' nightmare. Be prepared to lose some of your accessories, like printer, scanner, etc, because accessory manufacturers are refusing to provide Windows 7 drivers for some older equipment. Even (supposedly) compatible equipment can take hours and hours to install and setup.

        -- I eventually got my one of my two printers and TV tuner to install. In the 'upgrade' I lost my scanner (no driver) and my older printer (no parallel port). I only got my favorite keyboard and mouse shifted over from the XP after I ordered and received cable hardware adapters.

        -- Microsoft claimed my inkjet printer was "100%" compatible" and a driver for it is supposedly built into Windows 7, but when the printer was connected, the UBS message was, 'driver failed to initialize'. It took six hours of work and several false starts to finally get this printer properly installed. (Update -- It may be installed, but I not sure about "properly". It is still not printing reliably, which it always did under XP.)

        More unpleasant surprises await. Very likely some of your older XP programs will not install. The Windows 7 installer will tell you they are "incompatible" with Windows 7, or at least the version of Windows 7 preinstalled on most computers sold in stores (Windows 7 Home Premium). The reason is programs from mid 1990's and earlier (Windows 3.1 and Dos) are 16 bit code,  and 16 bit code will not run on a 64 bit OS's like Windows 7 (? 64 bit Vista). Some of my circuit analysis programs are from the Win 3.1 era and won't run.

        -- Some old XP programs (I found) can be made to run on Windows 7 by a trick. The trick is to copy over from the XP (or archive) the program's folder. This circumvents the Windows 7 installer, which I find can block installation of programs that will in fact run.

        I am now writing this essay using my trusty old html editor, Netscape 4.8 Composer, which I copied over from the XP, and which runs fine under Windows 7, even though the Windows 7 installer told me it was incompatible and refused to install it!

        -- There is way to get 16 bit code to run (maybe) using emulators, essentially installing a 2nd OS, like Win 3.1 or XP, on top of Windows 7, but this is a whole new ballgame in terms of effort, cost, time, and complexity to get this setup. You need to ask yourself, is it worth it for one or two old programs.

        -- Microsoft talks about 'free' downloads, which are an emulator + XP OS, to provide XP compatibility, but when you read the fine print you find:

               a) Windows upgrade costing $90 is needed (so much for free!)
                             (Home Premium => Professional)
               b) An additional 1 gb of ram is needed
                              (2 gb for 64 bit OS + 1 gb for emulator = 3 gb total)
               c) All Microsoft will promise is that it might (or probably) will run
                              your old XP programs

        -- A classic example of a core OS function 'improved' from XP such that it is now barely usable is filename search. Not only is it badly laid out, missing XP features (like number of files found), but I am convined (like others) that it just does not work right, that on partial searches it misses files. My tests and travails with Windows 7 Search are here: Windows 7 Search misses files and is a disorganized mess

Introduction
        Summer 2010 I was forced to 'upgrade' from Windows XP to Windows 7 by a hard drive failure in my four year old Windows XP machine. Returning home from a trip I powered up my trusty HP/Compaq XP desktop only to find it refused to boot. I tried several times and each time the boot froze after only a few lines on screen. I assumed my hard disk had died. Like most techies I can't live without a computer (news, finance, email, supporting my home page), plus I was just days away from a trip to NYC with my nephew and niece, so that very afternoon I went shopping and bought a new Window's machine (at Staples). I found just what I was looking for: moderately priced ($450) HP/Compaq, a step or two up from low end desktops, which now run about $300. For $450 I got a very quiet HP/Compaq desktop with a quad core AMD (2.8 ghz) processor, 4 gb ram, 750 gb hard drive. I was also pleasantly surprised when I got it home and found the new machine had dual monitor support built-in (HDMI and VGA), so I didn't need to transfer my PCI express video card from the old machine.

        It looked like I was upgrading to a much faster and more capable machine. At least that would be the case if the operating system was the same, but of course the operating system is not the same ('thanks' Microsoft!). The only Microsoft operating system now available on new machines in stores is some flavor of Windows 7 (previously it was Vista). My machine came with Windows 7 Home Premium.

        So if your Windows computer is more than a couple of years old, buying a new computer means a forced 'upgrade' in the operating system, and herein lies the rub and the tale.

        I knew that a fall back from Vista to XP was allowed by Microsoft, but did not know if it was possible from Windows 7. In a computer store for IT professionals I was told it was, but the procedure I found online for doing it looked very complicated and tricky, at best full of risk for someone who is an amateur. Also it didn't even seem to apply to a new machine with Windows 7 preinstalled, because it seemed to be pulling XP from some hidden directory on the disk. Does a new Windows 7 machine have the XP operating system hidden on it? I doubt it.

        Not only that but the new mouse and keyboard connectors are USB 1.1 (not USB 2.0). Very likely this is OK performance wise, but you need to remember the two bottom USB connectors on the machine are 1.1 not 2.0.  Looks to me like these two 'special' USB ports are marked no different (on the sheet meal) than the other six USB 2.0 ports on the machine, so this could be trouble down the line.

        Yes, I know Windows 7 has 'compatibility' modes that are supposed to allow older programs to run in Windows 7, but I found them to be pretty much of a joke. Program after programs that ran fine on my XP would either not run (or install) even with its properties set to XP compatibility mode (or any other compatibility mode.)

        I found an indirect confirmation of this lack of compatibility in a Windows forum, where the advice to get old programs running was to download a (free) compatibility add-on from Microsoft. But of course this add-on was limited to the more expensive versions of Windows 7 and was not available to the user running Windows 7 Home Premium. I see Microsoft advises users to upgrade to Window 7 Professional  to "Use XP Mode with numerous programs". Oh, yea, basically they are admitting that the compatibility modes in the Home Premium version either don't work or don't work very well. But for $90 more Microsoft will sell you a disk that will convert you Windows 7 Home Premium to Windows 7 Professional.

        Windows calls the Windows 7 version upgrades 'Anytime' upgrades. Translation (from Wikipedia): all the features are there in all Windows 7 installations, it's just that some of them are turned off. An 'anytime' upgrade does not wipe the disk, it just unlocks the locked features.

Collusion or scam?
        It smells like collusion or a scam. Microsoft changes the operating system such that new drivers are required. The major accessory manufacturers like Canon and HP then just refuse to provide them for old equipment! (More sales!) I have seen posting after postings in Windows 7 forums where users are infuriated by being forced by accessory manufacturers (in collusion with Microsoft) to replace perfectly good, often high performance and expensive, printers, scanners, and other accessories simply because the manufacturers won't provide new drivers. (A task that I suspect is quite simple, because my guess is a) the changes are pretty simple, and b) they can be applied widely.) What a racket!

Grossly misleading
       Microsoft promotes upgrades to Windows 7 (for $120!) saying it will "Run your PC more efficiently", and "Easily connect a home network". Well I found the latter to be true, but curiously Microsoft (somehow) just forgets to mention that there's a big chance your printer and scanner will become useless, due to no drivers for older equipment, and there's a good chance you have programs, maybe a lot of programs, that run fine in XP, but won't run after your Windows 7 upgrade (even using compatibility modes).

        This lack of drivers does not look like a timing or temporary issue, it looks like these drivers will never be provided! Windows 7 was released nearly a year ago (Oct 09) and I read it is an upgrade of Vista, which was around a year or two. If there are no Vista or Windows 7 drivers as of summer 2010, it's a good bet there never will be.

No HP scanner 'fix'
        With my early Canon driver 'fix' (see below, using wrong driver) I spend hours trying to duplicate this sucess for my HP scanner. I must have tried half a dozen different Windows 7 compatible HP scanjet drivers to see if I could get one to work with my scanner, but no luck. One poster claimed the 5300 scanner driver would work with my 5470c scanner if the permissions were set to full control, but it doesn't work for me. It looks at this point like my $300 HP scanner is never going to work with Windows 7. Luckily a basic printer/scanner is now pretty cheap.

Thanks for all the crap on my new computer HP
        A really annoying time consuming task when getting a new computer retail is to decrapify it. My HP computer like nearly all prebuilt computers sold in stores comes loaded with crap. Useless programs from HP and worse various trial versions of stuff from lots of different manufacturers. I was up until 5:00 am deleting programs. This task is also slightly risky as it is not always clear what is an essential program and what is crap.

        The worst by far was Norton. All attempts to remove this using the Windows 7 program delete gave a misleading notice (I forget the text, but it was something like removal is not allowed because it is in use.) Researching online I found the only way to remove Norton from a new machine was to go to the Norton site and download and run a Norton removal tool (more risk). Well I did that and it appears to have fully removed Norton.

         This Norton experience tells me something about HP. They put Norton on (or allowed Norton to do it), and they have to know that the normal Windows 7 program removal doesn't work, and even worse that the Norton removal message is at best misleading (if not an outright lie). And what do they do about it? As far as I can see, nothing. Nice customer support HP.

Programs that will not run
        My biggest concern was how to support my extensive home page using a Windows 7 computer. Everything on my home page from day one has been written using the built in wyswyg html editor in Netscape 4.8 (Composer), but I found that Netscape 4.8 just won't install in Windows 7. Netscape 4.8 does run under Vista on my laptop, but with some limitations, so I had already checked out other versions of Netscape Composer, but didn't like what I found. In later versions of Netscape the html editor went missing, but even before that I found the spell checker in revisions after 4.8 did not work right. (It could only check the whole document not just highlighted text, which is unacceptable for an essay of any length.)

Composer 'fix'
        I was pleasantly surprised (? still a little skeptical) when I found in a forum that a modern replacement for the ten year old Netscape 4.8 Composer could be found in the built-in html editor (Composer) of the latest version of SeaMonkey, which is based on the old Netscape Composer code. SeaMonkey installed under Windows 7, and I was pleasantly surprised to find that's its Composer looked a lot Composer in Netscape 4.8 and (surprise!) that its spell checker worked correctly. A quick test showed it looked to be compatible (100%?) with all Netscape 4.8 created html files of my site. I am writing this XP to Windows 7 quasi-rant using the SeaMonkey Composer partly to test it out.

        A few of the commands in SeaMonkey Composer are little different from Netscape 4.8 (table differences are the most worrying, but I have not really worked with them much), but I can live this. More worrying is how compatible with Windows 7 it really is. It will work fine for a while and then an instability will pop up. For example, one time I suddenly found it would not load a file and as a 'fix' for this I had to change the XP compatibility property. But as I write this I am not using a a compatibility mode, and repeated saves have worked fine.

        Worrying too are bugs. Netscape composer had apparently been used to write Netscape and it was nearly bug free. This was a major strength. In SeaMonkey Composer while writing I this I suddenly found a normal Window's editing cut and paste (ctrl x/v) didn't work correctly. I cut two paragraphs (to move them) and found nothing happened when I tried to paste them. I worried that I was going to lose the two paragraphs of text, so I opened another editor and the two paragraphs pasted there correctly, so the bug is in paste not cut. Never happened again, but it's worrying because it smells of instability, I don't know what triggered it, and a bug in core Window's editing seems pretty basic. (my guess is some hidden control character is not being handled correctly)

FTP upload utility
        Another problem I ran into reestablishing support for my my online homepage was with my FTP upload utility. On my XP machine I used FreeFTP (CoffeeCup Software), but (surprise, surprise) I found it wouldn't run under Windows 7. Luckily CoffeeCup Software is still around and this program is still supported (and still free!), and their latest version seems to work OK under Windows 7. I just used it to upload this file to my site's server. So far, so good, in fact the new FTP utility stays connected to the server, so it's easier to use.

        So summarizing, both of the software tools I used on the XP to support my online home page [Netscape 4.8 Composer and FreeFTP] I found would not run under Windows 7 Home Premium even with their compatibility properties set to XP. Here I appear to have lucked out (and it is luck), because user support for Netscape has produced a newer very similar editor that is compatible with Windows 7 (or at least pretty compatible), and the company that wrote the FTP upload utility is still around has a new version too.

Google Earth
        Google Earth ran fine on my XP with 1 Gb of ram. It's a great program and free, so of course I downloaded the latest version for my new Windows7 machine, and I find it runs like crap! It's so slow on my 4 Gb ram Windows 7 machine that it's barely usable. How can this be?

        I have enough other Windows7 problems to fix, so Google Earth goes on the back burner. Only after several months (during winter snows) do I tackle Google Earth, and see if I can figure out why it is running so slow. It takes just a few minutes Googling to find a bunch of other people with exactly the same problem I have, Google Earth used to run OK and now it just crawls. One reply message (from Google I think) recommends installing an older rev of version 5. When I check for Google Earth updates, I find version 6 is now available, so I uninstall my version 5 and install 6. Version 6 fixes the problem, speed is now OK (but version 6 has its own quirks).

        Not sure if this problem was Windows7 related (likely it was) or a simple Google Earth bug, but regardless it's the kind of problem you run into when you get a new machine and need to go online and reinstall a bunch of programs. In this case loss of a valued program for several months.

Windows 7 weirdnesses and bugs
        Rename bug --- This bug one I can't believe, but it's true. I was renaming some desktop icons (Microsoft continues to put the stupid 'shortcut' in the name). When I hit enter to exit rename, the shortcut disappeared! Yup, it's true. It was repeatable. I did an online search and found it to be a known Windows 7 problem. Like four years of Vista/Windows 7 development and something as simple as icon rename doesn't work! Give me a break. Are they totally incompetent at Microsoft? Turns out they when you refresh, the icon does come back, but I didn't know this, so I had made duplicate icons, and then found I had two copies of several icons.

        Desktop icons I dare not delete --- I was playing around in Windows 7 and dragged up some directory icons (to the center of desktop) from some sort of tray in the bottom. When I went to delete these desktop directory icons, I got scared. The warning text said deleting this desktop directory icon would delete the (whole) directory!! What? There two possibilies here, neither of them good. One is that deleting a desktop directory icon does actually delete a whole directory. How could they possibly allow this? (Not only this, but I found you can rename these directory icons, so you might not even know which directory you are deleting!) If this is true, it's just ridiculous. An accident waiting to happen.

         On the other hand if the directory desktop icons are just shortcuts, then they are grossly mislabeled, because the Y/N box tells you the directory (not just a shortcut to it) will be deleted if you hit Yes. I would need to run a test to see what happens.

I ran the delete folder icon test
        Well I ran the test, and it deleted only the icon (shortcut) not the directory. Here is the exact (warning) text, when you right click on the directory icon and select Delete:

        It clearly says "this folder" not this shortcut, and this is exactly the same text used when you go into the directory and actually do delete a folder! Idiots. I guess all the reviewers who gave Windows 7 such glowing reviews didn't notice such stupidities, or don't they care? I see the pros saying you should never adopt a new operating system until the first update is released (Windows 7 Service Pack 1 is still in beta), but the millions of ordinary users who go the store to buy a Windows computer have no such choice. Thanks Microsoft...

It's a directory copy (update)
        I think I figured out what is going on here. Probably the directory icon I deleted actually was a directory, but it was a copy of the original directory created when when the icon was created. I figured this out when I later made a new directory icon and was surprised to a copy being made (to the desktop I think). I then deleted this icon and found a deleted directory in the Recycle bin. Right clicking on a desktop directory icon allows a real directory shortcut to be created.

        OK, I had it wrong, but I was faked out by Microsoft not showing paths. If I had seen a path to the desktop, it would have made it clear from the beginning what was going on!

        The same stupid path problem is seen when Windows 7 is coping files and pauses on a 'bad' file. The file is named, but no path is given! How are you supposed to check on the file if you don't know where it is? Idiots...

        A few minutes later I go back to check file size and this time F5 works! Bug?

Explorer is still buggy with home networks
        My home network (at its maximum) consists of my Window 7 desktop, old XP desktop, and Vista laptop connected via one router. The most annoying feature, which happens frequently, is that when the XP or Vista is turned on it doesn't just pop up in the Win 7 network directory. It often takes 30 sec or so and often takes some 'fooling around' or playing with Explorer. It is just not clean. I first noticed this weirdness with my first home network of XP and Vista, and it is no better with Windows 7.

        As I write, I am looking at the network directory structure using an application (graphics viewer program ADCSee). The network structure in the right and left panes do not agree! The right pane shows the all three active computers on my network, but one of the computer is missing from the left pane. Click expand or collapse on the left pane and it makes no difference, only two of three computers show up, yet on the right pane there is the 3rd computer. Click F5 (reload) and still the 3rd computer does not show on the left pane. Good grief, just not clean.

        It gets even weirder. OK, above I am not using Windows 7 Explorer directly I am looking at the directory structure though Windows calls made by an application. So I start Win7 Explorer to look at the network structure in the buff, a direct look by Windows 7 Explorer without any filtering by an application. What do I find? I click Network and only two of three computers come up in the right pane. After ten seconds or so I switch out to write this. When I pop back to Explorer a minute of so later for a confirming look, I find (without any keystrokes) that the 3rd computer now has come up in the right pane (? left pane too). Why the long delay, an application was already seeing all three computers?

        Let me summarize. Even though all computers have been on for a long time and even though all three computers display (in the right pane at least) in a Windows 7 application, when I start Windows 7 Explorer it can (for ten+ seconds) only find two of three computers on my network! Windows networking remains annoyingly buggy.

Good news --- XP disk comes alive
        Before chucking out my old XP computer with the 'dead' disk drive, I just plugged it in (no mouse, no keyboard, no nothing connected), and son of a gun the disk light started flashing and it sounded like disk noises. It was booting. This is good news. I had not backed up in quite a while, so I thought I had lost some stuff and I couldn't remember the name of some of the programs I liked (What was the name of the Korean video player I liked?) The only thing I can think of is that maybe the computer had been affected by days of high heat while I was away (unlikely as it was off), or maybe booting was affected by an external connected USB drive that appears to have failed (again this seems unlikely).

        And with the XP machine now back from the dead it can be used (at least for a while) to run the scanner and record programs from cable.

        Soon after installing my Windows 7 machine I found one of my three external USB drives looked dead. It did not show up in the directory, so I took it out and put it aside. A week later after cleaning it up I gave it another try, and it too is back from the dead.

XP and Windows 7 on home network
        I ran an ethernet cable from the XP machine over to the router and that's all it took for the two machines to show up (after a while) as Network drives. Like with Vista it looks like Windows 7 Network drive visibility may be unpredictable, sometimes another machine shows up quickly, and sometimes I need to probe for it. (I always found my Vista ?=> XP home network to be rather flaky, sometimes an added machine shows up quickly and sometimes not. It's not predictable, not robust. I don't have a clue as to why this happens.)

        After two weeks, my experience has been Windows 7 networks with my XP and my (wireless) Vista portable quite reliably. (Of course, actually using the network to move (or view) files due to seemingly random permission halts is another story!)

Window's permission hassle
        Being blocked by permissions and passwords is frustrating as hell. I am the only one using my machines. I want them to just work, to do as I request, and when networked together to act as a single machine. Heaven forbid Microsoft would ask you this simple question:

         Are you the only user and do you want permissions and passwords turned off?

        This permission hassle is likely a hangover from Vista. I have Vista on my laptop, and the machine is half crippled because anytime you try and do anything you are blocked because you don't have 'permission'. The machine is near useless. This is after many hours researching Vista permissions online and turning them all off. The permissions are not centralized or global. They appear to be scattered all over the machine and at various levels. Apparently Microsoft realized what a nightmare permissions were in Vista and have scaled them way back in Windows 7 (at least I hope that is the case).

        "You require permission from the computer's administrator (which is me!) to make changes to this file." (I am not changing the file, just copying it.) The file name is given, but no path.

Computer hardware problem (or weirdnesses)
        My new HP computer also had (or has) a worrying hardware problem. After using the computer for a few days, I started getting a black 'death' screen during boot saying Read Error, hit Ctrl + Alt + Del. Hitting Ctrl + Alt + Del doesn't resolve the problem. It just cause boot to start again and a few seconds later the boot stops with the same read error and same (useless) error message.

        This is bad. If you don't have access to another computer, there is no way to go online to see if this can be resolved. Has the hard disk failed? The only other options you have is to access other options early in the boot, like a system roll back. I tried a roll back and at least the disk drive seemed to working OK for a few seconds, but the roll back didn't solve the problem.

        Luckily I did have access to another machine and I found other users reporting exactly the same problem: new computer works a few days and then at boot starts giving Read Error (hit Ctrl + Alt + Del). In online forums it was suggested the Read Error was probably due to an incorrect boot sequence in Bios. I played around with the Bios boot sequence (finding it difficult at first to force a save to the Cmos memory), and this appears to have fixed the problem. Whoops, well turns out it was not fixed, because a few days later the boot 'Read Error' was back

Bios boot trap
      The HP Windows 7 splash screen on start up has an option (hit Esc) called 'Boot Menu'. It seems obvious that if you have a boot problem you should go here, right? Well sort of , but not really. This is trap. This screen gives the boot sequence (five drives in my case since I have three external USB drives and the DVD drive is there too) and allows you to change the sequence. It's all very techie with just long model numbers for each drive. If you pick the right entry (not that simple), the computer will boot, but the next time you repower the machine the 'Read Error' boot halt is back again! Yikes, it changes the boot sequence only for that boot! It is not a permanent fix. (What's it doing here? My guess is that it is a left over development tool.)  Incredibly there is no way (at least that I have found) to save the new boot sequence from the 'Boot Menu'!  It's an absurd trap on a consumer machine, and I fell into it.

        I finally figured out that what you need to do to change permanently the boot sequence is at start to select 'Setup', which brings up the standard bios options. One of the bios pages is called 'Boot' and from here you can also change the boot sequence, but unlike 'Bios Menu', here you have the option of saving the new boot sequence to CMOS memory when you exit. It's all very techie and confusing. I doubt seriously if your Aunt Tilly can figure this one out.

        Not to mention that changing a bios option is extremely consumer unfriendly. The look of the bios in Microsoft computers has not changed in decades. No fancy smancy graphics screens here, it's just basic text and unfriendly as hell. For example, the bios sequence lists the detail model numbers of drives, but since (initially) I had two USB drives attached, I was faced with a confusing list of numbers and had to guess.

        -- XP Mode consists of the Virtual PC-based virtual environment and a fully licensed copy of Windows XP with Service Pack 3 (SP3). It will be made available, for free, to users of Windows 7 Professional, Enterprise, and Ultimate editions via a download from the Microsoft web site. (That is, it will not be included in the box with Windows 7, but is considered an out-of-band update, like Windows Live Essentials.) XPM works much like today's Virtual PC products, but with one important exception: As with the enterprise-based MED-V (Microsoft Enterprise Desktop Virtualization) product, XPM does not require you to run the virtual environment as a separate Windows desktop. Instead, as you install applications inside the virtual XP environment, they are published to the host (Windows 7) OS as well. (With shortcuts placed in the Start Menu.) That way, users can run Windows XP-based applications (like IE 6) alongside Windows 7 applications under a single desktop.

        I would probably pay this extortion to get all my old programs to run, if it was that simple. The problem is, or my concern is, that Windows 7 Professional will bring with it a crippling bunch of permissions and passwords!

Keyboard program select (Alt Tab) weirdness (Nov 12, 2010)
        After using Windows 7 for several months, I am bothered almost daily by a stupid little annoying problem. In Windows the keyboard command to switch between running programs is alt-tab, which when pressed brings up a row of icons of running programs and steps through them. I have found two programs that can't be selected by alt-tab, and they are weird in different ways.

        Window's Media player (actually playing an mp3 music file) is in the icon list, but when you select it, nothing happens. Software for my new Cannon scanner also acts weirdly. In some screens it can be selected normally by alt-tab, but when I go into its advanced screen (Cannon ScanGuard), it disappears from the alt-tab icon row so it cannot be selected from the keyboard. However, these programs can still be selected by a mouse because they remain in the taskbar.

        In other words the weirdness is that alt-tab doesn't cycle through all the taskbar programs, some programs are skipped! Why? Microsoft testing sure has a lot of holes, or else they just don't bother to fix things!

Empty Recycle Bin (9/11)
        There must have been a directive from the top at Microsoft saying don't tell the user the facts, or skip the data collecting, or don't confuse the novice users. I see this in action is Search, where the search function does not tell you how many items it found (obviously it is trivial to count them when searching), and I see it too in 'Empty the Recycle Bin'. I would like to know how many items I am going to permanently delete before I do it. Call me crazy. But often the 'Empty Recycle Bin' Y/N requester box gives no count, just saying do you want to delete "all" these items. (Well that's clear!) This keep the user in the dark attitude of Windows7 (Home) is ridiculous and infuriating! (Is it possible Windows7 professional doesn't do this?)

        Running some tests on the recycle bin I find its response rather curious. What it tells you in its Y/N requester box appears to depend on the number of items in the bin. For example, if there is only one file, say a picture file, the Y/N requester box tells almost too much: file name, type, size, rating, dimensions, even pops up a thumbnail image. For two items it changes to "Are you sure you want to permanently delete these 2 items", and worked the same at 60 files, but when I tried 150 or so files, the file count mysteriously disappears! Now I get the familiar do you want to delete "All" these files. There must be a cutoff limit somewhere around 100 files. What counting more than 100 files in a multi-GHz machine prior to the occasional delete takes too long? Give me a break. Another poorly designed and/or half-ass implemented Windows7 function.

File 'date' weirdness (10/12/11)
        I saved an image from the web (picture of Eva Braun on NYT site), and a few minutes went searching for it in Window7 Explorer (to rename it). Explorer tells me no file in the directory has today's date. What? I check the system clock to see if the date is correct and it is. I click on the properties bar of explorer and the column I have been sorting on is named "Date", and that seems right. Another crazy weidness of Window7 which at this point has be baffled. Searching for a file by date is file managment 101, it should just work, but it doesn't in Window7.

        Checking the file column options bring up a list which starts with basics: Name, Date, Type, Size, Tags, then more detailed properties. As far as I know these are the defaults and all were checked in my directory. It was the  'Date' column I was sorting on. But when I go looking I find 12 more date entries arranged like this:

Date entries on first properties pull down list
                        Date                                                          (does not give save date)

Under 'More' properties I find 12 more 'date' entries (right, my best guess)
                        date accessed                                              file copy date
                        date acquired
                        date archived
                        date completed
                        date created                                                file copy date
                        date last saved                                            file last save date
                        date modified                                             file original save date
                        date received
                        date released
                        date sent
                        date taken
                        date visited

        I have no idea what most of these do. I assume most are used only for specific file types, like 'data taken' is probably reading the date hidden inside the photos taken by digital cameras.

        In a directory of acquired images I check (add to the screen) to the following columns to see what they do:
                        date
                        date accessed
                        date acquired                                            blank for most (but not all) images
                        date created                                              file copy date
                        date last saved
                        date taken                                                 blank for most (but not all) images

        What is weird is that I find for the vast majority of the images in the directory 'date', 'date accessed', 'date created', 'date last saved' are all the same, but not for this picture saved from NYT online and a few others. In this case 'date accessed', 'date created', and 'date last saved' are all the same and it is the date and time I saved the file. But the 'date' property for some wierd reason is different, about a month earlier.

'Date taken' is not date taken
       Windows7 Explorer has been upgraded from earlier versions of the OS and includes a thumbnail and also (I now see) an extensive set of properties. In its properties I see the picture property 'date taken' is filled in and this is what 'data' is displaying. Progress. Sure enough when I active the 'date taken' column it is filled in for this photos and has a date in Sept 2011. Now since this is a picture of Eva Braun taken in 1940 it is of course not the date the picture was taken, but it might reflect some processing by the NYT or the source from which it came.

        Looking at photos from my own (Cannon) camera I see another strange thing. For summer photos all the 'data modfied' in EXIF are one hour later than 'date taken'. Yikes, it looks like 'data modfied' is EST, whereas 'date taken' is EDT. I also figured out by looking at a backup directory that 'file created' and 'file access' dates represent the date the files were copied, whereas 'file modified' reflects (probably) the first file save date.

EXIF dates
       Looking at a few more images, I find 'date taken' in Explorer is coming  (not surprisingly) from the EXIF properties of the photos, but EXIF itself I see can have multiple dates. One Nikon photo I looked has three dates in its EXIF properties: 'date/time', date/time original', 'date/time digitized, the latter two the same and the first months later. What Explorer is displaying as 'date taken' is not the Nikon EXIF generic 'date', but (most likely) its property called 'date original'. EXIF dates themselves are confusing. Why the generic photo 'date' would not be the same as the 'date original' I don't know. Is the later 'date' the date when the images is copied from the memory card? Seems weird, and even more so, since this date was about nine months after the 'date original'.

'Date accessed' weirdness
        It seems pretty clear that 'date accessed' must reflect the last time the file was opened or viewed, right? Nope, I clicked on the Eva Braun photo to open it in a photo viewer, and I find the 'date accessed', which include the time, did not change. So 'date accessed' is not the date an image file was last accessed! Yes indeed, Microsoft progamming in all its glory!

        A search shows that this file attribute can be disabled in registry (below) and in my machine is (by default) disabled

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Filesystem
            'NtfsDisableLastAccessUpdate'                  1 (disables)   0 (inables)

        What a zoo of confusing, illogical and weirdly acting file properties. I am going to change my basic file date to 'date last saved', hoping that it does what is says. Good luck to me, I will need it.
-----------------------------------------------------------------------------------------------------------------------

        I began my effort to install my three or four year old Canon inkjet printer by going to the Canon support site to find a Windows 7 driver. I found my printer, but there did not appear to be any Windows 7 driver for it. Not good.

My Canon 'fix' --- wrong Canon driver
                Maybe I was lucky, but on the first try I was able to get my Canon inkjet printer (S820, six inks) functional by trial and error downloading a Windows 7 driver for a different Canon printer (MP810). How functional is it? Will it still print color prints? I don't know, but so far it has printed out online pages and pdf pages in black and white OK, and it prints a Windows test page OK. Curiously the printer sounds different (quieter, maybe slower), but so far, at least for normal black and white, it seems to be OK. Nowhere online have I seen the substitute Cnnon printer driver 'fix' I found. Here it is:

               Canon S820 inkjet (hardware) => Canon MP810 Inkjet (Windows 7 driver)

Microsoft Windows 7 Compatibility center
        I stumbled on this Microsoft site (below) that claims to be a central depository with info on Windows 7 compatibility for thousands of hardware, software and drivers.

        http://www.microsoft.com/windows/compatibility/windows-7/en-us/About.aspx

        As a test I entered my Canon printer (Canon S820). The site says the Canon S820 inkjet is compatible with Windows 7, but that's not what I Canon told me. I had earlier gone to Canon for a driver and could find no Windows 7 driver for the Canon S820. (Don't know what happened here, maybe I did not fully scan the pull down list, because now in driver support for Cnnon S820 printer I do find a Windows 7 drivers (or is it?)).

         Son of a gun. Microsoft pointed to a Canon page and in the OS pull down list for the S820 inkjet is listed Windows 7 64 bit (dated Mar 2010). My memory is a few days ago I went into the Canon site and found a driver support page for the S820 and Windows 7 was not in the OS list. Are there two Canon support sites that are different?

        The closest HP scanner to mine could be HP Scanjet 5500C. The Microsoft site says the HP Scanjet 5500C is compatible with Windows 7 and installs automatically. I then went to the HP scanner support page and entered: HP Scanjet 5500C. Guess what Windows 7 is not in the OS list for its drivers, but Vista is. What a nightmare.

I install the 'correct' Windows 7 printer driver --- and printer stops working!
        OK, Microsoft has told me my S820 Canon printer is Windows 7 compatible, so I uninstall the wrong printer driver (for Canon MP810). On the Canon inkjet support site the S820 Windows 7 driver is described like this:

        So is this a driver or not? It's identified as an "add-on module" whatever that is, but it's listed under the header Drivers. I downloaded it, and it appears to install successfully, but still my S820 does not appear in the list of printers.

        Later on a European Canon site, I find that the driver for Canon S820 is supposed to be built into Windows 7. This explains the "Add On" description. In Device Manager S820 shows up as an unknown device with a question mark.

        Let's summarize, the printer is supposedly 100% Windows 7 compatible (says Microsoft), its driver is supposedly built into Windows 7, but when Windows 7 searches for it, it can't find it! Oh, yea, this sounds like Mirosoft. (And in spite of this, the printer prints.)

         I click 'Add a device' and Windows starts a search for installed devices. It searches for 5 min, then 10 min and nothing. (You would think for a quad core 2.8 Ghz machine it could find an uninstalled printer in ten minutes, but nope, so I hit Cancel.) Next I pull out and replace the printer USB connector. This brings up a message that the Device driver did not install correctly".

        Windows 7 'Install a Printer' site says, "If your printer is a universal serial bus (USB) model (mine is), Windows should automatically detect it and begin installation when you plug it in." Ya, sure.

Reinstalling 'wrong' MP810 printer driver
         I went to the Canon site and downloaded the two Windows 7 drivers for the MP810. Neither will install under any compatibility setting. I am totally baffled as to why the MP810 drivers downloaded from Canon won't install, because when I got the printer working earlier with the 'wrong' driver Windows identified the printer as the Canon MP810. No printer, I am back to square one!

        While pondering what to do next, I spot in Windows 7 'Devices and Printers' screen an 'Add a printer' button, and (eventually) this brings up a list of (what I now understand to be) built-in Windows 7 printer drivers organized by manufacturer. Finally, I'm thinking, progress, but then I find the Canon S820 is not listed!

My printer is both '100% compatible' and not compatible
        Microsoft is telling me the Canon S820 printer is Windows 7 compatible (and the driver is supposedly built into Windows 7), but I find the Canon S820 is not on the Windows driver list. So what does the ordinary computer user do? I notice the Canon MP810 (not my printer but which earlier worked) is on the list, and when I click it, it installs and prints a test page properly! Can you believe this? I am right back where I started from four hours ago. (For all I know I could have clicked any of the dozens of drivers in the Canon list and the S820 might have worked, but I am not going to waste more time exploring printer drivers.) What a freaking nightmare!

Add a printer
        Under 'Devices and Printer' there are two buttons marked 'Add a device' and 'Add a printer'. Clicking 'Add a printer' brings up a 'Choose a printer port' screen.  This list begins with LPT1 and goes on for ten ports (Com1, file, XPSPort, etc) most of which look like they are from DOS days! My printer is a USB printer, but there is no port on the list labeled 'USB'!  Near the end of the list is what seems to be the closest equivalent, something called "USB001 (Virtual printer port for USB)". I chose it, and the printer installs. Good grief!

        How come none of the Windows 7 reviewers picked up on techie inanities like this in a core consumer task (installing a printer)? To the ordinary computer user this must be a freaking nightmare!

         The driver list will generally shows Windows 7 32 bit and Windows 7 64 bit. How is your not very technical Aunt Tillie supposed to know which flavor of Windows 7 she has? All she will know is that it's a Windows 7 computer. This is a ridiculous complication to force on users. What is this unix! Why can't drivers just be labeled Window 7 and the computer itself separate out from the download the driver it should install? I mean it does know if it's a 32 bit or 64 bit, doesn't it?

        Talk about confusing Aunt Tillie, this confuses me. I now know from many hours of poking around the control panel that my (Home Premium) computer is identified as 64 bit. Somewhere I read 64 bit Windows 7 means it is 64 bit capable, so that does that mean Windows 7 64 bit also includes the 32 bit version? Will 32 bit drivers work with my 64 bit capable Windows 7? (Later, I read you want 64 bit drivers for 64 bit Windows 7.) I have the Home flavor and it's 64 bit, so what the hell is 32 bit Windows 7?  An old obolete version? An emerging market version? I saw an article that said Microsoft developed six flavors of Windows 7, but not all are sold in the US. So now to pick a driver I need to know about international versions of Windows? This is a freaking nightmare!

Installing the 'correct' printer driver again
        I found a video on 'How to install a Windows 7 printer' that led me to again to try to get the right printer driver installed for my Canon S820 printer. Before I begin this my printer is in fact working OK using Canon MP810 driver. I watched the video carefully and when the confusing 'Select a Port' screen came up (showing LPT1 the first entry highlighted), the video made no mention of choosing a USB port for a USB printer, they said just click next.

         There was another printer development too. I found out the 'Windows update' button on the 'Add a Printer' screen updates the built-in list of Windows 7 drivers. So I clicked it, and it went blank for a few minutes (I thought nothing was happening), but when it returned to life I found (mirable dictu) my Canon S820 printer was now listed.

Windows Live update trap
       Nothing is ever simple with Microsoft. I later learned there is an incredible trap with Windows Live Update for printer drivers. Here's the story: A poster online said my ten year old HP Laserjet 4L worked with Vista and might work with Windows 7, so (for fun, I have no parallel port) I checked to see if the Laserjet 4L was included as a supported HP printer. Nope. I figured my built-in Windows 7 printer driver list was up to date since I had run Windows Live (update) just a few days earlier when installing my Canon inkjet. Just to be sure I hit Windows Live update button again, and what do you know a whole bunch of new HP printers appeared, and there was the Laserjet 4L.

        It's now clear that you must select the manufacturer of your printer before you update. Clearly Live update is only updating drivers for the manufacturer selected in the left column. This is not intuitive, and there is no warning. What a trap! Microsoft in action, what a freaking nightmare printer installation is.

        The Windows 7 'Install a Printer' video skips over the confusing port screen and worse if you do what they do ("just click next") your USB printer is installed the DOS way on LPT1! Incredible, even the people making the Install a Printer video for Microsoft don't seem to know how to install a printer!

        Joy and rapture, after five or six hours work I have finally gotten my printer working correctly (I hope) with Windows 7.What a joy this operating system is!!! (My HP scanner is still just a lump, and looks like it will need to be replaced.) (Later I find my printer still isn't setup right and needs more work.)

Is the Canon printer working right?
        The first time I go to use my Canon inkjet S820 printer for real, a few days after it was installed with the right driver, all I get is a totally gray page even though its print preview (in browser) looked fine. I am pissed. The printer still is not right. Either it's not installer correctly or not set up correctly. I had printed a test page when I installed it, and it was fine.

'Print test page?'
         I right click on the printer icon to bring up its properties intending to print another test page, and guess what, Windows 7 has no 'Print a test page' there. I push into troubleshoot printer and still no 'Print a test page'. You would think to any normal person the first entry on a printer troubleshoot page would be to print a test page, but not at Microsoft. I need to go on a hunt for it.

Hassling with the Canon inkjet print software
        After experimenting with the Canon printer software (five pages of settings!), I think the printer is finally working OK. I first set the Canon software to show print preview, so I got two print previews, one from the application and a 2nd one from the Canon software. The application print preview would look OK, but the Canon print preview showed a gray screen, so clearly there was something wrong with the Canon print settings.

         I knew that my Canon's print settings in the XP had always been 'custom' (set by a Canon wizard), but that was to match the printer color quality to Canon print paper (at that time I was doing color photo printing). I reviewed the Canon defaults carefully and didn't see any problem. In desperation I ran the Canon wizard, which put in a complex series of custom settings, (and guess what!) the custom print settings 'fixed' the print problem. Gray screen was gone and the print scaling error disappeared too. What was wrong with the Canon print defaults (supposedly) for my specific printer (S820)? Why does this custom 'fix' work? Not a clue... It's a stupid trial and error fix. Another hour shot on the inkjet printer.

        And while it now seems to be printing OK (of course, I thought that before when it successfully printed a test page), it still seems to be printing quite a bit slower than when it was used with the XP.

        But after hours and hours of work, this same (100% Windows 7 compatible!) printer under Windows 7 is still not printing reliably. Sometimes it prints and sometimes it prints a blank (blue) page. After thinking I had solved the last of the printing problems ('blue page' problem) with custom settings in the Canon driver, I just got another blank 'blue page' when printing a confirmation.  Maddening. (My temp work around is to activate print preview in the Canon driver, which at least the first time showed the blank (blue) screen.)

'Blue page' print bug tracked down (update 9/10/10)
       I think I finally tracked down the source of the 'blue page' print problem. Canon print preview showed a ticket I was about to print was going to print blank, even though my browser's print preview showed it looked OK. With a blank page print pending I was able to experiment with print options, and I found it happens only when printing with the browser's 'Print Preview on'. It was consistent:

        It should not matter if  Print Preview is on/off when you print. Clearly there is bug (problem) with Opera 10.60 browser Print Preview operating under Windows 7. I ran the same version (latest I think) of Opera under XP for quite a while and never saw this bug. Until Opera can fix this I need to remember to turn off Print Preview before printing.

        Canon print preview caught another print problem with the ticket. The browser print preview showed the whole ticket as fitting (easily) on one page, but Canon print preview (which matches the actual print) showed the lower half of the ticket moved to a second page. I fixed this problem with some adjustment of Opera's print options. Setting scaling a little below 100% plus a reduction of default print margins brought Opera's and Canon's print previews into agreement. I left the final settings: 90% scaling and 0.5 in print margins all around.

Six week printer update (10/2/10)
        Still using the double print preview to catch blank blue pages, but haven't seen one since I adjusted my browser print setting about three weeks ago. So while my printer has been printing OK, look below at how it remains in Device Manger. And remember, Microsoft says, this is a 100% compatible Windows printer. My device manager lists no printers. Pushing into Other Devices/CanonS820 gives:

                                        Device type:               Other devices
                                        Manufacturer:             Unknown
                                        Location:                     on USB printing support
                                        Device status:             This device is working correctly

       Is the the mark of a stable, well written, operating system?

Few months later printer update (12/31/10)
        I have kept double print preview on for several more months and have never had another blank screen, so it looks like with all my hard work I have navigated around the Window's 7 (initial release) print bugs. It is probably time to uncheck the print preview option in the Cannon print software.

        I found out the name of its printer driver from a computer test program HP had pre-installed. It is the only piece of  pre-installed software that I did not delete. It pops up occasionally asking if it can run a detailed set of tests on the computer and connected hardware, and I always decline because it takes so long, but last night I let it run. In its report it puts a printer icon next to S820 and shows that it is being driven by a generic Microsoft USB print driver. It also reports it is made by Cannon, serial #, using USB 1.1.0 (interesting), but curiously there is no mention of the Cannon print software, which is involved in controlling the printer too.

                            Driver:    c:\windows\system32\drivers\usbprint.sys
             Driver provider:    Microsoft

----------------------------------------------------------------------------------------------------------------------

TV tuner install
        My TV tuner stick (Hauppauge WinTv-HVR-950Q) is less than a year old. The Windows 7 compatibility page tells me it is 100% compatible, that it needs no driver and will automatically install. In my XP I ran it with several programs including (Korean) KMPlayer, the best video (? TV) player out there. I downloaded the latest version of (free) KMPlayer for Windows 7 and for video playback it is working fine. When I use it to access live TV from my HVR-950Q tuner, I get video, but no audio.

Picture, but no sound
        I have now played around for several hours with every audio setting I can find in Windows and KMPlayer (there are a lot of audio settings), but no sound. Yikes. Not sure what to do next. As usual the Windows 7 troubleshooter is baffled.

        Got it working. I will give Windows 7 a pass on this one. I found still another audio setting on KMPlayer (WDM Setup, under open) and apparently the default TV audio setting on download was set to 'do not use' (weird). When I selected Win tuner, I got sound. I also found that while video format was set for 'NTSC M' is was Korean 'NTSC M' not USA 'NTSC M. This is understandable as this play was written in Korea.

TV tuner programs
        When setting up a new computer one of them more difficult and time consuming tasks is setting up programs to watch and record TV. On my XP I used a suite of four different programs to view, record, and later view TV: WinTV, Beyond TV, KMPlayer and VLCPlayer. These programs are touchy, complicated (KmPlayer has an amazing number of settings), and very time consuming to set up: drivers for TV tuner, adjust view quality (SD and HD), auto scan for channels (analog, digital, HD digital), set favorite channels, set snapshot (resolution, directory), set video recording (resolution, directory), figure out how scheduling works. You can easily put in 40 hours to get TV up and running well on a computer.

        Complicating the change of operating system is that programs change too, especially in the world of TV. I bought my latest Hauppage tuner (HVR-950Q)  only 8 months ago, but when I went to download its mating TV viewer from Hauppage for Windows 7, I found the one I was using on the XP (ver 6) gone and replaced by radically updated ver 7, which when I tried it 8 months ago was barely working. Hauppage software has always been knows as a resource hog and not very good. It took virtually all the CPU capacity of my old XP to run it, but I was hoping the latest Hauppage tuner would run a lot better on my much faster and x4 more ram computer, and it does.

         When I finally got Hauppauge WinTV v7 TV tuner set up, I found it vastly improved from 8 months ago. It handles both SD and HD, has good quality picture, snapshot, and recording. It runs fairly well on Windows 7, but still occasionally it crashes, and twice it crashed Windows 7 itself! It took a whole day to set up, and Hauppauge being Hauppage it still leaves a lot to be desired: better channel sorting, better scheduling, more keyboard shortcuts (? documentation for existing shortcuts), and a few screen controls (now it has none) like lighten/darken.

        (update) After a few days use, I find the improved WinTV application mated with this four quad AMD processor and 4 gb ram, handles high def TV very well. There is enough capability in the hardware that other programs run OK with hi-def TV active. (I read multiple applications are one of things multi-core processors do well.) Have had no OS crashes since I got the program installed and set up. Snapshot feature of WinTV v7 takes nice high quality pictures. Only negative is that Comcast recently encrypted all extended basic channels in the Boston area, so the only clear QAM channels available on cable are local channels (about 10 hi-def). I also have a Hauppage tuner for over the air hi-def, but have not hooked it up.

        Changing the TV channel is now an adventure (this caused one the crashes), so I better save all my work before changing the channel. And golly, don't I see Windows 7 advertisement saying the reason to upgrade to Windows 7 is because it is so capable of handling video and media....
-----------------------------------------------------------------------------------------------------------------------

Old program summary
        OS characteristics are found under Directory, Computer, properties, and it shows my Windows 7 Home Premium to be a '64-bit operating system'. XP and my Vista portable are 32 bit OS, meaning they can run 32 bit and 16 bit code, but a 64 bit OS can only run 64 bit code and 32 bit code. There's no support in 64 bit Windows 7 (or 64 bit Vista) for running 16 bit code. This is the reason why many old programs that run on XP won't run on Windows 7.

        I found a solution (if a little cludgy to use) that allows Dos programs to run in Windows 7. It's a free open source Dos emulation program called DosBox that opens up a Dos command line. It runs my Dos era editor Speedscript (written in Turbo Pascal) pretty well. So this got one old program working.

        I was surprised to find in the directory of another of my old programs (1996 simulation programs called Vissim) both a 16 bit and 32 bit .exe. On my 32 bit Vista notebook both run, but on 64 bit Windows 7 only the 32 bit .exe runs, so the fix here was just to rename the 16 bit .exe (exe => .ex~).

        The big problem, for which there appears to be no simple fix, is how to run (non Dos) 16 bit programs. These tend to be early Windows programs, programs written for Windows 3.1, which was a 16 bit OS. Unfortunately this includes my favorite circuit simulation program (Electronic Workbench), which has no 32 bit version and that I want to keep running.

Emulation fix
       There is a fix that allows (some) 16 bit programs to run, but it's expensive (in a lot of ways). As described by Microsoft, it requires downloading a complete 2nd Microsoft OS which runs in an emulation environment under Windows 7. Microsoft provides such an emulator, and others are available in the public domain. The Microsoft fix requires nearly a $100 upgrade to Windows professional and a downloading of XP SP3 (requires an additional 1 gb of ram, total of 3 gb).

        A possibly less expensive fix would be to use a public domain emulator, like VM VirtualBox from Oracle (installed), and buy a copy of 3.1 to install on it. A long shot possibility would be to see if I can extract a bootable XP (recovery) disk from my XP, and to see if the emulator will install it. Based on extensive searching online (? a lucky find of a key trick), I have figured out how to get the XP to write recovery disks, and as I write, this is happening. (It takes nearly an hour to prepare, write, and verify each of of two DVD+R, 4.7 gb, disks.) I have no Windows product key, and HP says recovery disks will only work on the computer model they come from, so it's a crap shoot.

        I have seen programs that can be moved by copying called "portable" programs.

        One reason bypassing installation may work is that (according to some posters) some 32 bit programs come with 16 bit installers that, of couse, won't run.

        A good old picture viewer I like is ACDSee 3.1 (2000). Even though it is ten years old I found I was able to install it from the original CD, and it runs pretty well (the occasional error, but certainly it runs better than it ran on Vista, which is consistent with what I see some others reporting for their programs.)  A later version of ACDSee, which I also regularly used on XP, is ACDSee 7.0 (2004). An installation from its original CD also appeared to be sucessful, but when I started it, it had a strange problem, it didn't 'see' the keyboard making it unusable. Nothing is ever simple! Programs like this have a lot of settings. (I eventually I got it working, I think by fixing one of its settings.)

Directory view
        A minor quibble about some older programs running on Windows 7 is that they don't properly handle Library ? Document folders in their directory trees. In XP all documents listed in the 'My Documents' folder are also accessible (perhaps a little less conveniently) under the c:\ folder, and that is the case too in Windows 7, so all (local) documents using the trees of the older programs are accessible. In the important matter of navigation to external drives and network drives the directory trees my old programs work fine under Windows 7.

        I note that Microsoft being Microsoft can't resist making stupid little name changes.  'My Computer' in XP has been changed to 'Computer' (Wow, that's a significant change), and the top folder name 'My Document' in XP is now 'Libraries' (Later I learned in a video that Libraries is a new Windows 7 feature whose purpose is to point to documents across multiple drives.)

        Let's not even mention trying to run DOS programs under Windows 7 Home Premium. I have one DOS program (Speedscript) I wrote myself I would like for old time sake to bring over, but don't see any mention of DOS program compatibility in Windows 7.  All these programs ran on the XP. (It turned out I got the Dos editor working first via a public domain emulation program.)

Installing Netscape 4.8 two different ways
        Compatibility of old programs with Windows 7 Home is weird. A good example is Netscape 4.8, which dates from 2002. Composer in Netscape 4.8 has long been the html editor I've used to generate the files on my home page. To install Netscape 4.8 on my new Windows 7 computer I originally went to the online Netscape archive and downloaded version 4.8 for Windows, but I found its installation file would not run under any compatibility setting, always reporting:

"The version of this file (Netscape 4.8 installation) is not compatible with the version of Windows you're running"

         But after successfully getting a couple of old XP programs to run in Windows 7 by copying over their program directory over from XP, I tried it with Netscape 4.8, and guess what, it works! When 'installed' this way, Netscape 4.8 will run under Windows 7 and after using for several days it appears to run perfectly. More complications. What a freaking nightmare setting up Windows 7 is.

        My experience with Netscape 4.8 (Composer) raises a very interesting question:

        How is it that a program that I know runs properly on Windows 7, like Netscape 4.8 Composer, cannot be installed? How is it that you need to fake out the Windows 7 installer (by copying over the program directory from another computer) to get them running on Windows 7? (Later I saw a poster suggest that the problem may some 32 bit programs come with 16 bit installers. But he was discussing installing from old disks, and I got Netscape 4.8 from an online archive, and there was no warning or hint it would not install on Windows 7.

No support for 32 bit help!
        Microsoft makes everything hard by not supporting backward capability. Take Help. The 32 bit exe file in Vissim runs fine, so I think the program is working OK on Windows 7, that is until I press F1looking for Help. This brings up the message that this version of Windows is not compatiable with the Window help format in which Help for Vissim was written. On the Microsoft site it points to I find this:

        "Microsoft stopped including the 32-bit Help file viewer in Windows releases beginning with Windows Vista and Windows Server 2008."

Crazy permission problem on block data transfer
        I am copying data folders from the 'My Documents' area of XP to the Windows 7 'Public, Public Pictures' area over my home network using Windows 7. Full sharing is set globally on XP 'My Document's' and on all the folders below. Several folders copy over fine and then warnings begin that a specific file can't be copied because I lack Administrator's permission. I click skip this file and similar files. Later I check and find one of the folders I thought I had copied was totally blank, all of its files were skipped!

        Here is another major bone I have with Microsoft. After telling the OS to apply the 'skip' instruction to future files, I am never told how many files are skipped. Was it one or thousands? (It was thousands) How can uses be kept in the dark like this during basic file manipulations. This is ridiculous. The folder name copied, so if I not later checked it, I would have not known it had no files in it.

        The permissions hassle of Vista is alive and well in Windows 7. It is just maddening, a freaking nightmare, totally ridiculous ... As I see it, my time is being wasted by idiots (or incompetents) at Microsoft.

A classic case of permission weirdness
        In 'My Documents' on the XP I had eight very similar folders to copy over to the Windows 7 (using Windows 7). The top level folder ('My Documents') had its network sharing property selected. In the eight subdirectories below I was copying there were no specific entries in the sharing property page, meaning no checks marks either in 'private' or 'network share'. So I start copying the subdirectories one by one, and what happens? Five of the eight copy over fine and three are blocked for lack of permission! The eight subdirectories are all in the same location, with very similar names and data, and as far as I can tell are all the same, but five copy and three don't. Maddening...

        What does this tell me? Well one, apparently clicking share in a top level folder doesn't change the share properties (by default?) in subdirectories. But more interesting, it seems that if sharing is not specifically entered into the properties for a folder, whether or not it can be copied (whether it's treated as sharable) appears to (almost) random. It's like an uninitialized variable. Hence maybe this is why it seems so unpredictable, it really is unpredictable, a symptom of a badly designed OS.

        I soon got the three blocked folders to copy. All I did was go into the properties of the three blocked XP folders (using XP) and checked to allow 'network sharing'. Some fix! So how come the other five folders copied without sharing being specifically indicated?

I think Windows 7 has frozen, but it has not
        I am in the process of copying folders from XP to Windows 7 (using Windows 7) when I see copy progress bar turn red and stop advancing. It looks like a freeze, I can't get any response or even exit copy, though other programs still are active. What to do, reboot? When I try to reboot, I find out what happened. The folder copy stopped again on a permission problem, but this time saying I didn't have permission to copy a specific file (not folder), and it threw up a Skip/Retry error message and was waiting for me to respond.

Error message on 2nd monitor
        So why didn't I see the error message? Because of what appears to be another Windows 7 quirk. I run two monitors and for some unknown reason the OS put the message on my 2nd monitor, rather than my primary monitor. This is ridiculous. Why does it do this? My 2nd monitor is shared with TV and was covered by the TV, so I didn't see it. Hence the apparent freeze.

         Smells like the folder copying weirdness all over again, but at the file level. It's like there's unstable, uninitialized network share property. The result is my Windows 7 folder is missing two files, and since I didn't write down the files identified, I don't know which files are missing. This is a freaking nightmare!!

        Two of ten thousand or so nearly identical files didn't copy over. I tracked those two files down on the XP and when I click their Properties, Security tab (in Windows 7) there is the message "You do not have permission to view or edit this objects permisson setting". Only on these two files do I get this. So I checked these files property from XP. There is no Share tab there, and their properties look like all the other files in the folder. So I copied the two problem folders to the temp3 folder on the XP.

More copying weirdness
        After I reset permissions on the XP folder I copied the folder again over the first copy. I was surprised when I go no overwrite message. Later when I checked the Windows 7 folder I find it has twice the files of the XP folder! Why did this happen? No clue. Somehow there are two copies of nearly every file!! How they got renamed is not obvious on a quick look. I had to delete the folder and copy it again.

Big copy question
        In short (as the log I have kept here I think demonstrates) copying data files from XP to Windows 7 is a pain in the ass, a freaking nightmare!  The big copy question is this? Why is all this micky mouse necessary to copy data files from one Windows computer to another? My answer is bad OS design.

                                            'Program Files'
                                            'Program Files (x86)'

        If they are for 32 bit and 64 bit programs, you would think they would be labeled 32 and 64 bit to provide a modicum of user friendlyness, but that's not the Microsoft way. Why be clear and straightforward, when you can be confusing as hell to the ordinary user. That's apparently the way they think in Redford Washington. So the drivers are labeled one way and the programs a different way! What a freaking nightmare!

        I'm sure the pros know which is for 32 bit and which for 64 bit programs, because (I think) (x86) is an historical holdover. My guess is that older 32 bit programs go in the (86) folder (yup). Why is it necessary to separate the programs in the directory anyway? Can't the operating system do this on its own without revealing all this complexity to the user? What is this Linux!

Service pack 1
        Many computer pros advise never to switch to a new operating system until after the first service pack (bug fix) is released. I bought my new machine with Windows 7 in Aug 2010 and Windows 7 was released in Oct 2009, so it's been on the market nearly a year and no service pack has been (officially) released.  A Google search does show a beta Service Pack 1 recently (July 2010) became available for general download. So where does that leave the millions of ordinary computer users who go to the store to buy a new Windows machine and find their only choice of operating system is Windows 7? I'll tell you, it leaves them up the creek, screwed by Microsoft so it can fatten its bottom line.

Cost of Windows upgrade (after vs before) purchase
        I like probably everyone has a bunch of programs you have used for a long time and want to move over to any new machine. So far I have resisted paying Microsoft the extortion fee an (Anytime) upgrade to Windows 7 Professional, partly because it is obscenely overpriced ($90 is Microsoft exercising its monopoly power plain and simple), and partly because Windows Professional brings what Microsoft calls "more security", which very likely means continuing headaches of more permissions and passwords for a home machine.

        For fun I looked at new Windows 7 machines comparing Home Premium to Windows Professional. Microsoft now wants $90 (retail) to upgrade (one) Windows 7 Home Premium to Professional, so how much extra I wondered would it have cost to have bought a machine with Windows 7 Professional pre-installed.

        I checked the HP site where all there machines have base prices and upgrade options. I was amazed to see it cost more to upgrade to Professional before you buy the machine than after! In every model (even for a $300 Windows 7 machine) the upgrade cost was $120 extra to go from Windows 7 Home Premium to Windows 7 Professional vs $90 (really $89) for a later upgrade, which Microsoft  says will not disturb your programs or data.

        A thought just occurred to me. I wonder if maybe my print problem is tied in to a Windows 7 'feature' called 'snap'(?) that resizes windows. If you drag a window high, the screen grays (indicating the snap will be activated.) Could this screen graying be getting triggered by scaling print settings? (Needs a test, still more work)

        I recopy the whole directory from XP, and it runs. Next day it won't start (complaint is always the same, bad Python library). I check the Python library and it looks same on as on XP. I copy over only the Python library and it runs. Next day problem is back. One day I 'cured' the problem and got the program to start by just changing permissions on the program files.

        This to me is the smoking gun, the proof that it is some sort of permission weirdness that is preventing the program from accessing a particular directory! (Well maybe not, because this happens one time and this problem seems to come and go unpredictably.)

        I think well maybe it needs to be installed, instead of being copied over, so I delete all its files and install it from its installation disk. It appears to install OK, except the installer does not put it where I tell it to. So I copy over the files to where I want them. When it starts, incredibly it puts a copy of itself in the default location with another desktop icon. (Probably because the registry contains the default path.)  I now have two copies of the program with two separate icons, both of which run OK, so I leave it that way. Next morning neither copy of the program will run (yikes!), both reporting bad Python libraries. Good grief... Is Windows 7 really stable. I am beginning to doubt it.  Programs run one day and the next day they don't.

        I see I can run a test. Just copy over Python libraries from XP to one of the Python subdirectories on Windows 7. So I run the test and guess what, both versions of Paint Ship Pro now run (without any compatibility settings). Yikes! This is bizarre. The two programs seems to work together, either they both run or they don't. Possibilities: the program is looking outside of its directory for a subdirectory (unlikely), or more likely this is yet another example of permission problems, here blocking access to needed subdirectory, or the program makes some sort of OS call on start and the call is not supported and randomly responds??  If the programs are in the 'mood' to run, I can close and open them and they run every time. I bet it I reboot they won't run. Time to run a reboot test.

        Well, I reboot and both programs still run, but later in the day (even though the programs have been off) I try them and they both won't start. Yikes! Totally unpredictable and unstable. I call up the troubleshooter and it says Start program with these recommended settings (XP SP2). I tell it program started OK and to save settings and it reports back "Issues found: Incompatible Application Detected"  What! The program is running now, and it ran OK for three weeks when I first copied it over! (But here is a 'statement' from the OS that this program is incompatible, even though it was then running! (Why it is incompatible, of course, it doesn't tell me.)

        I have manually put in XP comparability settings, run as administrator and added Everyone has full control to one copy with the other copy having no special compatibility settings. This is a good test of whether compatibility settings make any difference. Both are now running I am going to leave them a while to see what happens. A few hours later, they both refuse to start. Next morning they both start! And the test result is that compatibility settings don't seem to make any difference here.

Really discouraged about  Paint Shop Pro 8 (update 9/29/10)
        After six weeks work, I am really discouraged that I can ever get Windows 7 Home Premium set up to run reliably with the programs I want. Printing is still shaky, my mouse wheel is still erratic, I have lost the scanner software I liked and scanner 3D capability, but worst of all it is beginning to look like Paint Shop Pro 8 (my full featured graphic editing program, former competitor to PhotoShop) is  never going to run reliably in Windows 7. It's totally unpredictable whether it will start. If it starts it runs OK, but it gets into modes where it refuses to start always reporting that a particular subdirectory is missing or corrupt. Nor do I have a reliable trick to get it to start.

        The couple of times I tried it recopying over from XP has worked, but this is time consuming since my XP machine is generally not on, and I have no confidence this will work when I need it to work. Ideas: try to delete registry settings, web search.

        -- For $100 there appears to be Windows 7 successor (?) program Corel Paint Shop Pro X3. Save $20 it says if you upgrade, but oldest allowed upgrade is from Corel Paint Shop Pro 9, so it looks like the program was probably sold to Corel after version 8. It takes a long time to learn to use a graphics program, so if its much changed, which it likely is with a new owner and six revisions later, this is no real fix (even for $100).

            -- One 2007 poster reports Paint Shop Pro 8 stopped running when he upgraded from XP to Vista, and that he finally got it running with compatibility settings and run as administrator.

        -- Poster recommends for Vista running Paint Shop Pro 8 use Microsoft emulator with XP.

More Paint Shop Pro 8 tests (9/27/10)
        Got the two versions to respond differently. Initially both are running. I took the one with permissions down to Window 95 and fails on start with new symptom (can't find english.dll). Now one repeatedly starts and one doesn't. OK, so compatibility settings can at least stop it from starting. I am going to walk the compatibility setting upward. There are 11 compatibility settings: 95, Me, NT, 2000, XP(2), Server(2), Vista (3)

        Tiny progress. The threshold between starting and not starting is ME (won't start) and NT (starts). This seems to be repeatable. But another surprise with NT setting while it starts OK, all the pull down submenus are blank. So it is not true if it starts it runs OK!! At the same time the no compatibility version is OK with normal submenus. OK, one level up to Windows 2000 and the submenus are back. On a quick test the program is now running OK. So Windows 2000 is the lower threshold for normal operation. I going to try walking downward. I was surprised to see the program is OK even at top Vista settings (Server and XP ok too). And it is repeatable, at NT the submenus disappear, and at Me the program ? below the program won't start.

Bottom line on compatibility --- While program is in a running mode, I find the program starts and runs OK at all compatibility settings 2000 and higher. NT is the threshold, it starts but no submenus. At Me and 95 it won't start. I'm going to leave it at XP SP2, which is generally the default.

More tests --- I delete Python library from the no compatibility version. Something strange happens. It somehow senses the missing directory and it begins to install. Install from where??  The compatibility version says it is beginning to install too, but when I cancel it starts. The install routine just asks to insert a disk. There must be some sort of directory check as the program starts that triggers this. Why does the version that runs also trigger this install routine? With the directory missing, now bottom line the version with missing directory won't start and the other version does start. I add back the subdirectory and both run OK. Now I will just delete the python files leaving the directory heading. Same result, it must be doing a file check, or hash check. I'll just delete one of the 600 or so files in the python subdirectory. Deleted one 2k file from some python  subdirectory lib-old. The deleted file is not noticed. Both programs run. But properties sees the missing file (3354 vs 3355 files)

Searched registry. Bunch of Jasc files. very likely put there by the disk install because only address is the install version. (nothing I could identify looked critical) And it appears the program can run OK without any registry entries. Deleted the dll library under python: same as with whole python out, one won't start other calls install CD, but then starts.

Idea --- Workaround trick. Maybe make a backup Python subdirectory that I can pop in quickly if the program won't start. I'll call it 'Python Libraries -- Replace'  I put in both versions of program, and both versions still run.. file count now 3,975. I've done it, now need to wait for next time it won't run and pop in the subdirectory and see what happens.

Now Paint Shop in a run mode (9/28/10)
        During this day of testing Paint Shop Pro 8 I have started it dozens of times and rebooted three of four times, and (except when I specifically disabled it) it runs every time. Yet yesterday with same setting neither version would start at all! And probably in a few days when I go to use it it won't start. This kind of instability, work for a few days then don't work for a few days, is just maddening, and more than that is symptomatic of bad design.

        I once read an article on ten things never to do in a design. For example, Don't design things that are almost symmetrical. These were excellent design guidelines. And what we have here is a program that almost runs correctly. Sure the program was designed first, but the job of the huge staff of Microsoft is to make a clear distinction between programs that run and those that don't. Why does this program almost run correctly? My answer is this is a sympton of bad design in Windows 7 OS.

Paint Shop originally ran
        Paint Shop originally ran for first few weeks, so what's new in recent weeks. Maybe a big one is I installed Dosbox emulator and win 3.1 on that and have used it quite a few times. This might be causeing problems. The thought here is to turn on the bios emulator option. Entering and exiting Dosbox as a test doen't seem to have any effect on Paint Shop (now working)

        Another change is making large video recordings unattended. I have seen that the Win TV application does not work well after a lot of recording maybe indicating some sort of memery leak.

Is Paint Shop Pro being affected by memory corruption from video recording??
        Is Paint Shop's problem a memory/file corruption from video recording (so maybe some recently installed program). I like this idea (still a long short). Only fairly recently did I begin video recording, and only recently has this problem started. My memory is that the program ran fine for the first weeks I got the computer. Test: Do video recording every other night and see what happens. (meanwhile recopy over from XP to hopefull get the program working each time.) Another long shot test go into the bios and turn ON the emulation option that HP says keeps 'threads'? separate during I presume emulation.

OK, my emergency  'fix' works
       I delete the python libraries subdirectory on one version and copy over the same subdirectory from XP. Yikes, this gets both versions of the program running. Somehow they are coupled, something totally bizarre is going on. I'll put the XP version in my replace backup subdirectory.

        The desktop icon put in by the installation has no target (grayed out). It's start location is in the Jasc directory, but maybe it is running the other code. In other words maybe both icons are running the same version. Test: I deleted the python subdirectory from my location and both version still run, when I delete python from the Jasc location it won't run, but my version runs (after cancelling install box --- they are coupled)! One interpretation: both icons find Jasc version first, so deletion from my location makes no difference, but if it is disabled, my icon after finding it is disabled (? thowing up install box) finds my version second and it runs. this makes sense.

        What, what! Python libraries are missing in both versions (renamed), yet one of them still runs! I'll reboot and recheck. Same thing one version still runs with python libraries renamed (other throws a fault)! I did a search and there is no other copy of subdirectory hiding in the program files. Really strange. I correct name only on Jasc subdirectory and both start normally. I repeat test with corrected name only in my location. Jasc throws error, but mine after putting up install box, runs. So it seems the library is needed, but with it renamed in both versions they run!!!

        I now seem to have a way to get the program running. What I don't have is a way to break it. I'll try doing a little video recording. Did a few seconds of video recording, no effect, both still run.

Fresh start --- Delete everything and copy over Paint Shop Pro from XP again (9/30/10)
        Two copies are so complicated and the install didn't seem to fix the problem, so I am going to uninstall, clean out the registry and copy over again from XP. OK uninstalled Jasc version, what I find is suggestive. The top directory name still there and under it just one subbdirectory, python libraries! It didn't get deleted. I had played with it, but it was included in the original install. Something about its properties!! (uninstall gave no hint of an issue) Checking resistry. OK uninstall purged the directory too. The only Jasc entries are Animation shop.

     Icon --- Windows 7 is just not well behaved. After I have deleted one version of Paint shop and the other is running OK, there is a minor problem. for some reason the shortcut icon has changed. I spend 45 minutes working to restore the icon. I can't find the .ico file in the directory. I copy over the shortcut from XP and its icon changes! I find the change icon button on shortcut properties, and the icon I want it there but I don't have administrator properites to save it. So I hassle with permissions for 15 minutes. I give up, and the when I go back to the desktop, the old icon is back. Christ, Windows 7 is totally buggy and unstable!

        So after 1.5 days days of work on Paint Shop trying to fix it, I am back where I started. One version copied over from XP (with no registry stuff) and it's working OK.  I copy over XP python library as a back up and find it has 621 file vs 620 for the subdirectory I have been using. I track down the difference file it is a 2006 file (others are all 2003):
                               JascUtils.pyc       =>         ~ascUtils.pyc
program runs with either version of python. I left active the subdirectory same as XP with the 2006 file in it.

        I have enabled the bios emulation option, on the (long shot) possiblity that Dosbox and Win 3.1 emulation are doing some sort of corruption Paint Shop. First look and everything still runs same. What this bios option does I don't really know, nor do I know why HP says they 'recommend' that it be off (if you are not doing emulation.).

Paint Shop Pro update 10/20/10
        I have started Paint Shop Pro several times a day for the last few week and it starts and runs every time. Now it's in a run mode. Is my fresh copy over 'reinstall'  with cleaned out registry, and bios emulation option changed to ON finally got this program running reliably? With Window 7 Who know, but so far so good. Another three weeks (now 11/12/10) and Paint Shop Pro has been OK. Looks like my dozens of hours of work on this one program have finally paid off.

Frozen keyboard (update 3/26/11)
        New problem popped up today. Going to bed I switch on computer so it can do a scheduled late night recording (classic TV comedy). Next morning I start browser and everything looks normal (desktop, mouse), but I find the browser is not responding to any commands from the keyboard. I hit system command Esc/Crtl so I can restart Windows and nothing, so it looks like the problem is with Windows 7 and not the browser. Sure enough, I force a Windows 7 shut down (hold power switch), and when I power up everything is fine. Windows 7 is not stable.
-------------------------------------------------------------------------------------------------------------------

        I have been working nearly full time for ten days to get my Windows 7 machine set up. I have browsers, email, picture viewers, html editor and uploader, Open Office business programs, Google earth, inkjet printer (well sort of, see above), and TV view/capture all working on a relatively clean (decrapified) machine. I got the keyboard and mouse the way I like them by buying an adapter (ps2 to USB) and a USB extension cable from Amazon.

Good features of new machine
          This new HP (with quad core and 4 gb ram) gives the impression of being a lot faster than my single core 1 gb ram XP machine. It's particularly noticable with (CPU sucking) live TV. Hi-res TV was basically unwatchable on the XP, but here works perfectly and other programs can be run at the same time.

         There are some features of Windows 7 I like. One particularly nice feature is typing a search word in the control panel will nearly always pulls up what you need. However, even this has a quirk. After you type one letter in the seach box, it goes off somewhere. I always need two trys to type in a search phrase. Another nice feature is that Windows 7 boots fast and it shuts down very fast. (I read that speeding up boot was a priority for Windows 7.)

Overscan fix on 2nd monitor
       My new HP machine has built-in support for dual monitors (I suspect this has nothing to do with Windows 7), but initially there was a small overscan problem on my 2nd monitor in full screen mode. With my video card in the XP the 2nd monitor had worked perfectly. I could find no adjustment for overscan in the built-in HP video software, but (eventually) I found a fix. My HDTV (Olevia 42"), which I use as a 2nd monitor, was able to sync up to the VGA signal it was receiving (apparently separate from its TV settings). In HDTV Setup: Screen/Adjustment/Auto Sync.

        Quite a few of my old programs I have successfully migrated to Windows 7 via a combination of CD installation and the (work around) trick of copying over the program directory from the XP. But I appear to have lost some, including my favorite circuit analysis programs, Electronic Workbench (8 bit I think), that won't run.

         I am far from done installing programs. There are a bunch that I have gotten to yet like Turbo Tax, Canon camera utilities, Garmin and MP3 utilities. I suspect it's unwise to try and move specialized utilities (like boot, virus fix and malware recovery programs), which were slowly gathered over the years, so replacements for these need to be sought out, and I will be surprised if they can be found.

Using TV as a 2nd monitor in a dual monitor setup (4/11 update)
        There is a very annoying quirk in dual monitor support. I don't know if it's in Windows or video cards with dual outputs, like the one built into my new HP. I found (in my XP) my dual monitor setup kept getting messed up when I changed the source on a large screen TV I used as a 2nd monitor. By trial and error I solved the problem by swapping HDMI ? VGA between monitors. I found as long as the secondary monitor was connected via VGA my dual monitor setup was stable. Of cource this forced me to run the my primary monitor on HDMI since my video card has only two outputs: VGA and HDMI. The switch from VGA to HDMI slightly degraded picture quality since I don't run the primary monitor/TV at its native resolution.

        Recently reading Amazon TV reviews I came across below. This fellow had a similar problem (he blames it on Windows), which he explains, and he came up with the same solution I did.

        -- Another benefit of using the analog VGA cable versus the HDMI cable is that Windows keeps the 2nd monitor extended desktop alive if you are using dual monitors. With an HDMI cable connected to a PC, if you change sources with the remote, away from the HDMI source, Windows thinks the extended desktop goes away and will put everything you had open on the extended desktop back onto the other monitor. Example: I have a browser open on the TV screen, I use the remote to see whats on over-the-air TV so I change input source. Windows automatically removes the second monitor (in this case the TV), and then moves my open browser window to my other regular (non-tv) monitor. If I connect the TV via VGA analog, swapping away from the PC source does not affect the extended desktop as Windows still thinks the TV monitor is active and doesn't mess with window positioning. (excerpt from an Amazon TV review)

         There are additional considerations. One is whether or not you can downgrade from Professional => Home Premium undestructively if you don't like it. I need to research this. Another issue which needs looking into before upgrading is whether or not the upgrade package might recrapify my computer.

Adding a volume icon to desktop
        I wanted to put a (sound) volume icon on the desktop. Simple right, after all there's a volume icon in the lower right corner of the taskbar? Well I did it, but it took close to an hour. There appears to be no way to pull the volume icon onto the desktop or to use it to make a shortcut. Playing around and doing searches for the volume file got me nowhere. First problem --- what is the file name: volume.exe, speaker.exe, sound.exe? After several Google searches, I finally found out it's SndVol.exe. To find it I had to look through system files on the directory.

         C:\Windows\System32\SndVol.exe

Windows 7 annoyances
        * File search emphasis seems to be on recovering a file. If your interest is in finding where a file is located, then Windows 7 Search leaves a lot to be desired. Initially it looked like 'View, Content' was the best way to view results because it included the full path. Well, it does with text or htm files, but for picture files the path is missing from the Content view! Just plain weird and annoying.

        * Seach has an annoyance so bad, I think it should be called a bug. In the Search options box you can choose: include subdirectories or partial searches. The box has an 'Apply' button, but annoyance #1, is you can't redo the search until you also hit 'Yes' and close the box. But the big problem (bug!) is that why you hit the recycle icon to redo the search, the new search conditions are not applied!

        That's right you do all these clicks to set new search conditions, hit Apply, OK (box closes), and redo the search, and the new conditions are not applied. I find to get the new search conditions to apply, I need to click the directory, which clears the search window, and then the new search conditons kick in. Really nice design Microsoft!

        * A serious search annoyance is that search conditions are not visible, and worse to check them it's a long series of mouse clicks (Organize, Folder options, Search) and this only brings up some of the options. It's all to easy to forget your search limits.

        * The 'When modified/Size" file search restriction box is annoying. When you start to type in the file search window, the box pops up covering the search View button. It takes the restriction box a few seconds to self clear.

        * How do you search for a filename as opposed to file content? So far I haven't figured it out. A search for 'tel.htm' returns both files like 'telephone.htm' and an index file whose content includes telephone.htm. Yikes. (This one later solved, see above.)

        * I read some computer types complaining that Explorer requires too much clicking. Their complaint was Microsoft in later editions of Windows added an automatic scroll up to Explorer. After ten days of playing with Windows 7, I think I see their point. Sometimes when opening a directory I begin to move the mouse toward a folder (in left pane) and up it scrolls.

One month update
        It takes a really long, long time to set up a new computer. I am now about a month into the process, and while for the most part things are working OK, there remain annoying problems. Browser print is still not 100% reliable, but I hope I have finally got this figured out and fixed. Last night without warning Print Shop Pro refused to start claiming a corrupted library. This program has been running fine for a month and the library looked OK. Got it up and running again by recopying over the whole directory from XP, but why was this necessary?  Another instability and not a clue as to its source. For the last few days my mouse has starting acting up (wheel scrolls jerkily), another weird instability. Tried a 2nd optical mouse and exactly the same problem. Driver problem (it's is using the Windows 7 default mouse driver)? USB extension cable too long?

Patent viewing
       And new issues/problems continue to pop up. Today I went to the US patent office site to look at Don Sadoway's liquid metal battery patent application, and I get no patent image. Now I remember to look at US patent images your computer needs a special .tiff viewer, which this being a new machine of course doesn't wave. Now the viewer is free, but it's another 20 minute (?) job finding it and installing it.

        US patent office points to three outside companies who provide free .tiff viewer. I have always used the AlternaTiff viewer. I go to its home page and it says it's a browser add on for 32 bit web browsers. It mentions Windows 7, but that mean it only works in 32 bit Windows 7? Who knows, need to try it out. It tells me it installed correctly, but right after Window pops up a "Program Compatibility Assistant" window telling me it didn't install correctly! It suggests reinstalling with some compatibility setting (hidden of course) it's picked. On the 2nd installation no pop up window. Works. Yup, well maybe it took 15 minutes, but it's still only installed on one browser.

Window 7 can't reliably copy a directory's files! (10/19/10)
        I have spent hours trying to copy music files from a local USB hard drive to the memory of an mp3 music player. It's a simple copy/paste operation copying about 650 mp3 files (about 4 Gb) from a single directory to the solid state memory of a new Sansa music player, which comes pre-formatted. Over the years I have had several Sansa mp3 players and file copy to all of them acts strangely. Copy transfer rates start off fairly fast (1 sec/file), but after a few minutes transfer rate slows way way down until its 15 to 30 sec/file. But that's no excuse for Windows 7 Copy doing the strange things it did during these transfers.

        The first time copy seemed to be going OK, but I ran out of time and wanted to try out the music clip, so I aborted the file copy about half way through. Next time I go to copy the remaining files and Windows is just badly behaved. If I select don't overwrite existing files, then copy just doesn't start (no copy box). This is bad. So I select overwrite files and let it copy in background, it seems to be doing OK, but later I find no advance in the copy box bar or file being copies. It has just frozen with no error message after about 300 files (1.5 Gb copied). (It could be that it was just copying super slow, and I didn't at this time remember this weirdness about the Sansa clip.)  I shut everything down, reboot the machine, start again selecting don't overwrite. Again no copy box comes up, but maybe it will come up later I think, so I leave the computer alone for a couple of hours. Come back and nothing has happened. Don't have any more files than when I first copied over about half the files.

        I delete all the Sansa files (takes about two minutes) and start the copy process again. Initially files copy about one a second, which means it should take about 10 minutes (tells me 25 min). After 20% or so of the files are copies, it looks like copying is slowing down, it now takes 2 or 3 sec/file.  It comes back to me that I ran into this file slowdown on the XP too about two years ago copying to the Sansa and it took a long time (hours) to copy the last half of the files. Twenty minutes into copy the progress bar indicates about 45% of the files are copied and copy has slowed way way down. It's now taking about 15 sec a file and the time to finish estimate is up from 25 min to 4.5 hr. At half done it's telling me 8 hr to finish. At a little over 55% it tells me 14 hours remaining. This is ridiculous!

        So I cancel the copy at Mozart's 17th piano concerto (400 files copied). I then select the remaining files from Mozart 17th piano concerto to end. Copy box comes up and three minutes later it hasn't even copied a short 3 min song. Doubly ridiculous. And still not a single error message. Finally a box pops up says not responding, 'skip file' or end copy. I say skip and still nothing, copy box sits open on same short song. I check Sansa and its on and reports connected. I go to check Sansa properties and get nothing, then Sansa clip not responding. I unplug Sansa and plug it in again. It says 'refreshing media'. I begin the file copy again starting with Mozart 18th piano concerto (no overlap). It starts copying again, but it's still a crawl, reporting 17 hours remaining.

        Well after most of the night I find copying has ended. I suspect I missed a few files near the stitch point (Mozart's 17th piano concerto), so I recopy those few files. I do a file count compare and get 647 files in original directory and 636 files in Sansa directory, I am missing 11 files, so I Ctrl A copy the original directory to the Sansa choosing 'Don't copy duplicates' and still the copied directory is 11 files short. Do this several times. Doing an F5 refresh I later see the copied Sansa has 644 files, but 3 files are missing! Some OS this is! When I compare directory listings, I see which files are missing,, it is the first three files in the directory. That's right several Ctrl A copies of the directory continue to miss the first three files! And no error message. Some OS this is!!! Just because the Sansa may be slow to respond is no excuse for Copy to just silently skip files. Again I do a Ctrl A copy/paste of all files and I can see it copies the first three (missing) files, then it hits the conflict, I select don't copy (duplicates, though confusingly it doesn't use this word) and copy box closes. When I check finally, finally, after multiple attempts Copy has copied all 647 files. Windows 7 Copy is about as reliable as Windows 7 partial filename search!

        Checking the Sansa I found I was going to have to do the file load all over again, this time with mp3 files with tags removed, so that the Sansa would list the files alphabetically.  I finally learned my lesson. I deleted all files in a Sansa. Did a Ctrl A Copy/Paste from the new directory as I was going to bed and let it run all night. Next morning all the files were copied.

Six month update (Jan 2011)
        I find setting up a new computer and fixing all the little nagging problems is almost a never ending task. For months on my new Windows7 computer my mouse wheel has been somewhat erratic. One of these nagging little problem. The cause of the problem is that it is connected to the computer's USB port via a 20 ft extension cord, which needs to be long to wrap around my easy chair. Never had a problem running my Ps2 mouse with this long extension on my old XP. I know it is the long extension cord, because two mice acts the same, and when I shorten the cord, the mice work fine.

        I fixed the problem with a Logitech V220 cordless optical mouse bought at local store on a whim ($20), but later found it had 400 very positive Amazon reviews. It has a four foot (27 Mhz) range to a receiver that plugs into a USB port. When I tried the receiver in the computer USB port 5-6 feet away, it was erratic, but when I realized I could plug the receiver into the end of the USB extension cord (on floor about 2 feet below chair arm), this fixed the range problem. Not all optical mice can handle the uneven surface of my chair arm, but this mouse is very smooth. It also has a neat feature I had never even heard of. The wheel tilts rt/left to provide hor scrolling.

        I fixed another problem this week too: How to do screen capture of streaming video. Streaming on demand video is becoming big, and a lot of old stuff is available with no monthly fee and (at least for the time being) with relatively few commercials (via Fancast and Crackle). I find the streaming (flash?) players are barely functional providing the user with almost no controls (jumps, dark/light, record, screen capture all missing). I am probably spoiled, because I regularly use the amazing KMPlayer to view cable TV shows recorded by WinTV.

        The only way I knew to screen capture streaming video was to use the computer's 'Print Screen' key, which is a hold over from Dos days and is a key rarely used anymore. It works OK for the occasional capture, but 'Print Screen' is very limited as all it does is copy the screen to the clipboard (with my computer it copies the screens of both monitors).

        When I thought about it, what was needed was an enhanced 'Print Screen" function. A simple utility that would auto-name and auto-save the (active) screen to a predefined directory when the Print Screen key (or a user defined hotkey) is hit. With a little searching I found just what I wanted in a freeware utility called 'LightScreen' (ver 1.01) written by Christian Kaiser and released under the 'GNU General Public License'.

        Next a TIVO like streaming record utility would be nice. This would allow commercials to be skipped during playback, so it's very unlikely this feature will ever be built-in, and I wouldn't be surprised if active measures aren't being taken to block recording.
--------------------------------------------------------------------------------------------------------------------------

Versions of Windows 7
       Six different version of Window 7 exist, one of which (Windows Starter) is 32 bit, but the only versions of Windows 7 widely available at retail (according to Wikipedia) are 'Home Premium' (mine), 'Professional' and 'Ultimate'. All these are 64 bit Windows 7 (sometime referred to as '32/64 bit' Windows 7). Virtually never in sales material is it pointed out that 64 bit Windows 7 won't run old 16 bit (Dos and Windows 3.1) programs. (And even 32 bit Windows 7 apparently doesn't run 16 bit code very well, because Microsoft support here says it won't run 16 bit code full screen.) You have to dig pretty deep in Microsoft support to find this: "16-bit programs are not supported on 64-bit versions of Windows Vista or of Windows 7."

16 bit software (Virtual DOS machine)
       16 bit code Dos code and Windows 3.1 code will not run in 64 bit Windows 7 (? 64 bit Vista) because Microsoft has removed the 'Virtual DOS machine' (VDM). The only way to run these old 16 bit programs on 64 bit Windows 7 is via emulation. An emulator must be installed, then an older version of Windows installed in the emulator, then the old program is run by the old version of Windows in the emulator environment. Even this is not 100% clean, because there can be problems with printers, ports, network support and the even on a fast new machine the program may run slower than it did on XP, which runs 16 bit code in hardware.

        -- The VDM subsystem was added to Windows with the July 1993 release of Windows NT, Microsoft's first fully 32-bit operating system. VDM allows Windows NT and later to run DOS and 16-bit Windows software.

Scanner fix?
        Here's a poster who has my HP5470c scanner, for which there is no Windows 7 (64 bit driver), reporting that he can use the scanner under XP Mode emulation. Whoops, when another poster asked whether he was using 32 bit or 64 bit Windows 7, he answered  32 bit. False alarm.

        --I had today the same problem with 5470c. Solved. I have installed Windows XP mode pack (download it at MS), then PrecisonScan with drivers. Then I ran it with rightclick through Troubleshoot compatibility (in my case WinXP SP2 as last working OS) and all works fine

Free Emulators -- DosBox, VirtualBox
        Several emulators for Windows 7 are available free. One is open source DosBox, which appears to have a dedicated group of supporters.  Out of the box it runs Dos programs, and Windows 3.1 can be installed on it. Another free emulator, which seems pretty polished, is VirtualBox from Oracle that is self described as 'Graphical User Interface'. You can install any version of Windows from 3.1 up to Windows 7 on it (if you have the disks and license!). However, unlike DosBox if you don't install a Windows OS on it it's useless. I downloaded and installed both of these emulators to play with. There are other free emulators too that I didn't try, like VMLite.

There are several YouTube videos (from different people) showing how to use DosBox
         http://www.youtube.com/watch?v=ASRP_X6kmqo?feature=related

Good comparison of emulators (including DosBox)
         http://www.thefreecountry.com/emulators/pc.shtml

Speedscript in DosBox
       I tried Speedscript in DosBox (without installing any OS on it) and was surprised to find it ran, and ran pretty good. Speedscript is pretty demanding Dos program because in includes quite a few (long) language routines (written by me), and it writes directly both to sound and video chips. DosBox emulator (apparently with Dos built-in) solved the problem of running Dos editor Speedscript on Windows 7. (Well that is if you don't want to print! Print support is missing from DosBox at the present time.) DosBox apparently supports and runs hundreds of Dos games and that is it's focus, which explains why print is not a priority.

Electronic Workbench
        The only spice simulator I ever used a work, and used quite a bit for non-linear front end designs, was Electronic Workbench. Spice code had been developed by several university teams and one of them was put in the public domain. Electronic Workbench made the underlying Spice code easy to use, because it put on top of it a graphical circuit draw program. It has a library of components (R, C, op amps, diodes, transistors, etc) and instruments (scope, meters, etc) that you put on screen and connect together. Hitting 'Go' runs (invisible to the user) the spice code and the instruments show the voltage and current waveforms. This program has a lot of limitations, the worst being that if currents or voltage change too rapidly the simulation stops saying 'no convergence', but over time I learned some tricks to get it to run and got useful answers from it.

        When I ran Electronic Workbench on my XP, I could see that clearly it was a graphical program, so it must have run under Windows. When I checked its file dates (1994), I saw it fell in the Windows 3.1 era (1992 to 1996). Windows 3.1 was the first successful Windows and was a 16 bit OS, so very likely Electronic Workbench was a 16 bit Windows program. I tried running it with (bare) DosBox, but it wouldn't run.

XP recovery disks
        I read that HP recovery disk had a full copy of the XP operating system on them (I now suspect this may not be true), and I came across a trick to get HP computers to write more than one set of recovery disks. The latter was important as I had bought my XP slightly used (from a store) and the previous owners had written recovery disks. The trick showed how to delete two files and HP would again write recovery disks. I tried this trick and it worked, and in 90 minutes I had two DVD XP recovery disks.

1) HP disk recovery program --- Start/Programs/PC Help ? Tools/Compaq Recovery DC-DVD Creator

2) Trick to get around one copy limit ---- First in folder options 1) show hidden files and 2) uncheck Hide Protected Operating system files. The file HPCD.sys is to be deleted (I renamed it HPCD.sy~) in two locations below:

                D:\HPCD.sys                                        =>    D:\HPCD.sy~
                C:\windows\SMINST\HPCD.sys        =>    C:\windows\SMINST\HPCD.sy~

Windows 3.1 on DosBox
        Later I read that Windows 3.1 could be installed on the DosBox emulator, and I found detailed instructions on how to do this. (Installing an OS is always tricky, and installing an OS on an emulator, for which it was not designed, is doubly tricky, so having a detailed roadmap on how to proceed is very useful, perhaps essential.) Here's the instructions I followed for installing Windows 3.1 (from a hard disk) onto DosBox. (I used the directory names he recommended.)

How to install 3.1 on DosBox (long and detailed)
         http://vogons.zetafleet.com/viewtopic.php?t=9405

        What I received from Ebay was a sealed envelope (picture on Ebay was only the envelope) that said Acer Windows 3.1, but the word 'Microsoft' was nowhere to be found in any of the text on the envelope (not even in the fine print). Not a good sign. However, inside were six 3.5 in diskettes that said Microsoft Windows 3.1 (not the 3.11, this is the original 3.1) with file dates of 1992.

Can 18 year old diskettes be read?
       These are (probably) 18 year old diskettes and I put them in an old machine with a diskette drive (neither my XP or Windows 7 have a diskette drive) that probably had not been used for 7 or 8 years. There was a lot of thrashing by the diskette drive and after a minute or it told me the diskette was not formatted (and did I want to format it?)! Well it looked like I struck out again. But I tried another disk and I got a directory of files! Progress. (Maybe it was cutting through years of dust, and it showed that the 15 year old diskettes could at least be partially read.). So I began copying the diskette files to the hard drive.

        Got lots of thrashing and lots of file read errors, but by keeping at it and pulling out the disk and putting it in again, I eventually got all of the files on the six diskettes copied to a single directory (c:\doswin\win31) on the hard drive. I then followed the detailed instructions for installing Windows 3.1 from the hard drive onto DosBox, and it worked the first time. Putting Electronic Workbench in the DosBox (emulated) c:\ directory (really c:\doswin) makes it show up as a Windows 3.1 application (I think), and it ran!

Running Electronic Workbench under DosBox
       To make it run slick the autoexec file for DosBox had to be modified to avoid having to manually 'mount' the DosBox drives every time (something that in the future would be a killer, because I would never remember how to do it, even though I wrote up a short help file.). I also had to relearn how Windows 3.1 and to try different resolutions to see which one looked best for Electronic Workbench.

       I followed the instructions above for installing Windows 3.1 and (separately) video drivers and it went smoothly. First step was to put all the files from the six Win3.1 installation (3.5") diskettes into a single file (c:\doswin\win31). I named the directories exactly how above suggested. I now have it so Windows 3.1 starts easily. This involved making a few changes to the DosBox batch file:

        c:\Program files (x86)\DosBox-0.74\DOSBox 0.74 Options.bat

        When DosBox (now) starts, it presents a Dos c:\ prompt. Typing 'win' starts Windows 3.1 (very quick), then a (double) click on Electron Workbench icon starts it. (As a bonus, the original Windows Solitaire is now available too. It seems a lot easier to win than later versions. I won and the cascade is fast.) When the application is closed,  and then DosBox is closed, you are returned to the Dos prompt and typing 'exit' shuts down the emulation.

        So how well does 16 bit Electronic Workbench run under Windows 3.1 in DosBox?  Well not too bad, it's certainly usable. It's not as fast as on the XP, but probably faster than it was in the 90's, and it's fast enough. There's no print support in DosBox, which looked bad, but I soon realized that there's an acceptable workaround for occasional use, just do screen captures of the schematic and instruments.

Emulation parameter in bios (update 9/23/10)
        Playing around with my bios I found it has a CPU emulation feature set to disabled. The descriptive text says (something like) HP recommends this be disabled unless you are running multiple emulations that need to run in isolation. (I read software developers use emulators this way to test software.) I turned it (on as a test) to see if Electronic Workbench simulations would run any faster, but no difference, so I set back to the setting HP recommends (disabled).

Scanner update -- Cannon Lide 210 (9/23/10)
        I finally threw in the towel trying to get my old scanner to run under Windows 7 and bought a new scanner. Staples had a huge number of (All-in-One) printer/scanners and zero straight scanners on display. I can only conclude that there can't be much of a market for straight scanners anymore.

        While my six or seven year old ($300) HP 5470c HP scanner still makes great scans, it is not in the best shape. Its power supply had failed a couple of years ago and ever since I have been powering it with a lab grade adjustable power supply, which will now be freed up. I did a lot of beautiful scans with the HP on 3d objects (coins, watches, flowers, feathers, etc) where with the resolution cranked up (2,400 dpi max) it would act much like a low power microscope. I hate to see it go. (See the Apendix for three spectacular scanner photographs I have taken with it.)

        I had picked out the least complicated all-in-one to buy, but was not really happy with its complexity and bulk. At checkout I found out that Staples did have a couple of straight scanners in boxes, so I switched and bought their simplest: Canon Lide 210 ($100).

        This thing is tiny (8.5 x 11" glass), lights the target with LEDs, and pulls so little power that it is completely powered from the USB port. It's claimed max resolution is 4,800 dpi, 48 bit. I knew before I bought it that it's reviews were mixed with some people complaining that it was sloooow. (I find speed is OK) I read that this type of scanner has a narrow depth of field, so it does not handle 3d objects well. (Oh, yea, see below)

        Only just got the Canon scanner, but first impression is positive on hardware (less positive on software). It does a scan of a pencil sketch quickly (no lamp warm up) and quality (after some adjustments) is pretty good. I had used the HP software a long time and over time had learned to use it well. It presents a single clean screen, has a nice histogram allowing the end points to be set quickly, and could display a large image.

        My initial impression of the Canon scanner software is far less positive. It's cluttered with too many beginner features, its histogram doesn't seem to work well, and the image is not as large. It's so cluttered, and its real control program buried so deep, that I almost didn't find it. I was about to go searching for more advanced Canon scanner software when I stumbled on it. I now suspect that unfortunately this may be the best software Canon has. It still might be worthwhile to download what Canon provides for its top of the line scanners and/or to try 3rd party scanning software like VueScan. Still more work to get back to where I was in scanning. Thanks HP.

        There's also some smelly about the claimed high resolution of 4,800 dpi (on the box and spec). In the software pull down menus max resolution is only 1200 dpi.  Some reviewers claimed the scanner resolution was not as claimed, but others pointed out it would do it, but you need to type in the value! Strange. It's probably that it's so slow as to be nearly unusable and/or the drive mechanism backlash and tolerance badly compromises the scan quality.

        Here's a review discussing the poor 3d scanning ability of a Canon Lide scanner (reviewer had to press a book against the glass to get a sharp image). Poor 3d scans with Cnon Lide scanners it says is because Lide scanners use CIS (contact image sensor) vs ccd sensor (with good optics) for scanners with good depth of field. (It has references to 'Scanner photography') (see appendix for some of my 3d scans).

         http://www.stockholmviews.com/canon-lide-200-review/lide200-4.html

Canon scanner software now wont' start!
       I just Alt-tabbed over to double check the Canon pull down resolution. After a couple of days of not using the Canon software I couldn't remember how to get into the real real scan program. An opening menu drops you into the beginner scan page. Here on the left I finally notice a tiny little check box that says "Use the scanner driver" (well that's clear!). When you check this, the (green) Scan button changes to "Open the Scanner Driver", and then you click this to open the real scanner program. Whew!

        Well I do it, and the program hangs! Into Task Manager for a forced shutdown, try it again, same problem. What the hell happened? Never saw this when I did my one and only scan. Looks like I am going to have to reinstall the Canon software. Thanks Microsoft, Canon and HP. Still more work to get scanning working under Windows 7.

        I reinstall the Canon software and its working. This is a new 100% compatible Windows 7 scanner and I had to reinstall the software. Another data point that Windows 7 is not stable.

Need to buy a 2nd scanner for 3D scanning
       I think I bought the wrong scanner. I really want to keep the capability to 3D scan, and now I have found out the hard way that this Canon scanner, which I had only researched a little, won't do it. To get back the ability to do 3D scanning I need to buy a 2nd scanner! Thanks HP and Microsoft. As I research what makes a 3D scanner, I find you have to dig deep. One requirement (only requirement?) for 3d scanning is that the scanner use a CCD (like digital camera) sensor not a CIS sensor. The former (CCD) uses a bright lamp (needs warm up time) and (apparently) uses optics. The latter (CIS) uses dim LED power, so the scanner can run off the USB port (and no optics?). When I look at scanner specs on Amazon, it doesn't tell me what sensor is used. Only when I go to the HP site and look at the full pdf specs, do I find info on whether a scanner can do 3D scanning.

Setting up Canon ScanGear
        I spend a few hours working with the Canon software to see if I could get it to work better. Scanner software is a little tricky, it took me a long time before I really mastered the HP scan software. The default Canon startup is geared to beginners and requires about four layer of confusing menus to get to the advanced screen. Here I had partial success. I found a shortcut to directly access the Scan/Import screen, and from there clicking 'Use the scanner driver' box and 'Open Scanner Driver' bring you into the Advanced screen. (I was unable to find any .exe in ScanGear) I set up preferences so when entering the Advanced screen a (fast) preview scan automatically runs. This is pretty slick. (Only downside is if you don't use the scanner for a while, the need to click the obscurely labeled 'use the scanner driver' might not be obvious.)

        I experimented with calling ScanGear from Paint Shop Pro. This might save a little time as the scan appears directly in Paint Shop for cropping (or enhancement), and you have the same control of the scanner as with entry via Canon shortcut.

        I continue to compare Canon ScanGear to Vuescan (which a lot of people like). Originally Vuescan had a slight edge, but with Canon's improved startup it's pretty much of a toss up. In neither is setting the B/W points as easy (or the histogram as clear) as in my old HP scanner software. (From reviews I suspect HP has changed their scanner software, and a lot of people hate the new HP software, at least those doing photo and slide scanning do.) One minor area where Canon is limiting me is in resolution of preview scans. The Canon preview scan is fast, but text readability suffers as the resolution is pretty low. In Vuescan I know how to set resolution of  preview,  but if there is a way to do it in Canon I can't find it.

My Amazon review of Cannon Lide 210 scanner

 Title:  No 3D scanning, October 2, 2010 By  Donald E. Fulton

       I bought this scanner to use with Windows 7, because HP has not made available a 64 bit driver for my trusty old HP 5470c scanner (in an effort to boost scanner sales no doubt). There can't be much of a market for straight scanners anymore because my local Staples has on display dozens of all-in-one printer/scanners and zero straight scanners.

       Pro: I like that this scanner is small, low power, and uncluttered, but I won't dwell on these points as they have been discussed by other reviewers. Quality as far as I can tell from my limited use is good. I saw a detailed review of this scanner that concluded the quality was excellent. Speed is no problem, with no lamp warmup and the preview scan is quick (10 sec).

       Cons hardware: As I now know (but did not know when I bought this scanner), all low power LED scanners with CIS sensors like the Cannon Lide family, have a big, big drawback. They have almost no depth of field. They can only scan paper, they can't be used for the scanning of 3d objects (scanner photography). I did a lot of scanning of 3D objects with my HP 5470c where by cranking up the resolution you could use it like a low power microscope and generate beautiful scans. To be able to do 3D scans with Windows 7, I am going to have to buy yet another scanner!

       Document top is near the buttons. To avoid having to rotate the image each time you scan you need to remember to put documents on the glass 'upside down'.

       Cons software: One weirdness is that even though this is 4,800 dpi scanner, the pull down resolution choices (even on the Advanced screen) stop at 1,200. Why? Apparently you have to type in higher values. I marked '4,800' on the cover to remember in future how high I can go.

       The Cannon scan software is cluttered with beginner screens. The 'Advanced' screen, which an experienced scanner will want to use, is almost totally hidden. About three layers down there is tiny little check box on left that says "use the scanner driver". When you click this, the green 'Scan' button changes to 'Open Scanner Driver', and this brings you into the scanner screen with full controls (Cannon ScanGear). Access is so obscure, the first time it took me an hour to find it. As far as I can tell, there is no way to start directly in ScanGear, but I did find a way to bypass a couple of beginner screens (add shortcut to 'MP Navigator EX 4.0\mpnex40.exe'), and if you play around with preferences you can get ScanGear to automatically generate a preview scan as you enter.

       Cannon ScanGear provides about the same level of scan control as HP's software, but I find the Cannon histogram (? VueScan's too) to be not nearly as good as my HP 5470c histogram, so setting the B/W points is more difficult. The histogram is quirky too. If image adjustments other than 'none' are selected, the histogram is either blank or compressed. A good feature of ScanGear is that it remembers all your settings.

       One useful button is 'Copy', which does a scan and sends it direct to the printer. To get half decent quality in a Copy button scan you need to have preset the software to 'Auto'. An annoyance of the Copy button is that it opens a Canon screen that it doesn't close. I also have found that sometimes the Copy button is ignored.

       I had to install the Cannon software twice on my Windows 7 machine to get it to work reliably.

       HP Scanjet    G3110            $100    ($87 Amazon)  2008  adaptor for scanning neg and slides (built into lid)
                Scan Technology   CCD (charge coupled device), 11 sec preview
                "Get realistic scans of 3D items by capturing more detail and depth, great for online auction sites"
                                        and Media Type   3D objects
                 spec does not say Windows 7 (only Vista), on Windows 7 compatible page
                                 some terrible reviews
        ** one reviewer compared it his 5470, saying the 5470 much easier to use and faster. He does not
                          understand why new HP software is so bad!! (his 5th HP scanner)

      HP Scanjet    G4010            $135 (126 Amazon)  2007
                    "surprisingly realistic 3D scans of larger items"
                   instant scanner startup, CCD, 8.5 sec preview
                   only XP in spec (reviewer in 2010 says not Windows 7 driver)  on Windows 7 compatible page

     HP Scanjet    G4050            $180  (170 Amazon)    2007  optimized for slides and negative
                        worlds first 6 color scanner
                        16 slides or 35 film at a time (hardware red eye correction)
                         "surprisingly realistic 3D scans of larger items"
                        CCD, 8.5 sec preview
                       XP and Vista ,o n Windows 7 compatible page

Looking at HP scanner on compatibility site, then a check on Amazon
                HP scanjet 5470c photo scanner              used $42 + 9 shipping (mine) not Windows 7
                HP scanjet 4370 photo scanner                used $35 + 22 shipping
                HP scanjet 4890 photo scanner               --------
                HP scanjet 4850 photo scanner               used 75 + 11 shipping (bad reviews)
                HP scanjet 3800 photo scanner                --------
                HP scanjet G2710 photo scanner           ---------
                HP scanjet 3670 photo scanner               ---------
               Canon Canoscan 4200F                          239 new (used 75 +9)
 

HP software does not mention my old program. And lots of people say the software for slides and film is cludegy and complicated.

 Researching Scanner photography
          Depth of field          about 1/2 inch
           people like Epson , epson 4490   v500,     Canoscan 4200F  m480
-----------------------------------------------------------------------------------------------------

Windows 7 directory 'name' sort algorithm is changed
        A quick look at a large directory in Windows 7 Explorer bothered me, it just didn't look at all like I remembered. So I ran a little directory test. Here's the same directory, sorted by 'name', viwed four ways: Two versions of a well known picture viewer (ACDSee ver 3.1 from 2000 and ver 7.0 2004 both running under Windows 7) and by XP Explorer and Windows 7 Explorer. They are all sort differently!

               ACDSee viewer
           ver 3.1             ver 7.0                      XP Explorer               Windows 7 Explorer
       ----------------------------------           -----------------          --------------------------
       0000100a.jpg       00_44a.jpg                 00_44a.jpg                 0000a.jpg
       0000a.jpg            0000100a.jpg              0000a.jpg                   000a.jpg
       0001a.jpg            0000a.jpg                    000a.jpg                      000b.jpg
       00044a.jpg          0001a.jpg                    00a.jpg                        00_44a.jpg
       000a.jpg              00044a.jpg                  000b.jpg                      00a.jpg
       000b.jpg              000a.jpg                      01.jpg                          0001a.jpg
       002a.jpg              000b.jpg                     0001a.jpg                     01.jpg
       00_44a.jpg           002a..jpg                   002a.jpg                      002a.jpg
       00a.jpg                00a.jpg                        2a.jpg                           2a.jpg
       01.jpg                  01.jpg                         03.jpg                           03.jpg
       03.jpg                  03.jpg                         3.jpg                             03a.jpg
       03a.jpg                03a.jpg                        03a.jpg                         3.jpg
       20a.jpg                20a.jpg                       3a.jpg                           3a.jpg
       2a.jpg                  2a.jpg                          20a.jpg                         20a.jpg
       3.jpg                    3.jpg                           00044a.jpg                   00044a.jpg
       3a.jpg                  3a.jpg                         0000100a.jpg               0000100a.jpg

ACDSee sort
        Clearly ACDSee sorts character by character. It apparently sorts with its own built-in algorithm, not using the operating system sort. In its directories all files beginning with '0' come before all other files in a directory. I prefer this. However, even ACDSee appears to have tweaked its sort order over time. Notice the file 00_44a.jpg is in different places. Apparently control characters like 'underscore' were positioned between numbers and letters in 2000, but in 2004 they were moved ahead of numbers.

Windows Explorers sort
         Notice the 'name' sort in XP and Windows 7 while roughly similar is not the same. Windows looks like it is using some sort of 'real' numerical sort with leading zeros in a number ignored. But of course, the two Microsoft sort algorithms don't do this the same way. Notice in my little test directory there are all sort of strange reversals and files seemingly out of place. For example, with an XP sort file 3.jpg comes before 03a.jpg, but in Windows 7 the order is reversed. In XP the file 01.jpg comes before 0001a.jpg, but in Windows 7 the order is reversed.

        Here is another perspective: In all directories the files [03.jpg, 3.jpg, 3a.jpg] are in the same order. So where in this sequence should the file 03a.jpg be inserted? In Windows 7 (? ACDSee) it is inserted between 03.jpg and 3.jpg, and in XP it is inserted between 3.jpg and 3a.jpg. Not sure which is more 'logical', but one thing is sure, the order is not the same! Stupid little differences like this can make file copying and transfer a real joy!

        I guess the Windows 7 design team looking at the sort algorithm the XP team had picked (after about 20 years of Window development) figured they got it wrong. The Windows 7 'boys' know better how to sort, so they decided to 'improve' the sort algorithm.

Turning off numerical sorting
        I did a little Googling and according to reference (below) a character by character sort was how Microsoft sorted in Windows 2000 and earlier. The reference describes how to turn off numerical sorting in Windows 7 and return to a character by character sort, but (surprise!) it can't be done with Home Premium. The change is done in Group Policy and guess what...

        "Note: This guide shows you how to make changes to Windows 7 using Group Policy. Group Policy is not available in Home versions of Windows 7."

Cycling directory display modes with [mouse wheel + ctrl]
         Playing around in the directory in Windows 7 I found that holding down ctrl while rolling the mouse wheel cycled through the directory display modes. However with more playing I found it goes through two sequences: It changes the directory display view but only after it cycles through something like a million icon size changes. (The directory display pull down list has only three icon sizes, but the mouse wheel + ctrl cycles through something like 30 icon sizes!) Only when icons get very small does more rolling begin to change the view. Totally uninportant, but pretty weird I think.

Summary
        My tests of Windows 7 Search shows in a simple search it works very poorly (at its main job!) finding files. I found it misses (up to) 80% of filenames in a partial filename search (files that XP finds)! I have played with all Search options ('partial match' on/off, 'natural language search' on/off) and this is the best performance I could get. In its present state (Sept 2010, prior to SP1) Win7 simple Search is a joke.

        A Windows 7 advertisement --- "Windows 7 has better ways to find and manage files"! Wow, that's chutzpah given that in Window's 7 Microsoft broke XP's (simple) partial file search.

How to do partial fileaname searches
        However, there is a reliable way to partial filename searches in Window 7: wildcards.  A search of 'filename:*xxxx*' will find all filenames containing the string 'xxxx'. The prefix 'filename:' is needed to limit the search to filenames since by default Windows 7 searches both filenames and content.

Warning  ---  Use wildcards (*,?) to make filename searches reliable. My tests below show clearly that even with my recommended search setting (below) a simple, straight search in Window 7 for partial filenames, which worked reliably in XP, has been broken in Windows 7 (? Vista). It misses files, lots of them! Comparison tests with XP shows Win7 in a simple partial filename search missing as much as 80% of files. And as far as I can figure out no other search settings work any better. (These tests run Aug/Sept 10 prior to SP 1 release.)

        In XP above the search box it says,  "All or part of the filename:"  XP search supports wildcards, so a partial filename search can also be done by searching for '*xxxx*'. However, it is an unnecessary complication in XP as a simple search reliably finds the search phrase anywhere in the filename.

        What Microsoft has done in Win7 is to break one of the two ways of doing a partial filename search that in XP work reliably. And it broke the simple way leaving the more complex way! Sure the pros will soon learn they must search with wildcards in Win7, but since partial filename searches work a little, and since they are combined with content searches, it makes Win7 Search a great big trap for the unwary (for most users, including me). This is really 3rd rate engineering and inexcusable in a mainstream 'upgrade' OS.

Search                            Directory page search

Options                          Restore Defaults
                                        Natural language search on

Prefixes                         filename: xxxx                    (filenames only)     (use as default) (not XP)
                                        content: xxxx                      (content only)  (not XP)

Wildcards                       *, ?                                       (DOS style)

Example:                        filename:*xxxx*               (finds 'xxxx' inside a filename)              (works well)
                                        filename:???.*                    (finds any three character filename)

        First click 'Restore Defaults' in the search option page (under Folder options). In 'Where to Search' this selects the 1st option [in indexed directories search filename and content, and in non-indexed filename only]. (2nd option can be horribly slow). In 'How to Search' the defaults are 1st option ['Include Subdirectories'] (obviously this depends on the search) and 2nd option ['Find partial matches' on] (it works only in context where it completes a word)

        Also click the 3rd 'How to Search' option [Use Natural Language search] (It seems to make wildcards works correctly). Finally kill the content search with prefix 'filename:'. For content (only) search use prefix 'content:'. Separating filenames from content in searches is extremely useful, really essential, and these prefixes seems to work well even overriding any conflicting search criteria. These search prefixes appear to be new in Win7 (or Vista) as my tests show XP treats prefixes as folder names.

Content search
        I made a temp directory and created put in it a few text documents each consisting of a single word  (xyzzztp). I created the documents using Open Source Writer and saved the document in five formats: .odt (Open Office test default, .txt, .html. doc (Word XP) .rtf (rich text format) .pdf, then ran a few search tests (partial match on and natural language on).

                            content:xyzzztp                      found
                            content:x?zzztp                      not found
                            content:x                                found
                            content:x*                             found

Conclusion --- Wild cards don't work in content search (* is treated as a null character)

                            content:xyzzz                        found
                            content:yzzztp                      not found
                            content:zzztp                        not found

Conclusion --- Partial match only works for first part of string. Does not work for embedded or end partial string.

                            content:xyzzztp                      .txt, .rtf, html      found
                                                                             .doc, odt, .pdf    not found

Conclusion --- Content search only searches in three of six common text file types (html, rtf, and txt)!  Hard to believe but it does not search in Microsoft .doc (didn't work in Word 95. doc either though I see posters saying .doc is searched),  Open Source .odt, or Adobe .pdf.  This is with default indexing options.

        I read that Control Panel/Indexing Options allows you to select extensions whose content are to be indexed and you can choose to index content, so with playing around perhaps more content can be searched. (In comparison search within an Adobe .pdf document finds a partial string anywhere in the word.) Everything with Microsoft is too hard.

Good free search utility -- Agent Ransack (from MythicSoft)
        A poster said he has given up on Microsoft and recommended a free 3rd party file search utility called Agent Ransack from MythicSoft. Yes, a quick look says this is what a file search utility should be. Searches filenames and file content. In a repeat of the test above, searching for a partial embedded word, it finds all six file types!. Tells you how many files it finds. It's content window shows every instance of the search word in context!

         http://www.mythicsoft.com/page.aspx?type=agentransack?page=home

(Update)
        I have come to depend on Agent Ransack to help manually recover from virus attacks. It has two features that are very useful when searching for virus files. One, it allows you to define a very tight search window, so if you know approx when the virsus attack started you can search for files written a few minutes before and after this time. Two, (by default) it displays windows filetimes to the second, so all the components of a virus that installs multiple copies of itself, like the FBI lock virus, can more easily be found because they will have exactly the same filetime.

Intro
        All I want from Search is to be able to simply search for filenames (? folders) with standard (DOS types) wildcards, and separately, to be able to search for file content in specific directories. I have no interest in learning to use a query language for searches.

Working to understand Search in Windows 7
        What follows below are my semi-raw notes on Windows 7 Search. Conclusions I draw from early tests are sometimes wrong, as I later figure out. But this back and forth and early confusion, even after hours of work, is in an of itself revealing about Search, about how badly laid out and confusing Search is, about how hard it is to find files, and about how it can easily mislead you.

        After writing below, I played with Vista's Search a little. I now see that Windows 7 Seach is just Vista's Search tweaked a litttle. Windows 7 Search is 2nd generation, and it's still a bloody mess! In some ways Windows 7 Search layout is worse than Vista's. Vista directory search had a shortcut button to take you directly to the Search Option page, but it's gone in Windows 7. Not only is the Search Option page now several layers deep, but it hides under 'Organize, Folder Options'). Amazing.

        I read that the both Vista's Windows 7's Search are oriented to support a rich query language (pages of text commands), something I never learned from the operating system. The two commands that I thinks are (obviously!) most useful [filename:, content:] are barely mentioned. I say obviously because they separate the Windows 7 default combined searching of content and filenames into separate searches. I found 'content:' from a post and guessed 'filename:' As I look through pages of query commands I did see 'filename:', but I did not see 'content:'. But according to my tests they both work and work cleanly.

        The 'Natural Language' search option I read relaxes (in some unspecified way) the structures of the query language, but what it really does is still a total mystery to me. My limited testing seems to indicate that wildcard searches work better with Natural Language search on (and I saw this online too), but why I have no clue. At this point it's just another (zero documented) complication making search a bitch to use reliably. The Search option screen has no Help button and F1 does nothing.

File Search (on Start screen)
        I started looking for the volume file (SndVol.exe.) using Windows 7 file search (lower left corner, 'Start search'), but it baffles me. It doesn't work like XP. The search results come up instantly, so if it's searching it's searching an index list. The main problem is that the results (at least for a system file) have no path! A search for volume would just point me to the same volume window available in the taskbar, but I couldn't figure out where it was or the name of the file. There must be more capable search hiding somewhere.

        OK, buried deep (Organize, Folder and Search Options, Search) you can choose where to search, but weirdly the two choices are mutually exclusive. One choice is search indexed locations (for filenames and contents) and in non-indexed locations (filenames only). I had at one point checked this because it seemed most general, but it was clear I was getting only an index search. The other choice looks like it's probably more like an XP search (it says it may take several minutes). The first search option for 'SndVol.exe' now brings up this file (!), so I'll try the 2nd option.

        Weirder and weirder. Don't see anyway to limit the search to location or time (it must be somewhere). I enter 'SndVol' and SndVol.exe comes up, but with no path even though I have paths set to full. Even weirder if I enter a partial filename "SndVo" (just missing last letter) it doesn't find the file, so it is apparently not searching for partial filenames ('Find partial matches' is clicked), which XP did by default! Time to Google to figure out how Windows 7 Search works.

        First articles talk about how much better Windows 7 search is than XP, because it searches the contents of files (in directories you specify). OK, I'll grant that's nice, it replaces Google hard drive indexing and searches, but I still can't figure out how to search disk for files. Microsoft says

        -- "You can instantly narrow search by date, file type, and other useful categories." How?

        -- "When searching from the Start menu, only files that have been indexed will appear in search results." Ok that explains why there was no disk activity.

        -- "Most files on your computer are indexed automatically." Note the caveat your files, not most files. There are warning from Microsoft about indexing too many directories. I only have a few data directories indexed.

        When you type in the directory search window, a filter window pops up with options of 'when modified' and file 'size'. No 'where to look', even though I am typing at the top level! I dropped down to the c:\ drive on my XP network drive and started a search. It's clear from the disk leds that only the network drive is being searched, so it looks like the search in a directory where you enter the search and its subdirectories (if you have clicked the include subdirectories option elsewhere!). Big question now is how do you search for files across multiple drives?

Search, Content
        I saw that clicking the View button (2nd from right, select 'Content') was giving some of the file text. I first thought this was context of the search word, but it's not. It's just the first couple of lines of text of the file. This is most useful view window for search, because it includes a lot of other file information, including for htm files the author (from htm meta tags).

How to stop a search?
        The XP c:\ drive search has been going on for minutes now and I want to stop, but I don't see a Stop button! How the hell do you stop a search. OK, there's a little 'x' next to the search window that functions as a search stop.

'Boot' vs 'Boots'
        I was searching my homepage .htm files for 'boot'. Directory search is also returning files that contain 'boots' and 'reboot'. I can't figure out how to search for 'boot ' ('boot' with trailing space). Adding parenthesis doesn't work.

Search is a disorganized mess
       After playing around with Search for an evening and reading extensive posts about it, I think I know pretty well how Windows 7 Search works.

        My  impression of Windows 7 Search is that it is a disorganized mess. It looks like Search underneath (at least in some ways) is much more capable than XP (less capable complain many posters when it comes to network drives), but its commands are all over the place. The 'where to search' box is totally isolated and two levels down from the 'when modified' and 'size' search restriction boxes. (Windows spins this as "There are lots of ways to search in Windows 7".) I suppose once you get to know where all the search commands hide, it will be fine.

        It has confusing options like 'Natural language' (tested by trial and error) and to what extent file content should be searched. Search setting are hidden when search is occurring (Let's see is it searching subdirectories or not?). It doesn't tell you where it's searching. The search progress bar is just a fake. Wild cards do work, and work as expected, if you have all the setting right (looks like natural language needs to be on). With setting wrong Search will fake you out with either too many files found or not find a file that is actually there.

        By default Search searches filenames and file content. This makes the returns inherently difficult to interpret (Microsoft does put a box around search characters in a filename). Finding the path of the returned files is an easter egg hunt (right View). After a lot of scrounging, I found (apparently) undocumented in Windows 7 hidden, but very useful, search prefixes that will restrict the search to either filenames or file content. Why is there a click box for this useful feature, or perhaps an expert search window??

        Bottom line ---  Windows 7 Search is a disorganized, freaking mess. Probably OK if you use it a lot, but so badly laid out with hidden, confusing and cryptic options that it will be difficult to use reliable if used infrequently.

              Search for                       Yields                          Comment
             ---------------                     --------                          ------------
               htm or .htm                (all htm files)
             t.htm or te.htm            (all htm files)                      what?
                  tel.htm                    telephone.htm
                                                telegraph.htm
                                                   index.html             file content includes 'telphone.htm'

Comments
         *There seems to be a three character threshold! 't' or 'te' don't (seem to) do anything, only when 'tel' is entered is the search restricted to filenames and content containing 'tel'.

        Later update --- I don't think so. When I learned about the hidden prefix 'filename:' I reran the search above using it (? with natural language search on). Now everything works as expected: t.htm yields nothing and t*.htm yields three .htm files beginning with t. Probably 't' and 'te' are so common in English that they were found in the text of all the files, which is why all the files were returned.

         * I find it quite incredible that the search option box doesn't contain an option to search only filenames or file content. (There must be a way to do this, need to do some research.) (There is, I found it later from a poster)

Natural Language Search
        Does anybody on the planet know what the Windows 7 seach option 'Natural language search' does? Setting 'natural language search' on makes no change in 'htm' search results, but it does cause t.htm, te.htm, and tel.htm to produce no results. I checked to see if (DOS) wildcards might work:

                   tel.htm                     (no results)
                  tel*.htm                    telephone.htm
                                                  telegraph.htm
                   *phone.htm            telephone.htm
                tel?phone.htm            telephone.htm
                ???phone.htm              (no result)
              ????phone.htm            telephone.htm

        This is promising. From the above tests it looks like DOS wildcards (* and ?) are back. But to use them you need to click the 'Natural Language' search option (whatever it is) on, otherwise they won't work as expected.

Wildcards broken?
       I saw a poster who was complaining bitterly that Microsoft 'broke' wildcards in Windows 7, meaning they don't work like they did for 20+ years. How they always worked is this:  '*' can replace a string of any length, '?' replaces only a single character, and the two parts of the filename are treated separately, leading of course to the famous DOS directory search of *.* that every DOS user knew well. So a search for ??a.jpg should only find .jpg files with a filename of three characters ending in 'a'.

         I ran a little test and ??a.jpg does finds three character .jpg file names ending in 'a' (as expected), but it also finds this filename: 00jpg100a.txt. What! Obviously (as the poster noted), Windows 7 is searching from 'jpg' anywhere in the filename (including the extension) and (if allowed) in the contents of the file too. It does look like wildcards are (a little) broken in that the separation between the filename proper and extension seems to have been breached..

The best way to do a partial filename search is with wildcards: 'filename:2pianos*.jpg'

        If you search for 'xxx' (in a filename say) with 'Find Partial Matches' Search Option set on what does this mean? I can think of two likely possibilities. One, it searches for text string 'xxx' anywhere in the filename. Two it searches for 'xxx' only in beginning of filename, in other words it's the equivalent of xxx*. A little test: I have a file in the directory I am searching named, '2pianos_4hand.jpg (so no text). I did searches for:

                    filename:pianos.jpg                    not found
                    filename:2pianos.jpg                  not found
                    filename:2pianos*.jpg                found

                    pianos.jpg                                     not found
                    2pianos.jpg                                   not found
                    2pianos*.jpg                                found

Does not work in filenames?
        'Partial Matches' on clearly does not find the text 'pianos' inside the filename, and from the above tests I (initially) concluded that it also does it fill out the rest of the filename, i.e. '2pianos' is not equivalent to '2pianos*'. The result is the same whether natural language search is on or off.  No wonder I see so many poster complaints about partial filenames not working! So what the hell does 'Find Partial Matches' do? All the more reason to do searches with wildcards.

        But going back later to confirm that partial matching doesn't work for partial filenames, I was surprised. I searched 'sndvo' (partial of sndvol.exe in c:\Windows) and it was found. So then I went back to the directory above and searched:

                    filename:2pianos                       found
                    2pianos                                       found

        Summarizing --- Searching 'filename:2pianos' you find the file, but if you add the (correct) .jpg suffix searching 'filename:2pianos.jpg' you do not find the file. Then to compound the confusion I turned off 'find partial matches' and it makes no difference, 'filename:2pianos' still finds the file. Yikes. No wonder people are going nuts about Windows 7 search.

Using wildcards for partial filename search
        The only reliable way to do a partial filename search in Windows 7 is to use wildcards.

First search below finds all filenames containing 'piano'

                filename:*piano*                                 2pianos_4hands.jpg
                                                                               2pianos_frey_carsey.jpg

Search can be tightened by using more '*'. I understand the first, but the second isn't how I thought '*' worked.

               filename:*piano*h*                              2pianos_4hands.jpg
               filename:*piano*h                                2pianos_4hands.jpg

The three wildcard searches above work exactly the same in XP (minus 'filename:').

Does work in content
        I think I figured out what 'Partial matches' does. It works on file content, but not in filenames (well probably not, see above). It's my 2nd definition above, it fills out the rest of the text word. I have a text file containing the word '2pianos'. When I search (with Partial Matches on) for 'content:2pian', it finds the file, but when I search for 'content:iano', the file is not found. And unlike with filenames, when I turn off 'Partial matches' 'content:2pian' now fails, so 'Parial matches' controls.

        I love Microsoft's attitude about (not) explaining things like this. It's for them to know and us to find out! All they would have to do is put a link on Partial Matches, or Natural Language, which when clicked would bring up an explanations and some help, or even '(not for filenames)'.

Actually using Search
        OK, I've run some tests on Windows 7 Search, but when you really try and find something how well does it work? I've given it two tries. In one it works well, in the other not so well.

        Where I like Search and think it is a real advance of XP is finding stuff in local files. I now have written quite a few long (html) technical essay for my home page. Often I'm looking for something, but can't remember which essay it is in. (There is overlap in some of the technical essays.) In its first test Search quickly found my search text (that directory is indexed) and provided convenient links to the files. The search preview pane shows the html text of the file, but disappointingly it does not show the portion of the text containing the search item, it just shows the start of the file. So to find the actual item, you may need to open a few of the files and use the application search to find the search text.

        Where Search basically failed (maybe this is a Windows 7 problem) is finding the location of the volume file (SndVol.exe). I needed the link to put a Volume shortcut on my desktop. I previously found the file by looking through candidate directories finding it at c:\Windows\System32\SndVol.exe.

        Having run a few Search tests I think I now basically understand how Windows 7 file search works, so I give it a spin to find the location of 'SndVol.exe'. I go to c:\ drive and it its search window enter the filename (SndVol.exe). Not found, so I try c:\Windows and again not found. Then I remember that maybe subdirectories are not being searched (they were not). Remember search conditions are not visable while you are searching (a big flaw I think in search design). After a minute or two searching the (non-indexed) Windows folder and its subdirectories the file is found. A progress bar indicates the progress of the search. So the location is now found right? Well, sort of.

        After a minute or so the progress bar (appears) to show a completed search, i.e. it has moved all the way across its window and stopped. The file is found, but it's not where it should be, not in the System32 subdirectory. (It's in a subdirectory with a very long technical looking name.) Damn, either the found file is a copy or there is something wrong with the path info (turns out it's the former). Ten minutes (!) later nothing on screen has changed, but cursor still shows an hourglass. Is it still searching? It's very unclear. The progress bar saying no, but the waiting (hourglass) cursor seems to be saying yes (or maybe).

        Another couple of minutes go by (12 min into the search!) and another copy of the file at the location I am expecting (c:\Windows\System32) now appears on screen, so it was still searching. It took like 30 minutes for the search to finally finish (and as it trundled on it found a few more versions of the file)! And the only indication that Search had finished was the hourglass cursor finally disappeared (no 'search complete' message). (Later when I checked the properties of Windows directory I found it has almost 70,000 files in 13,000 folders. Yikes!)

        Redoing search starting from c:\Windows\System32 and turning off subdirectory search the whole search takes about ten seconds, and it finds the file. What happens here to the progress bar is it is about 25% of the way across when the search ends, and then it just jumps across to fill the window. (It's like it just runs at a fixed speed unrelated to the size of the directories being searched.)

My comments on using Search
          * The progress bar is clearly a joke. Windows directory search was only about 3% over when the progress bar had traveled all the way across and stopped.
        *  It's very difficult to know when search is finished, because Search doesn't show where it's searching, progress bar is a joke, and there is no 'search complete' text.
        * Search can be bloody slow. The reason (I suspect) is because it is searching not just filenames, but the content of thousands of files, and there appears to be no way to turn this feature off!! No wonder why Microsoft added a file indexing feature. (I later find there is a way to turn off content search, just preceed the search text with 'filename:')

I see the problem?
        I think I see the problem the posters report of 'file not found'. When I search for my email address (a file content) in my data directories (partial search and subdirectory search is on), it is found. Searching using the Start Search and again it is found. But when I search the whole c:\ drive, it is not found. I agree with the posters, Search is either quirky or just does not work right.

        The only way I can explain Search's action is that a search of c:\ drive, which has some directories indexed and some (most) not indexed, is that it is treated as all non-indexed, so only filename searches are made. That's why a search for sndvol (filename) succeeds and for my email (content) fails.

       'What to Search' => In indexed locations search filename and content
                                          In non-indexed locations search filename only

        Avoid 2nd choice in [Folder option, Search option, 'What to Search']. For a large directory 'Always search filename and content' can take a half hour! 1st choice option will search the entire c:\ drive for a particular filename in only a few seconds.

         http://helpdeskgeek.com/windows-7/windows-7-file-search-indexing-options/

Searching filename or content
        Good god, there are hidden crypic codes that will limit Windows 7 Search to content or filename. I had explored every search option and I didn't find them (do they exist?). The use of 'content:' (prefix) was mention by one poster, so I tried it out, and it works. It limits the search to file contents. I guessed that 'filename:' might limit the search to filenames, and it does! (Apparently these cryptic codes need to be remembered! Why are they not in the search boxes or on a right click?) Two very useful search text prefixes to remember:

                        filename: xxxx
                        content: xxxx

Microsoft video on Search
        A member of the Windows 7 development team gives a 4 minute tutorial on how to use Windows 7 search and Libraries. 'Libraries' are new in Windows 7 and he explains how to use them.

         http://windows.microsoft.com/en-us/windows7/help/files-folders-search

Comparison to XP search
        I had never used Search much in XP.  I never liked typing in the cramped XP search space with the stupid little dog below, and certainly had never systematically explored it like I just did with Windows 7. My XP searches were generally slow, mostly because I couldn't see how to select a specific subdirectory below the c:\ drive. Seeing that a lot of posters liked XP search and I was now familiar with Windows 7 Search, I cranked up the XP and did a few XP searches.

        My first surprise was to notice that XP Explorer directories pages have a 'Search' button near the top. I had never noticed this before. This is how you select the directory to search (local directory is the default). I had done all my XP searching from Start/Search and was always puzzled that you couldn't control where to search below c:\. So Search in XP is not that intuitive either. Wildcards work in XP too (who knew).

        Searching the same directory with XP and Windows 7 is very revealing. One thing that immediately jumps out is that Search in Windows 7 (Home Premium) is lacking two useful features of XP Search, specifically:

                -- XP tells you number of files found
                -- XP tells you during search where it's searching

        Why did Microsoft remove these? The number of files found can sometimes be especially useful. It's just crazy. Windows 7 is supposed to be an upgrade from XP?? I can imagine someone justifying this in a Microsoft meeting saying we want to make Search appear simpler and not to 'confuse' users.

        An aside --- Comparing the search results between XP and Windows 7 was a real joy, since the two OS have different sort algorithms!

More filename searches with partial matching on and off
        Setting partial matching off. I search for a single character like ''4'  (filename:4'), 'a', 'i' and 'p'. In the first three cases Windows 7 returns a few files (all of whose filenames contain the searched character) and no returns in the case of 'p'. In all these cases XP returns hundred to thousands of files all of whose filename (or extension) contain the searched character. But this beg the question, Why  with partial matching off does Windows 7 return any filenames at all? Doesn't make sense. Smells like a problem.

        Setting partial matching on. I repeat the single character searches. Now Windows 7 returns many pages of files each time, so clearly partial matching had a big effect. (How many files are found I don't know, because Windows 7 does not tell me!!) On first view it seems that maybe Windows 7 and XP are now working the same,  but a closer looks shows Windows 7 Search is missing files. On a search for 'p' (filename:p) Windows 7 misses 'atp_diagram.gif', 'bridge_duplex.gif' and others, all of which XP search finds. A search of a three character string ('hau', partial of house) reduced the number of files returned allowing me to roughly quantify how much Windows 7 Search is missing. XP returned about 30 files and Windows 7 only 6. Yikes Windows 7 missed about 80% of the files it should have found.

        Some of the Windows 7 posters who said they were sure Windows 7 Search was missing files were right. Windows 7 Search does miss files (lots of them). It's a piece of crap.

Windows 7 Search is fatally flawed
        The only conclusion I can draw is that Windows 7 Search just plain doesn't work right. It's either got gross bugs or major design flaws. And worse, by working partially (finding some files and missing others) it fakes you out. (No wonder I was confused, test results can be contradictory.)

                     Search phrase                                        Results
                    -----------------                                    -------------
                       edison                                       3 files starting with 'edison'
                       ediso                                         3 files starting with 'edison'
                       edis                                           3 files starting with 'edison'
OK, no surprises. Search phases begins filename
(XP finds same 3 files)

                       edi                                             3 files starting with 'edison'
                                                                   +      file with 'edi' inside
OK,  'edison' files + one file with three character string 'edi' inside filename
(XP finds same 4 files + one more)
                       ed                                             3 files starting with 'Edison'
                                                                  + three files with 'ed' inside
OK,  'edison' files + three files with two character string 'ed' inside filename
(XP finds same 6 files + about 24 more)

------------------------------
Now watch this. I start removing characters from the beginning of 'edison'

                       dison                                         no files found
                       ison                                           no files found
(XP finds the three edison files)
                      son                                     one file with 'son' inside filename
(XP finds the three edison files + 12 more containing 'son')

Yikes, yikes! 'son' in 'edison' is not found, but it finds 'son' inside another filename

        Again, I can only conclude that parial filename search in Windows 7 does not work right. It misses files.

Check with XP
        But the problem of missed files in Win7 is much worse than the above test suggests. The same test done with XP shows that Windows 7 is missing a huge numbers of files. Search for string 'son', Win7 finds 1, XP finds 15.  Search for string 'ed', Win7 finds 6, XP finds 30.

Content searches
       I haven't done any contents test searches (yet) looking for words inside files, but a poster who ran some content tests reports that Win7 misses most of them. This is totally consistent with what I find in partial filename searches.

-----------------------------------------------------------------------------------------------------
Microsoft's explains what to do when programs are not compatible with Windows 7
        I found a posting (Dec 2009) where someone asked about the error message above and a Microsoft support engineer replied. Here's the posting and reply:

Poster

When trying to install Cinemania 95 I receive a message which states "The version of the file is not compatible with the version  of Windows you are running . Check whether you need an x86(32-bit) or x64(64 bit version of the program."This was never an issue wuth Windows_XP. Is there a patch to solve this problem?

If you have an older application for Windows XP or Vista that doesn't run in Windows 7, you may be able to get it working properly by running the program in compatibility mode.

1. To begin, find the application or shortcut that is causing the problem, then right click on it and select Properties.
2. Then, select Compatibility from the tabbed menu at the top of the properties page:
3. Now, check the "Run this program in compatibility mode for..." box and select the OS you wish to emulate. For most applications, it will be Windows XP SP2. Once you are done, click OK.
4. When you next launch the application it should run under compatibility mode using the OS you selected. If it still fails to run correctly, try another OS selection in step 3 and try again.

Marilyn, Microsoft Answers Support Engineer

(some sort of work around)
         http://h30434.www3.hp.com/psg/board/message?board.id=Install?thread.id=1844?view=by_date_ascending?page=2

Twain driver
         http://scanworkssoftware.com/twnimporter.html

------------------------------------
Windows 7 Explorer screen capture (11/5/10)
        I have not systematically examined Win7 Explorer, but on casual observation the left directory pane on Window7 Explorer has never looked clean. It seems to be cluttered with what I presume are all sorts of repeat entries, far more than XP. There's so many that sometimes 'c:\' is at the bottom of the page.

        I thought I would document a recent (minor) Explorer weirdness. I was surprised to see a 'new folder' icon (somehow) popped up on my desktop. I have no idea how it got created. Before deleting it, I clicked on it (it was blank) and below is a screen capture showing how it's listed in the Explorer directory pane.

My comments
        Notice in the left directory pane 'New folder' is at the top level listed directly under 'Desktop', but the address bar at top shows it to be at [c:\user\windows_7\desktop\new folder]. Apparently the latter is where it actually exists on the c:\ drive (yup), and the directory pane listing is what, a shortcut?

        Another weirdness is that of the eight (top level) 'Desktop' entries only two of them ('Recycle' and 'New folder') are actually on my desktop with icons!  I have no desktop icons for 'Computer', 'Network', 'Homegroup', etc, so why are they shown under desktop? I don't even have a Homegroup, which is local network of computers running Windows 7! This is the entire directory listing for my computer, so everything is listed under 'Desktop', really strange.

        A still further weirdness is the ordering of items. The most important entry ('Computer') is way down the list. It even comes after Homegroup, which doesn't exist! Bizarre.

        And what is supposed to be the difference between 'Windows_7' and 'Libraries' entries anyways? Not a clue. Mostly I ignore these top categories. When I push into 'Windows_7' and look at the default, it looks like expanded Libraries.

        If you push into 'Windows_7' you find 'Desktop'. So 'Windows_7' is under 'Desktop' and 'Desktop' is under 'Windows_7'? Oh, yea!

        What is 'New Folder' doing at the top level anyway?  It's blank. I renamed and I put a file in it and still it remains at the top level. Why? What's so special about this directory? Really weird.

        When I go to delete the New folder, the pop up 'Are you sure' box just says is it OK to "move this folder to the recyle bin?"  It should say 'this folder and its contents', where is 'and its contents'? It is also (I would argue) less than clear to new users that this is a folder 'delete' request.

UBS disk drive plug and play bug (update 9/7/11)
        When I bought a 2nd external USB drive, identical to the one I was using, to act as a backup drive, I uncovered a major Windows7 (Home) bug. A USB plug and play bug. When I plugged in my new drive, it did not show up in Explorer, thus it could not be accessed, even though Device Manger could see it and told me it was working OK.

        It took a few hours work and some cursing, but I eventually got the two drives recognized. Below is my Amazon review (for the WD 2 TB drive) where I discuss the problem and how I came up with a work around.

Title: 2nd Drive Not Recognized by Windows7 (Home)
by Don Fulton, September 7, 2011
This review is from: Western Digital WD Elements 2 TB USB 2.0 Desktop External Hard Drive (Electronics)

        There is a huge bug in Windows 7 (Home) that I ran into when I bought a second WD Elements USB drive to act as a backup to my first WD Elements USB drive, both models the same size (2TB). I found that when I plugged in the new second drive, it was not recognized by the system, no disk letter was assigned, it didn't show up in Explorer. I got the normal USB sound plugging it in, and in fact in Device Manager both drives were there, and clicking on them I was told both were working OK.

        I know the new 2TB drive I received was not damaged, because if I plugged it in alone, i.e. with my existing 2TB WD drive removed, it worked fine. Plug in the two drives in any order and only one or the other will show up in Explorer! The other stays hidden with no drive letter assigned and inaccessible.

        Good news is that after about four hours work researching this and trying things, I got both drives working. I will explain below how I did it.

        First I want to curse out Microsoft (and WD too). This is a horrible bug, USB drives are supposed to be plug and play. I'm an engineer, so was able to plow though some technical forum postings, but most non-techies would be stumped by this. Buying a second drive to act as a backup has got to be fairly common, this is not an unusual configuration. The cursing applies to WD too, because this problem is known to them, in fact I found the hint on one of their forums for the solution. I read that WD metaphorically shrugs and blames Microsoft, but by providing no insert in the disk drive packaging to warn and/or provide a work around, they are just leaving their customers hanging.

        I started my research by searching the Amazon reviews and found some tips and tricks that had worked for others to get a single WD drive recognized, but none of them worked in this case. Here is what I tried: reversed the order of plugging in USB cable and drive power, added some media, i.e. put the new empty drive on another computer and copied over a file to it, renamed the new drive so drives had different names, enabled/disabled the drives in Device Manager, and rebooted a bunch of times. All to no avail.

        Here's what did work. I had read on a WD forum that one user with the same problem had gotten his drives working by plugging both drives into a Window7 Pro. His explanation had something to do with the computer needing to reassign signatures when two drives are the same, and he guessed that Windows Home for some reason (bug!!) is unable to do this, but his other machine could. At that point he was able to move the drives back to Windows Home, and they now were both recognized, the signatures apparently fixed (permanently) by the other machine.

        I have an old Windows XP machine, so I used that. I just plugged both 2TB WD drives into the XP and let them sit for a minute or two until their drive lights stopped flashing, and sure enough when I moved them back to my Window7 Home machine, both drives now displayed in Explorer and both could be accessed. I later was able to fully copy the contents of the first drive to the second.

        Microsoft's incompetence is dragging down the USA's technical reputation. Not only does Windows7 file search not work right, Windows7 System Restore is so buggy that it is not reliable, but now I find that its plug and play can't handle two identical drives!

Entering a search phrase in Control Panel
        -- Every entry into the Control Panel search box has to be typed twice. After you type the first letter, it goes off and does something and rejects further characters. Work around is to retype the phrase. This happens every time!

File sort from applications
        When I try and sort files by date in a my Netscape editor's file directory, usually nothing happens. This one is really annoying as I often need to find newly saved image files in a long directory. By trial and error I have found a cludgy workaround. A name sort first will often get the date sort to work!  What? This smells like a problem with an older application calling Window7 file functions, maybe a missing call variable?

System backup
        System backup does not run automatically as it should. Window7 (supposedly) has an automatic file backup program built in. I set it up to run weekly using the default (Sun at 7:00 pm). It ran a few day later on the first Sun, but the backup file date indicates it has not run since, and in the last three weeks I am sure the computer has been on at Sun 7:00 pm. How can such a major problem exist?

System restore points
       System restore does not automatically create system restore points on a (weekly) schedule as it should. It does create restore points prior to an install.  How can such a major problem exist? For a long time my workaround was to manually create restore points, which is hard to remember and tedious as the link is buried. Recently I searched out a script (for Vista) to make restore points and put a shortcut to the script on the desktop. So far this seems to be working. System restore is such an important recovery function, why is it necessary to go outside of Microsoft to be able to shortcut 'Create a restore point'?

       System restore also does not seem to be retaining restore points as it should even though I have allocated plenty of memory. I sometimes find only one restore point.

Windows Restore shortcut
       Why is shortcuting to system functions so hard? When I installed Windows7, it took me an hour to find the filename of the volume program. I would now like to put a shortcut to System Restore on my desktop so I could check restore points, but there is no obvious way to do this. If Microsoft would show the name of the file, it could be searched out, but they hide it! (Poking around Start I figure out it is c:\windows\system32\rstrui.exe, well that's sure clear!)

Incorrect file size during file copy
        During picture upload from my camera using Windows7 Explorer, I noticed Explorer changing the file size. My picture files are nominally 3 Mbytes, but no two are exactly the same. Here's what I see in Explorer during the file tranfer: during transfer which takes 2-3 sec per picture the file size will display, say, '319,000 KB' (wrong), but then it changes to '3,190 KB' (right) when the upload finishes and the next transfer begins. Good grief. Yup, file size display is too high by x100 during every transfer! Another stupid bug the people at Redmond WA never bothered to fix.

        I can guess what happened here. During normal file copy this incorrect file size display is too fast to see, only when the file transfer is really slow does the incorrect formatting become visible. Did they never bothered to test for this, never test Explorer Copy with large files? This can't be true. Is it related to the camera? Who knows? Yet the fact remains that I find Explorer file size wrong every time, always x100 too large. Explorer file copy, a key system function, is not clean.
=====================================================================

Scanner photography with HP 5470c scanner
        A few images of 3d objects I have scanned with my abandoned HP 5470c scanner. A good 3d scanner can be used like a low power microscope revealing fantastic detail.

Read Errors --- Why my computer won't boot (update 3/30/11)
        The reason why I 'upgraded' (to use the term loosely) from XP to Windows 7 was my XP refused to boot. A few seconds into its boot it stopped on with words 'Disk Read Error', 'Ctrl + Alt + Del' to restart, which does nothing. Today after six months of use when I powered up this morning I got exactly the same 'disk read error' boot problem on my Window 7 computer. I was pissed.

Did I have this problem earlier?
       Looking back in this essay I see I got some Disk read boot failures early on with my new computer. This problem appeared to go away (somewhat mysteriously) when I played with the bios boot sequence, so at that time I put it down as a bios problem (? talked about it that way in my Amazon review). But based on the problem popping up again, and today's tests, I now suspect the earlier boot cause may very well have been due to intermittent problems with one of my three external USB drives.

** Remove USB devices ? back to life (3/30/11)
        So I disconnected all of of my external USB devices (including my keyboard and mouse USB connections too), and it booted. Reconnecting them I got a message that my 320 Mbyte drive might have errors and should be checked and fixed. I said OK, and Chkdsk did find errors it said it fixed, but it seemed minor (unused space was allocated in error).

        So Windows 7 seems to be indicating that my 320 Mbyte external drive is preventing it from booting. Why would the design of the operating system even allow this?? Can a read error on a non-system external drive kill the whole computer, with no diagnostics? Seems so. If this is true, this is another indication of how badly designed Windows operating systems are.

It's back!
        With Chkdsk having fixed the system errors on the 320 Mbyte. I power up my computer in its usual configuration (with 3 external USB drives) and without the USB flash drive. Problem is back...  Hangs in a few seconds on Read Error. Taking my hint from the earlier reported problem with the 320 Mbyte drive, this time I remove only this one drive, and (guess what) it boots.

        While running, I reconnect the suspect 320 Mbyte USB drive and get the normal USB connect sound. It appears to be working fine, normal in Explorer, and quickly loads a file. Leaving it connected I power down and power up again. While powering down I can tell something is not right, because Windows does not respond when I push the power button. Only when I hold it to force a hardware power off, does the computer turn off.

        At power up with 320 Mbyte drive connected it hangs. As a check I pull another external USB drive and use Ctrl + Alt + Del, and no boot. I reconnect this other drive and remove the suspect 320 Mbyte drive. Sure enough when I  hit Ctrl + Alt + Del with the 320 Mbyte drive USB drive removed, it boots.

Confirming 'Disk Read Error' boot problem
        These few tests confirm that (very likely) the cause of the fatal 'Disk Read Error' boot problem is one of my three USB external hard drives. And since I have had these three drives for years, almost for sure this is what led to be believe my XP's internal hard drive had failed, and why I bought a new computer.

Piss poor design
        It seems to me this is a gapping hole in Windows architecture (it happened same on the XP and Windows 7). The core problem is not that it won't boot, but that it provides no diagnostics as to the cause. When on the XP I got the error message 'Disk Read Error' I logically assumed this meant a read error on the internal 'c/d' hard drive.

Fix the 'Disk Read Error' error message!!
       Removing an external USB hard drive is trivial, so if stupid Windows would just identify which drive has the read error 90% of the problem would be gone.  In fact even with no detailed knowledge I can suggest a pretty good, and trivial to implment, quasi-fix. Just add to the 'Disk Read Error' warning message text that says the 'read error may be in an internal or external drive' and/or 'retry with external drives disconnected'!!

To do
        While the few tests I did are not definitive, they make a strong case that I should replace my 320 Mbyte hard drive. Apparently Windows demands that all connected hard drives respond corrrectly when polled early in the boot sequence, and my 320 Mbyte drive is apparently, intermittently, failing this boot test (even though when connected it works normally).

        Buy a new USB drive (probably 1 Terabyte) to replace the 320 Mybe drive. In the meantime leave it disconnected, which is OK as I use it as a backup drive. Just for fun overnight should probably have the 320 Mbyte drive tools check for bad sectors.

        Might make sense to do some research to see if others have had this type of Windows problem.

Won't boot again four months later (8/24/11)
        Everything has been OK for four months (since April 11 crash and reinstall), been running with two USB (external drives): 160 Mbyte and new 2 Tbyte drive. Come home from two day trip and boot up, and for two hours everything normal. I have been monitoring restore points disappearing for last few weeks so to check I click Restore icon. Up comes splash Restore screen but it is taking forever to start (not normal), so I play a few minutes of Solitaire and when I check back I can see it's hung. I soft Restart computer, but it takes a long time powering down and then won't boot. Hangs at the first HP splash screen (F11 for system recover). Force power down and at power up same thing. Press F11 and nothing. A boot failure, but different than I have seen before. Yikes!

        Learning from past I pull USB plugs: 160 Mbyte drive, 320 Mbyte drive, TV tuner and scanner. It boots normally! Reconnect USB devices: scanner, TV tuner, and 2 Tbyte drive, and it boots normally. I leave out the 160 Mbyte drive because I can tell from its metal case that it is abnormally hot. Looks like my 160 Mbyte USB drive now several years old has gone bad too following the 320 Mbyte drive.  (I found for the last four months the 320 Mbyte drive had been left with a USB cable connected, but with the power plug pulled. Not the best, but it should be OK, and it never appeared to cause a problem.

USB devices can kill boot!
        As I wrote before, what kind of idiot company designs a computer that won't boot (with no diagnostics) if a USB device goes bad. That would be Microsoft!

         System Restore on Windows7 Home is totally useless!

(update 4/9/11) Crash #1
       Maybe my earlier boot problems (described above) were a prelude, maybe not, who knows.

        Anyway two weeks later, with my computer only 8 months old, I am browsing along and suddenly crash....  No power glitch, no warning, just a totally unexpected, instantaneous Win7 crash, followed by the computer starting to reboot. But the reboot doesn't get far, just a few text lines, and then it hangs. It hangs close to where it did earlier, but not quite the same. This time there is no (Ctrl/Alt/Del) text, just an underline cursor top left on a black screen. In spite of hours of work I could never recover. Bye bye to my recently completed and not backed up 2010 Turbo Tax income file (luckily I had just printed it out) and lots of other data from the last six weeks.

System Restore to the rescue?
       I was expecting System Restore to save me. It had saved me from a crash of my Vista portable last summer. In fact I had researched it and written an essay about System Restore, calling it a gem in the operating system. This time I tried System Restore about half dozen times. The first time and some other times it reported it had successfully rolled back the system files, and other times it reported errors. None of the roll backs worked. The boot stopped every time just where it did the first time.

        When I started System Restore, I found only one restore point was available, which I didn't understand since I had manually made some not that long ago, but the one point was a few days before the crash, which should have been fine. Win7 is supposed to (says Microsoft) create restore points regularly, but it doesn't! I was aware of this, so now and then I would create a restore point manually, and restore points were being created when new programs were added or deleted. So where were the restore points I had created a little while ago? I know about memory space allocation for restore points, and I had set it to what I though were generous levels, confirmed by the fact that I often did see several restore points. Another discouraging thing about Restore was that it said it could restore c:\ but not d:\ due to insufficient room. The size allocations it reported looked funny, most of hard drive now appeared to be labeled d:\ with c:\ being only 100 Mbytes.

Boot repair
       In the HP suite of recovery tool (accessed by F11 at boot) there is also a program that says it repairs boot problems. Tried it a couple of times, but it also was unable to fix the boot. There were also extensive hardware test tools, and I ran all these. All my hardware (CPU, disk drive, etc) passed all tests. All indications were this was a software crash and not a hardware problem.

System Restore fails me!
       Needless to say this experience has badly shaken my faith in System Restore (? Microsoft). The first time I need System Restore to save me in Windows 7, and it doesn't work!  It doesn't properly roll back my system files, even though it tells me it has successful! (I don't like to be lied to Microsoft!)  It also didn't have the restore points it should have, and claimed it couldn't restore one drive due to lack of space. It also gave conflicting reports about whether it was successful in repeated tries.

On to System Recovery
        My hardware (CPU, memory, disk drives) had just passed a fairly comprehensive suite of HP tests, so it looked my problem was software. I was hoping my d:\drive was still OK. Have exhausted all other options I was going to have to go back to factory conditions using System Recover, which will reinstall the OS (along with the free crap software) from the d:\ partition.

        I go into System Recover, and it asks me if I want to do a backup before recovery. I say yes. There is no choice of backup options, except where to put it. The file size will be 50 Gbytes (it tells me) and luckily I have 70 Gbyte free in my one external (160 Gbyte) drive, so it will fit. The backup is running slow and clearly will take hours, so I leave it running and go to bed. When I check in the morning, the backup ran to completion without error, so I then run System Recovery.

        The good news is that in the morning, after System Recovery has run, my computer boots. Everything looks normal. System Recover has wiped clean the c:\ drive (removing Win7 all programs and data) and has written a new copy of Win7 pulled from the (hidden) d:\ drive (located on small partition on the internal hard drive).

        While System Recover (as expected) has reinstalled crap/trial software too (like Norton) from d:\, the crap total looks to be somewhat less than what I remember when the computer was new. This is at least partially confirmed by the fact that this time I was able to uninstalled Norton without any special hassles (using Win7 uninstall), whereas when the machine was new Win7 uninstall was unable to get rid of it, and I had to go the Norton site to to run a Norton program to remove it.

About that backup file
        I look at my external hard drive and see it has a 50 Gbyte directory named Backup (date) with 220 files all with .wim suffix. Restoring these files is something I will do later. First step is to get back online and reestablish email. However, when I do look around a little, I don't see any tools, or any obvious way to pull my files out of this backup file heap.

        I try clicking on one of the .wim files hoping that will bring up the decode utility, but Win7 tells me it doesn't know about .wim files. Not good. I Google .wim and a Wikipedia entry on this file type comes up. It tells me it was invented by Microsoft for backup of Windows files, and 'wim' stands for windows image backup.

        What? .wim files are a Microsoft filetype for Windows backup, yet Windows reports it doesn't know anything about .wim files! This is fu.... amazing! No matter how low the bar Microsoft can sink lower, Microsoft never disappoints. I do a little Googling trying to figure out how to (safely!) recover these files, and I come across the posting below (from 2010), which reflects my situation. My backup too was created by an HP recovery suite integrated with Microsoft System Recovery.

        "I used HP Recovery Manager to back up all my data files before a full System Recovery and now I can't restore the backed up files.  Recovery Manager saved all files as .wim files and no one at HP tech support knows how to restore these files. I have copied the files to my desktop but can't access the data.  How do I convert these back to music, photo, document files, and then restore them to my document folders?"

Image backup files
        Wikipedia says .wim files are image backup files, which I think means is they are just raw copies of disk sectors. This scares me in a couple of way. For one thing it's now a few days later and I have reinstalled most of my software, so there is no way I want my newly restored computer messed up by an uncontrolled writing of disk sectors all over c:\.  Also I have no way of knowing what's in them, I suspect it is a mixture of data and program fragments. It is also unclear to me how without an intelligent tool raw disk images can be put back together as files, especially files with titles. One idea I have is I will soon be receiving a new external drive, so why not put the recovery files on this empty drive and work on it there.? Work on it with what? Still no clue. There's only a few files in the backup that I really want (like my 2010 income tax file!).

Useless .wim backup files
       After doing some googling, it looks to me that the 50 Gbyte of .wim files made by the System Recovery tool prior to the system recovery is useless. It is an image backup and will replace everything. Not only would it wipe out all my manual recovery work (now about 98% done), but far worse, it was made after the system crashed, so there is a very good chance that it corrupt! I am going to delete it.
==============================================================================
2nd Catastrophic Window7 crash (4/6/12)
        In about two full days work I am about 85-90% recovered from my 2nd complete reinstall of Window7 in the two and a half years I have had my HP computer. In both cases there appear to be no hardware problems. Recovery was helped by some planning I did and some luck. Here are the key elements in the recovery process:

         1) Manual save of Speed (personal) directory periodically
                          Latest Speed directory I had manually saved was two months old (2/1/12). This recovered a lot of information, but since it was two months old it meant I was still missing my latest financial info and recent HS talk material (on DNA), both of which I wanted.

         2) Windows auto backup ---- incremental backup of Speed directory
                         A year ago I had set up a backup program built into Windows7 to do backup of my Speed directory. It has been doing a weekly backup at Sun 7:00 pm for about a year. My memory is it did a full backup when it started, and since has been doing incremental backups. Being Microsoft it is wildly unfriendly. Everything hides under a cryptic folder name (WINDOWS7-HP). Under that are tons of files.zip in dated directories, but amazingly under the .zip files are the actual files not encrypted. These files can be copied in the normal way. Every week has has two .zip folders. The first contains .html and other text files that were changed during the week, and the second .zip folder has pictures that were added.

        It was tedius, but since I had saved a copy of the entire folder manually on 2/1/12, by opening 8 pair of .zip files in the eight weeks since the crash, I was able to add all the new figures and updated the files that had changed. The most recent incremental backup had been six days before the crash. Most weeks there were only 1-4 changed files.

Backup files
        I only found the recent weekly backup files my accident. I have two 2TB USB drives and both had a single top level directory (WINDOWS7-HP), which I assumed were the same, but they are not. I found files for the last six months only on my #2 backup drive. Why this strange arrangment, I have no idea. (Some of the earlier backup on drive #1 are full backups of Speed folder) Anyway the latest weekly incremental backup was found in the directory path below:

(2TB drive #2)
       WINDOWS7-HP
            Backup Set 2011-08-28 190000             (incremetal backup starting Aug 8, 2011)
                 Backup Files 2012-04-01 190001     (April 1, 2012 weekly incremental backup was most recent)

         3) Recent picture of desktop
                        It's easy to overlook but one of the critical pieces of information needed to restore your computer is to know what was there, which programs were on your desktop being used. You may have some nice utility (video player, a search program, etc) that you downloaded free online. But do you remember all their names, where to go to get them again? I bet you don't. Hence the value of an image of your desktop that is not too old.

                    Here I lucked out. I had bought a BB Playbook tablet computer six weeks earlier and just fooling around testing its camera had taken a picture of my monitor showing the Window7 desktop. (I almost deleted the image a few days earlier, but held onto it just in case.)

Recovery overview
            Of the 30 or so programs on my desktop I found a needed a half dozed or so original disks and the rest could be downloaded. The real time burner I have found is not the installation, this takes maybe 1/3rd of the time, the other 2/3rd is in the setup of the programs. Except for some simple programs (like search progam, Agent Ransack) most programs take a lot of set up: defaults, hotkeys, directories, etc. Most frustrating are programs (I have a couple) that don't remember their setups. My old html editor (Netscape 4.8) copied over was throwing weird errors on startup, which I evenually cured by running in XP compatibility mode. My favorite free download video player (KMPlayer), in of course a new rev, is now playing poorly. Played around with a lot (million variables in this program) and it's still not working right, on the other hand VLC video play is working pretty well.

           The bulk of space on my c:\ drive was captured TV program I had captured with my USB TV decoder. I didn't consider these high priority, so didn't back them up. Except for a few I put on Playbook and some overflow videos I put onto a USB drive, these all were permanently lost in the crash and recovery/

==========================================================================================

Introduction
       This virus is horrible. I have been hit by this thing about ten times in recent months. A recent article in the New York Times about 'ransomware' (mentioning the FBI Lock virus) said this threat has become much more common with 16 gangs working on extorning money this way. I read that if you just click the 'wrong' link and your computer is hijacked, that there is no action you can take to prevent from being infected, that you don't have to open or run anything to be infected. Well maybe, but after being attacked so many times I think I can be a little more specific. I strong suspect that the attack is triggered by clicking on a video to run it. The video is either infected or maybe the video screen and start arrow are just fakes on a fake screen and the 'run' click initiates a download. Maybe it's a bug in flash that is being exploited, don't really know. But being careful about running videos on dodgy sites might give a modicum of protection.

        Why the authorities cannot shut down the criminals running this scam, I don't know. I mean they ask you to send them money! How hard can it be to find them? (Or are they in lawless Russia?)

       I have been hit so many times that I am quite an expert in how it acts and getting pretty good at recovery. I have all the recovery tools I need on my computer and can now recover and clean up my files in about 30 minutes. Every attack is a little different. The opening screens are different, the location and names of the virus files move around a little. One time the attack came with an MP3 file, so not only was my computer locked, but a voice kept repeating "your computer is locked". I don't have a webcam on my desktop, but I read that it often freaks out those being attacked by it starting the webcam and showing the user face on the screen.
--------------------------------------------------------------
** New variant of FBI Lock virus is MUCH more difficult to recover from (update 12/24/12)
        After recovering so many times over the last few months from the FBI lock virus, I knew it very well, but today I got attacked by a much more letal variant. I recovered, but it was much more difficult and took a long time. The virus writing gangs have addressed both of the weaknesses of the virus that I discuss in the section below.

        One, you can no longer regain control by booting into Safe mode! When I tried this, safe mode started to load files normally, but I got just a white screen. Even Ctrl-Alt-Del access to Task Manager was blocked (it just flashes and disappears.). No access to Safe mode makes recovery much more difficult. The only approach left (that I know) is to boot from recovery disks. Luckily not only had I recently bought a set from HP, but just today I made my own recovery DVD. If you don't have recovery disks, I know of no way to recovering without changing the hard drive!

        I put in the recovery DVD I had just made and (pressing any keyboard key) booted into it. It worked and brought up a bunch of tools. One possible fix that I did not try was System Restore. I had two restore points made in last two days (still there). I had also made a disk image today, but this was painfully slow, several hours copying 250 Gbytes to a USB hard drive.

        Here's the long series of steps that eventually allowed be to delete the virus and recover. (Obviously I have no way of knowing if all these steps are necessary.)

            -- Startup Repair tool  ---- reported no boot errors  (I doubt this is needed)
            -- Command prompt tool --- try to run System File Checker [sfc.exe /scannow]. Won't run as it says boot repair has
                                            a restart pending
            -- Reboot (F8) into Safe mode with Command prompt --- Works, I get a command prompt.
                                            Run System File Checker (10 min), then exit. This brings up Safe mode, better but still damaged.
                                            Safe mode now has black screen with Safe in four corners, but now Ctrl-Alt-Del works and gets
                                            me to Task Manager. From there (file, run, browse) allows me navigate in Explorer
                                            so I can run Malewarebytes or (Mythicsoft) Agent Ransack.
            -- Run Agent Ransack in Safe mode --- Do a file search around the time of the lockup. I see Malewarebyte log write
                                            and at same exact time two 124 kbyte tmp files written (8240.tmp and 8241.tmp), but (unlike every
                                            previous attack) I find no '.exe' file in the few minutes preceeding the lockup. Big problem, the
                                            main virus .exe file is not found!
            -- Still in Safe mode I open Malewarebyte log in Notepad. It has three (non recyle bin) trojan entries. Two are the .tmp files
                                            I noted above (8240.tmp and 8241.tmp) at the same time as the log is written. But the log contains
                                            another trojan entry about 19 minutes earlier (FCBC.tmp), but this is also a tmp file.
            -- Run Agent Ransack again in Safe mode --- This time with the search centered around the 19 minute earlier time noted
                                            in the Maleware byte log. Bingo! Eight seconds before the log entry is what looks like the virus .exe file
                                            (xaARWGa.exe, 121 kbytes), and at the exact time of the log entry and FCBC.tmp trojan a suspicious file
                                            (uwjgotw.zpf, 186 kbytes). There are also at these times a bunch of picture files (.jpg and .png) with
                                            an .htm file (main.htm) that together very likely are the phony FBI screen.

        Deleted all the suspect files around these two times (19 minutes apart), and I had recovered. A scan by Malwarebytes came up clean except for a registry entry. This long process took nearly two hours. Googling 'xaARWGa.exe' I find only one entry for it on a maleware site: it had shown up first time a month ago in UK, was unsigned, but it was not known if it was dangerous. (I bet it is!)
------------------------------------------------------
(old) FBI Lock virus has some flaws
        One flaw is that the FBI Lock virus runs immediately when it downloads. This means if you can get control of your machine, you can find and delete the virus files. Any .exe files (first) written at the time the machine locked up are very likey the key virus files.

        Second flaw is that after your machine locks you can regain control by booting up in Safe Mode (tap F8 while booting).

        Third flaw is that (free) anti-malware can usually find and kill this virus. Run it in Safe mode. I use the highly regarded free version of Malwarebytes Anti-Malware. Every time, but one, it detected the virus and offered to kill it. In my experience it doesn't always find all the virus files, so a manual search for files downloaded at the same time will sometimes pick up other virus fragments like shortcuts and prefetches.

Attack and recovery
         The sign an attack has begun is without warning the (fake) 'FBI logo warning screen' suddenly pops up covering the whole screen, and in 1 or 2 seconds your computer really is locked up, keyboard and mouse don't work and even the interrupt Ctrl-Alt-Del is disabled. Your only option is to power down. The best thing to do is to immediately power down by holding the power switch, and to later find the virus files take note of the time. While not essential, it's good to wait a few minutes before powering up again. The reason for the wait is make a gap in file times, so you can easily separate files written by boot from those written around the time of the infection.

        When you click an infected link, the virus files quickly load and once loaded immediately lock the machine. This means that all the virus files will have filetimes very close together, usually the same to the second. Window's Explorer only shows file times to the minue, but Windows internally tracks time to higher resolution. I use and recommend the free search below: Agent Ransack from Myhicsoft

         http://www.mythicsoft.com/page.aspx?type=agentransack&page=home

        It shows file times to the second and can do file searchs for files written in a narrow time window making it relatively easy to find all the virus files. Typically there are 4-6 virus files usually written at exactly the same time (to the second). A common pattern is to see two or three .exe files writen at the exactly the same time (to the second) to different locations and with different names. The key that this is the virus writing multiple copies of itself to your hard drive is that all the files are the same size. (roughly 100 kbytes).

        I learned the hard way it is not enough to just delete one of the virus .exe files (say those in c:\user). If you don't get rid of all copies of the virus key (.exe) files, you will find the computer instantly relocks when you reboot. So the key to recovery is to find the exact file time, typically a 1-3 second window, and delete pretty much all the files (first) written your hard drive in this window. Even in such a tight time window I might find a dozen to two dozen files (applications write temporary files all the time), but loss of tmp files does no harm and with such a tight time window it is unlikely that by mistake a key system or application file will get deleted.

        When the computer locks up, I power down and note the time. By waiting a few minutes before rebooting I know the virus files are somewhere in the 100 or so files written in the last minute. If I can find just one virus file, then I know I can find the rest of them because they will the same, or almost the same, file time. If a malware scan finds a target or two, I don't let the malware quarantine, instead I note the location and find it with my Agent Ransack search utility to find its exact file time.

        While malware makes recovery easier, it can be done manually. I just did it on my last attack. Sort the files of the last minute by type and locate the few .exe files ('application' files). Some of the virus files are in this group. See the same size .exe file written at the exact same time to two locations?  Very suspicious. These are probably virus files, note the time. See an .exe file whose name appears to be a long random string of letters or numbers? Very suspicious. Good chance this is a virus file, note its time.

        Before deleting the (random).exe virus file, typically 96k to 116k, note the filename(s), because there may be a registry value pointing to this file that also needs to be cleaned out. Not sure how vital deleting the registry value is, but I suspect that if it remains and points to a non-existent file, it's just an annoyance at startup and can be cleaned up later.

MalwareBytes Anti-Malware
        The free program I use to find the virus files is the widely recommended 'MalwareBytes Anti-Malware', and it has identified some (generally two) of the virus files almost every time, however, it failed once to find anything. Another free program that I read will find the FBI lock virus files is 'HitmanPro Cloud Antimalware'. The only time I tried HitmanPro is when MalwareBytes failed to find the virus, and it failed too. MalwareBytes Anti-Malware doing a quick scan (3 min) under Safe mode has always in my experience reliably found two of the virus files (without a lot of false hits). It offers to delete these files, and for many this may be all that is necessary to recover, but I want to go further and remove all traces of the virus.

(Update Nov 16, 2012)
        'MalwareBytes Anti-Malware' has been on my computer for a couple of months. Twice during this time it has popped up a window saying it has blocked a virus attack giving the file name and asking if I wanted it killed, to which I say yes. From the filename this virus that it catches 'in the act' and kills does not appear to be the FBI lock virus. As far as I can tell MalwareBytes has never stopped an FBI lock virus attack, it just helps with cleanup running in Safe mode.

        In a recent FBI lock virus attack I did not run MalwareBytes. I decided to see if I could recover manually, which I did successfully. In looking through the files at the time of the attack I noticed something curious. At the very second of the attack some change was made in a folder labeled as a 'MalwareBytes log'. I can think of two possible explanations. One is that the virus writers are now attacking trying to disable MalwareBytes, or two, and probably more likely, MalwareBytes detected the virus attack when it occurred noting the virus filename and location for identification after the fact. Pretty sure the latter is correct. Looking more at Malwarebyte logs I see it often has logged trojans as they were downloaded with the notation "Allow".

Virus hides as Task Scheduler
       In my recent attack before running MalwareBytes I had already located the two virus .exe files (almost for sure two copies of the same file, same size (116k) and written at exact same time, even though as is common different file names). When I ran MalwareBytes it only found one trojan, this was the copy of the virus .exe file with a long random name. The other virus .exe copy, which MalwareBytes had missed, had a system sounding name (TaskScheduler.exe), and the virus had placed at the same time a 1k shortcut file in Windows Startup folder to call it (taskscheduler.lnk). I bet that if I had depended this time only on a Malwarebyte's quaranteen, I would have still been locked up on reboot, because I found out the hard way earlier that one remaining .exe virus file is all it takes.

Malware fail (Nov 10, 2012)
        On another attack today of the FBI lock virus both of my anti-malware programs (see above) failed to detect the virus. Maybe the virus is getting smarter. The good news is I was able to recover manually using my procedure and the great search program 'Agent Ransack', which can search files in a tight time window and shows file times to the second.  However, it took me three tries and about two hours.

        The reason it took three tries was I did too narrow a search the first two times. The first time I stupidly searched just c:\user folder (saving just a few minutes), where I know from past experience virus files are always found. What I forgot is that the virus puts copies of the key files in several locations outside c:\user). When I rebooted the supposedly clean machine, it locked up almost instantly (1-2 seconds after the desktop appeared). On my second cleaning I widened the search to the whole c:\ drive, but set the search time window (only) around the time of the second attack. Big mistake, it means I missed files that were time stamped with the time of the first attack, so again on boot up with the virus files still on the machine from the original attack, the machine locked up again.

Manual cleaning succeeds (Nov 10, 2012)
       Finally recovery effort #3 succeeded. When I started cleaning #3, I didn't understand the virus files from the original attack a couple of hours earlier were still on the machine, but I remembered there was often a virus file in a 'prefetch' directory, so I thought that maybe this was calling a new copy of the virus at power up. To prevent this I powered down my cable modem before repowering my machine (with hindsight I doubt this was necessary). This time when I started cleaning (searching c:\), I looked at the 'prefetch' folder, and there was a file with the time stamp of the original attack (two hours earlier). I now realized my error, that I had missed virus files in the my first two cleanings and  that I needed to a search of c:\ with centered on the time of the original attack, and sure enough I found a bunch of virus files.

        I found virus files in these folders:
                  c:\user                                                   (various subdirectories)
                  c:\windows\prefetch
                  c:\windows
                  c:\programdata                                      (registry value pointed to virus .exe files in this folder)
                  registry value (search using filename of virus .exe file)

        The lock virus files are (for me) pretty easy to recognize. Files and directories that turn up in the narrow time window search and have names that look like long random letter or number strings are very likely virus files. The (random).exe file (96k or 100k) is probably the key file, and I found two or  three copies of it (with same name, size, and timestamp),, and also another copy (same length and time stamp) but with a different filename consisting of a long random number string. My virus .exe filename in this attack was 'fsbpleuk.exe', but it is different in every attack. I used this filename ('fsbpleuk') to search the registry using Windows tool 'regedit', and sure enough I found a registry value pointing to [c:\programdata\fsbpleuk.exe], which I deleted along with the virus files.

Nature of the 'lock' screen files
       I found the 'lock' screen is not a single image file but about a dozen or so small, fragment image files and an associated .html files that pulls them together, and all resides on the hard drive. The virus created a subdirectory in the 'c:\programdata', which consisted of a long random letter string (hence it looks suspicious), and in there went the files associated with the lock screen. Curiously these fragment image files names for the lock screen were readable and with their function spelled out (in english), for example one was 'moneypak.png'.

Agent Ransack
       I have on my machine a very good, free, general purpose search program called: 'Agent Ransack'. This search engine is much (much!) better than Windows built-in search. With this tool (still in safe mode) I search all the c:\ directory for files changed within a 2 or 3 minute window (before and after) the identified virus file time. In a few minutes it generally comes up with two or three pages of files, and they can be sorted by time (to the second, Windows just shows files times to the minute). Since you know the name, location and approx time of at least one or two of the virus files from the malware program, find these files in the Agent Ransack list. Any files that have nearly the same file times (to the second) are very suspect and can probably be deleted. In fact I have found that I can generally delete nearly everything (dozens of files) within 30 seconds or so of the virus files without any problem. Most of these files are apparently temp files written by running programs. The only problem I ever had was I deleted the local copy of my emails and had to download them again from the server. I now to watch out for that file.

CCleaner
       Final clean up (still in safe mode) involves a registry search using text fragments from the virus files names (like 'isass') using Window's Regedit. Sometimes it finds something suspect in the registry and sometimes not. One online site recommended a general free cleanup tool called CCleaner. In one fell swoop this program will delete dozens of temp windows files and browser history files. Maybe not necessary, but seems like good practice. It's fast and easy and has not given me any problems. Finally empty the recycle bin and immediately reboot. It's important to clean out the Recycle bin, because I think some viruses can reload themselves from there. Everything should be back to normal.
-------------------------------------
Detail notes
     Unlock: F8 on reboot to enter Safe mode (no network)
                    I read that another way to get rid of the FBI screen is to disconnect machine from internet (pull cable), because the FBI
                                splash screen is not on the computer, it is being downloaded from a web site called at startup (I don't think this is true)
        Fix:     run Malwarebytes Anti-Malware (free)    --- Disables the virus
                   Or  --- before deleting with Malwarebytes, use explorer to find the times these files were installed. This is time of
                         attack. Search out other files with same file date and time (I use file search utility: Agent Ransack.)
                         This part is tricky, but delete suspect files with these same times.
                  CCleaner from Piriform (free) --- general clean up utility, not specifically for this virus. Use it to clean
                        out browser history and empty Recycle bin
         Another possible fix is 'System Restore' if it has a restore point and will work! My experience with System Restore on
                                Windows7 has been bad, and I read it may not work, but others report it has worked for them.
                                 This is the Win7 System Restore file (open it to start system restore): C:\windows\system32\rstrui.exe
----------------------------------
(another update, Sept 26, 2012)
         I have gotten hit with this virus still again (or it is hiding and just returns). This time recovered by deleting dozens of files with time stamps within a couple of minutes of attack. This time used Malwarebytes only to find two key files (it misses some files) and from them got the exact attack time. There is info on this virus on the (real) FBI site. It says you do not have to open a file to get infected, just browse to the wrong site. FBI page identifies the virus as being installed by "Citadel Malware" (sold on open market by Russian hackers) and it installs a program identified as "Reveton Ransomware". Citadel Malware does it's work by exploiting a vulnerability in Java. (Interesting: Firefox just popped up a window saying 'Java Platform SE7 U5 10.5.1.255' has been known to cause security problems and suggests disabling it.)

Details on virus
       A google search led me to the first site below which has a lot of detail as to how the virus operates, what files do what, very useful. They (Anvisoft) have a (free) program (2nd link) that they say deletes the virus: 'Anvi Smart Defender'. Here is their outline and I can (to some extent) verify this since I just recovered manually today and kept notes on the files.

This folder has
1) Delete   *.dll.lnk          in     C:\users\Window_7\Appdata\roaming\Microsoft\Windows\Start Menu\programs\startup
2) Delete    ctfmon.lnk      in     C:\users\Window_7\Appdata\roaming\Microsoft\Windows\Start Menu\programs\startup
                                                     yes, I found in this directory: ctfmon.lnk    1k             "This calls virus on startup"
                                                                                                                                         "It points to or calls the malicious file"
                   I also had:       CTFMON.exe-[random].pf   25k       in         c:\windows\prefetch
                                          Isass.exe   44k                               in         c:\programdata    (identified by Malewarebytes and related to ctfmon)
                     (probably)     gla.pad        81 Mb                         in         c:\programdata  (dated 4 min later, but huge file)
3) Delete  rool0_pk.exe    in   C:\users\Window_7\Appdata\local\temp           "fixes the FBI moneypak"
               [random].mof   in   C:\users\Window_7\Appdata\local\temp
                     V.class       in   C:\users\Window_7\Appdata\local\temp   (for good measure, a Java file)
  (I didn't have any of the #3 files)

ctfmon notes
        I have no doubt the ctfmon.lnk (1k) in the directory shown above is a key virus file. However, a google search and a search of my c:\ drive shows multiple copies of ctfmon.exe (9 or 10k) that Google says is a Microsoft file. In my cleaned system I do not find ctfmon.lnk.

        forums.anvisoft.com/viewtopic-45-953-0.html

more manual delete info here
       http://deletemalware.blogspot.com/2012/07/remove-fbi-moneypak-ransomware.html

I have not tried this cleaner
       www.anvisoft.com/product/smartdefender.html?refer=forums
----------------------------------
(update Sept 2012)
        Incredibly I got hit with this virus a 2nd time, about six weeks later. Same routine, computer suddenly (after some delay) locks with FBI splash screen. Reboot in safe mode (F8) and run Anti-Malware to kill virus. This time I checked YouTube and found a bunch of fixes for this virus. One was manual showing entries in registry to check, another recommends the utilities above. I also did some manual file deletes (using 'Agent Ransack', an excellent free search utility) for files dated within a few seconds of the bad files found by Malwarebytes.
--------------------------
        In Aug 2012 my computer was suddenly taken over by virus that orders you to go to a store and send someone a bunch of money to unlock it. This virus is nasty it throws up detailed large splash screen (with an FBI logo no less!) and totally disables the computer. The trick to regain control is reboot hitting F8 to come up in safe mode. Choose 'Safe mode with networking' as this provides access to the internet.

        I rebooted into safe mode and knowing exactly when it had hit started looking for files with that time stamp to delete. My history has been that manually virus recovery rarely works anymore, viruses are too good at hiding, but I did make some progress and must have knocked out some of its files, because I at least got the computer unlocked and usable, though clearly still sick. I little searching found reference to the virus and a recommendation for Malware Bytes. I was familiar with this program as it is one of several virus programs I had previously, but all were lost in my April 2012 crash and were never replaced. Malware Bytes has cleaned my machine. The only residual problem I have is I myself deleted two files with odd names and the virus time stamp, and now on boot up I get dinged that these two files are missing, which I supposed may mean some residual of the virus is still in my machine and looking for at boot.

Adobe's fault?
        I read that this virus is (pretty much) Adobe's fault in that their update program had a defect that the virus people exploited. I can believe this as just before the virus hit, an Adobe update screen appeared. I later suspected the Adobe screen might have been fake, but it fits with the scenario that this was the vector by which the virus got in.

        Later I found several YouTube videos on the virus. The video of the first link is pretty much of a joke (unviewable with no narration), but in the text the details of virus and recovery are laid out for a manual recovery including registry keys to delete. I did not use this, I used Malware Bytes, so I don't know if it's right, but it look authoritative. I did check several of the registry items you should delete and none found, which is good. Also in one of the comments I guy says he called his ISP after he got hit, and they recommended the program I used (Malware Bytes).

        The 2nd link is a Youtube video that shows recovery using Malware Bytes and clean up with a 2nd free utility CCleaner from Piriform
        http://www.piriform.com/ccleaner/download

http://blog.yoocare.com/computer-locked-by-fbi-moneypak-virus-asking-to-pay-200-fine-to-unlock/
http://www.youtube.com/watch?v=pdUrMr0UqWc

My fake FBI warning screen (Oct 2012)
        On a recent attack I grabbed my tablet computer and photographed my fake FBI warning screen on my locked computer.

        Notice the blank green in the upper right corner labeled 'video recording ON'. I read that if your laptop has a webcam (I have no webcam), the picture from your camera shows up here. Nice touch. Notice also you are instructed to send "200$". Almost no one in USA writes a dollar amount with the dollar sign at the end. And there are odd phrases like "fine of two to five hundred minimal wages", "deprivation of liberty". From all this there is little doubt that whoever wrote this screen is outside the USA and probably not a native english speaker.

Advanced methods (from link below) for fighting FBI Lock virus (Dec 24, 2012)
        -- * If Windows’ Safe mode brings up a black screen, with “safe mode” in the four corners – Move your cursor to the lower left corner, where the Search box is usually visible in Windows Start Menu and it will come up, including the “Run” box. (haven't tried this, but if it works, this is helpful)

        -- * To get to 'System Restore' from 'Safe mode with command prompt'. Type in command line:
                            explorer”                                                 (press Enter)    (do it fast, in only 2-3 sec virus may block typing)
               in explorer navigate to:
                            c:\windows\system32\rstrui.exe                 (press Enter)

        -- * At boot virus is called by a link (or shortcut) often called 'ctfmon.lnk' in Startup folder:
              (Important, the virus file is not 'ctfmon.exe' which is a system file!)
                            c:\users\Windows_7\Appdata\roaming\Microsoft\Windows\Start Menu\programs\Startup
                                            (In my uninfected machine the only file in this folder is 'desktop.ini')

        -- Flash drive option:   (have not tried this, but it is simple if it works. I am however doubtful that a USB file is going to load and run)
                    On another (clean) computer, download Malwarebytes and load the Mbam-Setup.exe (or similar) file onto the flash drive.
                    Remove the flash drive from the clean computer and insert it into the affected machine, proceed to install Malwarebytes
                    using the setup file located on the flash drive.

                    I have put Malwarebytes on a flash drive (more than the .exe was required), so if I remember I might be able to try this
                    out the next time I get attacked. In normal operation Malwarebytes runs OK from USB flash memory. (One problem I see
                    with this method though is that the Malwarebytes database is going to be out of date.)

        -- Remove hard drive and fix it remotely using a 2nd machine
                    A last resort, because a lot of work. The reference I found called for taking out the internal hard drive, moving a jumper
                    to make it a slave drive (IDE only, not SATA), then installing it internally in another machine to work on it, but this is
                    doing it the hard way.

                    Instead just use a drive USB kit (power supply and cables, I bought one for $10) to convert the internal drive to a USB
                    drive, clean it with the good machine, then reinstall.

        --  I read the FBI lock virus is exploiting a vulnerability in Java

These tips from this detailed FBI lock article (Dec 2012)
            Although this reference is very comprehensive with seven different ways of attacking the FBI virus. They do not include my favorite method of doing a time window search using Agent Ransack to find the virus files. Nor do they mention the Ctrl-Alt-Del to Task Manager method to get to explorer in damaged Safe mode with a black screen.

                http://botcrawl.com/how-to-remove-the-fbi-moneypak-ransomware-virus-fake-fbi-malware-removal/
===============================================================================================

        In fighting an infection by nasty 'yield.manager' (and its related family), which repeatedly pops up adds covering web sites, I got further infected by agressive add programs riding on the installers of free (supposedly) anti-malwarere programs. These parasitic programs installed agressive tool bars ('IB Updater' and 'Incredibar'') on several browsers, in my case Chrome and Mozilla Firefox. Somehow in working to delete all this crap, and maybe in fighting the FBI lock virus, two Windows tools essential to fighting viruses got damaged: Windows registry editor tool 'regedit' would not run, and Safe mode screen icons disappeared leaving a black screen.

        After ten days of work, I think I have fixed all (or most) of these problems. The nasty tool bars that attached themselves to Chrome and Mozilla are gone. Regit now runs and works fine. Safe mode icons are back too. It's hard to say the popups are 100% gone, but on favorite sites that had popups every minute, I have seen a popup in several days.

        Of course, it's a given is that all files, directories and registry entries that can be found are deleted. This pretty much handled my last attack, the nasty browser toolbars. The tool bar installer sprayed dozens of entries into the registry. Key word searches of the registry with regedit located the file locations. By hand I hand deleted the files and the dozens of registry entries. The browsers also helped. Mozilla threw up a screen saying the newly side-loaded toolbar was causing instability and asked that it be disabled. It said it could not delete it, because it had been universally loaded. In Chrome I was able to disable the agressive toolbar too. But this approach didn't work with the popup adds, more was needed, and, of course, more was needed too to fix the regedit and Safe mode.

        Here are the key fixes:

               1) Microsoft System File Checker
                            Restored 'Regedit' and 'Safe mode' to their original state. Is 'System File Checker' another
                                  Microsoft hidden gem? (It gets good reviews.)
                2) 'Hosts' file edit ---  (c:\windows\system32\drivers\etc\hosts)
                            A vital part of the yieldmanager virus strategy appears to be that it edits the system 'Hosts' file
                                 (used in translating URL names to URL numbers) such that it redirects to ad sites. The
                                 virus adds a few lines to this text file are hard to find and totally cryptic, so you need
                                 to know what you are looking for. Also Hosts is a hidden, protected system file that is
                                 very difficult to change. Cleaning up the Hosts file appears to have removed the popup
                                 'x' frames.
               3) Browser Site blocking
                            Block sites from from where adds are pulled. This is not a clean fix to popup adds but helps,
                                  because more often than not the popup ad window goes transparent, with just a frame 'x'
                                  remaining.
=============================================================================

      All of a sudden a week ago I started to get lot of really annoying popup adds that cover part of the screen, usually the lower left corner. They all have the same frame with a window close 'x' projecting in upper right. They are not browser specific.  Chrome shows the same popup frame as Opera. They only seem to show up on some sites (reliably on Andrew Sullivan). When one pops up and you close it, a few minutes later another pops up. They are not stopped by my browser popup setting: block 'unwanted' popups, and even setting it to 'block all popups' does not stop them.  In one case, Andrew Sullivan's blog site, a lower left corner window add would repeatably popup with a 7 sec delay after a page reload. A little research shows these annoying popups are associated with 'yield.manager' and sure enough I find my browser has a cookie from 'yield.manager'.

Overview
        It took a lot of work and several false starts, but I finally got rid of annoying popup ads from yield. manager. This attack is known to be a bitch and none of the anti-malware tooks I tried couldn't touch it. Online you are told to fight this infection by deleting ad cookies, but this is a waste of time. Ad cookies are written all the time, deleting them does no good, they're soon back. Other sites say to disable 'javascript', because the popup windows are called by javascript code. Sure enough disabling javascript gets rid of the popups, but it messes up so many sites that it is not a practical fix.

        I did get some partial success in blunting the attack by having my browser block the handful of site from which the adds are pulled. This often, but not always, made the popup window, which is still there(!), transparent. Later I learned the yield.manager virus is known to add redirect lines to the hidden system files called 'hosts', and this I found was the key. After I undid the damge to the 'hosts' file the virus does, I found the popups were completely gone.
------------------------
How to get rid of 'yield.manager' popups
        I finally came up with a clean fix to the popup problem, fix the 'hosts' file. It may not be at the root of the popup attack, but it appears to be a key component. I find fixing the 'hosts' file gets rid of the popups (frame and all). 'Hosts' is a hidden system file at the location below. In the same directory is the file 'hosts.txt', but the file that has been corrupted and needs to be fixed is the file 'hosts' (with no suffix).

                c:\windows\system32\drivers\etc\hosts

How to fix 'hosts' file
        The yield.manager virus adds some (URL redirect) lines to the 'hosts' text file that are easily missed as they are proceeded by hundreds of blank lines. Since 'hosts' is a text file, it can be edited with Notepad. Delete the added lines. This file should have only two active lines and be the same as 'hosts.txt' file.  Now comes the tricky part getting permission to write the new file. The virus makes this difficult, because after modifying the file it has tightened the file permissions.

** This works to rewrite 'hosts' file! (12/6/12)
        The recommended procedure online is often just steps 2) and 3) below, but I (and some others) have found this to be unreliable. What works for me is to first loosen file permissions as shown in step 1).

        1) Change 'hosts' file properties first
               Properties, Security ("Authenticated Users), Edit, Full Control, Apply, then unclick Read-only
        2) Notepad (run as administrator) can now overwrite 'hosts'
        3) May need to save file as "hosts" (with quotes, to prevent '.txt' suffix from being added)

'Temp34.exe' Trojan Lameshield
       Possibly related to the popups (maybe its root source) is a virus file 'Temp34.exe', which Malwarebytes identifies as 'Trojan Lameshield'. I found it on my machine, and it had started running a process called 'temp34.exe *32', which was visible in Task Manager. Fix is delete file and in Task Manager (Ctrl-Alt-Del) kill any process with a similar name it has started running.
------------------------
Detail notes
        From examining the html code I found that the popups are javascript code that loads from the web the frame (http://content.yieldmanager.edgesuite.net) and its contents (http://ad.yieldmanager.com). The Opera browser can disable javascript, and I find this kills the popups, but unfortunately 'javascript disabled' is not a practical setting as it messes up far too many sites, in particular, financial sites I use everyday become unusable.

        I have made some progress against the popups by having Opera block the content from the half dozen or so sites that source the frame and content. At some sites, like Andrew Sullivan, the popup is reduced to nothing by a tiny black 'x', a minor annoyance. In this case the frame must be either missing or transparent, but in a few sites the window remains a pain showing as an opaque white block.  I get the site to block from properties (and html code) of the popups. In Opera they are listed at [Tools, Preferences, Advanced, Content, Blocked Content]. Popups can also be right clicked and from the menu choose Block. This causes the site will be entered into the block content list.

        Try as I may (spending mucho hours over 2-3 days) I have been unable to find the root calling program. I delete cookies, clean out everything, search the registry and a little while later the popups and the same cookies are back. Either something remains on my machine I can't find or some site I commonly use is reinfecting me with these adds.

Blocked sites
        This list of blocked sites that works pretty well.

                    http:/ad.yieldmanager.com/*
                    http:/ad.yieldmanager.net/*
                    http:/yieldmanager.com/*
                    http:/yieldmanager.net/*
                    http:/content.yieldmanager.com/*
                    http:/content.yieldmanager.net/*
                    http://content.yieldmanager.edgesuite.com/*
                    http://content.yieldmanager.edgesuite.net/*
                    http://static.exoclick.com/*
                    http://static.exoclick.net/*
                    http://chitika.com/*
                    http://scripts.chitika.com/*
                    http://scripts.chitika.net/*

                    http://doubleclick.com/*
                    http://doubleclick.net/*
                    http://adbrite.com/*

                    http://ad.doubleclick.net                             (obtained from Sullivan code)

Comments
        -- 'goarticles' (client) is associated with chitika
        --  exoclick site is images for IRC channels
        -- blocking  site 'http://ad.doubleclick.net' (obtained from Sullivan code) is OK, it just blocks several (full width) adds for Slate computer.

Good reference (about yieldmanager popups)
         http://deletemalware.blogspot.com/2010/08/how-to-remove-adyieldmanagercom.html

        "Basically, you need to delete existing ad.yieldmanager.com cookies and then block third-party cookies from yieldmanager.com in your web browser. Here's the official YieldManager's opt-out cookie which stops the ability to keep track your browsing information: http://ad.yieldmanager.com/opt-out

Sullivan site code (with popup)
        The popup is 300 x 200 in size. A search for 300 on the page yields the code below. Note it's being called by 'http://ad.doubleclick.net' (This is Chrome browser with no blocked site, yet curiously I am getting the same transparent popup with 'x'.)

<div id="speedbump1"></div>
<script>
$(function() {
   var url='http://ad.doubleclick.net/adj/5480.iac.thedailybeast/dish;tile=2;sz=300x250;ord=' + (Math.random()*10000000000000000) + '?';

   writeCapture.writeOnGetElementById = true;
   var content = writeCapture.sanitize("<scrip" + "t src='" + url + "'><" + "/scri"  + "pt>");
   $("#speedbump1").html(content);
});
------------------------------
Right click the popup
        By right clicking the popups they seem to be of two types: some images downloaded (with the URL shown by right clicking) and others, even though they look like static images are very different, they have Flash settings. I used my three malware programs, which all came up negative. My good search program found some of the file and source names and I deleted these files and cookies. My general cleaner program also found the same file and source names and I used it to do mass deletions. These would seem to help for a while (maybe a few min to hour), but pretty soon the popups were back.

        Browsers can block sites, so even though far from ideal, one way to battle the download images, which I have seen recommended is to enter the source URL's into the block list. In Opera browser the place to enter URL's to be blocked is below.  (Another way to do it is just right click the popup and chose in the menu 'Block content'.)
 

            Tools, Preferences, Advanced, Content, Blocked Content

Here are the (root) addresses I am currently blocking, all of which were obtained from my popup addresses: (I am going to see if this works)

        http://content.yieldmanager.edgesuite.net
        http:/yieldmanager.net                                           (yieldmanger.net is a cookie)
        http://scripts.chitika.net                                        (http://scripts.chitika.net/static/css/goarticles550x250.css)   ('goarticles' is client)
        http://static.exoclick.com
                 Exoclick say it is an IRC-challen image cache ... "This site only takes links to images from IRC-channels and downloads the image to this cache!" It has an index showing it has thousands of images of all kinds.

Not browser specific
        This is not an Opera problem. The same popups appear on Chrome.

Chrome provides a lot of tools to look at the html code:

             script                                 javascript                                                                    (can javascript be disabled in Opera? yes under Content)
             popup src (source)            http://ad.yieldmanager.com                                          (suspect this is the key manager)
             frame src (source)            http://content.yieldmanager.edgesuite.net/atoms/         (height=250, width=300)
             ????                                  http://dg.specificclick.net

Controlled test of javascript on/off
        I finally came across a reproducible way to bring up a popup. A popup appeared on Sullivan page, so reload page (don't scroll) and popup reappears 7 sec!  Works everytime. Now I am going to disable javascript (under Content) and see what happens. No popup! Reabling javascript. Yes, popups are back and I also see from the reload indicator on the bar that reloading is delayed by 10 or so as the browser goes out to download the damn popup window! Disabling Javascript again. Popups gone!

Kill the popups
        After 24 hours works I have figured out how to fully get rid of (lower left corner)popups. Whether this is a practical fix remains to be seen (it's not). An examination of the popup code shows the script producing the popup add is 'javascript' code. It calls several URL's (starting at http://ad.yieldmanager.com) that set up th frame, its size and ad content. Javascript can be disabled in Java and an on/off test showed at least one popup (in Sullivan) came and went every time. Thus it appears javascript controlled popup adds can be removed by:

                    Disable Javascript            (in Opera: Tools, Preferences, Content, Enable javascript on/off)

        There are javascript option settings too, but the only one I though might work (detect context) didn't work.  I have read online that javascript in not very important and can be turned off. But the 64 dollar question is what else will now not work? Is it practical to leave it disabled?

        BAD NEWS  -- Tiaa-Cref and Vanguard both require Javascript enabled!

Very interesting -- partial fix
        Within minutes of blocking the three site above (and deleting the Opera cookie 'yieldmanager.net') I see something very interesting. The block is a partial fix. On my screen in a fixed location is the lower left corner delete X  (small black circle with an 'x'), but that's all! Apparently the calling program (trojan) is writing the 'x', but the (opaque) screen never loads, so the whole screen remains normal except for a super imposed 'x'. Or maybe Opera let's the 'x' though, so you can click on to see there is blocked content.

Full fix?
       Right clicking the first two floating 'x' I see and then choosing the Block site, up comes a screen tells me the image is blocked. In upper right when I click Details it tells me the image was blocked from 'http://content.yieldmanager.edgesuite.net'. The Opera blocked info window gives me the option to click on the 'blocked image box' to block future images from this source. So I do and it changes from grayed out to not grayed out. (Never worked this way again!) With that change sites formerly ad infected have been totally clean for the last couple of hours. Fingers crossed. Nope, 'x's are back, but still it's progress since no popups.

Simpler way to block sites
        Instead of typeing in the URL of the site to be blocked Opera will do it for you. When a popup comes up, right click popup, choose the 'Block content' from menu, then tell Opera to block content from this site. Opera adds the URL to the block list.

Cookie deletions
        By right clicking popups I assembled a list of half a dozen or so key words. When I checked the Opera (very long) cookie list I found several of of my keyword. I probably should just have deleted all the cookies, but I started out with selective deletions. I found the suspicious cookies in several groups. I deleted all below that were on my list. Since cookies that started with ad. or ads. inherently looks like advertising and two of them I know are associated with my popup eruption, I deleted all the cookies beginning with 'ad'.

               http:/yieldmanager.net
               http://static.exoclick.com
               ads.crackmanager
               ad.yieldmanger.net
               (adxxxxxxxxxxxxx)

        Within an hour of deleting the above cookies and meanwhile only visiting a few trusted news sites I find the cookie 'ad.yieldmanger.net' is back! And not surprisingly the URL of a new popup includes 'yieldmanger.net'. This coolie has four component which are just long random names, but the properties of these can be looked at. When I do I find they have times (to the second), and one is just a few minutes ago when I was reading news. I do a search around the cookie time window to see what files have been written. Find nothing at exactly this time and nothing definitive, however, the two large files AgGIUADxxxxxxx I keep deleting are back. This time I am deleting all Opera's cookies, then I can see more easily when new ones get written.

        Looking at my recent browser history, which seems to include all the redirects that occur, one below standout as suspicious. This is not a site I know nothing about, and when I push into it there is 'ad.yieldmanger'. 'yieldmanager' is the common keyword attached to the popup windows. I read it's not uncommon for trojan sites to pretend to be sypware removal sites.

                        spywareremove.com                                     (www.spywareremove.com is a recent cookie)
                             Remove ad.yieldmanager.com

        Google search not conclusive, but one 2009 report has a poster on Norton saying this site is not legitimate. I went on the site and it's voice pitch certainly sounds like a scam!

        Cookie settings: I had Opera set on Accept cookies, so I changed it to a slighly more narrow, Accept cookies from sites I visit. I temp clicked Ask me before accpting cookies.

        Cookie delete: I can find any Opera tool to delete all cookies, which is strange, or any easy way to do it. Maybe CCleaner can do it. Yup, it tells me I have nearly 400 cookies and it can delete them, so I am doing that along with having it clear Opera history and icons, etc. Sure enough Opera cookies nearly blank except for a few mail site that I manually deleted. So cookies now blank and I am supposed to be asked before any site (I visit) deposits one. Yikes my first click to NYT and it deposits not one, but a whole bunch including one with the words market in it. I am going to have to delete the request, because I can't browse with repeated cookie requests. I will instead enable Delete recent cookies on exit.

        One click to NYT cause 13 cookies to be deposited under several different headings!!!

        Trying a bunch of sites and checking cookies.
        Popups (partially blocked) show up when clicking
                Sun Pornotube     exoclick on popup properties, but I cant find this in its cookie! (It's single cookie just specified lang as English)
               Pornox                same
                AndrewSullivan    yieldmanager

        Yikes, even starting with totally blank cookies, a single click on Andrew Sullivan gives (as before) a partially blocked (yieldmanger) popup. A bunch of cookies show, but nothing suspicious. It doesn't look like cookies are the driver! A registry search for yieldmanager comes up null.

Curious
         Even from a clean Opera (and a reboot) I still get partially blocked popups, but I notice two thing that are curious. It seems that only some sites trigger the popups, one that reliably does in Andrew Sullivan. I have to scroll some for the popup to show. The other curious thing is that on Sullivan the blocked popups are always transparent (only the 'x' shows), but on other sites the blocked popups are white opaque blocks.

Hosts hijack
        I am beginning to suspect strongly that the ad popups are tied in with redirects in a host file. I read the purpose of this text file is to list redirect URL's when incorrect URL's are entered, but this can be hijacked by viruses to do hijacks. Hijack this always reports that it can't open the Host file, which it suggests is at

        c:\windows\system32\drivers\etc\hosts

        HiJack implies that host has 8 very suspect redirects to two URL's with these three names:   www.google-analytics.com, ad-emea.doubleclick.net, www.statcounter.com

               50.31.74.129
             217.23.13.202

        Sure enought when I google on above URL's I find someone else has exactly the same eight entries under a title from malware program "Hosts file hijack", but where is this file? When I look at the host.txt file in the above folder I find it is just comment lines with no body (and same for other hosts. txt files I find).

Host file (good) info
        http://answers.microsoft.com/en-us/windows/forum/windows_xp-system/how-to-fix-corrupted-etchosts-file/828b55b2-352f-43ed-b8a3-a77b25c58d6d

Microsoft says this is a hidden text file, which can be hijacked and when can be user edited (with notepad).

Unhiding
        OK, progress. Even though I routinely have ckecked shows system files, there is another entry in Organize\Folder and Search Options\view\.  This is 'hide protected operating system files (Recommended)', which when I uncheck brings up a file in the above folder just named:

            'Hosts' (not host.txt) in c:\windows\system32\drivers\etc\          folder

        This is the file to edit!  Damn, Notepad shows nothing interesting in 'Hosts' and even though Hosts is 2k vs the host.txt which is 1k, and both files look exactly the same in Notepad (unless there are hidden lines). Try the filename 'localhost', it looks like 'host' might redirect here.

Fixed Hosts
        I hope I have I fixed the 'hosts' file to which the ad trojan had added redirect lines. c:\windows\system32\drivers\etc\hosts (no suffix) has had the offending text lines removed. However, it is labeled as a 'file', whereas the corrupted old hosts (renamed: hosts_old(infected) is labeled a 'system' file.

        I finally stumbled on the redirect lines in the Hosts file, and after a lot of screwing around, figure out how to write a new Host file. The new 'hosts' file has the six redirect lines deleted (50.31.74.129 and  217.23.13.202  both labeled: www.google-analytics.com, ad-emea.doubleclick.net, www.statcounter.com) deleted.

        1) I found the virus guys had hidden the six new ad redirect lines by the simple strategy of putting in hundreds of blank lines between it and the sample text, so it was a long scroll down. The only difference in appearance between the modified host file and host.txt (sample) is scroll bars appear.

        2) In Notepad it was trivial to delete the virus added redirect lines, but I found it impossible to save the new file. Notepad insisted on writing it as 'hosts.txt' rather than 'hosts'. Also could not rename the files. Not sure how I did it, but in Safe mode by various renamings I got the cleaned up txt file renamed 'hosts' and the corrupted txt file renamed 'hosts_old(infected)', however, the system properties are not fixed, with the old file labeled a system file and the new 'hosts' file is just a normal file. Not sure what this will do.

Agressive Adobe Flash install is bringing in ad crap (12/4/12)
       Today got reinfected with more ad sofware crap that again changed (and locked) my 'hosts' file. Running HiJack it tells me it can't open 'hosts' file, and it shows the the redirects added to the file. This time besides the old doubleclick, statcounter and google-analytics there are some new ones like facebook.

        The new hosts file was written at exactly the same time as Adobe Flash install software automatically downloaded and very agressively poppped up a big window over my work asking to be installed. From the size of the Adobe file and its attruibutes it did look like it was probably from Adobe, but I am pretty sure that coming along with it is this agressive advertising crap that changes the 'hosts' file.

How to delete hosts file (update 12/4/12)
        From before I knew what needed to be done, just delete the added redirect lines at the end of the file. And like before I couldn't do it Notepad was unable to overwrite the file. It's read only, and when I try to change the attribute, it tells me I don't have permission. Last time by screwing around with it I was somehow able to rewrite the 'hosts', but didn't really know how I did it. I tried this again and nothing worked.

        I found a web site discussing exactly this problem, and they had the same problem they couldn't change the 'hosts' file. They traced it down to the maleware having changed file owner (group) to "Authenicated Users" making it impossible for anyone, even admistrators to change it. I checked my 'hosts' file and found the same thing, the only one able to change it was "Authenicated Users". This site came up with a low level fix involving some command line system utility called 'CACLS', which I don't understand that allowed them to add 'administrators' to the file's owner list.

* Run Notepad as admistrator to change 'hosts' file
        With some more googling, however, I discovered a much simple way to change the locked read-only 'hosts' file. The trick is to open Notepad as Administrator: right click Accessories, Notepad and select 'Run as administrator'. In Notepad then open 'hosts' at c:\windows\system32\drivers\etc\ and delete the added lines. Notepad opened as administrator I found can now overwrite the corrupted, locked, and read-only 'hosts' file.

*         Hosts is the key file controlling the popups. After a few days with no popups, they were back. I checked with a quick HiJack scan and sure enough a few hours earlier someone had rewritten hosts.

        However, when I tried the above procedure it didn't work! I get an error message on save saying the file is read only.

** This works to rewrite Hosts file! (12/6/12)
    1) Change Hosts properties first
            Properties, Security ("Authenticated Users), Edit, Full Control, Apply, then unclick Read-only
    2) Notepad (run as administrator) can now overwrite 'hosts'
    3) May need to save file as "hosts" (with quotes)

(change properties back to 'read only' advises one poster to keep Microsoft from changing it? I am going to skip this step and see what happens)
---------------------------------
** Temp34.exe virus
        I did a Ctrl-Alt-Del and found a process running called 'temp34.exe *32' with description 'temp34.exe'. Looked suspecious. It's a large executable file downloaded only two days ago.    (c:\windows\temp\temp34.exe     752 Kb)   A google seach turns up 'Spyware Removal' (http://www.spywareremove.com/file/temp34exe-322169/) saying they have 234 reports it is maleware associated with 'Backdoor.Kelihos.F'

        And son of a gun while I am reading about it, the popups come back. I find hosts is again changed just a few hours after I fixed it, and I had been only on mainstream news sites in the meantime.

        Run MalwareBytes Anti-Malware and sure enough it flags temp34.exe as a trojan ('Trojan Lameshield'). And it has a registry value. Program also finds a trojan with a random name c:\users\window_7\wgs.......exe

        "Trojan.Lameshield Virus is nasty Trojan. It creates combine effect of rootkit and adware. Which means you will be bombarded with alot of ads and your browser gets hijacked and redirect to specific page."

        A reference pointed to a tool built into the Windows 7 operating system that I had never heard of: System File Checker (sfc.exe). This program is a real gem and can fix a lot of weird Windows problems. It checks, and its key feature, will automatically replace orrupted Windows 7 system files with clean versions. Yes, Windows 7 has a tool (built-in) to fix its own files! Who knew. Windows was preinstalled on my machine, so for backup purposes there is an archive of (original) Windows files on drive d:\, and this is what the program uses. I read that if your machine has no Window archive on the hard drive, then you need a set of Windows backup disks to run this program, which obviously makes it harder to use.

Safe mode and registry file editor not working
        Prior to running this tool I had lost two vital system functions needed to fight virus attacks: 'regedit.exe' would not run and Safe mode came up with a black screen, no icons. The Windows registry editor (regedit) would not run, no error message, it just ignored any request. Made a copy of it with different name, but it won't run either. I downloaded a free registry cleaner (Free Window Registry Repair). I found it was able to access and change the registry, but even with a lot of cleaning 'regedit.exe' still would not open.

How to run it
        All Programs, Accessories, select Command Prompt, right click it to run it as administrator, then type in dos like window text below

                    sfc /scannow                         (sfc => system file checker)  (note space between sfc and /scannow)

        It takes 10 min to run. If it finds no problems it tells you at the end. In my case it just told me it had repaired some files, but I needed to go to its log (c:\Windows\Logs\CBS\CBS.log) to see what changes it had made. Its log showed it repaired several files including a version of regedit (not actually regedit.exe), but this fixed the problem. Regedit now runs normally!

Safe mode and regedit repaired by sfc.exe
        Not only did System File Checker fix regedit, but it appears to have fixed Safe mode too, my Safe mode icons are back!  For the last week or so since my add infestation and prior to running System File Checker when I went into Safe mode I had no icons, just a black screen with Safe in the four courners and the Build # at the top. It was usable in this corrupted state, but just barely. Ctrl-Alt-Del would bring up Program Manager and under File, Run a new process, you can get to a file browse screen, and from there by knowing the location of MalwareBytes anti-maleware I can run it. Repeated web searches showed a few others had the same problem with Safe mode, and I found the 'Run' work around tip, but no one had any idea as to how fix the Safe mode corruption. I think I stumbled on it.

        On forums I find comments that the utility of tools like file checker can be compromised if the OS is updated with service packs.

More on Microsoft 'System File Checker'
         I have used Windows for decades and had never heard of System File Checker (sfc.exe). One reference called it a staple of IT pros. I did not have to download this program, it is part of Windows 7 Home operating system, yet curiously there is no mention of it in the Windows Control Panel or Help System!

Microsoft explains how to run it
**        "Use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7"
         http://support.microsoft.com/kb/929833#method1

Here is a video on the history of sfc.exe and a demo of how to run it
         http://windows7forums.com/blogs/mike/353-compute-confidence-windows-system-file-integrity-checker.html

-------------------------------------
More virus type annoying software
        Trying to get rid of yield.manager popup I downloaded several new anti-malware programs and even though I was careful this has led to new corruption. One way these new programs get installed is by the installer programs for the 'free' (anti-malware) program you are downloading. If offered I always choose custom installation, and unclick the addon progrms the installers brings along. Another suspect is the supposed anti-malware AdAware I down loaded and a few days later uninstalled. (It was the second most downloaded anti-malware on CNET, after
Malwarebytes, but I don't trust it given its agressive nature, and problems like regedit.exe stopped working just after uninstalling it. (I say one user blame his not working 'regedit' on AdAware)

Softonic
        Another bunch of aggressive annoying downloads have come from Softonic (http://grabit.en.softonic.com). This has not affected my much, but only because the browsers that it attacks I don't use much. On at least two browser (Mozilla, zzzz) it had installed a locking toolbar called:

                        IB Updater toolbar
                       Incredibar toolbar                          http://mystart.incredibar.com
                        MyStart toolbar ?

        Mozilla on its own identified this IB Updater toolbar as nasty, bringing up a set of user feedbacks about it, and offered to block it. Mozilla says it has been universally "side-installed" by a 3rd party. Anti-malware HitmanPro also identified Softronic as trouble. Softronics is thought to download a bunch of troublesome stuff. Google search shows Incredibar toolbar as a virus. According to one poster whenever he opens a new tab Incredibar goes to the web and calls a page to download

AdAware to blame?
       Based on timing and its agressive nature I suspect AdAware (supposedly anti-malware) which I downloaded to fight yieldmanger (useless) my be the cause this. I uninstalled AdAware after a few days as I did not like its aggressive nature, acting more like malware than anti-malware. It was just after I uninstalled it that I found the Windows 7 registry utility (regeit.exe) would no longer run. So I suspect AdAware here too.

        A search for 'Softonic' turned up several entries which I deleted. One was an addon for KMPlayer, my main video player. (I have not seen any change in KMPlayer's operation.)

---------------------------------------
(earlier notes)

Flash cookies
        What I discovered was this file was in a folder (first below) buried about ten layers deep that specified setting ('settings.sol') associated with 'Macromedia\Flash player'. A similiar list of dubious 'flash cookies' is also to be found in the second folder.

        c:\users\window_7\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\
        c:\users\window_7\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\LAD342JP\

        In the first directory I could see from the filenames, some trustworthy like Vanguard, other much less trustworth, that what look like 'Flash cookies' are being deposited. Each directory held only one file named 'settings.sol' I deleted all the directories under 'sys'. And so far my popup flash adds are gone. Later I found in the 2nd folder a similar list of dubious sites most of which in the form of xxxxx.com. I cleaned out this directory too. 100 sites had dropped 'flash cookies' here. A quick test shows a flash video plays OK, and I can see it writes into these directories, so cleaning out these directories looks like a history cleaning.  My popups are still gone. This looks like a fix.

        With hindsight I probably made a mistake. There must be an underlying trojan program downloading the adds. I should have looked at the settings filetime, and used its filetime to try and find the program calling the adds. Wait there is one file still in this directory with dated a couple of hour ago, maybe the last the add popped up. I did a file search around its time window and bingo. I find a very suspecious pair of programs in

          c:\windows\prefetch\AgGIUAD_(long random number)

------------------------------
(This stuff is OK. Ready Boot, Trace, agGIRAD are part of an Microsoft boot speedup that is adaptive. It traces what is usually called, then prefetches it to speed things up. The good news is I suspect deleting this stuff did not cause any real harm.)

        A check of the directory 'c:\windows\prefetch' includes dozens of programs, many written in the last two days, a few of which look OK, but many are difficult to decipher. I suspect they all can be deleted. Even more suspicious I find a (single) subdirectory

        c:\windows\prefetch\ReadyBoot

        ReadyBoot contains only files all named 'Trace' (Trace6, Trace7, etc) installed within the last two days. Talk about suspicious! I am deleting the ReadyBoot subdirectory, and the two 'AgGIUAD' files, but I suspect all the files in c:\windows\prefetch\ can probably go as I don't thing prefetching any file is very important. I also plan to do a registry search for 'AgGIUAD'. It came up empty.
------------------------
CCleaner to the rescue
        I wondered, Does 'CCleaner' clean out the Flash folders folders? The answer is it doesn't by default, but it can! Just click the Adobe Flash Player (under Multimedia). It also has an option to delete 'old prefetch data', so I clicked that too. Looks like CCleaner may be a simple way to clean out Flash popup adds. Next time try it.

Notes on popup add war
        Cleaning efforts get rid of adds for a few hours, but they come back. Sometimes I find the same file fragments as I deleted.

        While something on my machine is calling these popups, I have not been able to find it. Another way to fight these popups that I see recommended is to have your browser block the sites from which the popups come. Obviously this is less desirable than getting at the root, the program calling them, and I see they have several different sources.

        A google search shows 'yieldmanager.net' is a cookie tracker and is associated with popups. Sure enought I find it in the cookie list of my browser Opera.

Reference for getting rid of ad.yieldmanager
       This looks good.
http://www.zomocainc.com/2007/07/13/how-to-remove-adyieldmanagercom-popup-spyware/

New York Times article about FBI lock virus (12/6/12)
        Reports it is hitting US big time with 16 different gangs in Russia doing this. Nearly zero useful info on recover. (No mention of Malwarebytes Anti-Malware) They do say if you pay the crooks rarely unclock your machine. Also they say while your computer is unlocked the crooks can explore it and steal stuff.

http://www.nytimes.com/2012/12/06/technology/ransomware-is-expanding-in-the-united-states.html?ref=todayspaper&_r=0
------------------------------------------------------------------------------------------------
Fake Adobe Installation virus (12/6/12)
        I have confirmed that an Adobe Installation screen (with sliding bar) that agressively pops up is in fact a fake. It has popped up twice this morning. I quickly hit the kill 'x' and it disappears, but don't know what this means. Maleware bytes shows two recent trojan infections both in c:\windows\installer and almost for sure are what is throwing up the Adobe screen

            Rootkit.0Access
            Trojan.Dropper.BCMinor

I have multiple problems with this one
        1) Malwarebytes (in normal Windows mode) can't seem to kill this. It says it quaranteens it, but a few minutes later it is back. Two problems its back. I run Malwarebytes again and same problem.
        2) c:\windows\installer don't show any recent entries, nor can I find a file or directory with the URL Malwarebytes gives
                  (Reason -- date on (1dace891... directory was old which faked me out, but inside it I found two subdirectories 'U' and 'L' with todays date)
  **  3) Can't get into Safe mode. F8 on two tries does not work. This is a big problem. I was going to run Malwarebytes from Safe mode, but I can't get there. I have shut down my cable modem and will run 'System File Checker' to see if it can fix the Safe mode problem.

                (I eventually got to Safe mode, but whether it was hardware power down (holing power button down) or deletion
                    of the fake Adobe Rootkit files I don't know.)

Even though my system was clean a few days ago, it reports that it did indeed find corrupted files and repaired them. Very hard to read the long log file, but searching 'corrupted' it look like this file was corrupted and replaced. Who knows what it does.

            C:\Windows\System32\services.exe

        I was able to locate the two trojans identified by Malwarebytes and found several more files in two different subdirectors ('U' found by Malwarebytes and 'L')that had come in two groups about an hour ago and deleted them all.

                    c:\windows\installer\(1dace891.....

        Without rebooting ran Malwarebytes again, and this time it come up clean. Rebooted by pushing power button and this time F8 brought up Safe mode. Ran Melwalware bytes in Safe mode and again clean. Reconnected to internet rebooted normally and again ran Malwarebytes and still clean. HiJack tells me 'hosts' file OK too, so it looks like fake Adobe Installer, which is really trojans [Rootkit.0Access[ and [Trojan.Dropper.BCMinor], are gone.

Does hardware power (button held down) work better than soft Restart for getting into Safe Mode?
        Two tries with F8 had failed. The second F8 try failed after System File Checker ran and fixed a system file. F8 on 3rd try finally worked either because the fake Adobe installer trojan files had all been deleted or because I had used the hardware button (held down) to shut off.

Tablet camera is a good tool
        I found a real convenience here (since path are so long and file names often long random strings) is to use the camera on my BB tablet computer to photograph outputs from the tools. The later I can pull up the tablet picture and use explorer to go search.

======================================================================================================================

Overview
       After my 3rd Windows crash with the original hard drive in my machine, I decide it is time to change either the machine or the hard drive. While my machine sits 'dead' for a week, I buy a new internal hard drive and figure out how to get Windows cheap (Windows backup disks mailed to me by HP) to put on it. Playing with tools (like Startup repair) on the replacement disks and running System Restore for the 3rd and 4th time, I am amazed when the last run of System Restore (aided by the Startup repair utilities?) actually seems to work.

        True to form System Restore as it is finishing up throws up an error window (saying it didn't change anything!), while under it I can see the system booting and in a few seconds my desktop comes up looking perfectly normal. Given the error message I expected Windows was going to be unstable and would soon crash, but it didn't. It is now a now a day later, I have rebooted several times, run a lot of utilities, and (with one exception) the system seems OK.

        The exception comes from sfc.exe (System File Checker). I ran it soon after the desktop came up, and at that time it reported no errors in Windows files (comparing them with the d:\ partition files). But a day later when I run it again, sfc.exe reports an error it says it can't fix (in Microsoft powershell?) because it says the archive copy is corrupted. I had read that Windows Startup repair run from Windows disk writes a new copy of the system files to the d:\partion, so I tried it, but it didn't fix the problem.

3nd Catastrophic Windows 7 crash (update 12/12/2012)
        3rd Windows 7 disk crash! Time to replace the damn [Seagate Sata 3.5" 750 Gbyte, 7,500 rpm] disk drive. Eight months after my last disk crash (Apr 12) the same thing has happened again. Is this crash caused by (or related to) all the virus attacks I have been fighting for the last three months? Who knows, but I suspect no (well maybe, see below), since it went down about the same as before. I am browsing along, TV tuner working,  and the system is clean of viruses or so all my anti-maleware tools tell me. With no warning the sound shuts off, I see no errors messages on screen (last time a disk write error flashed), but seconds later up the usual Windows 'powering down' graphic appears. I don't let it complete, I hold down the power button to force a power down in five seconds.

        That's it, the system won't boot, as in previous crashed I get just a flashing line cursor upper left. Using function keys at boot I can still get into the HP and Microsoft recovery and diagnostic tools, some them in hires graphics. As before the system passes all the hardware tests, including disk drive tests, but unlike last time I find that this time (joy??) there is a Restore point and it is only two days old, when as far as I know the system was fine. It was created by the system on Sun at 7:00 pm when the weekly Microsoft Windows backup runs. ( I guess Windows hadn't got around to deleting it yet!)

        I am not very hopeful, having long concluded Microsoft has broken System Restore in Windows 7, and sure enough when I run it, it trundles a while, then tells me it has run into some undefined error and can't recover the system. I try in once again with same result. So what else is new?

What to do?
        I have every expectation that if I run the destructive System Recover (as I did after earlier crashes) wiping out all my files and programs, a copy of the OS pulled from the hidden d:\ drive where the preinstalled Windows resides could get my machine up running again pretty quickly. But no way, this disk drive has got to go, it is just not reliable. Normally I would probably just buy a new computer, but there's a problem, potentially a big problem, Microsoft has just come out with Window 8. I don't want to learn a new OS and don't want Window's 8 with its tablet oriented start screen for a desktop machine. I expect if I go to the stores that's all I am going to find. Yup.

Cheap external 'enclosure'
       Pulling an all nighter I find for 5-20 dollars I can buy very simple hardware to run an internal drive externally and plug it into a USB port. The 5-10 dollar option is just the drive lying on the table hooked to cables and a simple +5V, +12V supply. 20 dollars takes the drive off the table and puts it in a simple aluminum or plastic box. I have a lot of stuff on that c:\ drive I would like not to lose, including two days work on my virus essay not backed up. Reading articles and Amazon reviews I find this simple data recovery technique does often work and allow file recovery, so I invest 10 dollar for an 'on the table' cable system.

Proof it can work
       A few days later my brother hired a professional IT guy to help him setup a new computer. He retrieved pictures from a very old dead desktop machine by taking out the internal hard drive and connecting it to some sort of box he had and then via USB into the new machine. Proof, this data recovery technique works and is part of the It guys took kit.

Internal drive to USB drive
       From what I read online converting an hard internal drive to a USB drive is dead simple once you have the right kit or enclosure. With (older) IDE drives there is a jumper on the drive to move (master to slave?), but no physical adjustments are needed with the newer SATA drives. Apply power (+12V and +5V from kit) and the drive spins. Plug the USB cable in, and if the drive has been formatted it will be assigned a drive letter and will be read/writable like any external USB drive.

No Windows 7 computers in stores, but orderable online
       I go to my local Staples which has a pretty large computer dept and has a technical dept that works on computers. They have a couple of dozen computers on display, but only three of these are desktops (2 from HP, which I usually buy), and as I expected, they all have Windows 8 preinstalled. I find online that Microsoft is going to allow retailers to continue to sell Windows 7 machines for two more years. A check of the HP site shows they have several desktops on which you can get order Windows 7 as well as disk size and video card. When I add up what I want (same CPU speed plus upgrades to 1 Tbyte and video card with VGA and HDMI outputs) the price is 450, same as I paid a few years ago. I thought the price would have come down.

How to buy Window 7?
       I don't know anything about buying Windows disks, all my home machines have come from a store with Windows preinstalled (and no disks). I find on Amazon Windows 7 (Home) disks at many different prices, very surprising, and then I stumble across one at about half price (100) and it has 600 reviews! What? I just read a couple of reviews and find it is an OEM version, some people says it installs fine and for others it won't install. Yikes another complication, risk and time burner.

       At Staples one of their computer technicians tells me they use HP recovery disks all time to install Windows OS on brand new drives, and they can order them for me, estimate is 25-35 dollars, but when I go to buy price is 57. I buy them for 57. The paperwork gives the part # shown below. BR347AV is for my specific model # and product #  (from side label on computer) and will install everything to the factory state, meaning [Windows 7 64 bit OS + partion (d:\) with backup copy + bloatware].

                HP part #'s for recovery disk kit for my HP p6510f desktop:                                                  BR347AV
                                     (for model p6510f Windows 7 64 bit (10NASUMW608 + Supp 3)

HP will sell me direct exact same Windows recovery disks for $12!
       Doing a little reading about recovery disks and googling the above part # I find I can buy the exact same recovery set of disks for $12.08 from HP.com. (I also find exact same set of disks for $27 sold by an HP/Compaq archive site.) I buy the 12 dollar set. I think Staples is egregiously overcharging me, so I go to the store and cancel the 57 dollar order (no hassle). The archive site says their recovery kit is exactly the same set of recovery kit as originally available (confirmed by an email), yet the business oriented archive kit has 3 disks whereas the kit sold to home users on hp.com site has 4. Weird. Maybe an extra disk is thrown in for home users, hopefully with detailed instructions.

I make my own recovery disks
       Later after System Restore (perhaps helped by other repair tools) is able to boot the original hard drive, I make a recovery disk. Takes about 5 min to put about 300 Mybtes on a 4.7 Gbyte writable single DVD. I find I am not limited to making one, so I make two for insurance.

        And my recovery disk works! Within 24 hours of making the disk I get hit with a new super nasty variant of the FBI Lock virus that disables Safe mode. I use my new recovery disk to access tools that eventually allows me to recover from the virus.

Cost of Windows for a replacement hard drive
        Here is the incredible range of prices I found you can pay for a set of Windows 7 (new or replacement) disks for a new hard drive. These prices are post the introduction of Windows 8.

                   Baseline Windows 7 (Home Premium, 64 bit)                                 163 (Amazon)
                   System Builder Windows 7 (OEM version)                                        92  (Amazon)
                   HP Windows 7 recovery disks (via Staples)                                        57  (Staples order price)
                   HP Windows 7 recovery disks (from HP archive)                              27  (online)
                   HP Windows 7 recovery disks (from hp.com)                                    12   (online)
                   HP Windows 7 recovery disks (self made from PC)                            0   (just cost of blank CD's and time)

So the plan is...
       So the plan is: Don't reformat the old drive. Buy a new internal hard drive, swap it in for the old drive, set the old drive aside for later offline data recovery, and use the recovery disks bought from HP to reinstall [Windows 7 (64 bit) + drivers + bloatware].

        I later realized that while waiting for the Windows 7 disks to arrive and with my 'dead' hard drive still installed in the Windows 7 machine, I might be able to use a data Backup program I found on the F11 HP recovery screen to recover some of its data. The trick would be figuring out how this program worked. (I did use it, and like with most Microsoft products I found it only half-ass worked. After specifically saying it would back up 'recorded TV shows', which were about 90% of my hard disk space, I found it did not!)

Can I recover without reformatting?
         I see hints online that it might be possible to reinstall Windows on my old hard drive without reformatting it, but a list of recovery options on HP site shows they all reformat the c:\ drive. Any 'minimum' option just will not reformat other hard drive partitions. (long shot, but worth a little more research)

Monitor
        I earlier had the VGA output from the XP fed to the VGA input of my 42" monitor, which was free because I connect my Windows 7 machine to it via HDMI. Since my monitor is an HDTV, it comes with a remote so I can select the video output of either computer.

Keyboard and mouse
       My miniature keyboard came with a PS2 connector, but I had earlier added an adapter to convert it to USB, because my main HP machine uses USB 1 ports (in the rear) for keyboard and mouse. A mouse and keyboard with USB cables are flexible, because they can be plugged into any USB ports and will just work. I freed up the two front USB ports on both my main and backup computers, so now it is easy swap my keyboard and mouse between them.

Figuring out how HP's crude Backup tool works
        On the recovery screen (access with F11 at boot) on of the tools offered is an 'HP Backup' program for personal data. Even though my machine won't boot, the Backup program on its own is able to access the drive and offers to save to a USB external drive (plugged into the machine) or to write the data using the computer's optical drive.

        In the past I have found Backup programs like this to be a waste of time. They may be of use to the IT pro, but for the casual user they are pretty much worthless because they simply don't tell you how they work. They are incredibly unfriendly, and for no good reason. It would be trivial to add one or two help screens, but they don't. So I ran some tests with it.

        I first did a backup of only 'documents' saving to a large capacity external USB drive. It told me the file was about 300 Mbyes, so I went looking for a recent file of that size on the USB drive and found it (see below). This test showed the files in the output of this HP Backup program files cannot be read raw as they can with Windows backup program. The data files are packed (and to some degree compressed), so a recovery program is needed. In the directory with the saved files I found a single .exe file with a very suggestive name: RecoveryMgr.exe. This turned out to be the file recovery program.

How HP (recovery) data Backup works
        This program does only one thing, it doesn't do that very well. It claims to backup "Recorded TV shows", which I have a lot of on my 'dead' drive, but it doesn't!

How HP data Backup and Restore works
        Backup reads many types of data files (not program files like .exe or .dll) off the 'dead' c:\drive. It stores them packed and compressed (document files compressed x2.5, but picture files did not appear to compress at all) in a series of 200 Mbytes files (1.wim, 2.win, etc) on a user selected USB drive or optical drive. The restore program (included as an .exe in the same directory as the backup files) unpacks and uncompresses the files and writes them with their original directory structure to only the c:\ drive as subdirectories under a newly created folder c:\Backup Files (date).

        Note there is absurd restriction here, you can't choose where to recover the files. It just says it is going to write the files to the c:\ drive and your only option is Yes or Cancel. Aside from the choice of backup media the only other option in the program is that you to select the date type to backup and/or restore: pictures, video, documents, captured TV shows, etc.

Issues with HP Backup tool
* Restores only to c:\ drive
        There is no choice as to where to restore, it will only write to a c:\ drive. This is a huge and totally unnecessary restriction. Clearly the authors considered that the purpose of the program was just to capture data from c:\ of old drive and write it back to c:\ in a new (or recovered) drive on the same machine. But I am trying to recover data from my 'dead' hard drive while it is still in the Windows 7 machine. I would like to files to be restored to one of my large capacity backup USB drives, but I can't. There is, however, a work around.

Work around
        If the USB drive with the (Windows 7) backup files is moved from the dead machine to another machine, it will restore the Windows 7 files to the c:\drive of that machine. This is safe as it will not overwrite files in this new machine as all the Windows 7 files go under a newly created folder (c:\System Recovery Files). However, you may need quite a bit of disk space on the c:\ drive, and my backup XP machine hard drive was nearly full. I spent several hours moving lots of stuff off its c:\ drive to free up 100 Gbytes as I expected from my earlier document test that the 24 Gbytes from the full data backup was going to expand to 60 Gbytes. Turns out it hardly expanded at all. To restore the files off the external USB drive to the c:\ drive of my XP machine all I had to do was click 'RecoveryMgr.exe' (recovery program) in the folder with the backup files on the USB drive.

        This is a gross flaw in a user data backup program. The backup program specifically tells you it will backup "captured TV", and then it doesn't! I can only conclude HP is as incompetent at writing backup programs (subcontracted the job to Cyberlink) as Microsoft is. A lot of HP users must be pissed when they find out after their hard disk has been reformatted that HP has lied to them, that it has not backed up their captured TV shows now deleted.

        My TurboTax income file has also not been backed up! (Turbo Tax directory is there, but my personal income tax file is not in it.) Luckily I had manually backed this up at tax time.

* Super unfriendly, hard for non-IT pro to use
        I took a few hours playing with Backup program to figure out how it worked, but why is this necessary. It is absurd that these programs are so unfriendly to the point of being virtually useless unless you are an IT pro. The backup program could easily pop up a screen telling you how the program works, that files are packed and compressed, and how to unpack them, but of course it doesn't!

        I have a full restore in progress as I write. It's been going about 1 hr with multiple files flying back every second, yet it shows "progress 0%". Ah yes, this is one classy program! It took about an hour and a half to write a 24 Gbyte backup file. I was surprised that the disk space on c:\ taken by the restored files was about the same 24 Gbytes.

Windows 7 replacement CDs arrive
         A week after the crash my $12 set of Window's 7 replacement disks arrived from hp.com. The online HP documentation had said it was a set of four CD's, and, of course what arrives is five CD's! Specifically it is a shrink wrapped set of four System Recovery CDs (marked disk 1 of 4, 2 or 4, etc). The fifth CD is marked  "Supplemental Recovery" (disk 1 of 1) and says it is media from Microsoft, Microsoft bloatware. The one page instruction sheet describes how to feed in the disks. It says during the process you may be asked to insert the Supplemental Recovery CD. (I am, and I don't think this can be skipped)

Supplemental Recovery CD
        After using the disks and thinking about it, I now suspect the Supplemental disk carries not bloatware, but updates to the OS. It goes in almost immediately, and it stays in while recovery tools, like Startup Repair, run.

        The computer will power up/down several times during the install process. When the system powers down (and stays down) and CD tray opens the CD install process is complete. The post recovery instructions say go first to Microsoft for OS updates and then to HP for updates. I presume the disk can be used again in the future (no where does it say they can't be used more than once), so save them. However they are not going to put Windows (legally) on any other machine (motherboard) other than the one for which they were ordered.

Startup Repair --- Another Option?
        Googling around in preparation of reinstalling Windows 7 from my recovery disks I came across another possible recovery option. When booting with Windows disks, more tools are available than with the Windows partition on the d:\drive (true, for example a command prompt is an option). One interesting option I read is a reinstall of Windows files without formatting the c:\ drive. (It remains to be seen if this is possible with recovery disks that I am going to use. I find it is. However, after running it, I am not sure it is any different from the Repair Window utility that I had run earlier (and forgotten about) on a recovery screen the night of the crash. It reported failure to fix the problem earlier and it failed again using the disks.)

        Found a site with a ton of information about various ways of installing Windows. In there I find mention that there is a way to install a new copy of Windows files (from disks) without formatting the c:\drive, so personal data and programs are preserved. I don't want this for the long term since after three crashes I don't trust my hard drive, but it would be useful short term to recover more data and look at setting of programs. It's something called a 'Startup Repair'.

Startup Repair
       "Windows repair installation or a 'Startup Repair' is valuable when you need to reinstall important Windows files but keep all of your personal files and programs intact. A repair install can be thought of as a "copy over" of Windows. A Startup Repair is a smarter version of a repair Install. A Startup Repair or repair install is very often a relatively easy fix for many serious Windows operating system problems. Since these Windows repair options don't erase anything from your computer, they are simple ways to restore important Windows files.

        In general, a Startup Repair or repair install of Windows is accomplished by running the original Windows setup process and choosing the correct installation method or diagnostic option."

        The link below is step by step tutorial (with screen shots) of booting Windows 7 from disks. It shows what repair tools are available and how to do a 'Startup Repair. The 'Startup Repair' screen says it will fix Windows (files) automatically and gives assurances that no personal files will be changed.

         http://pcsupport.about.com/od/toolsofthetrade/ss/windows-7-startup-repair.htm        (Startup Repair tutorial)
         http://pcsupport.about.com/od/windows7/ht/system-repair-disc-windows-7.htm        (how to write repair disks ---  5 min)

Giving Startup Repair a try
        My 'dead' hard drive is still in my PC and I just got my disks so I may pop them in and see what happens. With the tutorial above I should be able to know when to stop to preserve my data for offline recovery. Well there are more options when booting with recovery disks, but the options are confusing, you basically need to click everything and look around. I do eventually get to a screen with a few more tools than I had seen before and 'Startup Repair' was there. I ran it and it failed. When I later rebooted without the disk using only function keys, I noticed that the recovery screens I had used the night of the crash had a very similar 'repair windows'. This was the firth tool I had run the night of the crash and it failed. Are these tools the same? Can't be sure, but I suspect they are, so really nothing new here.

        I spend a good hour screwing around with all the tools and paths when booting with the disks. Nothing really works. I can get into a cripple Safe Mode (black screen with Save Mode in corners), but it doesn't help. The Ctrl-Alt-Del interrupt doen't work from there as it did previously. At one point it asks me if I want to Restore. I had tried Restore (twice) the night of the crash and both times it said it did not complete due to some error. Now a week later with recovery disks when it asks if I run Restore again (maybe I ran it twice, don't remember). This time Restore runs longer than before and as it runs its status bar is showing progress, finally saying it is finishing restore.

After like 4th restore it boots!
       Now a strange thing happens. A small window pops up that Restore has not completed, errors, and at the same time in the background I see windows beginning to boot, and up comes my normal Windows desktop. I just close out the Restore error box to get to the desktop, but I suspect it will just crash or not be stable. Surprisingly things seems to work. First thing I plug in one of my large USB drives and I start to copy off the captured TV shows and video. This works OK and after a few hours I have recovered a lot, I probably will need to let it run all night to get everything.

        While the copying is going on I start to run tools. My hopes are on System File Checker. It runs OK and after 15 min or so reports it finding no ("integrity") errors. I don't dare reboot until I have recoved my data, but things are looking up. Has now run OK for a few hours. On line, no problem, videos play no problem. So what happened? It seems like the 3rd or 4th System Restore attempt worked. Previously I had run Startup Repair both from the d:\ partition and from the recovery disks. Both reported failure, but did this help. From what I know of how Restore works I don't see how.
--------------------------------------------------------------------------------------------------------------------------------------

Introduction
       I suffered my 3rd computer crash in two years recently. Wouldn't boot, dead for a week. Bought a new hard drive and Windows 7 disks, but didn't put it in when I managed (using System Restore on 4th try!) to get the old hard drive to boot. I then ran malware tools on it and looked at their logs around the time of the crash, and son of gun if a trojan file didn't load just seconds before the crash. Did a trojan crash my machine and prevent it from rebooting? I think maybe it did.

Did a Trojan cause my computer crash?
        Now a strange twist. I run my anti-Malware utilities and Anti-Malwarebytes reports one suspicious item:

                Trojan.Agent.NIX                    E65B.tmp               124k         @ 22:05:23  (10:05 PM)     12/11/12

        When the computer crashed,  I noted the time on the wall clock: 10:04 pm, Tues 12/11/12. This is almost exactly the time the virus file was written. I do a time search using Agent Ransack, and it shows the last file written to the drive (before a gap of four hours) was written 22:05:54, which is just 31 seconds after the virus/trojan comes in. Since the crash shutdown maybe took 5 -10 seconds before power off, it looks like the computer began to go down about 20 seconds after the virus came in! What are the odds! This is a strong circumstantial case that my computer/hard drive crash was caused by this virus! (However, I suppose it is possible that my power button forced power down in the midst of a virus induced computer crash might have actually cause the boot problem. Who knows?)

        I looked at all the files Agent Ransack found around this time looking for more virus stuff, but found nothing really suspicious. I did see that Malwarebytes had detected E65B.tmp coming in with writes to its log "Allowed" at the exact second it came in. I can find out very little about this virus. I do see it listed in some virus lists, but with no other info. On the negative side, it's a .tmp file, didn't see any .exe files in the time window. A search of the registry for 'E65B.tmp' came up null. So other than the (very strong!) time coincidence, I don't see how a .tmp file (alone) caused the shutdown. (More research turned up very little E65B.tmp or Trojan.Agent.NIX except it might be associated with Dyfuca or Rootkit.TDSS)

New insight on .tmp virus file
        Clearly a weakness in the argument that a virus crashed my computer is that the virus file written seconds before the crash was a .tmp file rather than an .exe file. But a new attack by a more virulent variant of the FBI lock virus has given me new insight on this.

        In the latest FBI attack, where Safe mode was also disabled, a search of a few minute time window (centered at the time of the attack) found only two .tmp virus files (both logged my Malwarebytes), no .exe file at all in the window. Using the Malwarebytes log I was able to find the virus .exe file, but unlike in all previous attacks, the virus .exe file had downloaded minutes earlier (about 20 minutes before lock) and seems to have waited around for the .tmp file(s) to appear, because the lock happened exactly when the .tmp files were written.

Where did E65B.tmp trojan file come from?
        A further and important mystery is where did the file E65B.tmp come from. My memory was I was not browsing when the sound went off and the computer began to suddenly log off. And I found data that confirmed this. I found that I took a screen capture picture (TV shows Cheers) at 22:05:20. This is just three seconds before E65B.tmp trojan file is written.

        Very weird. From the time of the picture this confirms that I was (probably) not browsing at the time this (virus) file is written, so where does it come from. (The weakens the case somewhat the this virus file cased the crash.) I can't be 100% positive I was not browsing as I often switch back and forth, still the picture is just three seconds ahead of the file time.

What to do now?
        After I get my data off, the first step is to see if the machine will reboot. If it doesn't reboot, then really no option, put in the new hard drive. [It does (after a week!) reboot.]

        If it does reboot and say it runs fine for a few days (it has), it's a harder choice. I have a new (blank) hard drive and a set of recovery disks. It's going to be a pain opening the computer (it's on the floor and all those wires!) and installing Windows on it and all my programs, but if I am going to put the new drive in, probably now is the time to do in, since I have read all about it and have recovered a lot of data, though it is scattered all around and it will be many hours putting all the pieces back together again.

        On the other hand in this essay (written pretty much in real time) I have documented the whole process, I have the parts disks, and tools, so if I do decide to continue to use the existing drive, it won't be too difficult to put the new drive in and install Windows on it.