EYES ONLY COMMUNIQUÉ

CIA TECHNICAL HANDBOOK TABLE OF CONTENTS
1. Mission Objectives 2. Level 1 - Pre-Operations (Pre-Op) 3. Check-In 3.1 In-Store Forms 4. Level 2 – Diagnostics 4.1 PC Doctor 4.2 DFT 4 . 3 Vi r u s S c a n 5. Contact Client 6. Repair 6 . 1 M o t h e r b o a r d / P o w e r- r e l a t e d s e r v i c e 6.2 BIOS Errors 6.3 STOP / SU Errors 6.4 Common Operating System Errors 6.5 Windows Registry 6.6 Operating System Service Checklist 6 . 6 . 1 S y s t e m Tu n e - u p a n d O p t i m i z a t i o n 6 . 7 Vi r u s R e m o v a l 6.8 Spyware Removal 6.9 Winsock2 and Dial-Up Networking (DUN) 6.10 Operating System Repair 6.10.1 Soft Install Windows 98/SE/ME 6.10.2 Clean Install 98/SE/ME 6.10.3 Format Installation of Windows 98/SE/ME 6.10.4 Windows 2000/XP Repair Methods 6.11 Common File Extensions for Data Backup 6.12 Generic / Quick Fixes 7. Post-Op 8. Check-Out

BURN OR EAT THIS DOCUMENT AFTER READING

EYES ONLY COMMUNIQUÉ

MISSION OBJECTIVES
• • • • • • • Understand new ways to check in clients and manage their expectations Understand new diagnostic processes and tools Tr o u b l e s h o o t a n d e r a d i c a t e v i r u s e s e f f e c t i v e l y Understand what Adware/Spyware are and how to eradicate them L e a r n n e w, b a s i c , a n d l o w l e v e l t r o u b l e s h o o t i n g p r o c e d u r e s Learn more effective ways of resolving advanced operating system issues, NOT just restoring Resolve advanced Winsock/Dial-up Networking issues

BURN OR EAT THIS DOCUMENT AFTER READING

EYES ONLY COMMUNIQUÉ

2.0 - LEVEL 1 – PRE-OPERATIONS (PRE-OP)
The following are steps that take only a moment andA be performed on every computer before it is checked into tech bench or at the begining of an on-site service call • • • • • • • • R e p l i c a t e c l i e n t ’s i s s u e ( s ) Open the computer case: Check for dust Check for distended capacitors Check for unseated cards and unconnected cables Check fans for proper operation Perform visual software inspection for viruses and spyware Check for rogue processes and startup applications

Check For Dust The following are problems that can and will be caused by dust: • Static Electricity • Heat • Fan malfunction • System board shorts

Ty p i c a l l y, y o u c a n u s e s o m e t y p e o f p r e s s u r e d a i r t a n k ( l i k e t h e o n e u s e d i n M o b i l e I n s t a l l ) t o effectively clean out computers. Because of the chemical residue that may accumulate on the system board, canned air is not recommended for performing this. Get authorization from the client for a System Cleaning before performing this task. Distended Capacitors A D i s t e n d e d C a p a c i t o r i s a n i m m e d i a t e s e r v i c e d i s q u a l i f i e r. W h e n a d i s t e n d e d c a p a c i t o r i s f o u n d , y o u c a n d e e m t h e c o m p u t e r to h a v e a d e f e c t i v e s y s t e m b o a r d . L o o k f o r e i t h e r a b u l g e o n t h e t o p s i d e o f t h e c a p a c i t o r o r a n a c i d - l i k e m a r k o n t h e t o p o r t h e b o t t o m o f t h e c a p a c i t o r.

BURN OR EAT THIS DOCUMENT AFTER READING

i n f o r m c l i e n t t h a t a $ 5 9 diagnostic fee is necessary to perform the diagnostic procedures to determine the problem.0 . perform repairs and s e n d c l i e n t o n t h e i r w a y. in-depth diagnosis must be performed to determine the nature and extent of the problem(s).R. • If computer is not able to be repaired during initial consultation phase.COMPUTER CHECK-IN * P e r f o r m t h e i n i t i a l d i a g n o s i s f o r t h e p r o d u c t b e f o r e c r e a t i n g a S TA R S e r v i c e O r d e r For all computers. should be administered at this time as well. administer the following: Perform the Non-Negotiables • Require the client to sign disclaimer form. These five minutes should be used for “quick fixes” and the initial diagnostic. a n d a t t a c h c o p y o f r e c e i p t t o s i g n e d S TA R Ta g .E. • I f t h e c l i e n t ’s e q u i p m e n t i s n o t c o v e r e d b y a w a r r a n t y o r P S P. All steps of C. inform the client that a full. • I n f o r m c l i e n t o f a n t i c i pa t e d t o t a l c o s t o f s e r v i c e a n d a l s o i n f o r m t h e m t h a t t h e $59 diagnostic fee is non-refundable and does not apply towards the cost of the repairs.A. • Each computer is granted a five minute consultation. E x a m i n a t i o n p o i n t s t o c o n s i d e r. O . • C r e a t e S TA R t a g a t t h i s t i m e w i t h d e t a i l e d n o t e s . S .EYES ONLY COMMUNIQUÉ 3. b u t n o t l i m i t e d t o : • Open case to check for dust • Proper operation of all fans • Unseated cards and cables • Distended capacitors • S p y w a r e a n d o r Vi r u s e s • Low system resources • Amount of memory • Any other applicable examinations that the technician feels necessary BURN OR EAT THIS DOCUMENT AFTER READING . • If product is covered under by a warranty or PSP the $59 diagnostic fee is waived. • Inform client that they will be receiving a phone call with a quote for total cost of repairs within given time frame During the initial consolation phase a thorough examination of both hardware and software pieces should be performed to make a very knowledgeable and accurate rough estimate for total cost of repairs. • If the computer is able to be repaired in less than five minutes. • C o l l e c t $ 5 9 D i a g n o s t i c F e e t h r o u g h P.

H D • P r e -O p c h e c kl i t s Customer feedback information • Debriefing and Recommendations: recommendations of what should/might be done to computer BURN OR EAT THIS DOCUMENT AFTER READING . p h o n e .EYES ONLY COMMUNIQUÉ 3. c o m p u t e r h a b i t s • C l i e n t ’s c o m p u t e r i n f o r m a t i o n : O S v e r s i o n . a d d r es s . C P U .S t o r e Ta c t i c a l A n a l y s i s ( f r o n t ) Data collection points include • C l i e n t ’s p e r s o n a l : n a m e .IN-STORE FORMS I n .1 . R A M .

EYES ONLY COMMUNIQUÉ Ta c t i c a l C a s e R e p o r t • • • • • Te c h n i c i a n ’s n o t e s e c t i o n Te c h n i c i a n w i l l d o c u m e n t A L L w o r k p e r f o r m e d a n d t h e r e s u l t s h e r e This will be shown to the client when they pick their machine up A d d i t i o n a l n o t e s a b o u t t h e c l i e n t ’s c o m p u t e r Payment due BURN OR EAT THIS DOCUMENT AFTER READING .

BURN OR EAT THIS DOCUMENT AFTER READING . stop working on the machine and contact the client for approval. I f p o s s i b l e h a r d d r i v e f a i l u r e i s p r e s e n t . I M M E D I AT E LY S T O P w o r k i n g o n t h e c l i e n t ’s m a c h i n e and contact them with findings/solutions.8 for instructions) D o c u m e n t A L L L e v e l 2 d i a g n o s t i c f in d i n g s . T h e r e a r e a p p r o p r i a t e s e c t i o n s o n t h e “ I n . Once your Level 2 diagnostics are completed.0 .S t o r e Ta c t i c a l A n a l y s i s ” f o r m f o r a l l o f t h e L e v e l 1 a n d L e v e l 2 D i a g n o s t i c t e s t s u n d e r t h e s e c t i o n labeled “System Diagnosis”.EYES ONLY COMMUNIQUÉ 4.LEVEL 2 DIAGNOSTICS • • • • Run Run Run Run PC Doctor DFT virus scan spyware scan (reference section 6.

Once testing is completed the results will be posted to view applicable issues. Once again this will be noted as special instructions before the testing starts.PC-DOCTOR DIAGNOSTICS • • • • • Start the PC into any version of Microsoft® Windows® Close all programs. graphics.1 . The details tab will also drill down into more information about each test. BURN OR EAT THIS DOCUMENT AFTER READING . INCLUDING anti-virus programs Insert the PC-Doctor CD into the CD-ROM Connect Parallel loop back Adaptor (program will not run without it) Select one of the install options from the Options menu • • • • • • • Install Quick Install and Run Create self-booting disk Run PC-Doctor from CD Uninstall Example (running within OS) Select Diagnostics from the menu The program will ask you to select the tests to be run and then prompt you to this screen to confirm (this will also give you any special instructions for each test) • • • Te s t i n g w i l l c o m m e n c e a n d r e c o r d p a r a m e t e r s a n d s t a t u s Note: Some tests (mouse. keyboard) will require interaction.EYES ONLY COMMUNIQUÉ 4.

This message will not appear when running DFT from a floppy Agree to the license agreement Ve r i f y t h a t a l l h a r d d r i v e s a p p e a r Run tests in ‘Advanced’ mode This software package runs only one Hard Drive at a time. If the hard drive tests complete successfully the results screen will display with a green background. 0x75 Defective Hard Disk Drive Component OTHER ERROR CODES ----------------0x00 No Error 0 x 1 0 Te s t a b o r t e d b y u s e r 0x20 Selected drive not present 0 x 2 1 ATA M a s t e r d e v i c e n o t p r e s e n t 0x22 Device protected 0x23 Format Degraded 0x30 Out of Memory 0x31 Wrong Parameter 0x33 Function cannot be executed on this device 0 x 4 0 S y s t e m i n t e r r u p t s t h e c u r r e n t o p e r a t i o n [ s m a r t d r v.EYES ONLY COMMUNIQUÉ 4. Start testing one of the drives. 0 x 7 2 D e v i c e S . the drive is defective and should be replaced. the hard drive has failed a test.2 . c o m / h d d / s u p p o r t / d f t 3 2 _ u s e r g u i d e . A .DFT (Drive Fitness Test) C h o o s e ATA o r S C S I s u p p o r t • • • • If running the test from a CD.Hard Drive Sector Scan . I F a s u b s e q u e n t t e s t f a i l s a g a i n . Proceed to match up the error code from t h e l i s t t h a t c a n b e f o u n d o n p a g e 3 2 o f t h e f o l l o w i n g P D F. A .t e s t f a i l e d [ A n e r r o r w a s d e t e c t e d d u r i n g S . R . t h e d r i v e i s d e f e c t i v e a n d s h o u l d b e replaced. M . p d f REPLACE HD (Usually these codes mean HD replacement is necessary) -----------------------------------------------------------------0x42 Drive temperature problem 0 x 7 0 C o r r u p t S e c t o r [ A g e n e r a l h a r d d i s k p r o b l e m w a s d e t e c t e d . R . I f a subsequent test fails again. choose Abort (A) when a message appears attempting to access the floppy drive for a log file. T.t e s t . E r r o r 0x73 Device damaged by shock 0 x 7 4 S . S e l f . If the background color is red. M o s t o f t h e t i m e w h e n t h i s t e s t f a i l s t h e hard drive needs to be replaced. M . Yo u c a n r u n t h e “ E r a s e D i s k ” u t i l i t y. R . T. Yo u c a n r u n t h e “ E r a s e D i s k ” u t i l i t y o f D F T. T. h t t p : / / w w w. M . e x e c a n c a u s e t h i s e r r o r ] 0x41 Bad Cable 0x43 Pending SCSI request 0 x 4 4 S y s t e m Vi b r a t i o n 0x45 Low System Performance 0x71 Device not ready BURN OR EAT THIS DOCUMENT AFTER READING . s e l f . h g s t . A .

• • • • Boot from MRI or boot disk Go to CD drive and type in the following command: smartdrv Go to C drive (C:\) Precede to delete all temp/temp Internet/restore files Note: If Win ME. perform the following command * It may be easier to remove temp/restore files from within Windows • Go to CD drive and type in the following commands: • The scan will commence BURN OR EAT THIS DOCUMENT AFTER READING .EYES ONLY COMMUNIQUÉ 4.3 .Virus Scan (McAfee Command Line) Windows 95/98/SE/ME F o l l o w t h e s e i n s t r u c t i o n s f o r s c a n ni n g f o r v i r u s e s .

NOTE: If a virus is found. • • T h i s i s a s o f t w a r e i s s u e a n d i t i s n o t c o v e r e d u n d e r a n y w a r r a n t y o r P S P. C l i c k ‘ I g n o r e ’ a n d continue the scan process. first. Then follow these instructions: • • • Open the run command Ty p e ‘ c m d ’ o r ‘ c o m m a n d ’ – C o m m a n d P r o m p t w i l l o p e n Go to CD drive and type in the following commands: • W h e n r u n n i n g a s c a n w i t h i n W i n d o w s N T / 2 k / X P y o u m a y g e t a n e r r o r.3 . contact the client and approve (if not previously approved) the cost for removing a virus.(NTFS) E a c h o f t h e s e o p e r a t i n g s y s t e m s h a v e t h e a b i l i t y t o r u n o n t h e N e w Te c h n o l o g y F i l e S y s t e m s (N T F S ) w h i c h c a n n o t b e a c c e s s e d f r o m a s t a n d a r d b o o t d i s k .EYES ONLY COMMUNIQUÉ 4. Commonly Used Switches: • /adl = all drives local • /all = all files • / r e p o r t c : \ < f i l e n a m e > = c re a t e a r e p o r t f i l e • /append = appends report • /clean = clean • /? = help • scanpm /? = help BURN OR EAT THIS DOCUMENT AFTER READING . Yo u f i r s t n e e d t o b o o t i n t o W i n d o w s Safe Mode. This is also a great time to up-sell the installation of new anti-virus software if n e c e s s a r y.Windows NT / 2000 / XP . This will not damage any files.

EYES ONLY COMMUNIQUÉ 5. If client approves/disapproves part of the service. It is very important that all repairs that are n e c e s s a r y t o b e m a d e a r e n o t e d o n Ta c t i c a l C a s e R e p o r t f o r m s o t h a t t h e p h o n e c a l l a n d approval amount is accurate. I f c l i e n t i s n o t a v a i l a b l e . BURN OR EAT THIS DOCUMENT AFTER READING . but not all o f i t . After making contact with the client and they approve/disapprove the cost. m a k e s u r e t h a t t h e r e a r e n o t e s o n t h e Ta c t i c a l C a s e R e p o r t f o r m t h a t r e f l e c t t h i s . l e a v e a me s s a g e i n f o r m i n g t h e m t h a t t h e y s h o u l d c o n t a c t t h e t e c h bench at the appropriate number and that you are looking for an approval for the estimate. make sure that t h e c o n v e r s a t i o n t i m e .CONTACTING CLIENT After the full diagnostic suite is completed. i f t h e r e a r e a n y p a r t s t h a t c l i e n t n e e d s t o p a y f o r t h i s s h o u l d b e n o t e d o n t h e Ta c t i c a l C a s e Report form. After getting approval perform necessary repairs and continue with service. d a t e a n d a p p r o v a l s / d i s a p p r o v a l s a r e d o c u m e n t e d o n t h e Ta c t i c a l Case Report form. appropriate solutions. and total cost of said solutions. A l s o .0 . It is to your benefit to get the name of person approving/disapproving the repairs if it is not the client. contact client with findings.

Motherboard / Power-Related Service Diagnostics NO T E : P r e .EYES ONLY COMMUNIQUÉ 6. h t m BURN OR EAT THIS DOCUMENT AFTER READING .5. memory and processor • I f t h a t d o e s n ’t w o r k .(DC: +/.O p s h o u l d h a v e a l r e a d y t a k e n p l a c e If the system does not boot: • U s e p o w e r s u p p l y t e s t e r t o v e r i f y t h a t i t i s p u s h i n g o u t p o w e r. i t i s p r o ba b l y a b a d m o t h e r b o a r d If power supply is not functioning: • Tr y a d i f f e r e n t p o w e r s u p p l y • Pull all cards except video card and one stick of RAM • If the computer turns on. use process of elimination to find out which card is preventing the computer from powering on.12) CMOS – (+/-3V) NOTE: Settings will need to be entered in the BIOS afterwards If power supply is functioning: • Check all cables • Pull/Reseat all cards. c o m p u t e r h o p e . • Te s t p o w e r s u p p l y a n d C M O S b a t t e r y w i t h a v o l t m e t e r. • • Power Supply . c o m / b e e p .1 . • Tr y a t e s t s w i t c h o r j u m p m o t h e r b o a r d Lookup Beep Codes if you hear any: R e f e r e n c e : h t t p : / / w w w. +/.

EYES ONLY COMMUNIQUÉ 6.BIOS Errors Keyboard Errors: • Check for stuck keys • Try different keyboard otherwise it is probably a defective port • Try another keyboard type (USB/PS2) Checksum Error: • Reboot system • If it recurs verify settings in BIOS (system clock) • If it recurs pull battery and power cable for 30 seconds • If it recurs replace CMOS battery • If it recurs re-flash CMOS using jumper on motherboard • If it recurs it is a defective motherboard No • • • • • • • • Hard Drive Recognized: Check all cables See if the Hard Drive is even spinning Volt-test the power cable to the hard drive Check IDE settings in the BIOS (Auto) Try different IDE cable and power cable Try other IDE channel (Secondary) Try client’s Hard Drive in test computer Try different Hard Drive in client’s computer BURN OR EAT THIS DOCUMENT AFTER READING .2 .

reference the Microsoft Knowledge Base article Q129971 for detail on why this error is occurring.Setup was unable to display the Nondisclosure Agreement. • Also.com (or Google Groups) using the SU error code to find the fix workaround. Check Google.3 . 0x0000000). search by STOP error number (i. • A r e s i m i l a r t o S U e r r o r s . • At the command prompt. Setup will now close. using the SU error code to find the fix or workaround. SU ERRORS • Usually appear when trying to install a new copy of Windows or when performing a Soft Install of Windows. • This is a common error message seen when performing a soft installation of Windows 9x Operating Systems • Boot to a Command Prompt with proper boot disk. E R R O R S U 0 3 5 0 W I N D O W S 9 x I N S TA L L AT I O N I S S U E • Error SU0350 . A g a i n . r e f e r e n c e t h e M i c r o s o f t K n o w l e d g e B a s e f o r details on why the error is occurring. • Restart the computer and resume installation BURN OR EAT THIS DOCUMENT AFTER READING .com (or Google Groups).STOP Errors / SU Errors STOP ERRORS STOP errors messages are software crashes or hardware malfunctions that cause the operating system to halt normal usage. There is a fix or workaround for all SU errors.e. a l t h o u g h t h e y d o n ’t a l w a y s h a p p e n w h e n i n s t a l l i n g / r e i n s t a l l i n g t h e o p e r a t i n g s y s te m . t x t c :\ w i n d o w s \ h e l p • W h e n y o u a r e p r o m p t e d t o o v e r w r i t e t h e f i l e . type the following line.EYES ONLY COMMUNIQUÉ 6. a n d t h e n p r e s s E N T E R . • When an SU error is encountered. and then press ENTER: • C o p y c : \ w i n d o w s \ l i c e n s e . check Google. • Also. p r e s s Y.

g.4 . at the prompt: If this does not resolve the problem proceed to a “Soft Install” of Windows. command prompt run the commands: * If the admin password is not available or working.COMMON OPERATING SYSTEM ERRORS AND FIXES N o O p e r a t i n g S y s t e m F o u n d / I n v a l i d S y s t e m D i s k / U n m o u n t a b l e _ B o o t _ Vo l u m e Ve r i f y t h e r e i s n o f l o p p y o r C D i s i n t h e d r i v e Run DFT (if not run already) and if DFT passes: * Do NOT run the following if Dynamic Drive Overlay (DDO) is being used [e. boot off a Win2k CD • • C:###BOT_TEXT###gt;chkdsk /r C:###BOT_TEXT###gt;fixboot BURN OR EAT THIS DOCUMENT AFTER READING . GoBack. MaxBLAST] Windows 9X / ME • Boot off of a boot disk.EYES ONLY COMMUNIQUÉ 6. Windows XP • • B o o t o f f t h e c l i e n t ’s O R I G I N A L W i n d o w s X P C D Run the recovery console.

click Export. The value in this string should only beor files. e x e a n d i s i n c l u d e d w i t h W i n d o w s f o r t h e p u r p o s e o f v i e w i n g a n d e d i t i n g t h e R e g i s t r y. t o r e s t o r e t h e k e y t o i t s o r i g i n a l s t a t e . E N U M E R AT O R K E Y The Enumerator key contains subkeys for the specific hardware components your computer uses. Yo u m a y n o w m o d i f y o r d e l e t e t h e ex p o r t e d k e y.5 .e. s e l e c t a l o c a t i o n w h e r e y o u w a n t t o s a v e t h e R e g i s t r a t i o n E n t r i e s ( .EYES ONLY COMMUNIQUÉ 6. WA R N I N G N O T E : I t i s p o s s i b l e t o p e r m a n e n t l y c o r r u p t W i n d o w s b y c h a n g i n g t h e R e g i s t r y. r e g ) . a p p l i c a t i o n s a n d h a r d w a r e d e v i c e s . BURN OR EAT THIS DOCUMENT AFTER READING . I t ’s c a l l e d R e g e d i t . a n d t h e n c l i c k S a v e . y o u v i r t u a l l y e l i m i n a t e t h e p o s s i b i l i t y o f d i s a s t e r. I f y o u f i n d t h i s w a s n o t h e l p f u l o r a p a r t o f Windows has become unstable. B y b a c k i n g u p b e f o r e m o d i f i c a t i o n . Windows Service Packs and/or Internet Explorer Updates). EXPORTING REGISTRY KEYS (BACKUP) Find and highlight the key you want to modify or delete. M a n y r e g i s t r y p r o b l e m s c a n b e r e m e d i e d by soft installing the operating system or installing certain updates (i. in t h e F i l e n a m e b o x . In t h e S a v e i n b o x .WINDOWS REGISTRY The Windows Registry is a central hierarchical database used to store information necessary to c o n f i g u r e t h e s y s t e m f o r o n e o r m o r e u s e r s . A n y c h a n g e s y o u m a k e s h o u l d b e d on e w i t h c a u t i o n . Removing individual keys will completely remove the device from the operating system. Windows 9X / ME • Location = HKEY_LOCAL_MACHINE\Enum Windows 2000 / XP • Location = HKEY_LOCAL_MACHINE\System\ControlSet001\Enum Choose next level down = type of device Right click on the device you would like to modify and click permissions Select Allow Full Control Export (Backup) the Key and Modify as needed RUN KEYS P r o g r am s i n t h e R u n k e y s s t a r t a u t o m a t i c a l l y e a c h t i m e t h a t a u s e r l o g s o n t o t h e O S Locations: • H K E Y _ C U R R E N T _ U S E R \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t Ve r s i o n \ R u n • H K E Y _ L O C A L _ M A C H I N E \ S O F T WA R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t Ve r s i o n \ R u n Programs that should not be starting up with Windows can be deleted. T h e R e g i s t r y i s e d i t e d w i t h a t o o l f o u n d i n y o u r W i n d o w s f o l d e r. “%1” %* -clear out additional words. EXEFile KEY Location: • HKEY_CLASSES_ROOT\exefile\shell\open\command A virus may corrupt this key resulting in EXE files being opened by the virus. On the File menu. simply Double Click the exported Registration Entry (.reg) a n d s e l e c t “ Ye s ” w h e n p r o m p t e d . t y p e a f i l e n a m e . T h a t t o o l i s t h e R e g i s t r y E d i t o r. characters.

EYES ONLY COMMUNIQUÉ 6.6 .OPERATING SYSTEM SERVICE CHECKLIST NOTE: Assume that Pre-Op has been preformed • • • • • • • • • • • • • • • • • A t t e m p t b o o t t o n o r m a l W i n d ow s R e p l i c a t e c l i e n t ’s i s s u e If cannot boot to normal Windows.bat and config.U p p o r t i o n o f t h e S y s t e m Tu n e .sys in Windows 9x Operating Systems Remove startup programs that are unnecessary for the function of the OS or peripherals. boot to Safe Mode Check Device Manger for redundant. (Always leave Antivirus and Software Firewalls enabled) Reboot system and enter Normal mode Reinstall any drivers for removed devices D e l e t e a l l Te m p f i l e s a n d Te m p o r a r y I n t e r n e t F i l e s S e e S y s t e m Tu n e . (Windows 9x/ME only) Remove all redundant devices (ALL entries must be removed for the device) (Windows 9x/ME only) Remove all conflicted devices and unknown/uninstalled devices Check startup configuration with MSCONFIG Uncheck autoexec. conflicted or unknown/uninstalled devices.U p a n d O p t i m i z a t i o n f o r e x a c t d e t a i l s Run Windows Update Install OS service packs and Internet Explorer updates Install all Critical Updates and selected other Updates Install DirectX updates Proceed to Post-Op procedures BURN OR EAT THIS DOCUMENT AFTER READING .

d a t ’s ( s p e c i fi c a l l y i n d e x . u s e I E ’s “ D e l e t e C o o k i e s ” .u p • Clean ALL of the temporary files on ALL accounts o M a k e s u r e t h a t y o u r e b o ot t h e m a c h i n e o n c e i n t o N o r m a l M o d e (in case temp files remain that need to be executed) o Common temp file locations: C : \ D o c u m e n t s a n d S e t t i n g s \ % u s e r % \ L o c a l S e t t i n g s \ Te m p C : \ D o c u m e n t s a n d S e t t i n g s \ % u s e r % \ L o c a l S e t t i n g s \ Te m p o r a r y I n t e r n e t F i l e s C:\Documents and Settings\%user%\Local Settings\History C:\Documents and Settings\%user%\Cookies C : \ W i n d o w s \ Te m p C : \ W i n d o w s \ Te m p o r a r y I n t e r n e t F i l e s C:\Windows\Cookies Any c:\temp dir E v e n t h o u g h C o o k i e s / T I F / H i s t o r y w e r e c l e a n e d . d a t ) l o c a t e d w i t h i n t h e s e f o l d e r s m a y n o t b e able to be deleted using conventional deletion methods BURN OR EAT THIS DOCUMENT AFTER READING .SYSTEM TUNE-UP AND OPTIMIZATION * This is a procedure that should be applied to ALL machines ( m i n u s m a c h i n e s t h a t h a v e h a r d w ar e o r o t h e r i s s u e s t h a t p r e v e n t b a s i c O S f u n c t i o n a l i t y ) *This procedure will be applied in conjunction with other services – it may end up being applied at different stages within said services Tu n e .6.EYES ONLY COMMUNIQUÉ 6. a n d “Clear History” options too. R e m e m b e r t h a t s o m e .1 . “ D e l e t e F i l e s ” .

7 . u s e t h e F i x U t i l i t y. a virus software may quarantine required operating system files.com/ Local • BartPE (where available) BURN OR EAT THIS DOCUMENT AFTER READING . P l e a s e a l s o n o t e t h a t t h i s m e t h o d takes more manual Agent time as opposed to typing commands and letting the software take care of the rest. Scanning and eradicating with NTFS • Safe Mode with networking required for online scan/eradication Online • House Call at http://housecall. u s e th e S y m a n t e c F i x U t i l i t y. D o n o t p e r f o r m t h i s o p e r a t i o n w h e n r e m o v i n g t h e K L E Z v i r u s .EYES ONLY COMMUNIQUÉ 6. Then run a manual scan of the secondary drive to remove viruses. Add the </clean> and </append> switches to the command line.3.txt NOTE: If the virus has an official clean tool (Symantec Fix Utility) DO NOT attempt to clean u s i n g t h i s c o m m a n d l i n e m e t h o d .trendmicro.txt log file Example of new command: • scanpm /adl /all /clean /append /report c:\virus. Do note that using this method. s y m a n t e c .VIRUS REMOVAL NOTE: For scanning instructions please reference section 4. This will clean the viruses and append your virus. Yo u m a y t h e n r u n a c o m m a n d l i n e v i r u s s c a n t o b e s u r e t h e v i r u s w a s e r a d ic a t e d . c o m Secondary Drive: • A hard drive may also be mounted as a secondary drive in a system that has an active virus scanning software. This would require a repair or Soft Install of the operating s y s t e m b e f o r e t h e c o m p u t e r w i l l f u n c t i o n p r o p e r l y. \ Vi r u s R e m o v a l To o l s • If tool is not available/out-dated for specific virus you may download Symantec removal t o o l s a t h t t p : / / w w w. V I R U S E R A D I C AT I O N A LT E R N AT I V E S U s e f i x / r e m o v a l t o o l s l o c a t e d o n M R I \ .

Remember to enable afterwards.EYES ONLY COMMUNIQUÉ VIRUS RESEARCH S e e M c A f e e ’s Vi r u s I n f o r m a t i o n L i s t w e b s i t e f o r a d v a n c e d m a n u a l v i r u s r e m o v a l i n s t r u c t i o n s .mcafee. c o m NOTE: In Windows ME and Windows XP remember to disable the Restore function to prevent the Restore directory from re-infecting the system. If a c l i e n t d o e s n o t w a n t v i r u s e s r e m o v e d f r o m t h e i r s y s t e m y o u M U S T m a k e a n o t a t i o n o f this denial of service in the service order notes. if the client does not want us to install new virus software. v i r u s l i s t . c o m h t t p : / / w w w. Notate this in the service order as well. Also. s y m a n t e c . note that we do not cover virus re-infection if the computer leaves the store without proper virus protection. BURN OR EAT THIS DOCUMENT AFTER READING .com Other excellent virus information websites: h t t p : / / w w w. http://vil.

DO NOT remove adware/spyware applications via Add/ Remove Programs right now • In Windows XP/ME – Disable the System Restore function SPYBOT SEARCH & DESTROY • Install SpyBot-S&D with all of the default settings selected.o u t t h a t t h e r e ’s s p y w a r e . s a f e r. e x e • CMESys. • When SpyBot-S&D finishes. If Internet is available.u p a n d Optimization for exact details).exe C e r t a i n a p p l i c a t i o n s ( e .exe • A S T.exe • Save. go to Settings -> Settings -> then enable “Show expert buttons in results list” (option is at the bottom). • SpyBot S&D will automatically restart.S e a r c h & D e s t r o y \ > ) . • If you’re not in the main scan page. m a n y w a y s o f r e m o v i n g a d w a r e / s p y w a r e. If “Select all items” is not available. then return to SpyBot-S&D tab and continue cleaning. K a Z a A . D o n ’t f o r g e t t o c h a n g e t h e p a t h o f i n s t a l l a t i o n f o r t h e u p d a t e s ( U s u a l l y < C : \ P r o g ra m F i l e s \ S p y B o t . This is normal so just let it finish • While SpyBot is running. it will BURN OR EAT THIS DOCUMENT AFTER READING .u p a n d O p t i m i z a t i o n f o r e x a c t d e t a i l s ) .8 . I f n o t (or no CD-ROM support). apply web updates via S p y B o t S & D .ADWARE/SPYWARE REMOVAL T h i s p r o c e d u r e i s t o b e u s e d a s a g u i d e f o r r e m o v i n g a d w a r e / s p y w a r e . install/update via Normal Mode. and then “Check for problems”.u p s • Homepage hijackings Some keys signs to look for: • KaZaA • To o l b a r s w i t h i n I n t e r n e t E x p l o r e r • Machine is extremely slow to boot Common running processes • Hbinst.exe • Msbb. “Select all items” and “Fix selected problems”. Depending on infestation level. get there. perform a system optimization (see Optimization portion of S y s t e m Tu n e . b u t t h i s i s a p r o v e n w a y o f e r a d i c a t i n g a l a r g e p e r c e n t a g e of most adware/spyware applications. c2. If the client requests that ANY adware/spyware application.lop). “Network fixes” may need to be applied. S o m e o f t h e s e could be but are not limited to: • Internet slow • To n s o f p o p . • A p p l y a l l u p d a t e s m a n u a l l y f r o m M R I .u p p o r t i o n o f S y s t e m Tu n e . file. • Launch “SpyBot-S&D (advanced mode)”. Record how many instances of spyware were found for your notes.g.n e t w o r k i n g . g . • D e l e t e A L L t e m p f i l e s o n A L L a c c o u n t s ( s e e Tu n e . T h e r e a r e m a n y. • Yo u M U S T i n f o r m t h e c l i e n t o f t h i s b e f o r e p r o c e e d i n g Boot into Safe Mode [with networking if applicable] • M o s t s p y w a r e r e m o v a l a p p l i c at i o n s c a n b e i n s t a l l e d a n d u p d a t e d w i t h i n S a f e M o d e . then return to Safe Mode for cleaning. M a n u a l u p d a t e s a r e a l s o a v a i l a b l e a t h t t p : / / w w w. • The scan will take a few minutes or could even “freeze” for some time (e. W i l d Ta n g e n t ) w i l l p r o b a b l y n o t w o r k a f t e r y o u clean the machine. o r g Yo u m a y h a v e t o c h a n g e t h e m i r r o r s i t e a s D D o S a t t a c k s a r e f r e q u e n t . etc be left on the machine our service cannot and will not carry a warranty Boot the machine once into Normal Mode [in case temp files remain that need to be executed] C l i e n t m a y p r o v i d e v i t a l i n f o r m a t i o n t h a t t e l l s y o u f l a t . We a t h e r B u g .EYES ONLY COMMUNIQUÉ 6.

( S p y B o t / A d . C o n t i n u e c l e a n i n g w i t h A d . \ S p y w a r e \ M i s c R e m o v a l To o l s . Not only for cleaning. H o w e v e r. a p p l y w e b u p d a t e s v i a A d . This is normal so just let it finish. • W h e n A d . During the fixing of problems the application may appear to freeze. etc). C o o l W W W S e a r c h . A D D I T I O N A L R E M O VA L T O O L S T h e r e a r e a f e w a d d i t i o n a l a d w a r e / s p y w a r e r e m o v a l t o o l s t h a t w i l l c o m e i n h a n d y.a w a r e 6 > . B e f o r e y o u u s e a n y o f th e s e t o o l s . Usually it will be able to fix most problems on the first attempt. • After updates are applied. VX2. B e t t e r I n t e r n e t . cancel this.g. This is normal so just let it finish Usually SpyBot will be able to fix most problems on the first attempt I f i t a s k s t o b e r u n a t n e x t s t a r t u p . p l e a s e r e a d t h e d o c u m e n t a t i o n f o r e a c h a p p l i c a t i o n . then “OK”. During the quarantine process the application may appear to freeze.AWA R E • I n s t a l l A d .Aw a r e s o m e t i m e s c a n ’t re m o v e d a l l o f t h e p a r t s o f t h i s h i j a c k – t h i s d o e s ) BURN OR EAT THIS DOCUMENT AFTER READING . Extract the . click “Next”. Other problems can actually be removed o n a s e c o n d s c a n w i t h o u t a r e bo o t . T h e y c a n b e l o c a t e d o n t h e M R I C D i n t h e f o l d e r : \ . i .Aw a r e f i n i s h e s . l a v a s o f t u s a . BetterInternet. variants of i-lookup.zip – usually <C:\Program Files\ L a v a s o f t \ A d .Aw a r e . • If it asks to be run at next startup. but as a prevention tool – so attach it! Once both above programs show the machine being “clean” move onto a deeper cleaning. VX2. “ S e l e c t a l l o b j e c t s ” ( r i g h t . S o m e p r o b l e m s c a n N O T b e r e m o v e d b y A d . Click “Start”.These will have to be “skipped” at this point and cleaned with other tools A D .Aw a r e . b e c a r e f u l n o t to “cross-clean” infections found by both applications otherwise you’ll be chasing a nonexisting infection • L a u n c h A d . O t h e r p r o b l e m s c a n a c t u a l l y b e r e m o v e d o n a s e c o n d s c a n w i t ho u t a r e b o o t .Aw a r e w i t h a l l o f t h e d e f a u l t s e t t i n g s s e l e c t e d • Apply all updates manually from MRI. g .S & D t o s a v e t i m e .Aw a r e u n t i l t h e m a c h i n e i s “ c l e a n ” p e r i t s f i n d i n g s . CWShredder U t i l i t y s p e c i f i c a l l y d e s i g n e d t o r e m o v e C o o l W W W S e a r c h . M i s c e l l a n e o u s e n t r i e s l i k e V X 2 . variants of i-lookup. This is normal so just let it finish.EYES ONLY COMMUNIQUÉ • • automatically notify you of this. I f I n t e r n e t i s a v a i l a b l e . These will have to be “skipped” at this point and cleaned with other tools D e p e n d i n g o n t h e l e v e l o f i n f e s t a t i on . Yo u c a n a c t u a l l y s t a r t t h e i n s t a l l a t i o n a n d s c a n n i n g w i t h t h i s a p p l i c a t i o n d u r i n g t h e l a t t e r s t a g e s o f S p y B o t . l oo k 2 m e .BetterInternet. M a n u a l u p d a t e s a r e a l s o a v a i l a b l e a t ht t p : / / w w w. n e t w a s i n s t a l l e d a s e c o n d s c a n i s n e c e s s a r y. R e b o o t i n t o S a f e M o d e a n d s c a n a g a i n .Aw a r e ( e . simply click “OK”. c o m / s u p p o r t / d o w n l o a d / . The scan will take a few minutes or could even “freeze” for some time at various locations.l o o k u p m a y s t i l l e x i s t a n d p o s s i b l y c a n n o t b e cleaned by either program. c a n c e l t h i s . This “ C l e a n ” m a y m e a n t h a t 9 9 % o f t h e in f e s t a t i o n w a s c l e a n e d . Be sure to select “Customize” and enable the following: • “Scan within archives” • “Scan my IE Favorites for banned URLs” • “Scan my Hosts files” – then click “Proceed” • Record how many instances of spyware were found for your notes. Continue cleaning with SpyBot-S&D until the machine is “clean” per its findings Some problems can NOT be removed by SpyBot-S&D (e. etc). o t h e r s p y w a r e r e m o v a l a p p l i c a t i o n s m a y n e e d t o b e used • SpySweeper is a great tool. I f N e w.c l i c k i n r e s u l t s t o g e t t h i s o p t i o n ) .

Aw a r e t o run. n o t e p a d . Yo u M U S T i n f o r m t h e c l i e n t t h a t t h i s will be deleted BEFORE you run this utility If client wishes for KaZaA or content downloaded via KaZaA to remain on the machine.Smartsearch. 0 S P 5 R u n Ti m e F i l e s ” . L o c a t e d o n t h e M R I \ . a p p l y “ Vi s u a l B a s i c 6 . usually winsock2 related KillMsg118 U t i l i t y d e s i g n t o c u r e m s g 1 1 8 . m s c o n f i g . I f C W S w a s o n t h e m a c h i n e a n d i t i n f e c t e d a n y o f t h e f o l l o w i n g . D o c u m e n t t h i s i n y o u r n o t e s . w a s n o t f o u n d ” a p p e a r s . If the machine has a n y o f t h e b e l o w v a r i a n t s . backups of files you delete will NOT be made. e x e . r e g D i s a b l e . Most major adware/spyware web sites will be inaccessible.C o u n t e r.c o u n t e r.U n d o S h o w Ve r b o s e S e c u r i t y S t a t u s M e s s a g e s . e x e .4 BURN OR EAT THIS DOCUMENT AFTER READING . and then shutdown.S h o w Ve r b o s e S e c u r i t y S t a t u s M e s s a g e s . M S V B V M 6 0 . e x e . t h i s r e m o v a l m u s t b e r u n F I R S T t o a l l o w S p y B o t a n d A d . \ W i n d o w s To o l s \ R e g i s t r y E n t r i e s E n a b l e . copy the application to the desktop if needed. e x e ’s l o c a t e d o n t h e M R I \ .SmartKiller (v1. r e g BHODemon Breaks down Browser Helper Objects (BHO) for further troubleshooting CoolWWWSearch. d l l (Z e s t y F i n d ) i s s u e s • Good to use this “just in case” ZestyFind is on the machine Hard to tell if this hijacker is actually on the machine until it redirects you • Depending on the level of infestation. r u n d l l 3 2 . CWS.Smartsearch. t h e s p e c i f i c .v2) MiniRemoval U t i l i t y s p e c i f i c a l l y d e s i g n e d t o r e m o v e v a r i a n t s o f C o o l W W W S e a r c h .3. r u n t h e f o l l o w i n g r e g i s t r y e n t r y t o s h o w t h e f i l e t h a t i s p o s s i b l y causing this • L o c a t e d o n M R I \ . and CWS. e x e ’s will have to be replaced: w m p l a y e r. Yo u w i l l k n o w t h a t t h e machine has this variant as most major adware/spyware removal tools will start.Msconfig This does not matter. • FixMsg117 U t i l i t y d e s i g n t o c u r e m s g 1 1 7 . • Va r i a n t 2 6 : C W S . System Configuration Utility will not prompt on next reboot Hijackthis Utility that assists in detecting and removing various hijacking entries WA R N I N G – R e a d A L L d o c u m e n t a t i o n a b o u t t h i s a p p l i c a t i o n b e f o r e u s i n g i t If run from a CD.Smartsearch. C W S h r e d d e r w i l l s a y t h a t i t found the CWS. d l l is s u e s • If the machine is “locking”/pausing for a long time a on the “Loading your personal s e t t i n g s … ” d i s p l a y. S m a r t s e a r c h . D L L . \ S p y w a r e \ C W S h r e d d e r \ A d d i t i o n a l C W S f i x e s I f y o u t w e a k m s c o n f i g a n d h av e n o t r e b o o t e d t h e m a c h i n e . e x e R e p l a c e m e n t .EYES ONLY COMMUNIQUÉ • • • I f t h e e r r o r “ ‘ A r e q u i r e d d l l . \ W i n d o w s To o l s .a c t i o n s • CWS. other fixes may need to be applied It will notify you of this. c o n t r o l .2. o u r s e r v i c e c a n n o t a n d w i l l n o t c a r r y a w a r r a n t y. KaZaABegone Utility designed to fully removed KaZaA and all of its remnants • G o o d t o r u n t h i s e v e n i f K a Z aA w a s n e v e r i n s t a l l e d a s i t f i n d s o t h e r s p y w a r e applications associated with KaZaA WA R N I N G – T h i s u t i l i t y w i l l d e l e t e t h e “ M y S h a r e d F o l d e r ” f o l d e r t h a t c o n t a i n s t h e c l i e n t ’s d a t a t h a t w a s d o w n l o a d e d v i a K a Z a A .

ActiveX. t h e m a c h i n e i s p r o b a b l y t e c h n i c a l l y “ c l e a n ” o D o y o u w a n t y o u r c l i e n t s t o s ee t h e m e s s l e f t b e h i n d – n o ! o This could freak them out and cause a “recall” on you – fix it the first time! • o o Clean the Favorites folders C:\Documents and Settings\%user%\Favorites C:\Windows\Favorites Do NOT delete all favorites – look for unusual entries • Adult Links • Gambling • Casino When these are created there are usually a few main folders and they all have the same modified date Sometimes the Favorites are so infected you have to remove all of them. R e m o v e a l l s p y w a r e / a d w a r e e n t r i e s f r o m t h e A d d / R e m o v e P r o g r a m s L i s t. or other similar technologies are good for testing. Manual Cleaning After you “clean” the machine using all of the applicable applications. H i j a c k t h i s . It is also helpful to visit sites that use: Flash.com/sts • h t t p : / / w i n d o w s u p d a t e . more effective than g o i n g t h r o u g h h u n d r e d s o f s h o r t c u t s . A d . manually remove it • O p e n R e g i s t r y E d i t o r t o t h e f o ll o w i n g k e y : [ H K E Y _ L O C A L _ M A C H I N E \ S O F T WA R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t Ve r s i o n \ U n i n s t a l l ] This key is where the Add/Remove Program list is store.geeksquad. For the hexadecimal entries you’ll have to look in the right pane for the name corresponding to the entry in the Add/Remove Programs list that you want to remove. c o m • http://mail. c o m BURN OR EAT THIS DOCUMENT AFTER READING . SSL. K a Z a A B e g o n e . After the Add/Remove Programs List is clean. there will still be miscellaneous files/folders/icons that exist on the machine that are related to adware/ spyware • A f t e r t h e m a i n [ S p y B o t . c o m • h t t p : / / w w w. g o o g l e . Ta l k t o y o u r c l i e n t i f t h i s h a p p e n s . If you recognize any installer that is used to install adware/spyware [most are in the root directory].EYES ONLY COMMUNIQUÉ If you have multiple user accounts on the machine you must clean all accounts using the instructions above. e t c ] a p p l i c a t i o ns a r e r u n . m i c r o s of t . I f i t c a n ’t b e removed. Be sure to only delete files/folders that you know are related to adware/spyware. • h t t p : / / w w w. • O n l y d e l e t e e x e c u t a b l e s t h a t yo u k n o w a r e a d w a r e / s p y w a r e Clean [C:\WINDOWS\Downloaded Program Files] – may have already been done with Hijackthis • D o n ’t f o r g e t t o r e m i n d t h e c l i e n t t h a t t h e y ’ l l w i l l h a v e t o d o w n l o a d F l a s h [ o r o t h e r similar] plug-ins if you deleted them Delete the miscellaneous spyware/adware icons/shortcuts on the desktop and start menus A f t e r A L L o f t h i s y o u h a v e f i n a l l y c l e a n e d t h e m a c h i n e s o n o w i t ’s t i m e f o r t e s t i n g . Some of the entries are plainly label and others are going to be in hexadecimal. delete them. reboot into Normal Mode Clean the [C:\Program Files] folder by removing the miscellaneous spyware/adware files/ folders. This will help prevent callbacks and recalls. c o m c a s t . (Re)Boot into Normal Mode and test Internet Explorer by visiting commonly used sites.Aw a r e ] a n d m i s c e l l a n e o u s [ C W S h r e d d e r.

EYES ONLY COMMUNIQUÉ If y o u c a n ’t g e t t o w e b s i t e s . b u t i t ’s f o r t h e e n t i r e G e e k S q u a d – s o d o i t w e l l ! E D U C AT E . you may have to start the removal process all over again Uninstall ALL spyware/adware applications used to performed the cleaning Delete the Lavasoft folder in the Start Menu and [C:\program files] Sometimes SpyBot will be here too. Hijackthis/other junk may be here In W i n d o w s X P / M E – r e e n a b l e S y s t e m R e s t o r e Reboot the machine a few more times just for good measure B e s u r e t h a t y o u d o c u m e n t t h r o u g h o u t y o u r r e m o v a l p r o c e d u r e s – i t ’s e a s y t o j o t d o w n a f e w notes while you’re doing the scans/cleaning instead of compiling it all at the end and missing vital points. D o c u m e n t a t i o n i s n o t o n l y f o r t h e c l i e n t . g . m s c o n f i g .E D U C AT E t h e c l i e n t – y o u ’ d b e a m a z e d h o w m u c h t h i s h e l p s ! ! BURN OR EAT THIS DOCUMENT AFTER READING . t e s t a g a i n . r a n d o m not normal pop-ups. a n d c a n p i n g . D N S . c o n t r o l . R e b o o t t h e m a c h i n e a f e w t i m e s . b u t y o u g e t a n I P a d d r e s s . Te s t r a n d o m p r o g r a m s t h a t m a y h a v e b e e n i n f e c t e d [ W M P. remove it if found Clean the [%temp%] directory one more time. E D U C AT E . a n d R E . e x e . e t c ] a n d preform this testing on ALL user accounts. Te s t i n g s h o u l d o n l y t a k e a f e w m i n u t e s a n d w i l l help prevent recalls – so do it!! If a t a n y t i m e d u r i n g y o u r t e s t i n g s p y w a r e / a d w a r e a p p e a r s ( e . I E ’s r e d i r e c t i n g y o u . For instructions on how to do this please see the winsock2/ DUN procedures. etc). w i n s o c k 2 probably needs to be repaired.

the ability to connect to the internet but not browse web sites. the ability to ping a web site by IP address but not by name.EYES ONLY COMMUNIQUÉ 6. If t h e s e s t e p s a r e f o l l o w e d i n t h e c o r r e c t o r d e r. m a n y i s s u e s t h a t a r e c a u s e d b y W i n s o c k b e i n g broken will be fixed. Winsock is damaged and must be reset to a working state. Windows 98/SE/ME Remove TCP/IP in the network stack • Start -> Settings -> Control Panel -> Networking • Remove all TCP/IP settings in the box -> click “OK” • DO NOT Reboot Remove Dial-Up Networking • Start -> Settings -> Control Panel -> Add/Remove Programs -> Windows Setup • Click on Communications • Uncheck Dial-Up Networking -> click “OK” • DO NOT Reboot Remove the Winsock2 registry key • Start -> Run -> type regedit -> click “OK” • Search for Winsock2 and delete all instances (should be two folders) • Exit Windows Registry • Reboot Reinstall Dial-Up Networking • Start -> Settings -> Control Panel -> Add/Remove Programs -> Windows Setup • Click on Communications • Check Dial-Up Networking -> click “OK” • Reboot WINDOWS 2000 Remove the Winsock2 registry key • Start -> Run -> type regedit – click “OK” • Follow the path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services • Delete: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsock2 Uninstall TCP/IP • Start -> Settings -> Network and Dial-Up connections • Right-click Local Area Connection -> Properties • Uncheck TCP/IP -> Click Uninstall • Reboot Re-install TCP/IP • Start -> Settings -> Network and Dial-Up connections • Right-click Local Area Connection -> Properties • Click Install -> highlight Protocol -> click “Add” • Install TCP/IP • Reboot BURN OR EAT THIS DOCUMENT AFTER READING .9 . *These issues may include a slow internet connection.WINSOCK2 / DIAL-UP NETWORKING (DUN) *If you are experiencing difficulty connecting to the internet or can connect to the internet but cannot access web pages.

close all open Windows N o t e : I n X P. re b o o t . A f t e r r e b o o t i n g y o u s h o u l d b e a b l e t o b r o w s e w e b s i t e s .i n s t a l l i n g T C P / I P.> Vi e w • Enable <Show hidden files and folders> Re-install TCP/IP • Start -> Control Panel -> Network Connections • Right-click the connect you wish to repair -> Properties • Click “Install…” -> highlight Protocol -> click “Add…” • Click “Have Disk…” -> click “Browse…” -> point to the <c:\windows\inf folder> * “Windows” folder may be named “Winnt” • Click “Open” -> click “OK” • Highlight “Internet Protocol (TCP/IP)” -> click “OK” * Installation will pause for a few seconds -> when finished. Tr y t o o p e n I n t e r n e t Explorer and see if you can browse.> F o l d e r O p t i o n s … . i t i s n o t u s u a l l y n e c e s s a r y t o r e b o o t a f t e r r e . M y C o m p u t e r . If you still cannot browse after completing the above steps.EYES ONLY COMMUNIQUÉ Windows XP Remove the Winsock and Winsock2 registry keys • Start -> Run -> type regedit -> click “OK” • Follow the path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services • Delete: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2 Make sure all files are shown • S t a r t . BURN OR EAT THIS DOCUMENT AFTER READING .> To o l s .

Run a Windows install as you normally would. BURN OR EAT THIS DOCUMENT AFTER READING . Boot from Windows boot disk to a DOS prompt. C r e a t e a n e w C A B S d i r e c t o r y. Make sure when it is completed that all programs and devices are working properly and that the post-op procedure is performed. E. Delete current CAB files and go to the C: drive. * Tr y p e r f o r m i n g a S o f t I n s t a l l u s i n g t h e i r C A B S f i r s t A. C. a n d c o p y c a b f i l e s f r o m t h e c l i e n t ’s o p e r a t i n g s y s t e m C D t o t h e n e w “ c a b s ” d i r e c t o r y.EYES ONLY COMMUNIQUÉ 6.10.SOFT INSTALL OF W INDOWS 98/SE/ME Any Internet Explorer upgrades should be uninstalled using add/remove programs before a soft i n s t a l l o f W i n d o w s 9 8 / M E i s pe r f o r m e d .1 . B. D. The process for ME is exactly the same except on the CD the folder that contains the cab files is D:\win9x instead of D:\win98 After the copy is complete switch back to the C: drive and run Windows 98/ME installation by typing “setup”.

Internet Explorer). g o o g l e . D o w n l o a d the proper drivers from the internet. or have us install their software at an additional fee. All data would be lost in this case. Create new Windows directory and copy cabs from Windows 98/ME disk C. • C o m p u t e r M a n u f a c t u r e r ’s w e b s i t e • D e v i c e M a n u f a c t u r e r ’s w e b s i t e • w w w. v e r i f y t h a t t h e i n i t i a l p r o b l e m h a s b e e n r e s o l v e d a n d c a n ’t b e recreated.CLEAN/PARALLEL INSTALL OF WINDOWS 98/SE/ME Client MUST BE NOTIFIED before a Clean/Parallel Install is done to any Operating System. then proceed to a Format Install of Windows (contact the client before proceeding). If the problem still occurs. The main difference is that you rename the entire Windows directory and then create the new folders f o r t h e c a b s . p r o c e e d a n d c o m p l e t e p o s t . Yo u r u n t h e s e t u p e x a c t l y t h e s a m e w a y a s y o u d o i n a s o f t i n s t a l l .EYES ONLY COMMUNIQUÉ 6. c o m ( U s e r n a m e : d r i v e r s P a s s w o r d : a l l ) • w w w. BURN OR EAT THIS DOCUMENT AFTER READING . N o d a t a w i l l b e l o s t . g o o g l e . t h e C L I E N T m u s t r e i n s t a l l A L L o f t h e i r p r o g r a m s f o r t h e i r d a t a to work. H o w e v e r. try updates (Windows. A system restore must be done from the Restore CDs if the computer is an OEM computer that did not come with program disks. Boot from Windows boot disk to DOS prompt. d r i v e r g u i d e . A. c o m / g r o u p s .o p p r o c e d u r e s . Yo u m a y n e e d t o r e i n s t a l l s o m e d r i v e r s a f t e r a C l e a n / P a r a l l e l I n s t a l l o f W i n d o w s . I f t h e p r o b l e m c a n ’t b e r e c r e a t e d . D.10. Rename current Windows directory to winold B.2 . (see format install of Windows 98/ME) A Clean/Parallel Install of Windows is very similar to a Soft Install of Windows. A f t e r a C l e a n / P a r a l l e l I n s t a l l . The process for ME is exactly the same except on the CD the folder that contains the cab files is D:\win9x instead of D:\win98 After the copy is complete switch back to the C: drive and run Windows 98/ME installation by typing “setup”. c o m Look for model numbers on device Printed Circuit Board (PCB) and major Integrated Circuits (IC) for search criteria.

A.o p procedure.EYES ONLY COMMUNIQUÉ 6. • C o m p u t e r M a n u f a c t u r e r ’s w e b s i t e • D e v i c e M a n u f a c t u r e r ’s w e b s i t e • w w w. The process for ME is exactly the same except on the CD the folder that contains the cab files is D:\win9x instead of D:\win98 After the copy is complete switch back to the C: drive and run Windows 98/ME installation by typing “setup”. D o w n l o a d t h e p r o p e r d r i v e r s f r o m t h e i n t e r n e t . A Format Install of Windows 98/ME should only be used as a last resort after all other options have been tried. d r i v e r g u i d e . g o o g l e .FORMAT INSTALL OF WINDOWS 98/SE/ME A F o r m a t I n s t a l l o f W i n d o w s 9 8 / M E D E L E T E S A L L D ATA O N T H E H A R D D R I V E . or we can install them for an additional fee. Format C: drive a:###BOT_TEXT###gt;format c: B. g o o g l e . After format completes create new Windows directory and copy cabs from Windows 98/ME disk C. c o m Look for model numbers on device Printed Circuit Board (PCB) and major Integrated Circuits (IC) for search criteria. M a k e s u r e W i n d o w s . c o m ( U s e r n a m e : d r i v e r s P a s s w o r d : a l l ) • w w w.10. A l l p r o g r a m s w i l l h a v e t o b e reinstalled by the client. Boot from Windows boot disk to DOS prompt. D. c o m / g r o u p s . a n d d e v i c e s a r e w o r k i n g p r o p e r l y. BURN OR EAT THIS DOCUMENT AFTER READING . p r o g r a m s . Yo u w i l l n e e d t o r e i n s t a l l s o m e d r i v e r s a f t e r a F o r m a t I n s t a l l o f W i n d o w s . P r o c e e d w i t h p o s t . o r u s e d r i v e r d i s k s t h a t c a m e w i t h t h e c o m p u t e r.3 . T h e c l i e n t m u s t k n o w t h a t A L L D ATA W I L L B E D E L E T E D F R O M T H E D R I V E .

y o u w i l l f i n d t h a t c l i e n t s h a v e t h e i r r e s t o r e C D b u r i e d i n a c l o s e t s o m e w h e r e .WINDOWS 2000 & XP REPAIR METHODS • • • Soft Installs (Repair Installation) Clean/Parallel Installs Format and Installs There are three ways you can attempt to resolve more severe technical issues that require at least a partial reinstallation of the operating system. especially when there is file system or partition corruption. OEM XP and Win2k cds give you two options for installation – a repair install (soft install). e t c … ) a f t e r t h e w i n d o w s r e i n s t a l l a t i o n h a s f i n i s h e d . t h e c l i e n t ’s d a t a i s n o t l o s t . or putting images on the hard drive that can be burned to CDs. It is very important to back up data before attempting any re-installation. P r e s s E n t e r ” . very little has c h a n g e d c o s m e t i c a l l y. ho w e v e r b e s u r e t o w a r n t h e m o f t h e r i s k o f d a t a l o s s .10. e t c . M o r e r e c e n t l y. and will continue through setup as if it was a standard installation. and strongly suggest backing up all important data before proceeding with the installation. there is always a chance for massive data corruption. it will give you the option to either repair the installation that was found. Q u i c k e n . A c l e a n o r parallel install is installing a fresh copy of windows on the system in a different directory than the current copy of windows. or to install a fresh copy of the Operating System. p r e s s R ” . usually when a corrupt file system is involved . S c r a b b l e . BURN OR EAT THIS DOCUMENT AFTER READING . S e t u p w i l l t h e n g o t h r o u g h a se r i e s o f c h e c k s a n d w i l l b e g i n r e p a i r i n g a n y c o r r u p t or missing system files. There is a potential for data corruption when performing any sort of install. Below are the best ways to perform each type of installation.) 3. The best practice is to do the least i n t r u s i v e f i x p o s s i b l e ( d o n ’t a m p u t a t e a n a r m t o f i x a b r o k e n f i n g e r n a i l ) .) S e l e c t t h e f i r s t m e n u o p t i o n : “ To s e t u p W i n d o w s X P n o w. B e s u r e to inform the client that ALL applications and peripherals will need to be reinstalled (that m e a n s Wo r d . Setup will search for previous installations on the drive. C L E A N / PA R A L L E L I N S TA L L S o m e t i m e s a s o f t i n s t a l l d o e s n o t r e s o l v e t h e i s s u e y o u a r e t r y i n g t o r e p a i r.so inform client of any potential risks before starting work. I f y o u ’ r e l u c k y. Once you’re done with a soft install. a n d t h e a d o r a b l e p u p p y w a l l p a p e r.4 . because clients are used to the w a y t h e y d o t h i n g s . O E M S O F T WA R E D I S C S O F T I N S TA L L A soft installation is the least intrusive way to repair an OS with corrupt files and/or missing or damaged portions of the OS. s o m e m a n u f a c t u r e r s h a v e s t o p p e d g i v i n g o u t C D s a n d are either putting the OS and restore information on a hidden hard drive partition.) 2. and suggest backing up any important data files “just in case”. T h e G e e k S q u a d always tries to leave a computer “the way it used to be”. To a t t e m p t a S o f t i n s t a l l ( o r r e p a i r i n s t a l l a t i o n ) : 1. T h e c l i e n t ’s d a t a S H O U L D n o t b e l o s t . If an installation is found. w h e n y o u n e e d t o r e i n s t a l l t h e O S .EYES ONLY COMMUNIQUÉ 6. c o r r u p t r e g i s t r y. inform the client of potential risks. D o n ’t g e t c a u g h t i n t h e h e a d l i g h t s o f a n e m p t y d i r e c t o r y tree. E v e n t h o u g h t h e s o f t i n s t a l l l e a v e s things visibly untouched. A c l e a n / p a r a l l e l i n s t a l l i s n e c e s s a r y w h e n t h e r e i s e x t r e m e O S c o r r u p t i o n . l e a v i n g t h e c l i e n t h a p p y a s a c l a m .) 4. t h e y h a v e a n a c t u a l X P o r 2 0 0 0 C D . S e l e c t t h e r e p a i r o p t i o n “ To r e p a i r t h e s e l e c t e d W i n d o w s X P i n s t a l l a t i o n . Ty p i c a l l y. o r a c l e a n i n s t a l l . T h e y l i k e t o h a v e t h e s o l i t a i r e i c o n i n t h e u p p e r r i g h t c o r n e r. The advantage to doing this rather than formatting is that a l t h o u g h y o u a r e “ s t a r t i n g f r o m s c r a t c h ” w i t h w i n d o w s . as c a t a s t r o p h e c a n s t r i k e a t a n y t i m e .

photos. E x p l a i n t o t h e m w h a t d a t a i s . BEFORE you do delete the partition. r e n a m e t h e c l i e n t ’s W i n d o w s . S e l e c t t h e o p t i o n “ To s e t u p W i n d o w s X P n o w. BURN OR EAT THIS DOCUMENT AFTER READING .) 4.) 6. Setup will prompt you for the new installation location.) B o o t t o t h e O E M C D . change the installation directory from “Windows” to “Windows2” or “WinXP”. This will be your new windows directory Proceed through install as normal. Te l l t h e m t h i s a t l e a s t 3 t i m e s b e f o r e f o r m a t t i n g t h e d r i v e . .) F O R M AT A N D I N S TA L L AT I O N A f o r m a t a n d i n s t a l l i s t h e m o s t i n tr u s i v e f i x p o s s i b l e . Gone. This will reduce the risk of data loss during the reinstall. When performing a format and install. e t c . T h i s m e t h o d c a u s e s a l l d a t a o n t h e c l i e n t ’s h a r d drive to be erased and a clean and fresh copy of windows to be installed. 1. . To p e r f o r m a f o r m a t a n d i n s t a l l : 1. This is a *LAST RESORT*. P r e s s E n t e r ” .) 5. Reiterate this point over and over until you are sure the client understands. and why it is necessary to t a k e s u c h h a r s h a c t i o n t o r e s ol v e t h e i r p r o b l e m ( p a r t i t i o n t a b l e i s c o r r u p t . it is crucial that you explain to the client t h a t A L L o f t h e i r d a t a i s g o i n g t o b e e r a s e d .) 4.m o s t p e o p l e d o n ’t k n o w t h a t t h e i r data is “all of their MP3 files”.) 2. quicken data. Select the option to install a fresh copy of Windows. P r o g r a m F i l e s .) I f p o s s i b l e . or “all of their pictures from the lake cabin”. Only after the client understands and agrees to losing all of their data. a n d s h o u l d o n l y b e u s e d i n e x t r e m e c a s e s o f p a r t i t i o n o r f i l e s y s t e m c o r r u p t i o n .) 3. This means e-mails. Press Enter”.) Inform the client that all of their data is going to be lost. B o o t t o t h e O E M W i n 2 k o r W i n d o w s X P C D a n d s e l e c t “ To s e t u p W i n d o w s X P n o w.) 2. there are 3 things you must do before proceeding with the work. D e l e t e t h e c u r r e n t p a r t i t i o n a n d f o l l o w s e t u p ’s i n s t r u c t i o n s t o c r e a t e a n d f o r m a t a n e w one. a n d D o c u m e n t s a n d S e t t i n g s directory before proceeding with the installation. Setup will find the previous installation and will ask if you want to repair it or “continue installing a fresh copy of Windows XP without repairing” Press ESC. If you were not able to rename the current windows directory before starting the clean install. continue deleting the partition and recreating a new one. 1.) 3.EYES ONLY COMMUNIQUÉ Although data should not be lost. 2. never going to see it again. documents. ) Inform the client that they will not have any of their data after you format the system Inform the client that their data will be gone when you are done.) 3. information like e-mail and quicken data may need to be imported after the respective programs are reinstalled. bookmarks.

It is up to them to decide how they want to proceed from there. I f y o u e n c o u n t e r a m a c h i n e t h a t w as s h i p p e d w i t h W 2 K o r X P a n d i t c a m e w i t h r e c o v e r y C D s .i m a g e t h e c l i e n t ’s h a r d d r i v e . Restore CDs are very straightforward and g e n e r a l l y f o r m a t a n d r e .d e s t r u c t i v e r e p a i r. it is wise to investigate what options are available for that specific recovery disc. and present the least intrusive option to resolve the problem to the client. r u n t h e n o n . NOTE: It would be wise to note any errors you run across during installation and research the cause and possible effect of said errors. inform the client of your recommendation. you should stop. A g a i n . If the only option that the recovery CD has to offer is a destructive install. If a non-destructive r e p a i r o p t i o n e x i s t s . After the installation is complete. At this point.) Setup will walk you through the rest of the install. It is crucial to stress the importance of informing the client about what formatting really means and making sure that the client understands the r e s u l t b e f o r e d o i n g a n y w o r k t h a t co u l d p o s s i b l y r e s u l t i n d a t a l o s s .EYES ONLY COMMUNIQUÉ 5. r e a d t h r o u g h a n y w a r n i n g s t h a t t h e r e c o v e r y C D ’s d i s p l a y s a n d m a k e sure to relay that information to the client in words they can understand. r e t u r n i n g i t t o t h e s t a t e t h e s y s t e m was in when it came off the shelf. This does not mean you have to reinstall all the applications that were installed before. T h e s t e p s t o p e r f o r m t h i s operation will vary from machine to machine and you should read everything VERY carefully before proceeding. F O R M AT A N D I N S TA L L W I T H R E C O V E R C D This is the standard recovery option for most PCs. S O F T I N S TA L L W I T H R E C O V E R C D S o m e r e c o v e r y C D s g i v e y o u t h e o p t i o n f o r a d e s t r u c t i v e r e p a i r o r a n o n . it is also extremely important to document EVERYTHING in the notes! BURN OR EAT THIS DOCUMENT AFTER READING . Reinstalling applications and importing data is an additional service and should b e b i l l e d a c c o r d i n g l y. NOTE: Not only is it very important to explain risks and reasons for your suggestions to clients in all situations. t h i s s h o u l d b e a L A S T R E S O R T. After you have examined your options. look at all available options. Yo u s h o u l d m a k e s u r e t h e y c a n g e t o n l i n e a n d c h e c k t h e i r e mail. it is your responsibility to install all needed drivers and to make sure everything is w o r k i n g a s i t s h o u l d b e . Once you have educated the client and they understand what is going to happen to their s y s t e m ( a n d w h y i t i s n e c e s s a r y ) . a soft install is not possible.d e s t r u c t i v e r e p a i r. It is also important to make sure that the OS is totally patched and the newest service packs are installed.

C : \ P r o g r a m F i l e s \ Q u i c k e n W \ B a c k u p I f t h e d a t a h a s n o t b e e n b a c k e d u p r e c e n t l y.C:\Windows\Application Data\Microsoft\Address Book * . c s v – C o m m a S e p a r a t e d Va l u e s A more reliable way to export/back-up address book entries To E x p o r t : F i l e > E x p o r t > A d d r e s s B o o k > Te x t F i l e > E x p o r t To I m p o r t : F i l e > I m p o r t > O t h e r A d d r e s s B o o k > Te x t F i l e > I m p o r t Quicken • *.mny Stores all transactional data for the account Ty p i c a l l o c a t i o n – C : \ P r o g r a m F i l e s \ M i c r o s o f t M o n e y BURN OR EAT THIS DOCUMENT AFTER READING .dbx .11 . d o c .Outlook Express data file (most commonly) Win 2k/XP: C:\Documents and Settings\% u s e r % \ L o c a l S e t t i n g s \ A p p l i c a t i o n D a t a \ I d e n t i t i e s \ { % } \ M i c r o s o f t \ O u t l o o k E x p r e s s Win 9x/ME: C:\Windows\Application Data \ I d e n t i t i e s \ { % } \ M i c r o s o f t \ O u t l o o k E x p r e s s • • *.qbb .M S Wo r d d o c u m e n t s *.wab – Windows Address Book Win 2K/XP – C:\Documents and Settings\%user%\Application Data\Microsoft\Address Book Win 9x/ME .EYES ONLY COMMUNIQUÉ 6.pst – Outlook data file Win 2k/XP: C:\Documents and Settings\%user%\Local Settings\Application Data\Microsoft\Outlook Win 9x/ME: C:\Windows\Profiles\%user%\Local Settings\Application Data\Microsoft\Outlook Microsoft Outlook Express • *.jpg – image files ‘Favorites’ directory • Win 2K/XP – C:\ Documents and Settings\%user%\Favorites • Win 9x/ME – C:\Windows\Favorites Microsoft Outlook • *.s p e c i f i c i nf o r m a t i o n Ty p i c a l l o c a t i o n – C : \ P r o g r a m F i l e s \ I n t u i t \ Q u i c k B o o k s Microsoft Money • *.qdf . t h e e n t i r e Q u i c k e n W d i r e c t o r y s h o u l d b e c o p i e d QuickBooks • *.Quicken data file Stores all transactional data for the account Ty p i c a l l o c a t i o n .COMMON FILE EXTENSIONS FOR DATA BACK-UP The following is a list of programs that are commonly backed up and the relevant files and typical locations. ‘My Documents’ directory • Usually best to back up everything in this directory • Some common extensions found here: * . This is not all inclusive so it is important to consult the client as to any specific needs they may have.xls – MS Excel spreadsheet *.QuickBooks company file S t o r e s a l l c o m p a n y .

3. M i c r o s o f t Wo r d w i l l n o t o p e n • Enable “Show hidden files and folders” • Normal. . “ D o n o t a l l o w a t t a c h m e n t s t o b e s a v e d o r o p e n e d t h a t could potentially be a virus” was automatically enabled. D N S . \ W i n d o w s To o l s \ B a t c h F i l e s I f n e t w o r k s h a r e s a r e t a k i n g a l o n g t i m e t o d i s p l a y.12 . Wo r d w i l l r e c r e a t e t h i s f i l e n e x t t i m e i t ’s opened • C : \ D o c u m e n t s a n d S e t t i n g s \ % u s e r % \ A p p l i c a t i o n D a t a \ M i c r o s o f t \ Te m p l a t e s • C : \ P r o g r a m F i l e s \ M i c r o s o f t O f f i c e \ Te m p l a t e s • Yo u m u s t i n f o r m t h e c l i e n t t h a t t h e i r c u s t o m i z a t i o n s w i l l b e l o s t P a g i n g f i l e i s s e t t o 0 M B a n d w o n ’t s t a y s e t w h e n y o u m a n u a l l y t r y t o s e t i t • Apply the Intel Application Accelerator v2.\Intel C a n ’t a c c e s s a n y w e b s i t e s . \ W i n d o w s To o l s \ R e g i s t r y E n t r i e s There is a folder on the MRI with a few helpful links to various web sites • \.EYES ONLY COMMUNIQUÉ 6. . 0 ( s p e c i f i c a l l y 9 . r e g • L o c a t e d o n t h e M R I \ . “ message – use this . • S i m p l y s e a r c h f o r n o r m a l .dot is probably corrupt and needs to be placed.reg to show you what file is possibly causing this • A p p l y S h o w Ve r b o s e S e c u r i t y S t a t u s M e s s a g e s . \ W i n d o w s To o l s \ R e g i s t r y E n t r i e s • D o n ’t f o r g e t t o a p p l y t h e u n d o t o r e t u r n t h e m a c h i n e b a c k t o d i s p l a y i n g t h e d e f a u l t message Outlook Express 6 not allowing attachments • I f S e r v i c e P a c k 1 w a s i n s t a l l ed . simply uncheck this option Yo u • • • • • • c a n ’t a c c e s s t h e f o l l o w i n g s i t e s : Secured Sockets Layer (SSL) ActiveX is working partially/not at all Windows Update is not working properly (web site displays an ActiveX error) A O L v e r s i o n s g r e a t e r t h a n 7 .GENERIC/QUICK FIXES These are some speedy fixes that are often used.\Helpful Links BURN OR EAT THIS DOCUMENT AFTER READING .\Spyware\Winsock2 Utilities Windows 2000/XP Only U s e r a c c o u n t s a r e t a k i n g a l o n g t i m e t o l o a d / p a u s i n g a t t h e “ L o a d i n g Yo u r P e r s o n a l S e t t i n g s . b u t y o u g e t a n I P.reg • L o c a t e d o n t h e M R I \ . specifically SSL Apply the Cryptographic service and ActiveX fixes v3. if applicable • Located on the MRI \.bat L o c a t e d o n t h e M R I \ . see winsock2/DUN fixes • Yo u c a n p e r f o r m t h i s m a n u a l l y o r t h e r e a r e a f e w t o o l s o n t h e M R I • \. a n d c a n p i n g • Winsock2 may need to be repaired. d o t a n d d e l e t e . t r y t h i s t w e a k • W h e n a p p l i e d t h i s t e l l s t h e c o m p u t e r n o t t o l o o k a t t h e s h a r e s f o l d e r. t h e r e f o r e s p e e d i n g up your sharing • Apply Speed up file. 0 O p t i m i z e d ) w o n ’t a c c e s s m o s t s i t e s .print sharing tweak.

This is done to catch any issues that may still be occurring. a n d al l p a r t s Explain in detail what was wrong and what service was performed Make sure the client is fully aware of EVERYTHING you did to their machine Make recommendations as to how to prevent it from happening again C l o s e s e r v i c e o r d e r i n S TA R P r o c e s s p a y m e n t t h r o u g h P. S . p a p e r w o r k .Post-Operations (Post-Op) After completing any type of computer service. m o d e m / N I C . e . educate. This has turned up many little issues in the past that may have become potential recalls. h i g h e r t h a n 1 6 . t h a n k t h e c l i e n t f o r t h ei r b u s i n e s s ! BURN OR EAT THIS DOCUMENT AFTER READING . ) Te s t t h e i r m a j o r a p p l i c a t i o n s w h e t h e r y o u w o r k e d o n t h e m o r n o t . e t c .b i t 8 0 0 x 6 0 0 ) Check Device Manager in Normal Mode Check for multiple extraneous devices in Safe Mode Device Manager (Win9x only) Make sure Windows recognizes all the RAM in the system L o a d w e b p a g e s ( t r y t o u s e c l i e n t ’s a c c o u n t i f p o s s i b l e ) Open a sampling of applications on the desktop that the client likely uses ( e . A s a t i s f i e d c l i e n t m e a n s a p o t e n t i a l re p e a t c l i e n t ! • Educate. Q u i c k B o o k s . O . and re-educate the client on what was done with their system! Check-Out • • • • • • • • • • • P u l l u p c l i e n t ’s s e r v i c e o r d e r t h r o u g h S TA R Ve r i f y p r o d u c t i s c o m p l e t e G e t p r o d u c t . M i c r o s o f t Wo r d . g . • • • • • • • • • • Reboot the system a minimum of three times Wa t c h f o r s h u t d o w n p r o b l e m s Te s t a l l F l o p p y a n d C D d r i v e s Te s t s o u n d .EYES ONLY COMMUNIQUÉ 7. a n d vi d e o ( i . Q u i c k e n . By taking less than 5 minutes you may save a client the inconvenience of having to bring their computer back for what could have been an easy fix.0 . Parts and Labor G e t c l i e n t ’s s i g n a t u r e o n c l o s e d s e r v i c e o r d e r L a s t l y. post-op each system to verify that all of the following items are properly functioning. M i c r o s o f t E x c e l .

R i n g o u t t h e b a l a n c e d u e i n P. S h o w t h e c l i e n t t h e Ta c t i c a l C a s e R e p o r t f o r m ( o n r e v e r s e s i d e o f I n . Greet the client.S t o r e Ta c t i c a l Analysis form) and explain any applicable instructions regarding the product C l o s e t h e S e r v i c e O r d e r i n S TA R t o p r i n t o u t c o p i e s o f t h e S e r v i c e O r d e r. BURN OR EAT THIS DOCUMENT AFTER READING . u s e t h e S e r v i c e O r d e r n u m b e r o r t h e c l i e n t ’s p h o n e n u m b e r a n d l a s t n a m e t o p u l l u p t h e i r S e r v i c e O r d e r. c. If repairs were completed and verified using the full diagnostic suite and the post-op was performed and noted then there is no reason to power on the computer and show the client t h a t i t i s f u n c t i o n i n g a p p r o p r i a t e l y. 3. U s e S TA R t o i d e n t i f y t h e u n i t . I f c l i e n t r e q u e s t s t o h a v e u n i t p o w e r e d u p a t t h a t t i m e p o w e r u p t h e m a c h i n e a n d d e m o n s tr a t e p r o p e r o p e r a t i o n . S .EYES ONLY COMMUNIQUÉ 8. perform the following: 1. Have the client sign a copy of the Service Order. C o l l e c t p a y m e n t a s applicable. b. O . Give the unsigned copy of the Service Order and the unit to the client. a s t o p r e v e n t s h r i n k a n d t o n o t m i s s o u t o n a n y l a b o r c h a r g e s . O . technician should sign it as well.COMPUTER CHECK-OUT When the client returns to pick up their serviced product. 4. It is extremely important that all services and hardware pieces are processed t h r o u g h P. Keep signed copy for the store file. S . e v e n o f t h e r e i s a $ 0 b a l a n c e d u e .0 . 2. a.