Geeky way of doing things

How do I remove text enhance from Internet Explorer?

Muhammad Afruzur Rahman — Mon, 07 May 2012 02:26:18 +0000

I have been struggling with removing Text Enhance malware for over a month. No matter what I did, it seems to not work. Here are some of the methods I tried:

Run Microsoft Anti-malware signature package
Run adware
Run CCleaner
Run Spybot
Used different methods of removing add on from Internet Explorer

Click the Tools button , and then click Manage add-ons.
Under Show, click All add-ons.
Select the Text Enhance plugin from the list of software, and click disable.

None of these worked.

What worked?

I removed CodecC from Add Remove program.

Here is a bit more details that may help you:

There are many different versions of Text Enhance malware. Here are some of the variance that you may want to look for when trying to uninstall from Add Remove programs from your control panel.

Codecv 1.0RewardsrcadeSuite
Vid-Saver
TheBflix Class
Bflix1.0
TheBflix
TheBflix5.0
CodecM
Codec-V (Video Player, Win Trojan Known Location: C:\ProgramData\Codec-V)
Notepad++
Better Links
Vuze (Not the P2P client)
Downloadnsave
Installed Class
wxDfast
SiteAdvisor (This is the same name as a McAfee product, do not disable McAfee)
I Want This
BeCool
Facetheme
Yontoo
Protector by IB2.0.0.412
CodecC 1.0 (Quicktime, Video)

Deleting a local user profile on Terminal Server 2008 – Very tricky and a bit complicated than deleting it from Server 2003

Muhammad Afruzur Rahman — Fri, 02 Jul 2010 16:42:00 +0000

One of the last resort in fixing a user issue on a terminal server environment is to delete user profiels in order to start with a clean slate. That proved to be very difficult for me than I anticipated in a Terminal Server 2008 environment. I used server 2003 beforeand it was not as pain as this. Server 2003 all you had to do is just delete the user profile and ask the user to log back in. With that mind set here goes the story.

It is very easy to think a local user profile on Windows Server 2008, Windows Vista and Windows 7 directory is located under C:\Users directory(if you are using your Server 2003 knowledge). Behind the scene technicality is a bit different. Windows Server 2008, Windows Vista, Windows 7, contrary to common belief, actully keeps track of all the profiles that gets created in the registry key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.” Each of the profiles that is stored lcoally (happens in terminal server 2008 environment as well) a subkey is created. If you are not sure which profile you are looking for you should be able to see the username of each profile when you click on each SID.

What I did that caused the headache?

What happens if you delete the user profile directory below C:\Users\”Username” without modifying the registry? Well that is exactly what caused the headch for me. After deleting the profile, when the user logged in Windows displays a balloon tip (see the figure 1) indicating that Windows could not load the user profile and that the user was logged on with a temporary profile. As you know, temporary profile is the last option available to Windows to log you in if it can not load your profile properly. After you log off, all the changes are lost.

Figure: Event ID 1511

So how do you really delete a profile?

Follow one or the other options below:

Well make sure you delete the profile directory AND the subkey from the rigstry.
Go to start > run and type in sysdm.cpl. From there go to Advanced Tab, then to Settings on User Profiles and delete the profile you want to delete from there.

Figure: User Settings

Too late, I already deleted the profile, now what?

Not to worry. Windows is really smart (!). If windows finds an orphan ProfileList subkey matching a userprofile’s SID without an associated profile directory (C:\Users\”username”) it backs up the ProfileList subkey with a.bak extention. Just remove the one that corresponds to your troubled profile.

This was also the reason why if you don’t delete this none of the trobuelshooting will show up because the balloon tip needs to go first. Only way it will go is by deleting .bak subkey.

This does not apply to any machines with Server 2003 because it uses simplistic approach. If a ProfileList registry exists but directory does not, it just recreates the new profile and overrides the data.

Anyways, as much as I like windows server 2008, at the same time I have to wonder why Microsoft made this change! Maybe because they thought some users will find temporary profile very useful?

“Because of an error in data encryption, this session will end” – error on Windows Server 2008

Muhammad Afruzur Rahman — Tue, 26 May 2009 18:17:56 +0000

I am using Dell PowerEdge 2950 with NetXtreme II NIC with Windows Server 2008 (not R2). It was working perfectly. I enabled RemoetApp, created RDP, also enabled Remote Desktop to allow our users to connect from anywhere. Good thing is it is still in testing environment. I didn’t have any security software installed on it so I proceeded to install whatever I had available to me which was Symantec EndPoint 64 bit edition for Windows Server 2008.
Sure enough like any other installation, the installation process went well. I ran live update with no hitch. Then it asked me to reboot. After that, I started to get the following error:
“Because of an error in data encryption, this session will end. Please try connecting to the remote computer again.” – Just like the screen shot below.

Encryption Error after installing Symantec EndPoint on Windows Server 2008

As soon as you press ok, it just closes the program. I tried it with RemoteApps, Remote Desktops and also using the RDP clients I created for each program. Trying to locate information, I came across many useful hints but mostly about Windows Server 2003.
I tried to change registry keys but none of them worked for me. If you want to try those solutions go ahead but please know that it may inadvertently cause some other issues. Then I found another solution that I wanted to try which basically talks about “Large Send Offload on IPv4.” This was a unique solution because I thought it was brilliant. So I followed the following steps:
1. Went to the server room (because I can’t connect remotely even as administrator)
2. Logged onto the Server.
3. Then find your active “Local Area Connection Status” window.
4. Click on Properties
5. Click on Advanced tab and you will see something like the screen shot below:

6. Select Large Send Offload v2 (IPv4) and on the Value field select disable just like the screen shot below:

Encryption Error Solution

Press ok and you should be back in business.

Hope this helps.