Sunday, March 6, 2011

Virus issue

I don't often get involved in fixing PC problems, but recent jobs involved the same type of issue.  The PC starts to report serious errors, and show problems with boot sector and other critical areas of the disk.  It all looks rather real, and very worrying.  However, in both cases it was caused by a similar, but different Fake Anti Virus program.  I think if you continue there was an offer of the program to fix the issue - in exchange for some $$$s.

The approach I tooks was to remove the drive from the laptop and create an image for security purposes.  I then ran Norton which tracked down several viruses, and removed them.  This is where the two viruses behaved differently.

Virus one did not want to be removed by Norton and started each time the machine booted.  The problem was that a startup function  (go to msconfig) was launching the virus at startup each time.  By removing this start up line - and seeing the program it was starting (it had a randomly generated name) the PC was then OK.  The free AVG virus checker was added to the PC to try and prevent this happening again.  A report a few weeks after this event indicated that eveything has been OK.

Virus two was removed by Norton, but left the PC in a state where no program would actually launch from explorer.  Various 'Googled' ideas pointed to the registry, but this did not help.  Launching the command prompt was also very difficult and the start program launcher did not work.  A solution to this was rather unusual, but worked, and hence I am including it here.  Do Ctrl-Alt_Del and b ring up the task manager.  Under the top menu item 'File' thre is a run command.  This worked and a command window was opened.  It did not seem possible to change file attributes to make sure that a .exe was launched so evenually the PC was restored to a restore point from afew weeks earlier.  Everything then nearly worked.

On examining the PC there were issue with McAfee antivirus which was not running, and also 18 months of Vista updates had not been loaded - 90 patches althogether.  The 90 patches were installed, McAfee updated and this worked.  PC now all OK, but all automatic updating was set to 4am when the PC is normally turned off.  This was changed to a time when the PC was likely to be on and hopefully the problem will not arise again.

In both cases, no data was actually lost

Thursday, March 3, 2011

Parallel Programming

Modern proessors are not getting much faster, 3GHz has been a fast processor for about 7 years.  They are getting wider.  It started with hyperthreading and then multiple cores.  Almolst every processor is now a multiple core, and current Intel chips have 4 cores with hyperthreading, making in effect 8 cores.

Unfortunately, most programs just use a single core and so performance gains are not very significant.  The solution is to use parallel programming so that different tasks are performed in different cores.  This may sound simple but unfortunately many computing tasks are sequential.  In data recovery it is sequence or read disk, analyse data and save data.  The other problem is each time a task is split there is a processing overhead.  This means that benefits may not be very significant.

An example of the limited benefit mentioned above is a simple program I wrote to experiment with parallel programming.  It was purely an exercise with in memory manipulation - ie no hard disk access.  The first example was single threaded and took 35 seconds to run, using a single core.  The next example was using the 'parallel_invoke' function and used all possible cores.  When running it looked impressive with all 8 cores running at 100%.  However, the time was not reduced by a factor 8, but only roughly halved to 15 seconds.  Although this would be a worth while time gain its shows how overheads of a new task eat into the gains.  I am sure that a bit of tweaking could have made the improvement better, but the warning is that a PC may be running at 8 * 100% but actually alot of this may be house keeping.

In a real world example I have added some parallel processing into CnW Recovery software.  The area was to do with calculating MD5 hash values while writing data to the output drive.  As these processes do not depend on each other, they can run at the same time sharing the same memory buffer.  The result was a reduction in time from about 3 hours 30 mins to 3 hours 10 mins.  This is worth while but not very dramatic.  However, it will be possible to add SHA-1 hashing with no extra time penalty and that would be a major benefit.