I don’t expect this will be interesting to many of you, but I started talking about this in Twitter and the subject got too big and there were Too Many Questions, so here is the full story.
This machine has gone for five years without any virus protection on it. It’s been clean & safe in all that time. I know anti-virus companies like to spook you and convince you that the Internet is brimming with malicious code that magically comes down the wire through no fault of the user, but this is not quite the case.
I hang out in very safe areas of the ‘net. Most dangerous code comes from:
- Porn sites
- Pirate sites
- Social networking scams. (The “Adult content Viewer for MySpace” is a good example of this.
- Email attacks.
I don’t go to those sort of websites, and I can spot a dangerous email a mile away. So, I’ve run for years with no protection and my machine has remained secure. Every few months I’d install a random Anti-Spyware / Malware program, give the machine a once over, and un-install it. Security programs are generally slow, bossy, nagging, resource hogs, so I saw no reason to let one lay around in memory, taking up space. I like to run lean.
Well, it was a good plan while it lasted.
About a week ago I was looking for cheats for New Vegas. I wanted to see just how much of an impact leveling / skills had on combat performance, because… Geeze. I don’t know. Seemed like a laugh. But cheat sites are generally infused with seedy ads. One gave me a popup (even though Firefox has built-in popup blocking) that was an obviously fake virus warning. One of those ones that pretends to be scanning your computer, but is just filling up a progress bar and generating bullshit scare messages. It actually placed itself slightly off-screen, so the REAL close button wasn’t visible. I wasn’t falling for that. I grabbed the title bar, dragged the window back into view, tried to clicked on the close button, and missed. I clicked inside the window.
Now, this should not be enough to get Bad Things on your computer, but it was. Or at least, if I made any other mistakes, I can’t sort them out. Clicking IN that window launched a lot of other windows, and some of them weren’t browser windows, but just regulars Windows windows, and I knew I’d messed up. I was screwed.
I gave the machine a scrub-down and waited a few days. I treated the machine like a public terminal and I’ve been acting like I have a keylogger installed, just to be sure. (So I’m not typing my password directly, ever.) The machine seemed okay at first, but there were still symptoms:
- Task manager shows iexplore.exe running on startup, despite the fact that I un-installed all versions of Internet Explorer. There actually isn’t an executable named “iexplore” anywhere on my machine.
- If I do a Google search in either Firefox or Chrome, and then click on the search results, I’ll get a strange error message popup labeled proc:click. It spews a bunch of Javascript out, and then the search is redirected to a spam portal. So, I have to copy & paste search results. Re-installing Chrome fixes this until the next reboot.
- All Flash-based content is missing in Chrome. Again, re-installing Chrome fixes this until the next reboot.
- In trying to resolve problem #1, I found Program Files/Internet Explorer/IEDW.EXE on my machine. Suspicious, considering IE shouldn’t be there at all. I’d assume this is just Microsoft sloppyness, but if I delete IEDW.EXE, it magically re-appears. That’s a virus.
Note that while all of this was going on, Ad-Aware, SUPERAntiSpyWare, HiJackThis, MalwareBytes, and SpyBot Search & Destroy all gave my machine a clean bill of health. So whatever I’ve got, it’s either hiding itself or it’s not appearing in any virus database.
I rebooted into DOS and used the Arcane Techniques to cleanse the machine of IEDW.EXE. (There were several copies of the file lurking in there under different names. I nuked them all.) When I rebooted, the above problems seem to be alleviated. So… fixed?
I sat there for a few minutes and asked myself, “Do I really trust this machine? Do I feel safe entering my passwords?”
I do not.
I don’t see any way around it. It’s time to get out the Windows XP CD and Start over. So that’s what I’m doing today.
And to head you off: No, I am not installing any Linux. Yes, I know it’s more secure. Yes, I know it runs lots of stuff. My wife uses Ubuntu, I’ve seen it. It’s nice. But it can’t run the games I need to run. It can’t run my comic authoring software. It can’t (easily) use my TV Tuner card to let me play console games. It can’t run Paint Shop Pro. Yes, there are OS alternatives to some of these things. But I’m not going to ride all of those different learning curves and completely change my work pipeline. All of that would be far, far more disruptive than this virus was. Ubuntu is cool, but my relationship with Windows in entrenched. Thank you.
I may update this as my adventure continues. My data backup is nearly done. Time to begin the Ritual of Cleansing.
2:10PM: XP is installed. Managed to install XP Home instead of XP Professional. I can’t imagine I’ll notice the difference. (Using Laptop to type this.) Windows could not identify my ‘net adapter, so no internet. Told it to search for drivers. It didn’t find any. Asked me if I would like to connect to the internet to look for drivers. Heh. You can TRY.
2:39PM: I installed XP to the D: drive. The old Windows drive is still there, just in case I need to go back to it. I guess once the transition is over I could format c: and install Ubuntu, just for laughs. Currently I’m gathering up all the drivers I need. Also need to replace the default background before I kill myself.
2:49PM: Yay, sound! Also, I forgot how FAST a new install is. 2-year-old installs always have that minute of grunting and sweating after XP appears. The machine LOOKS ready, but it’s not going to do anything but thrash the HD for a minute and a half.
2:50PM: NO I DON’T WANT TO TAKE A TOUR. THANK YOU.
2:54PM: Time to get my service packs on.
2:56PM: NO I DON’T WANT TO TAKE A TOUR. PISS OFF.
2:58PM: Once again, I want to commend Microsoft for Internet Explorer. It really is a top-notch tool for downloading Firefox.
3:12PM: Okay, display drivers installed. No longer using Windows XP: LARGE PRINT EDITION.
3:13PM: Windows Update wants to know if I want Internet Explorer 8. On one hand, it’s the best version of IE ever. On the other hand: Duh, No.
3:19PM: Time for the tough stuff. Need to install my WAMP server so I can serve myself webpages. Can’t live without that thing. On the other hand, it’s a bit fiddly to install and I can never remember the proper steps until I’ve puzzled through them again.
3:35PM: Service Pack 3 is downloading. Still can’t remember how to install WAMP. Going to have to find the website and RTFM. Sigh. Stupid failing memory.
4:25PM:Had a bite to eat and a rest. Back at it.
4:33PM: Wow. Glad I grabbed the new WAMP. Latest version was completely turnkey. Boom! Webserver. (WAMP stands for Windows, Apache, MySQL, PHP. It’s the basic stuff you need on pretty much any webserver. I use it for working on this site. I have a mirror of this blog on my local machine, so I can experiment with changes without breaking things while people are trying to use the site. Er. Okay, I DID have a mirror. That’s gone now. Need to get that set up again. Still… Boom!)
6:42PM: It’s almost seven o’clock? Well, em… Minecraft works, I’ll say that much. YouTube operates it’s usual time-devouring magic with no difficulties. I’ve got steam re-installed. Now I just need to re-download a terrabyte or so of games.
Shamus Young is a programmer, an author, and nearly a composer. He works on this site full time. If you'd like to support him, you can do so via Patreon or PayPal.
T w e n t y S i d e d
