Yesterday was my birthday, and Linda and I went over my mother's house in Bristol for the day. My brothers were over, as was my father and stepmother. Having my two parents together is a rarity which I very much enjoy, and I thank Linda for engineering the get-together.
While at the house, I hopped online for a moment and learned that my mom's PC was in the evil clutches of what I can only describe as the most terrible trojan I've ever seen. They had already run AdAware and Spybot, neither of which had removed it. Aside from slowing the PC down to a crawl, I noticed in MSIE's status bar that it was continually referencing ads123.com. I did some googling around, and happened across HijackThis!, a powerful tool for use in the purging of such malware demons. But I couldn't access spychecker.com to download it, nor any of the mirrors I found. When I had problems accessing other anti-spyware sites, I began to suspect that downed servers weren't the problem.
I had to enable viewing of system files in order to get to their HOSTS file, which I found to be full of anti-spyware sites, pointing all those URLs to dummy IPs. After clearing out the HOSTS file, I downloaded HijackThis and read the guide. Apparently, HijackThis is capable of removing many files which are not spyware, and even those which may be required for windows to run, so I was very meticulous in removing items. It was complicated by the fact that many of the trojan components were random strings of characters, easily confused with SMSS.exe or spoolsv.exe, which are required processes.
Once I was finished, I removed all the evil malware components. (Not to insinuate that windows itself is anything other than evil) Upon reboot, I selected the admin profile and found that the computer at this point would reboot itself - it would never reach the desktop. Damn. While I initially suspected that I'd removed something I shouldn't have, I now think that perhaps this was part of the trojan - a guard against its removal, or some process or file I'd neglected to repair which was causing windows to search at startup for a malware component I'd removed. Maybe the config.sys? Boot.ini?
So now, starting in safe mode, I could either restore the malware-infected PC, or reinstall the OS. We elected to reinstall. In safe mode, the CD writing drivers weren't up, but thankfully my stepfather had just purchased a 256MB USB 2.0 drive. Very nice. We backed up documents, favorites, address books, etc... and began the reinstall.
My first problem came from the fact that I couldn't boot from the install CD. I'd been hitting F8 on load, which I'd thought would bring you into the BIOS, but the options were only things like starting in safe mode, which at this point I no longer needed. A quick phone call to my friend Rich gave me my answer: F10. (D'oh!)
From there, the format-and-reinstall process was fairly straightforward. After we set up the XP installation, I immediately installed ZoneAlarm, Norton Antivirus, and Firefox. The computer was now running like lightning.
I've got to reinstall my own OS soon.
Why yes - it is a Compaq. :-) And as mentioned, I'm about to try a reinstall on my Dell sometime soon. I've got two hard drives, which will make backing up much easier.
I've still got to spend some time and find a decent way to preserve paragraph formatting in longer comments without the user having to type tags into the comment. On that note, I should strip tags out beforehand so as to preserve my XHTML and prevent potential issues with broken formatting and/or security.
