Mmm, Virus...
Thursday, June 14th, 2007So I was downloading a DVD burning app using a torrent and I was looking for... erm... a thing for it. I've been around this great big ol' peer to peer file sharing internet of ours for a very long time and I know when things look suspicious and this definitely looked suspicious. It was a self-extracting archive, according to it's Properties, and WinRAR showed me package ratios and everything. So it was a legitimate self-extracting archive. So I thought I'd open it and see exactly what was inside! So it extracted and then opened a console window and RAN WHAT WAS JUST EXTRACTED.
It was probably extremely stupid of me, but I wasn't aware that self-extracting archives could automatically run a freshly extracted file like that. I knew some more advanced installers could, but I didn't know a plain archive could. Let it be known that I won't be making the same mistake twice.
It installed something pretty nasty actually. Probably the worst infection I've ever had. Windows Defender, which I thought was disabled, suddenly came alive and started yelling about worms and trojans and ad bots. (For the record, I thought I disabled Defender when I installed Vista, but after this, I'm leaving it on. It doesn't take up a whole lot of resources, and it did its job perfectly.) Also for the record, I had disabled User Access Control, which allowed the malware to actually start doing their dirty work. (Yes, I am defending Windows. If all the security systems had been left on, this wouldn't have happened. I shut everything off for ease of use, but if I was a computer technician, I would demand that my client keep everything on or I'll charge extra for repair. Do not shut off the Vista security apps unless you know how to fix the thing yourself.)
So I downloaded Ad-Aware and Spybot and AVG antivirus. Ad-Aware 2007, I learned, is completely incompatible with Vista and you should not use it. According to the official forums, Lavasoft was entirely aware of the completely reproducable crashing in Vista, but they released the new version anyway, with a promise of a hotfix "this fall". It is beyond my ability to describe how careless, arrogant, stupid and insane that is. "Oh, we know there's a crippling bug for the modern version of Windows, but oh well." I had to sift the internet for the last version of Ad-Aware, which, I might add, works perfectly. Why build a new program that's broken when the old version works perfectly fine?!
Spybot is only partly Vista-compatible, but it does its job when searching for malware. Together, they uncovered about 700 spyware applications and removed them. (Yep. 700. I rivaled Strong Bad's virus count there.) I restarted and about 300 came back. Restarted in safe mode, cleaned, restarted, 300 came back. Some horrid thing called PurityScan. I haven't had an infection for years, so I'd lost my knack for cleaning things up. I finally got wise and checked out MSCONFIG, and, sure enough, there were some unknown files starting up that were most likely reinfected me on every boot. So I disabled all of them, restarted in safe mode, ran scans, decided to activate User Access Control (Which I should have done in the very first place! It would have blocked the unknown files.), and restarted back into regular mode. Tada! Virus clean.
Let this be a lesson to you all! The Windows security programs are there for a reason. With them on, this won't happen in Vista. With them off, you're in major trouble, especially when you go poking around in randomly downloaded peer to peer file transfers!
(For the record, I have never picked up a virus on Vista before this, and this infection only happened because I actually opened the virus manually, without scanning it first. I feel like I have to beat this into the post or some random anti-Microsoft weirdo is gonna come along and gloat about how awful Windows is. Lemme tell you that even Linux can be infected if the user actually runs the virus by themselves. This was a user error, not a Microsoft error. So go 'way.)