Infection Imperfection

(This is a back-post for June 22. I will catch up on my normal site when I return but wanted to start posting these for general S&G as I get them done on vacation)

It happened again. I got an uber-virus on my computer and I’m not very happy about it. I truly wish I could meet with the author of this virus or any virus author so I could proceed to beat the holy living shit out of them. Then pound them until they are pink mush. And then beat them some more. And then form their geletous refuse into the shape of a human again and start all over.

As you can tell, I’m not too happy about all of this.

It happened when I innocently tried to look up some lyrics. I know that these days, Googling for song lyrics is pretty much just pulling up a list of spyware/virus sites. I had gone through this before so to try to head this off, I scrolled down a few pages in the hopes that I could get past the big ones and try to catch the lessor infected sites.

Uh…..no.

The second I hit the link, I knew I was infected. Pop-ups were coming fast and furious and my blocker was knocking them down as fast as they appeared. But then the tell-tale sign that I was infected came when my start-up monitor and another protection program came up and ask if I wanted to allow a certain executable. The good news was that it caught it but the bad news, I knew, was that it would continue to ask me over and over, in effect, screwing up my computer.

I knew I was screwed and while I knew I would get rid of it, the deep, aching feeling hit that I was going to spend too much time (defined as more than 5 seconds) undoing what some shitbag programming jackass did to me. So the steaming began.

My first reaction is to run Ad Aware. After updating it and running it, it caught the normal 15 trillion problems but I knew deep down inside that it would not fix this. I then ran Spybot Search and Destroy. Same result. I restarted my computer and still got infection warnings. Crap!!!

I then went to my Windows/system32 folder and sorted the files by date. I found a couple of .exe and .dll files that I tried to erase. Sure enough, they didn’t want to go away which meant they were in use and not for anything good, mind you.

The next thing to do was to start my computer in safe mode (gets the computer basically up but doesn’t load all the extra crap, some of which are the infected files). I went and erased the suspected .exe and .dll files. I ran both Ad Aware and Spybot S&D again (both of which take forever on my monstrous hard drives). I started the computer over and …

Still infected.

My response was not very proper. It rhymed with “suck.”

Now I knew I’d have to go to the next level of extermination: research.

The behavior was that I was getting pop up ads. How this happens I don’t know. I have a router with a firewall. I have a startup monitor. I have a watchdog program. I have Symantec Antivirus that I update and scan every night. I have Google Popup blocker. I keep updated and run Ad Aware and Spybot S&D often.

This was a very advanced program to get through all those defenses. And while I could have seen it as a worthy opponent, I didn’t. I saw it as an intrusion and a source of forced time waste.

I noted that the title bar of the pop up ads I was being served, there was something that said “Aurora – a part of the ABI Network.” OK, I knew who to bomb. Just kidding… where to start.

I found out that “ABI” stands for “A Better Network” and it was a company who supposedly served ads to people who want them. Come on guys, NO ONE wants these ads and especially when they are snuck onto your computer without a way to get them off without drastic measures.

I found a message board that talked about it and gave a few links to places I could go to get it removed. In particular, I found a script that had particular instructions to remove it and while I find it reassuring that this Trojan Horse I had stumbled on was well known, it was a new, rather nasty little bastard and it would cost me some time to rid myself of it.

Here is what it basically had me do: download two free programs (one really free and one that was a trial version). Start in safe mode and run the first one. Then run the second one. Then run Hijack This and get rid of a registry entry. Seemed simple enough, huh?

Well, then you have not been a long-time Jason-Blog reader.

I ran the first one which when unzipped created two files, one of which I was supposed to run but neither of which were named what the instructions told me they should be named. So I took a guess and not much happened, which was what it said would happen. Bad instructions, guys. You don’t tell someone that “nothing will happen” when you perform a step right because if they screwed it up (as I’m known to do from time to time to time to time…) then there is no difference in what happens if you do it right or wrong.

I then started the second program which was nothing more than a scan of my system much like Ad Aware. The problem was that my hard drive is huge and it wanted to run a scan on my backup drive, too. So with this set in motion, I went to do other things while hours passed.

When it finally decided I had had enough, it got done and I ran HiJack This, as asked. I found the registry entry and killed it.

At this point, I was supposed to start the computer in regular mode and everything was supposed to be hunky dory. And you know I just can’t let that happen so for S&G, I ran HiJack This again to see what should happen. As expected, there was no slimy bastard commie shitbag entries from spyware and I was happy. Had I effectively killed this cockroach of a program in one afternoon?

Unbelieving (or maybe just to get the thrill one more time of seeing a clean scan), I ran HiJack This one more time.

Part of me says I should have left good enough alone. The other part of me says that it’s better I found out since not knowing wouldn’t change the fact. A third side says that he likes strawberries and that he wanders if his fist can fit into his mouth. We tend to ignore that side but he takes over when in long meetings.

The entry was back.

Sonofabitchbassbastardfaglovingpieceofdogshitmother…

OK, ok, maybe I screwed up the first step by picking the wrong file to run. So I went back and ran both of them. Many times. There, you bastard, did I run the right program THIS time? (yes, that’s both huffy and pissy)

It was getting late so the idea was just to set it into motion and go to bed, secure in the knowledge that I would wake up blissful and once again, fully scanned. Wow, now that sounds both dirty and scary.

I fell asleep mumbling. It bore a striking resemblance to this once again:

Sonofabitchbassbastardfaglovingpieceofdogshitmother…