the Hushed Casket

I forgot to mention how my PC got infected, and what my impressions were of the software I was using at the time. My 17yr old cousin was over, and wanted to show me a CD he thought I should download from a fairly popular torrent site (isohunt.com). I told him to go ahead, thinking my (current w/ all updates) anti-malware setup would catch any malicious files. Well, before I could look at what he was doing (we were playing Guitar Hero 3), he had opened IE6 (which was the first mistake-- knew I should have deleted that shortcut!), gone to isohunt.com, and began the dwnld with uTorrent, w/out taking a look at all the files listed, and the type of extensions (mostly mp3s, but a few weird file extensions towards the bottom of the list). The spyware that someone was so kind to include then proceeded to try and hijack my desktop. It modified who knows how many registry keys, and changed my desktop background to a warning and a link to take me to a website that would supposedly "remove" the spyware (likely add more to it!). It even disabled the "Desktop" tab in Task Manager, so I couldn't change it back. It also effectively locked me out of regedit by having it automatically close itself after being open for only a few seconds. Not enough time to navigate to the keys I needed to modify/delete.

ZoneAlarm caught it first, when an executable file was trying to access the internet. Norton was close behind, finding the file that was trying to phone home, as well as several others. Once Norton was done w/ the quarantine process, I did a scan w/ AdAware. It didn't find anything new. So, at the time, it didn't serve a purpose.

I then did a Live Update w/ Norton, as well as AdAware. I rescanned w/ AdAware (it's updates dwnlded faster). However, by the time Norton was updated, I could no longer scan. Some file that had NOT been detected began copying itself, or replicating some other data, nonstop, until it COMPLETELY filled up my C:\drive. If I deleted something, it would have some free space for a few seconds, and then be full again. It was then I found out that Norton cannot scan without some available room in whatever drive it is trying to scan. The virus had effectively disabled Norton antivirus. I was not happy at all with that.

It was time for a fresh install of Windows, anyway, so the next day, I wiped the partition that my O/S resides on, and reinstalled WinXP Pro (more on that later). And, I decided to try some different anti-virus/spyware and firewall programs. Norton uses too much system resources for my taste (not to mention it's susceptibility to be crippled). ZoneAlarm got bought out by Check Point systems (used to be Zone Labs). I don't know if the buy-out was a good or bad thing (probably neither), but I knew there were other things out there. AdAware by Lavasoft, in my experience, has been ok, but I wanted to give some other programs a look.