Craptastic

about
articles
news
search
videos
home

Photorific

Login
Register«

Cooliferous

images (NSFW)
searches
taa
buy stuff
Last.fm
Facebook
» bug reports

News Talk

So much fo~
...
You Have T~
Facebook i~
Continuing~

Article Talk

World Of W~
Now What D~
Part 21: A~
Oblivion
Part 18.5:~

New Articles

Fast Eddie~
World Of W~
Now What D~
Part 21: A~
Part 20: A~

News

So much fo~
Go Canada ~
...
Sittin'
You Have T~

Don't Reformat

By: Quigley
on Friday, December 8th 2006 at 7:43pm

Windows really sucks. We all know that. But sadly, it must be dealt with. Makers of various viruses and other malware type things are aware of this, of course, and go out of their way to make my life as a tech a living hell. Until recently, I tended not to bother with too much sleuthig: "if it's broke, reformat" was my motto. But no more!

My most recent deal (finished about five minutes ago) was a hideous mess. How people let their computers get like this is beyond me. I was greeted with several illegitimate processes running on startup, a half-installed version of Norton Internet Security 2006, myriad "helpful" toolbars and ad agents and data miners, etc., etc., a corrupted Windows Update that was stuck in an endless cycle of trying to install its most recent automatic update (which was, ironically, the Malicious Software Removal Tool), and my personal favourite, no ability to run Windows Explorer, Internet Explorer, Control Panel or anything related (unless in safe mode).

It's all fixed now, and what's miraculous is that I didn't reformat! Normally I would have, but for some reason I was compelled to take this personally, and plug away at it till it was done.

My first step was to remove the various viruses, etc. This was relatively easy. Can't download software 'cause IE won't run, so I burned various things to CD and ran setup from the command prompt (stupid virus didn't stop that from running... duh!). I installed AVG 7.5, updated the def's, did a full scan, and deleted everything in quarantine. I then installed AdAware, and did the same thing.

Then, checked through the registry, startup stuff, etc., and through currently running processes, and Googled anything with which I wasn't familiar. Nothing illegitimate left! The problems, however, are all still present.

I tried installing Firefox and downloading a fresh IE6. No change. Googling around trying to find info on the issue, I came across, as one always does in a case like this, millions of ubiquitous tech forums wallpapered with HijackThis logs. I'd never used HijackThis before - never needed to, actually; I've solved everything else to date just fine without it. This was beyond my ability, though. I needed better tools. Is HijackThis a good tool? I'm not really sure, but in this particular experience, it worked beautifully. I ran a scan, deleted all the browser hijack objects it identified, and explorer worked again. Poof! Magic! 30 second fix! I checked, and sure enough, the Control Panel, search, Windows Explorer, IE, etc., all worked just fine, like they were supposed to.

There were still a couple of toolbars left in IE. All their supporting files and nasty bits have probably been deleted by now, but they're there, and they're annoying. I downloaded AVG Anti-Spyware Free Edition, on a hunch (and out of curiosity 'cause I'd never used it either), and used it to remove them. Easy enough. Now there are only two problems left: Norton is kicking out errors every time Windows starts up because it's only half installed and has its leg caught in the door, and Windows Update won't run. The former was a simple matter of Googling around and discovering that there was a special removal tool provided by Symantec to get rid of all registry values, files, etc., in the case of a corrupted install. This worked fine. Now on to problem 2.

I tried to scan for updates and received an error message. I searched around for the error code on Microsoft's web site. NOTHING. I double check. Nothing. I triple check that I have the error code right. Nothing. I Google it. I get a whopping FOUR search results. Can you guess what they all are? Yep! Posts on tech forums saying, "help, I have this error code in Windows Update and I can't find any documentation on it." I tried upgrading to Microsoft Update. That also revealed an error. It said that some necessary files had been removed and it had to download them fresh and register them. A progress indicator shows Downloading... 100%... Registering... 100%... Done! And it sends me back to the main page. I click the button to upgrade to Microsoft Update. Can you guess what it does? Yep again! Same damn thing! I try disabling AVG. Ditto. I note the other option: search for info on the error code. Well that didn't work last time - fuckers - but maybe they'll have something on this code. They do! I must use regsvr32.exe to register MSXML3.dll. DLL registration failed! Error code 0x80070005. I Google the error code. It means... ACCESS DENIED!

So from here it got tricky. By this point I've had the client's computer for far too long. I mess around for ages, trying various things that come to mind. No, it doesn't work in safe mode. No, it doesn't work if I overwrite MSXML3.dll with a version I know works from a stable system. No, no, no. I give in and try Microsoft's helpful online help service. A tech emails me back within one business day as promised. He gives me a phone number to call and says that they will help me. I call the number, and after being on hold for ages and having to very slowly spell out my first and last name and product ID code, I'm told that because it's OEM software, they will charge a $35 fee for tech support, and otherwise I have to return it to the manufacturer. I AM the manufacturer, I tell them. Well then pay the fee, they tell me. I hang up.

Googling around ad nauseam, I manage to find someone who claims to have an answer to this exact problem - the inability to register MSXML3.dll with regsvr32 after being told to by Microsoft's FAQ in regards to a Windows Update error. He says to check out various versions of MSXML 3.0, and indicates that, while simply downloading the old versions won't work (as I had already discovered), MS did release an .msi file that installs and registers all related files in support of MSXML 3.0 Service Pack 7. I search around on Microsoft's web site and sure enough, there's the .msi to which he referred. I download it, and run it, and...

... VICTORY IS MINE! After days of messing with this crap, I'm done. Windows update is in the process of finishing off the installation of .NET 1.1 and 2.0, and when I reboot of course there will be service packs, bug fixes, bug fixes for service packs, security updates, service pack security updates, security updates for bug fixes of security updates of bug fix service pack security service security bug fix update update bug fix security service update AAAAAAAAAAAAGH!!!!

But it will be done, and that's what matters.

The moral of the story here - and where I return to the title of my article - is that you don't need to reformat. Ever. I'm convinced of that. This whole episode has cost me a lot more time than a reformat would have. But the advantage is that in place of the sense of futility and frustration, and in place of combing through the hard drive searching for data the user might want to keep, cataloguing it, burning it to CD, forgetting to copy their address book before reformatting and knowing that they'll tell me as soon as I call that that's the one thing they really need me to keep, having to explain why I need all their driver CD's and software discs and listen to them tell me about how normal people don't keep that stuff and I wouldn't understand 'cause I'm a tech... I get a sense of accomplishment and victory, and most importantly, instead of backing out of the problem, I learned a thing or seventeen about how to deal with it much faster in the future. Give me another system like this and I'll have it done in no time flat.

So next time... don't reformat. Kick its ass!

Other Articles

Next: The Warrior from Quigley
Previous: Goddamn... Shit the Bed from Quigley
Previous: Willpower from Anesthetic

Comments for Don't Reformat

prev . 1 2 . next
11 Comments

Quigley Wrote...

Friday, December 8th 2006 at 7:44pm

there are spelling errors... bite me. :)

Quigley Wrote...

Friday, December 8th 2006 at 7:45pm

(they're typoes; my real speling is imppecable)

mike Wrote...

Sunday, December 10th 2006 at 9:21am

Next time, please reformat. You never can know what has been compromised.

An even better idea, is to reformat... and make an image of your CLEAN install. And by clean, I mean you should probably do all the installations and updates offline from cd. Now, the next time your computer is infected, you wipe it clean and restore back to your clean version. Now you a) know it's clean, b) haven't wasted your time reinstalling programs, and also c) haven't wasted time hunting down spyware.

Rule of thumb: Keep data and programs on separate partitions, this makes formatting the program partition easy and your data is always there when you get back.

mike Wrote...

Sunday, December 10th 2006 at 9:23am

Oh, and next time... it'll be just as hard. Since the spyware/malware guys will have figured out an even better gaping hole in windows to use, and there will be no documentation on the net on how to get rid of it.

And I really have to say it... when I was running windows and using firefox only, no spyware ever touched my computer (unless my wife downloaded it in another software package... ie, funny icon packs). Now that I'm running Linux, I worry about it even less.

SmrtySsa Wrote...

Sunday, December 10th 2006 at 8:37pm

Yeah, what he said.

I have a simple rule when i fix someone's crap, if It doesn't work after a single sweep, scan & "repair" of various tools I format. I only backup stuff in the documents & settings, and if I feel nice I'll do a full dump of program files for those retarded apps that save stuff where they shouldn't.

After that, pewf. Kiss it.

Quigley Wrote...

Tuesday, December 12th 2006 at 1:46pm

d: Your simple rule wouldn't work for me. People pay me $87.50 per hour to do this stuff. They don't give a rat's ass about my convenience; they want their data.

mike: Why the hell wouldn't you know what's been compromised? Check it out. If it works, leave it. If there's something you can't figure out, then fine, but in this case, that didn't happen to me. It was obvious what was compromised, and I fixed it. There could be other corruption, I suppose, but if it doesn't affect function, then what bloody difference does it make? It ain't national security, dude.

I got hit once. Someone sent me BackOrifice and I was dumb enough to open the executable because it was coming from a programmer who was a friend of mine and was actually toying with test code at the time and I figured I could trust them. I was wrong. This was a long time ago. Other than that, I'm with you. I don't have the faintest goddamn clue how people manage to get infected with shit of all sorts, but it never, ever happens to me. I just deal with a lot of people who are... well... grossly inept. :P

Also, regarding keeping data and programs, system files etc. on separate partitions, well... duh. :P Of course I do that, but long years of experience have told me that no matter how thoroughly you indoctrinate a client, they will start accepting default install/store/etc. directories the moment you turn your back on them, and then when you wipe their system partition clean, they'll blame you for the fact that their data is gone. Once again, the ideal solution is one thing, but isn't relevant to my article, which pertains to saving users from themselves.

SmrtySsa Wrote...

Tuesday, December 12th 2006 at 4:09pm

you have clients that will pay for days of work? impressive.

mike Wrote...

Tuesday, December 12th 2006 at 4:24pm

No, you missed the point. You don't KNOW what's been compromised. There could be even sneakier stuff on there you have no clue about. You CANNOT trust a computer after it has been infected with spyware. End of story. Let me remind you of the sony rootkit fiasco that happened a while back. Now just imagine that little silent install, which came from a supposedly reputable source, was actually malicious. Now ask yourself again: Are you sure you got everything? How sure? Are you willing to bet your business on that answer if you said yes?

Why do you think serious IT shops all re-image a computer when they get with spyware? Exactly the reasons I said above, and reiterated in this comment (and by serious I mean, corporate... not futureshop or those other idiots around who charge a billion dollars an hour). When it comes to your data, and even more importantly your customers data, you MUST be certain. If you want to do a quick scan for data stored in the wrong places, go ahead. But don't give me any crap about it being obvious. It is most definitely NOT obvious all of the time.

Quigley Wrote...

Tuesday, December 12th 2006 at 5:54pm

d: they don't pay for *days* at $87.50; that would be ridiculous. they pay what i charge them, which doesn't include any potential learning curve, and certainly doesn't include waiting for Microsoft to respond to emails. in this case i put roughly 12 hours of work into the system, interspersed by a lot of waiting. i charged for... 4.

mike: i appreciate you kicking my ass on this one. we're back and forth at each other so much i actually have trouble figuring out how to be humble without sounding sarcastic. seriously though, i'm humble. until this comment just now, and the hasty research that followed my reading it, i didn't know what a rootkit was. apparently i am more innocent than i thought.

i'm still confused about some things. so much spyware is so simple and people seem to get infected so easily... if you can't trust a computer after you know it's been hit, how can you trust a computer, period? what is it about a browser hijack and a compromised XML parser that makes it more likely that evil software may be lurking? don't get me wrong; i recognize the seriousness of this, but fresh install from a clean image or no, what's to say that a computer is at all trustworthy after it's been plugged into a router and in the hands of a client for 24 hours?

mike Wrote...

Tuesday, December 12th 2006 at 7:32pm

Well, maybe I overreacted a little bit... but you never can be too sure, especially when people who are barely computer literate are using the internet. It's just not a safe environment out there.

Darryl's philosophy is probably better, but I was trying to get a point across. If you can't do it in one sweep, it's something major and may have deeper roots. I *do* still recommend the clean image though, since it will save much of the time necessary for re-installations.

prev . 1 2 . next
11 Comments

You must be Logged in to leave comments.