Viral Infections at the Client Site

Submitted by Eus
on August 13, 2009 - 7:37am

Yesterday at the client site I got a report that one of their Windows XP machines kept restarting all the time. I had known for sometime that the machine was problematic because of heavy viral infections. So, I was reluctant to fix it. At the same time, the important PC that hit an interesting problem as described in http://kerneltrap.org/node/39213 got a blue screen when it was restarted or shutdown. Okay, I would have just let it be like that if the blue screen only had appeared during shutting down. But, after I installed a NIC card for bridging two subnetworks, I got a blue screen everytime I logged in as one of the users.

Fortunately, the blue screen that appeared after I logged in as one of the users told me the file that caused the problem. The file name was so contorted that I suspected that it was created by a virus. So, I went into Windows Safe Mode, deactivated all alien programs under tab `Startup' of `msconfig', and deleted all files having contorted names from `c:\windows\system32\drivers'. That does fix the problem.

From this one computer, I realized that the machine that kept restarting encountered blue screen as well. But, because the Windows XP's option to automatically restart the machine everytime a critical error occurs hadn't been turned off yet, the machine was restarted instead of displaying the blue screen. So, I turned the option off. This time, the blue screen showed no information regarding the file that caused the problem. Equipped with the previous experience, I deleted all files having contorted names from its `c:\windows\system32\drivers' and turned off all alien programs under tab `Startup' of `msconfig'. This does fix the problem within 10 minutes. I thought I would have a hard time dealing with this machine since doing fresh reinstallation wouldn't be so easy considering two important proprietary local programs lost their original installation CDs already.

So, well, I don't kill the viruses; I just don't want to spend my energy on cleaning up a proprietary system. I just help the users of those PCs to be able to work normally again. Whew, one day those PCs are going to "explode", and if my suggestion to have a periodic back-up is not followed, I dare not imagine how enraged the users will be.