I'm starting to keep count

[mouser.livejournal.com]

Maximum number of toolbars found on a single system: five

Maximum number of virus programs: two (but a coworker found three on one...).

Comments

[falnfenix]

you're just starting to chip the surface, there...

[ex-deliveryboy.livejournal.com]

[xforge.livejournal.com]

Do individual instances of spyware and hijackware count? And this would not even include cookies; I once did a salesman's laptop that had over 500 pieces of hijackery, and I'm not even sure I got them all.

[mouser.livejournal.com]

Ah - but those were done to prove a point, - and unless YOU get to fix them it really doesn't count.

[mouser.livejournal.com]

These machines were all reimaged just three months ago.

[vampireborg.livejournal.com]

I'll admit to using the StumbleUpon toolbar mostly because it amuses me to go Wiki hopping.

My favorite scan that I did, it still amuses me four years later. Win 2K box, someone went to go play poker. Whoops.

[falnfenix]

and?

when i worked at my old job (hospital IT), we'd have to reimage one machine in the ED every few weeks. it wasn't in a public area - the techs just don't know how to use the computers for work purposes. even when the department's computers are thoroughly locked down, it's surprising how much crap they manage to install.

basically: get used to it. it won't get much better until they're all logging into a terminal server.

[wolfhound668.livejournal.com]

I had a developer start at my company about three months ago. Within a week his laptop had to be reimaged due to a nasty zero-day virus. Two months later he did it again.

This guy works in IT and in theory at least should know better.

[jimbojones.livejournal.com]

I actually have the most perniciously infested computer I've ever seen on my workbench right now. Not so much in terms of "most random crap on it" - it's not even close, on that category, I've seen machines with ten or so toolbars and any number of other pieces of crap on them - but just in terms of how VILE and impossible-to-repair it is.

I took this damn thing as far too much of a personal challenge and spent nearly seven hours on it, pulling every stop out - I booted into Linux from a boot CD and ran CHNTPW (Offline NT Password and Registry Editor) and deleted files, ran ComboFix, GMER, MBAM, and more while booted into Windows, you name it. Seven fucking hours. After seven hours, I thought I had it licked - I'd gotten clean scans on MBAM and ComboFix, antivirus programs would actually run without me needing to rename their mutexes so the installed rootkits wouldn't lock them or send them to the debugger, AVG was getting updates... life was good.

Well, life was good for maybe five minutes - then AVG started reporting rootkit agents in NDIS.sys and about ten or fifteen more actual, legitimate, necessary-for-operation Windows system files.

At that point, I said "fuck this noise" and did what I should have done after two hours - pulled the machine and taken it back to the lab to salvage data C-A-R-E-F-U-L-L-Y and nuke the rest from orbit.

This is the XP Service Pack 3 workstation of a user who has only needed one other cleaning in the past two years (which was done only two months ago), and whose only bad habit is looking for internet games to play. Not gambling, mind you - the best I can figure from the forensics of the thing is that she originally got nailed by a trojaned version of a free game called "Diner Dash".

Sigh.

find /mnt/sda1 \( -name *.exe -o -name *.com -o -name *.sys -o -name *.dll -o -name *.tmp -o -name *.cmd -o -name *.bat -o -name *.scr -o -name *.pif \) -delete

[mouser.livejournal.com]

...files scanned ten thousand, files infected ELEVEN thousand...


Okay - that's amusing!

[vampireborg.livejournal.com]

Twelve thousand registry keys scanned, THIRTY THOUSAND infected. It was awesome for me as the PFY intern to have to fix.

[bothunter.livejournal.com]

May I suggest DeepFreeze from Faronics? (http://www.faronics.com/)

[mouser.livejournal.com]

I know the product and REALLY wish I could - but we're contract I.T. and they've made us leave them local admin.



I'm just glad it's fairly easy to reimage.

[spaz-own-joo.livejournal.com]

[ptstech.livejournal.com]

Ouch.

[amynnah.livejournal.com]

I just passed this around the Support Groups... :D

They thank you for the laughs. :)

[bothunter.livejournal.com]

Then let them be local admin. DeepFreeze will just undo all of their stupid mistakes!

[ravenofdreams.livejournal.com]

My toolbar record is nine. AV - two, at least that were updating.

[the-s-guy.livejournal.com]

Go get 'em, Edgar!

[hyuga.livejournal.com]

Really? Only five? I mean, don't get me wrong, that's a lot. But surely there's been worse...

[hyuga.livejournal.com]

I see this point has already been well made upthread :P

[shirenomad]

Whoa! That is not a small number! That is a BIG number!

[vampireborg.livejournal.com]

OMG KENSHIN.

It never fails to amuse me that there were over twice as many registry keys infected as EXISTED on the system.