Gee, I Think I Have a Virus

 
 
By Larry Seltzer  |  Posted 2005-09-06 Print this article Print
 
 
 
 
 
 
 

Opinion: System error or malware? Windows can keep you guessing.

When strange, inexplicable things happen on your Windows computer, what do you assume is the cause? Probably, youll think you have a virus, or some spyware, or one of those other bad things you read about even in the local newspaper. But you may be wrong. Very few things about Windows are inexplicable to Mark Russinovich, co-founder of Winternals Software and author of numerous essential Windows tools and books. In a recent Weblog entry, Russinovich detailed his investigation of "Intermittent (and Annoying) Explorer Hangs."
He didnt bring up the malware connection, probably because his problems had nothing to do with malware and he knew it, but I thought of it.
The highly condensed version of his story goes this way (I really do recommend reading the whole entry): Windows Explorer was hanging temporarily for as long as a minute on a particular machine during certain circumstances. It turned out that he had recently decommissioned a different machine on his network, and that he had used an application shared from that computer on the problem computer. The use of that shared program resulted in the registration of icons on the problem computer, and the icon files were located in the shares on the now-decommissioned computer. The icons were associated with folders where the program had been used to browse content. Read more here about how to spot hidden malware in registry names. When Explorer browsed those folders, it attempted to load the icons. Because Windows Explorer is largely a single-threaded program, it hung for a long period of time. Russinovich was able to diagnose the exact cause of the problem using the excellent registry- and file-monitoring programs his company builds. (Many of them are free.) But only very sophisticated users, mainly developers, are capable of this, and normal users would be befuddled by the task. He closes by observing, "This is just one example of the many types of Windows issues that cause users to complain that their systems slow down over time and that result in a general I dont know, just reinstall mentality. I hope Vista does better." I bet a lot of those users would take this sort of behavior and assume they have a virus. The ones who were a bit more sophisticated would assume they have some sort of spyware, and theyd still be wrong. Click here to read a commentary on safer updating behind the firewall. They would proceed to run spyware scanners which—guaranteed—would find dozens of potential threats. Most of them would be innocuous cookies, but how are most people to know the difference? Like Russinovich, Im shaking my fist in the air at Microsoft, but there are more general constructive points to make too. Russinovich points out that Explorers single-threaded nature allows obscure circumstances to consume it at times, and this is a good point. Certainly by now non-essential network tasks such as the one that failed on him should be spun off into threads. I think the more important point is the lack of communication with the user. Not only was the failure to find the icon file not communicated, and nor that the machine on which it was supposedly located wasnt present, but the error wasnt even logged in one of the event logs. In a sense, its impossible to know how many such errors go silently ignored, and potentially bombarding the user with error messages isnt necessarily the answer. But making a consumer operating system is partly a struggle to find a balance between guiding users and leaving them free to do what they want. Perhaps a "verbose" mode would be useful for Windows, in which readable error logs could easily be read, eliminating the need to resort to regmon and filemon (the tools Russinovich used). Vista does supposedly have a better Event Viewer, but its still an experts tool. In Russinovichs case at least, it should have been easy to come up with an error message that even a relative novice could recognize: "File xxxxx.ico on machine yyyyyy not found" and/or "Machine yyyyyy not found". Not every obscure error is this clear, but the situation does show how far Windows has to go. I also hope Vista does better on this. Does anyone else agree that system errors are often indistinguishable from malware attacks? Even an expert could be confused by this one, and there are many other circumstances, hardware failures for example, that can be similarly confusing. The lesson is that it may be practical to give up and reformat, but jumping to a conclusion doesnt make that conclusion true. Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. He can be reached at larryseltzer@ziffdavis.com. Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.
 
 
 
 
Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel