Opinion: System error or malware? Windows can keep you guessing.When strange, inexplicable things happen on your Windows computer, what do you assume is the cause? Probably, youll think you have a virus, or some spyware, or one of those other bad things you read about even in the local newspaper. But you may be wrong.
Very few things about Windows are inexplicable to Mark Russinovich, co-founder of Winternals Software and author of numerous essential Windows tools and books.
In a recent Weblog entry, Russinovich detailed his investigation of "Intermittent (and Annoying) Explorer Hangs."
He didnt bring up the malware connection, probably because his problems had nothing to do with malware and he knew it, but I thought of it.
The highly condensed version of his story goes this way (I really do recommend reading the whole entry): Windows Explorer was hanging temporarily for as long as a minute on a particular machine during certain circumstances.
It turned out that he had recently decommissioned a different machine on his network, and that he had used an application shared from that computer on the problem computer.
The use of that shared program resulted in the registration of icons on the problem computer, and the icon files were located in the shares on the now-decommissioned computer. The icons were associated with folders where the program had been used to browse content.
Read more here about how to spot hidden malware in registry names.
When Explorer browsed those folders, it attempted to load the icons. Because Windows Explorer is largely a single-threaded program, it hung for a long period of time.
Russinovich was able to diagnose the exact cause of the problem using the excellent registry- and file-monitoring programs his company builds. (Many of them are free.) But only very sophisticated users, mainly developers, are capable of this, and normal users would be befuddled by the task.
He closes by observing, "This is just one example of the many types of Windows issues that cause users to complain that their systems slow down over time and that result in a general I dont know, just reinstall mentality. I hope Vista does better."
I bet a lot of those users would take this sort of behavior and assume they have a virus. The ones who were a bit more sophisticated would assume they have some sort of spyware, and theyd still be wrong.
Click here to read a commentary on safer updating behind the firewall.
They would proceed to run spyware scanners which—guaranteed—would find dozens of potential threats. Most of them would be innocuous cookies, but how are most people to know the difference?
Like Russinovich, Im shaking my fist in the air at Microsoft, but there are more general constructive points to make too. Russinovich points out that Explorers single-threaded nature allows obscure circumstances to consume it at times, and this is a good point. Certainly by now non-essential network tasks such as the one that failed on him should be spun off into threads.
I think the more important point is the lack of communication with the user. Not only was the failure to find the icon file not communicated, and nor that the machine on which it was supposedly located wasnt present, but the error wasnt even logged in one of the event logs.
In a sense, its impossible to know how many such errors go silently ignored, and potentially bombarding the user with error messages isnt necessarily the answer. But making a consumer operating system is partly a struggle to find a balance between guiding users and leaving them free to do what they want.
Perhaps a "verbose" mode would be useful for Windows, in which readable error logs could easily be read, eliminating the need to resort to regmon and filemon (the tools Russinovich used). Vista does supposedly have a better Event Viewer, but its still an experts tool.
In Russinovichs case at least, it should have been easy to come up with an error message that even a relative novice could recognize: "File xxxxx.ico on machine yyyyyy not found" and/or "Machine yyyyyy not found". Not every obscure error is this clear, but the situation does show how far Windows has to go. I also hope Vista does better on this.
Does anyone else agree that system errors are often indistinguishable from malware attacks? Even an expert could be confused by this one, and there are many other circumstances, hardware failures for example, that can be similarly confusing.
The lesson is that it may be practical to give up and reformat, but jumping to a conclusion doesnt make that conclusion true.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. He can be reached at larryseltzer@ziffdavis.com.
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.
Network Security & Hardware 
