The other night my neighbor, Fireman Joe, stopped by my house asking me to fix his computer. It's a PC running Windows XP, and the problem he was having was that the icons kept disappearing and re-appearing.
Okay, I know that Macs and Linux systems don't have these problems. I get it.
*Deliberately long pause for the Mac and Linux users to get the snickering out of their systems*
Now on with the story.
Apparently, Fireman Joe, never got the memo that I don't fix computers anymore, I audit them.
Fireman Joe: Hey. So ya think you can come down and fix my computer?
Me: You know I don't do that anymore. Right?
Fireman Joe: Whadda ya mean? I thought you worked with computers.
Me: Well yeah, but I don't fix them. I audit them.
Fireman Joe: So? What's the difference?
As I went into my standard audit-speak explanation about how I evaluate system risks and render informed opinions, I could see the Homer Simpson-esque expression on his face take hold. You know that look. The disinterested, glazed-over look in his eyes, and the drool slithering from his mouth told me it was time to can the excuses and help the guy out.
"All right, Joe," I said. "I'll stop by later and take a look."
So there I was last Tuesday night, watching his desktop screen flicker and wondering "what the fuck is this?", which is step 1 in my process for fixing systems. The process goes like this:
- Stare at the screen and ask, "what the fuck is this?"
- Politely ask the system user/owner what they were doing right before the problem started without it sounding like an interrogation.
- Stare at the screen again and check to see if the system has a running firewall, anti-virus and malware utilities, and bitch if it doesn't.
- Bitch about the fact that people still use Internet Explorer.
- Take another deep breath and remember that these types of problems are not always of the ID-1o-T system user/owner type.
- Fix the problem, or give options if the problem can't be fixed (e.g.: Sorry, but you're going to need a new hard drive).

I spent a total of 6 hours over two separate nights figuring out what was wrong. Eventually, I fixed it using the Spybot Search and Destroy program, but that wasn't my first choice to solve the problem. In fact, it was my last choice and desperate one at that.
I ran MSCONFIG to disable some unusual programs from starting up. I scanned for unusual services in the Microsoft Management Console and found nothing, and checked the system registry for signs of malware. Nothing.
By 10PM Tuesday night, I had made very little progress. That's when EQ started dropping hints that it was time to go home.
EQ: What time do you get up for work in the morning?
Me: 5AM.
EQ: Shouldn't you be in bed already?
Me: Nah, I don't need a whole lot of sleep.
EQ: But aren't
you tired from such a
long day?
I got the hint. As I was walking out of their house, I told them I need to do some research and that I would come back with an answer. I was not giving up.
What I learned the next day was that the culprit behind the case of the blinking icons was a nasty virus called
virtumonde. Google's search engine was a big help here because my initial search of "explorer.exe problems" led me to a bunch of different links advocating the use of Vundofix.exe. I downloaded it and copied it to a memory stick and called Fireman Joe the next night with the good news.
"Stop by tomorrow," he said.
"Sure thing," I replied "and it won't take as long as Tuesday."
Promises. Promises.
Not only did the Vundofix.exe program
not work, but neither did HiJackThis!, Ad-Aware, AVG Anti-spyware nor the free version of Norton Internet Security 2008. Two hours into night number two, I was back at Step 1. Shit! I was ready to call it quits when I noticed (in between icon blinks) that the Spybot Search and Destroy installer was on their machine. I decided to give it a try. It was now 9:45PM and EQ was getting antsy again.
EQ: Should I call Geek Squad?
Me: No. Let me try the Spybot.
EQ: But don't you have to get up early for work?
She agreed to let me continue and became even more antsy when Spybot didn't catch the problem. But then a screen popped up asking if we wanted to update to a newer version of SpyBot. "What can it hurt?" I asked EQ. "I'll install it and you can monitor it to see if a problem comes up."
That did the trick. Not only did the updated version find the virtumonde.dll file that was causing the problem, but it also found several malicious registry settings that disabled the Windows Update component that keeps Windows systems patched.
EQ was elated. I was relieved. After the system restarted with no blinking icons, I downloaded and reinstalled AVG Antivirus and the ZoneAlarm personal firewall, and was out their door by 10:30PM. Before I left, I asked EQ again how come the system had no firewall and antivirus program installed.
EQ: Oh. My sister's boyfriend said that taking it off would speed up the computer.
I wanted to call her sister's boyfriend an idiot, but I realized that I had already run Step 3 twice and that it served no purpose to validate Step 6.
What I also realized is that the excitement and satisfaction I get from auditing systems is nowhere near as exciting as fixing them. Anyone else having a problem with their PC?