Why I hired a genius
So yesterday I was feeling a little to confident over the health of my system, and wouldn't you know - I got some spyware from some website. Did I have Microsoft Anti-Spyware installed? No. Why? I'm an idiot, that's why.
All of a sudden I get a message on the desktop as an HTML document that I had been infected with spyware and that I should run PSGuard, which has already been conveniently installed for me. Turns out that PSGuard IS the spyware, and acting as a spyware removal tool, totally screws up your system.
Not only was shit popping up left and right but I couldn't remove the helpful message from my desktop. The desktop tab in the Display Property window was frickin GONE. That's right. Gone!
Recognizing the smell of the wool being pulled over my eyes I found this website which directed me to install XsoftSpy to remove it. After a bit of online research I came to the conclusion that this was a safe tool to install, so I did. Turns out it will tell you EXACTLY what's wrong with your system, but if you want to REMOVE the malware you have to register. So I paid them their money and it worked.. Sort of.
I will say that SpyBot did not find this bad boy. AntiSpyware didn't find it either. XsoftSpy actually worked.
Everything returned to normal except that outgoing SMTP and POP3 connections didn't work. So, outlook was broken. I tried connecting with Telnet to my mail server on ports 110 and 25 with no luck. Outlook reported that it could not connect.
No TCP Filtering on the network connection, and turning the firewall off didn't do squat. I was stumped.
So I called in my resident genius who I have on staff for just these kinds of issues. He's painfully shy so I won't tell you who he is, but suffice it to say, he figured it out.
Rich Pendleton who runs Interbridge, my ISP across the hall said he thought it might be that the TCP stack itself had been stubbed. So I told the Genius this and he suggested I run WinsockFix, a free utility that restores your Winsock stack to its original state.
So after this, something strange happened. Telnet to the mail server at port 110 connected but I got a blank screen and pressing any key killed the connection. Outlook was reporting that the connection was Interrupted. Interesting.
So, I immediately thought that this was a double-whammy. Not only did the spyware write over the TCP stack but it also had some accomplice blocking the port. That's the way it looked anyway.
So boy genius says to boot up in Safe Mode with networking support. Sure enough, I could connect. Genius says to download and run HijackThis, which generates a log file of all startup activity. I ran it in safe mode and emailed the log file to him.
We went through all of the exes and dlls that load up at bootup and nothing seemed out of place. All of a sudden he says.. go ahead and disable all the Symantec Antivirus services and reboot. I got what he was thinking, that antivirus software is an easy target of spyware, and I didn't think of that. That's why I hired him.
Of course, that's what it was. I don't know what it was doing, but for some reason, it was blocking my outgoing SMTP and POP3 connection.
Thanks, Einstein.