As I have mentioned previously in this blog, I am graduate student in Electrical Engineering. As a result, I am sometimes considered to be a "whizkid" at least among some of the elder members of my family. They often assume that I should be able to fix just about any kind of mess involving new and not so strightforward technology (most of the time this means computers). While I can help with basic queries, I am not really a big "computers guy" and I avoid giving any such impressions as far as possible.
They say that necessity is the mother of invention, and I found myself having to upgrade my computer savviness by a notch this week. Two of my lab computers were infected by trojans and spyware and he situation was becoming intolerable. Apparently, the infection had taken place while I was in India, and my labmate Krishnan had carefully kept the infected computers untouched until my return. By implication, I was supposed to try and fix these things while Krishnan took his one month break. The trojans were of the pesky variety that kept opening random popups when the user was browsing other websites. Most of the pop ups would open in internet explorer even if one used only firefox. As a result, not only were browsing speeds reduced, but CPU and memory was also being overused.
The first of these computers I managed to fix after a long protracted process that involved me scanning the system multiple times, posting logs on an online forum dedicated to helping hapless victims of malware and waiting for instructions from the resident hackers. The whole process took 10 days but at the end of it, the computer was rid of its trojan and things became normal. I must mention of course that both the computers in my lab are somewhat old and therefore, were as fast as a tortoise on crutches when they were infected. It was a relief to get one of these PCs healthy and I was looking forward to cleaning up the other one as well.
Unfortunately, the guys at the forum did not respond to my second request for help, which was a bit strange. I waited two weeks for a reply and did not get one in spite of repeated bumps. There wasn't anything else I could do because those guys on the forum were volunteers and were giving tech support for free. Given my lack of options, I decided to try and fix everything on the second PC by myself.
I started out by running a complete scan of the system using one of the numerous scanning software available for free. The program produced a log that pinpointed the locations of all the files related to the trojans (and there were a helluva lot of them). I just had to delete the files while
making sure I did not screw up any system files along the way.
The more perceptive reader will surely be able to see where this is headed. Among the files that the scanning software pointed out, there were many windows registry entries. The windows registry is something like the heart and soul of the OS. In general, tampering with the registry is a bit like doing brain surgery with a hacksaw. It is something that only an expert should attempt (as a last resort) because there is simply too much that can go wrong. However, I was desperate to fix the machine and so I went ahead with my slash and burn style of cleaning up the PC even though I knew a misstep could cause the PC to crash.
I was really pleased when I had removed all traces of the spyware from the PC without causing a meltdown. However, I was shocked a little later when I realized that I simply could not connect to the internet anymore. After a little investigating I found out that while manually cleaning things up, I had somehow screwed up the TCP/IP settings in the registry. I had a different mess on my hand than what I started with and I felt bad for screwing up this way. So I immediately went to google and tried to search my way out of my predicament. I will not go into the details, but I will say that Windows XP does not intend its users to go around fixing stuff by themselves. There were a few sites which listed some simple steps I could take to "reintialize" the TCP/IP registry keys but these steps were all ineffective. I needed to do a complete reinstallation of the TCP/IP protocol to make things work again but XP explicitly considers TCP/IP to be a core of the OS and doesn't allow any user to uninstall it.
After a lot of time spent on google, I finally came across a web page which offered a brilliant hack to fix this whole mess.
This link actually specifies how you can change the permissions in order to make XP allow you to delete TCP/IP and then do a full reinstall. Some people might view this as a vulnerability in XP (since the user does something he should not be able to do), but in my opinion, it is one of the best examples of hacking. If you want to explain the essence of hacking to a layman, this would be a very illustrative example, as it shows a very innovative and non obvious solution to a hard problem.
That, in a nutshell is how I almost became a white hat hacker this week. I had great fun tampering with the registry entries, even though the whole thing nearly blew up in my face. The only thing left for me to do now is to get a T-Shirt saying "I Hacked the Windows XP registry and I Loved it". Any idea where I can get one of those?