What is ‘老猫烧鬚’ (read as Loh Mau Siew Soh)?
It is a Cantonese idiom which literally translates as an old cat got its whiskers burnt, and refers to those people who f*cked up despite their knowledge and wealth of experience. How this came about, according to what I was told – no idea if it was urban myth or the truth – is that a cat uses its whiskers as a gauge on whether a passage is too small for it to squeeze through. An old cat would therefore get itself stuck in a hole too small for itself if its whiskers are burnt.
I have never seen a cat stuck in a hole, and whether that is true or not does not really matter. This idiom was brought up to describe what I have gone through recently. Because I do desktop support, I deal with many everyday Windows problems. I get so sick of some of these problems that like a broken record, I continually advise my friends and some times my users: Never click on ‘Yes’ on popup windows asking for something to be installed if you never asked for it; Never run unsafe attachments in emails; Keep your anti-virus and anti-spyware program updated etc. These simple rules help to keep out the nasties aka malware from the wild Internet – bogus spyware detectors, trojans, adware, popups etc. above the usual defenses already in place.
And recently, I did something which was particularly dumb on my home computer. I downloaded a spreadsheet which came with some macros. When I activated it, good old trusty Norman Anti-virus program popped up a warning, indicating that the spreadsheet contained a unidentified trojan. The information this spreadsheet provide was too tempting (and no, it is not a list of brothel or prostitute phone numbers from sammyboy.com), and so I foolishly turned off my anti-virus program, and lowered the macro security level in Excel. In effect, the old cat has unknowingly burnt its own whiskers!!
The spreadsheet loads without the usual errors and prompts, but I still didn’t get what I wanted. The blasted sheet hanged my Excel though I was able to use whatever other things on my PC. After a few tries, I gave up and killed the sheet, turned my anti-virus back on, and was pleased that there was no errors. To be sure that it is ok, I rebooted my system, crossed my fingers and hope that the anti-virus program didn’t get killed after that. Everything appears fine, but obviously, the old cat is on its way into a hole too small for itself.
It was after this that my anti-virus program gets quite busy. On startup, I suddenly get files in my ‘temp’ folder indicating that some trojans has been downloaded but stopped. Or sometimes it happens when I am surfing the net. I also get some odd stuff getting installed without my expressed permission, and zero byte .tmp files which I cannot delete, even in ‘Safe Mode’. I cleared them with my assortment of anti-malware tools several times, but there was a growing sense of impending doom and dread. I knew something remains uncleared and things are definitely not well on my system!
Matters got worst on the evening of 28 February. This time round a bogus anti-spyware called Spyware Falcon got downloaded and actually got installed. Windows Defender and Norman Anti-virus detected it, but it was already installed! While Windows Defender did ultimately clear it off, I am now definitely miserable.
Desperate, I downloaded Spyware Doctor, which well, detects a whole load more than my usual assortment of anti-spyware like Windows Defender, Spybot S&D, Ad-aware and Hijack this. It detected even more shit than I am aware existed in the system32 folder and the registry. But there is a drawback. Because it is a trial copy, I had to manually remove whatever was detected. I took a radical approach to the problem. I created files and renamed them to those which usually gets reinstated by the trojan, denied myself permissions to them, clean out everything under the keys created by the trojan using regedit, and did the same thing by denying myself permissions to them.
However, one problem did not go away. It is clear that Spyware Doctor has overlooked a very small part of the trojan which remained active. I knew it is there because the odd zero byte .tmp files are still there, and they remain undeletable with the usual ‘used by another process’ error message. I was getting a first hand experience of what ‘process injection’ means, and learnt that there are more than one way to get something loaded on startup without using the usual run key in the registry. This allows it to remain in memory undetected but I will not go into the technical details at this point of time. Now all I can do is just wait for the anti-virus warnings again to confirm my suspicions.
They didn’t come straight up when I start my computer, but they did come because I deliberately left my computer running overnight on 1 March and when I woke up the next morning on 2 March, I saw some of the usual shits restored to the system, and the usual anti-virus warnings that something has been caught. My fake files did block some of those trojans, but not very successfully. Some of them actually renamed themselves and came in with another name. Apparently, the trojan has the ability to fool the user or the person cleaning them into complacency for some time, before it makes a come back. I am now utterly desperate.
It was then I recalled Trojan Hunter, which an old friend Roy told me about the week before. I uninstalled the rest of my anti-spy software, since they were obviously not very useful in wiping out the junk and then downloaded Trojan Hunter and installed it for a 30-day trial as my last ditch attempt to clean up my system.
Trojan Hunter, didn’t seem very user-friendly at all. But I was impressed with the things it looked out for – e.g. ports that programs have opened – which most of the other programs didn’t even bother about. It caught everything which was caught before, plus a .dll file – which I have forgotten to note down the name. Unlike Spyware Doctor, and despite being a trial installation as well, it clean out the mess without even a fuss. It simply asked you if you want it to do so. Above which, it certainly lived up to what it claimed on its website – the most powerful trojan scanner on the market.
I am not saying that the other spyware detectors are not good nor am I doing a sales pitch for Trojan Hunter. First of all, all of them worked as they are intended to. The reason some thing actually went undetected was because I was dumb enough to lower the defenses in spite of having been warned. Had I not lower my guard in the first place, it would have been stopped there and then! I learnt my lesson and would simply like to share this experience so that no one else gets ‘老猫烧鬚’ again. I also wanted to point out that installing the common anti-spyware detectors after a spyware infection may not completely eliminate them on your system and bring to your knowledge this Trojan Hunter which perhaps isn’t very commonly known. Hopefully this neat tool will help save some of the guys doing desktop support out there the hassle of reinstalling Windows completely, and thus reduces user frustration with IT support.
