Learning to hate Microsoft
Yesterday I installed Microsoft Windows XP Professional. Did I pay for it? No, I didn’t. But I bought their Home edition of the same OS. Well, actually, I really didn’t have any choice, it came with my computer. And XP Home didn’t work very well, as I told you yesterday and the day before that. So, if they can’t sell me a piece of software that works properly, I’ll just have to steal one that does.
I realize that if you take the same logic and talk about other things, like for instance cars, it sounds a little bit far out: “Your economy car just broke down, so I’ll just steal your luxury model”. But XP ain’t like a car. Cars don’t get worms. XP does.
After having installed XP and downloaded a butt load of critical updates, I went home and set up my laptop just to check if I’d been able to install and configure the WLAN card correctly. I had, indeed, and everything worked fine. I also noticed that there was constant upload activity on the network card, and that was a tad strange, since I wasn’t really doing anything. A tiny program called DLLHOST.EXE was hammering the network, and I kinda wondered why the hell it was doing just that. A quick search on Google showed that the program is “the DCOM DLL Host process supports DLL based COM objects and is used by many Windows programs.” So, no worries, then, it’s just Microsoft sending some packages back to Redmond, probably a few passwords, bank account numbers and things like that. But we trust Microsoft, don’t we?
I really didn’t care much about it until I got home this evening. The process was still going wild, stealing almost all of my upload capacity. So, I downloaded and installed ZoneAlarm (free application, if you don’t have it installed, you should do it now) to try to figure out what the little bugger really was up to.
Hey, it’s scanning the IP range of my local network. Well, that’s kind of interesting, isn’t it? Click, click, click. DLLHOST.EXE traffic blocked.
A quick scan with AVG Anti-Viris revealed that DLLHOST.EXE wasn’t a Microsoft thingy after all, it was the W32/Nachi.A worm working the graveyard shift. It was able to infiltrate my computer through one of two vulnerabilities in XP. But how could this have happened? I’m constantly installing security patches. And I’ve got the two critical updates fixing the vulnerabilities installed on my laptop. The answer is quite simple: For about an hour when I was installing Windows, I was wide open for attack, having no updates installed.
One hour was all it took and I was infected. Yay for Microsoft! Again!
Feedback
Do you have any thoughts you want to share? A question, maybe? Or is something in this post just plainly wrong? Then please send an e-mail to vegard at vegard dot net with your input. You can also use any of the other points of contact listed on the About page.
HallvardHAA-HAA(like the kid in simpsons)
.beldinLinux :) .. yes,yes,, I know.. you can’t ditch windoze because all of this shit you use at work.. WHATEVER.. :P
klasyay for firewalls! I can also recommend ZoneAlarm. its a great firewall even though it makes you a little paranoid. My ports are scanned between every 6 and 20 minutes, 24/7. the majority of all these are not worms, viruser and such, but it is still annoying.
Well, everything is back to normal now. I’ve got all my bandwidth back.
Tor-ErikYou could have used MS "ingame" firewall. At least it gives you some protection. And then after all the MS updates you could have downloaded ZoneAlarm or another FW… disconnected the network… disabled MS FW and installed ZoneAlarm… then connected the network again….
Yeah, I know… much work… but hey, it helps…. (learned the hard way)
I’m not sure if using the firewall would’ve helped much. I was connected to the NRK WAN at the time and I’m don’t know how good the Microsoft firewall is against OS security flaws (W32/Nachi.A uses the DCOM RPC and WebDAV vulnerabilities to spread).
If Windows wasn’t like a Swiss cheese when you install a fresh $269.99 copy of it, this wouldn’t have been a real problem in the first place.
ianwait a second… learning to hate microsoft? and there i was thinking it was just a basic human instinct…
:P
That sure is a good point. But hate is such a strong word. Right now I just dislike Microsoft. But I’m leaning heavily towards hate.
