It’s been an interesting couple of days, by which I mean bad. After almost ten years of working as a technician including for both the University of Wisconsin and now here in Amman, I was (almost) beaten down by a virus. A particularly nasty one.

When I taught my class, I would always teach my students about one virus in particular, the one named after a particularly nasty nuclear reactor explosion, the W32/Chernobyl virus which could actually eat into your computer’s BIOS and then tell it to overwrite itself into blankness. Unless you happened to have a BIOS flash programmer and the wherewithal to undo the solder joints holding the BIOS chip in place…this usually meant a completely fried motherboard, resulting in a new purchase. How many other viruses have you heard of that can actually physically damage computers? Not too many.
The one that has now merrily written itself all over my laptop’s hard drive is called the W32/Sality, variant AQ or AN, depending on which vendor you ask (in fact, it may even be something entirely new, which I’ll get to later). The Sality is one of the infamous types known as “Patching Viruses,” and their methods of spreading and eluding deletion are diabolical. Basically, a patching virus does exactly what it sounds like. When you hear of someone “patching” their own computer, it usually means with updates, like Windows Update, which overwrites or updates program and system files with newer, better versions. Sality does the same, except replace “better” with “evil.” It is able to actually insert its own viral code into a program’s .EXE file, which is how 99% of standard Windows applications start themselves up. Does this sound familiar? Once the program, any program’s .EXE file is affected, like Firefox.exe or Mspaint.exe, the sality writes itself into the last section of the .EXE file’s code and runs itself whenever that .EXE is run. Since almost every application, including antivirus systems, on a Windows computer is made of EXE files, this can be a problem.
To put it bluntly, there is 100% no way to remove this virus from within Windows. It’s impossible. Every time you try to scan it, it will merely eat your scanner and turn it into an infected virus-loader. The only possible chance to fight it is to use a program which can “disinfect” these viruses, but it has to be outside of the normal Windows operating system, preferably in a Linux boot CD that is immune to .EXE harvesting. I’ve always generically titled these systems “Alternative Boot Environments” or A.B.E. – or just ABE, for short (patent pending). Dr Web’s cleaner boot CD is particularly good ABE for evading .EXE patching. You have to be careful not to use a ham-fisted antivirus program that merely deletes everything it finds as a virus, because that would now mean deleting every program on your computer and somewhere a virus-writer would cackle with glee.
So how did this happen to a guy like me, with a decade of experience in the field? Well, I’ll be completely honest and tell you that I haven’t used antivirus programs in years on my personal computers, desktops or laptops. Don’t get me wrong; in my years at DoIT in Madison and working as a consultant, I have always been extremely diligent in making sure that computers are protected. But I always figured that antivirus programs are for people who make bad decisions and let their computers get infected.
And guess what? I’m still right…that’s exactly who they’re for. But this virus, Sality, outsmarted me for a split-second and that was all it took. I was down in Ayn al Basha doing some work on some photos for the Entity Green Training website with Lillie. I had made a shared folder on my laptop for her, named “Lillie” and we were passing around photos that needed to be re-sized for web use. I noticed a strange folder on my computer I didn’t remember making there, and figured that since she had write access to my computer’s shared folders, she had just made it. I didn’t notice until a second after I double-clicked it that the folder “icon” was a pixelated application icon, shaped like a Windows folder, and even more foolishly, that it was named Lillie.exe…not “Lillie” like a folder should be. I’m lucky that I had the “show file extensions” enabled on my computer – I still think that Microsoft disabling those by default is the dumbest thing in their history as software writers – otherwise, there would have been almost no way to visibly recognize this as a virus. It would have merely said “Lillie” and looked like a folder.
Seconds after I double-clicked that fateful file, my computer immediately betrayed signs that it was going into action. The hard drive spun up over my knee, the CPU usage shot up, and everything briefly slowed. Before I even drew my next breath I knew what I’d done and probably filled the air with a few expletives. It was too late by now, of course. The Sality had taken my computer, and now it was going to be a fight to the death, between the virus and my operating system. As many as 5/6 Sality infections result in the user or technician giving up and reformatting the computer. Literally, this was going to be a fight to the death – either I’d remove the virus, or the operating system would be erased to take it out.
Let’s go over the symptoms that have made me respect this fearful beast below:




