Dramatized for reading pleasure. It's over now and I'm in the fixing phase still.
ATTACKED! How Castoffpolite came back from a C Drive killing, probably a reformatting attack.
Howdy all,
I guess ya’all come to see what happened to this ole battle axe and her machine last week? Yeah, it happened on the 24 of January around 930 pm and it was not pretty.
If you have a relationship with your computer like I do with mine, you know the sound of it. You know the feel of the vibration through the desk and you can tell when something is wrong just by the sound. When you have an attack of the type that I did, the first thing, you’re surprised to hear your machine grunt, as I call it. You always hear it happens to someone else and you think, that could never happen to me. I am guilty of that very thought.
The next thing that happens is you look at your monitor then at your machine, and the C Drive light is just as solid and bright as the sun in the daytime. Then your monitor goes out and that leaves you thinking, “What the?” The next thing, your brain snaps into gear and you try to stop everything. (I’m not suggesting anyone do what I did, each situation is different.) I couldn’t reach the back of my machine from where I was sitting. Pair of scissors handy, SNAP! Internet connection gone! Yep, I cut the cable that connected my machine to the internet and left about 4 feet of cable hanging from my machine’s backside. Monitor still dark, C Drive still hyper active. I tried to shut it off using the power button. No good. While reaching for the main switch on the power strip, machine shut off. I did not turn it off, it shut down on its own. At this point I knew I took a hit but I had no idea how bad or what hit me.
Now, I am computer savvy, but not a geek, guru or whatever you folks out there wish to call yourselves, you folks that slide into a computer chassis and know what this and that is and what this and that does and can have a verbal conversation with a computer using ones and zeros.
At this stage of the game, I was wondering if I should take out the old drive and just replace it. What the heck, damage was already done, and I wasn’t going to be connecting to the internet right away, so and I tried to start my machine. I was amazed it actually came alive. I did not think it would.
Before this situation, I think I saw a page popup about TDSS, but I am not sure. It was present on my machine before the attack, but was not after. I really do not know what happened there.
Monitor came up, everything came up including a screen, pretty kaleidoscope colors in the background, a big yellow smiling face with fangs, a message that said F-O-A-D (if you don’t know the meaning of those letters you don’t need to know, it’s not a nice message), and a big yellow fist telling me I was number one. (I had a flashback, of 98 or 99, maybe early 2000, there was a critter virus going round that gave a picture of something and did all types of nasty things to your machine.) As soon as that disappeared, I was back to the default blue MS desktop, and my machine restarted on its own, again.
My system came up, and C Drive was calm again, my background then changed the default blue background, to a large picture of the Microsoft Media Player, play button. On my desktop all my files looked to be there, but when I clicked on them, there was no response except an error message that said, “No Dll’s installed”. I looked at my C Drive and it was empty. Everything was gone, only enough to start up the machine.
My mind was flying by then and I kept asking myself, “Did I backup my data before I went online after I closed my work?” I couldn’t remember if I did or not and then, my anger hit.
In fury, ugly words came across my tongue and out my mouth, so colorful and loud I got my husband’s attention over the taped TV show he was watching at the far end of the house. My verbal tirade was such the dogs ran away to another room. By the time hubby got to where I was, I was in tears, and I was still in the phase of a Scottish volcano spewing verbal magma out the hole I left in the ceiling of my house. At that point I just cried out my frustration and anger. Got it all out of my system as my hubby made his way silently back to his recorded TV show. There was nothing he could do, I am the tech person in our house. After 22 years of marriage, hubby knows when I am that angry and frustrated, the best thing is to leave me alone and let me get it out of my system.
With the fit over, and once again calm, I started to remember what I did that made me a target for this situation, where I was when this situation happened. I could not think of what I did to become a target of such an attack. I was on the HULU web site, watching that Monday’s taping of The View, when this situation happened. I have a paid for HULU account and was logged into my account, minding my own business when, WHAM, the program started stopping and starting, my machine almost jumped off my desktop when whatever it was punched through my AV protection and other locked doors I had on my machine and proceeded to eviscerate. Defecation happened fast and things went downhill from there.
I don’t know why, but I feel I was targeted. My hubby’s machine was on and this thing had to go through our router, but it did not bother his machine at all. I remember thinking it might have been Microsoft to force me to upgrade to their 7 OS. After all of this I was tired and physically worn out. It was after midnight my time and my brain at that point was mush, so I shut everything down and went to bed. There was nothing that could not wait until I got some sleep.
Tuesday, I got up and did a check of hubby’s machine, found it clean and ready to go. I hit the net looked for DLL or C Drive killing virus and all I could find was Kamikaze (sp). I’m not even sure that is the virus that got me. I came to Bleeping Computer to see if anyone else experienced anything of the type I did the night before. I did not go deep into the forums, so I did not read of anyone having the problem or a similarity in time line or situation. I sent a message to Eyesee gave her some information of the event and then went to work on my machine.
Now what I do is not for everyone, as I mentioned before I am computer savvy, and I know how to do certain things with my system that others might not with theirs, so what I do is not for everyone. What I did to correct the situation, was what I call a dip and strip, also known as a reformat and clean OS install. Although my machine started after the attack, I did not want to take the chance that the critter was still there. I reformatted my C Drive three times before I did an actual full install of my OS. Guess what I ran into while doing the full reinstall? Half way into full reinstall, monitor shut off again, C Drive hyperactive … no internet connection as there was still four feet of cable hanging from my machine. I shut everything down, removed the case and replaced my C Drive. Reformat and fresh install good after that. Current problems stemming from OS security patches, that I cannot seem to get anymore. That in itself makes me think it was a directed attack from Microsoft to force me to buy their 7 OS. The other stuff was cover to keep them unknown. I am probably wrong about that, but it is a thought that went through my mind.
My machine is designed and built by a local computer shop here. My current operating system is XP and after I replaced my internet cable, I went after AV download, updates, and drivers. With my motherboard, it takes a while to get all the drivers I need to make everything work because the downloads are huge.
With my security sort of feeling right, I contacted Trend about this situation, via phone and email. I needed to delete one machine to get a new AV download. On the phone to Trend, I told them what happened, and they checked something while I waited on hold. When they came back, THEY REQUESTED, I send them the C Drive from my machine. That is unusual, to have an AV company ask a customer to send them a C Drive. (While boxing it up, I got the feeling I should be wearing a full Hazmat suit and seal the drive in a bright orange contamination plastic bag.) Anyway, that drive is gone from my presence. Good luck Trend, you might need it with whatever is infecting that drive.
I contacted my ISP, and told them about the situation although there is nothing they can really do to help prevent this situation. I talked with the Tech there, told him what happened, and he is the one that suggested it was a reformatting virus of some sort. That's exactly what it did. Reformatted my hard drive.
To bring this major drama to a close, I am back, still do not have my machine up to my standards, it’s slow as molasses and I got a point of contention with an error message of “this computer does not meet minimum requirements”, when I try to get the drivers I need. I will continue to work at getting all my parts together.
As for my work, I did back up everything before I went online and became entwined with this drama moment. Set copies in several places online and on one of my stand alone storage drives. I am a writer, visual production assistant, and have need for security and privacy. So that is the end of my tale. If you wish, ask questions, I will answer as best I can.
Castoffpolite
Situtation Update:
Due to possible false report by Trend, it was suggested that I remove Trend and try different AV ware. I tried Avira. I am happy to report to all following this post, that Avira found two problems in my system and fixed them. Avira did not report any problems with hardware or MS updates, although there may still be a problem there, and I will go to another forum for assistance in that area. I feel more confident now than before that my machine is cleaner than it was.
End of this update, and on to the next problem solving situation.
Stay Tuned.
Castoffpolite
UPDATe on STRESS Factor;
Someone asked me in PM how I am handling this type of stress?
Answer, in a calm day I smoke maybe one pack in a 24 hour period. Today, I've smoked three packs in 8 hours. Very stressful for me and been this way since last week.
Castoffpolite
UPDATE
I am now over in the "Am I infected forum." I will work with them to make sure I am clean before moving on to deal with the possible hardware issue I think I have.
Stay Tuned, more to come on this current situation and follow up.
Castoffpolite
Edited by castoffpolite, 30 January 2011 - 06:47 PM.
This topic is locked
Back to top
