blarg?

A couple of hundred people have read my SystemNT fix, which makes me feel good. The fact that I had to write it at all doesn’t, but that’s life; as a Windows administrator I am convinced, much like those lunatic anorexics, that having to reboot thirty or forty times a day isn’t a “disease”; it’s actually a “lifestyle choice”.

I’ve got to tell you, though, that I’ve had to read this sentence an awful lot recently:

Important Customers who have deployed Windows XP Service Pack 2 RC2 are not at risk.

Really. Great.

Dear Microsoft: Fuck you, too. I’m running production machines here, and if I install a beta service pack on my production machines, I’m sure that knowing that they are not at risk from this particular threat will be a great consolation to me while I’m sitting at home without a job.

A printable version of these instructions is now available here. It was last updated June 28, 12:15 PM EST.

This blog entry and that document will be updated whenever new information is available.

Two machines at work today have been infected with something that I can’t find any documentation about. The symptoms, for us, are pornographic IE popups and a system that quickly bogs down to an unusable crawl. Other reported symptoms include increased activity on port 445 and missing administrative or hidden shares (any shares with “$” in their names) from servers.

The culprit seems to be a program called “systemnt.exe”, which you’ll be able to find in c:\windows\system32\ where it is concealed as a system/hidden/readonly file. There are a raft of registry keys pointing at that program, all of which are quickly reinserted into the registry if they’re deleted while it’s running. It won’t show up with a simple file search.

It was discovered running on two machines, one Windows 2000 Server and one XP Pro, both of which were fully patched as of about a week ago. On the 2000 machine, it couldn’t be shut down even in safe mode, because somebody (God, I wish I knew who) was logged in as administrator and, well, apparently something bad happened.

I don’t know what the infection vector is, or fully understand what’s going on. I’m not an expert at this
security analyst gig; I might be a talented amateur.

I’m currently terrified.

I was doing this whole WinAdmin job during the CodeRed, MSBlast and Sasser breakouts, and I hated every minute of it. I’d like to think that I’m being paranoid, but this smells like something new, and something that’s going to get ugly very, very quickly.

Boy, being wrong about this would feel great.

UPDATE: Systemnt.exe is a backdoor trojan, a worm that exploits several known security holes in NT-based systems to install itself remotely. Once you find out that it’s running on the system, you must not log in to that machine as administrator directly. If you do, the program will use your privileges to install itself as a service, which will be running as LOCAL_MACHINE after the next reboot. Instead, follow the following steps:

As of June 28th, the latest updates from all major antivirus vendors
should include protection against systemnt.exe.

If you have more information, or another technique that works, please leave a note in the comments. Again, a printable version of this information is available here.

“I’m sorry to have written you a four-page letter”, the old saw goes, “but I did not have the time to write you a one-page letter.” Well, at the famous Ecole de la Grande Blarg, we strive every day to push back the limits of sensical narrative, straining metaphor to the breaking point and pushing platitudes past cliche and even absurdity until they disconnect from meaning completely. The day’s effort of distilling a chapter down to a single page is as nothing, a piffling use of our narrative might; today I am pleased to report that I have taken this process miles further than had previously been thought possible: I have taken a full week’s experiences, literally reams of fuming bile and florid invective, and distilled it down to its consequential essence: nothing at all.

Take that, pedants. Furthermore, Ha!

Today, I found out via Scientific American that Microsoft has assembled one of the biggest braintrusts the world of computers has ever seen.

That’s nice. I’ve heard a rumor that in Germany they have one long, elaborate compound word that means, roughly, “stabbed in the colon by a service pack.”

This week, Outlook (not even the hellspawned Outlook Express) fucked two of my users over in a way that’s almost completely undocumented (that Microsoft apparently doesn’t even know about). Yesterday, and I swear to God this is true, I had to rebuild an XP box from scratch because a toolbar was in the wrong corner of the screen when I shut it down, making logging in again impossible. If it had been in the other corner of the screen, I apparently would have been fine.

People ask me why I keep using Linux, enormous pain in the ass that it is, and it’s simple: at least I can change it. Microsoft products steal time from me over and over again in ways that are completely immutable and too stupid to forgive; little, counterintuitive things, like not being able to logout without closing Office first, and big ones like the fact that “repairing” and “reinstalling” are exactly the same thing, even if it’s a single problem registry entry or corrupted file. Obscure configuration options, counterintuitive, hidden or outright idiotic options, bizzare, outlandish error messages, half-assed documentation and, my God, a set of tools so clownish that my days feel like I’m trying to put out a fire with a bucket full of confetti.

I absolutely fucking hate it when things that used to be trivially easy become hard or impossible, and that gets called progress. I’m glad Microsoft is innovating; innovation is great, I love neat new things. But if the people implementing those shiny new toys, are the same people they’ve got boning the process now, all that’s going to come out of it is a bunch of second-rate
shiny, knockoffs for which no originals exist.