For sale: svchost.exe virus. Excellent condition!

Blogging is a little bit like working out. It's hard to get to the gym, but after a couple of workouts you can feel it in your muscles and it makes you want to go back and work out some more. With blogging, you get the feedback from the hits and the comments and so on, and it makes you want to post more. But when you fall out of it, you kinda lose that motivation a little bit. Or at least I do. Maybe it's a post-civic election slump. Post electoral depression. It's been a week since I've posted .. which isn't much .. but I've already lost that blogging mojo.

Work got in the way last week, as well as viruses. Computer viruses. Nasty ones. Ones that my virus program can't clean and that keep coming back like that damned cat.

They're sneaky little devils. They take on the same names as legitimate windows executables: svchost.exe, shell.exe, dwm.exe, etc.. except they locate themselves in the application data of your windows profile, and other places they're not supposed to be. You can delete them, but then seconds later they're back. My Trend Micro would usually block them, but that meant a warning box was popping up literally every 3 or 4 seconds saying that something was blocked, and then another window would pop up saying svchost.exe failed to initialize.

That's annoying.

I would run my virus scan, and it did catch and quarantine a few of them, but not all. And it can't clean the quarantined files either. I tired manually deleting the bad files from safe mode, but that works for all of 18 nanoseconds. I tried running Spybot Serach & Destroy, but it mostly finds bad cookies and that sort of thing. It might have helped a little. Then I ran the CCleaner registry cleaner in the hope of cleaning whatever registry entries were causing these stupid little things to keep coming back. Then I tried Combofix. Then I tried running Trend Micro from safe mode.

Then I rebooted and I still had the Goddamned viruses.

Then I turned to the internet. Not very helpful. A bunch of sites try to get you to buy their phony product with phony reviews ("I downloaded it and now everything is perfect!") when the program you're downloading is probably loaded with more viruses than a refugee ship from Burma. There are also some sites that tell you to clean them manually by deleting autorun.ini and other files from your System32 directory, and then going into Regedit and deleting a bunch of lines in there.

Uhm. No. You first.

I finally got rid of them (I think ... mostly ...) using an internet scanner from Trend Micro called Housecall. Seemed to work well. Which makes me wonder why the Trend Micro program on my computer that I pay for can't do the same thing.

So that was my weekend. Thanks for humouring me, as I attempt to get back into the blogging groove by sharing my problems with the world.