Our weakness is that the tendency to slide into this sort of nonsense was already there.  “The terrorists have already won” reaction really is saying “the terrorists exploited a tendency that was there, ready to come out under the right provocation, or perhaps eventually under no provocation at all.”

I greet tomorrow’s anniversary with my horror at the carnage, destruction, and savage evil of it all having morphed into horror at the lost opportunity of it all.  Unless you’re talking opportunity presented to those who would enfeeble us because power feels good and a cowed populace makes things so much easier.

If you see a whirling dust eddy in the right location, it might just be the troubled spinning of graveless heroes and victims.

It turned out the malware affliction was a variant of this lovely thing.  I had a certain amount of fun, because I located the files that contained the user’s recent web browser keystrokes, including his webmail URL, name and password, and all the most recent actions, including what I had done in the registry and such since sitting down.  I’d heard of viruses or spyware designed to log keystrokes and transmit the info, but I’d never encountered one or seen direct evidence that’s what it was.

When I hit the registry, the most recently modified key was now blank “run once” under HKCU (hkey_current_user), so obviously something had been planted there and had a chance to deploy and clear on reboot.  The run key under HKLM (hkey_local_machine) had five items, only one of them legit.  One of them was winlogin.  It and one other put themselves back as soon as they were cleared.

The file I recognized as not right in processes was ieredir.exe, which I was able to get rid of.  Searching on it later told me this was Briz-F or a variant and allowed me to learn more.

The symptoms he was having were that Firefox would not run at all.  Double-click and it goes away instantly.  Internet Explorer would run but not work.  Other things started hanging and not working, including eventually Word.

Fishing through files on the system, I found it was apparently spoofing explorer.exe with its own version, which would explain a lot.  Ugly.

He went home.  I left it for today, filled with joy at having that much extra to do this weekend.  A cleanup of that sort could take hours.  Afterward I looked at proxy server logs and found since about 10:00 AM the machine had periodically talked to a suspicious sounding .info URL and a URL ending in .org that otherwise sounded like it could be a credit union site.  The latter appears to make you think that it is doing a windows update.

So, remember I had Sadie with me?  She is so good!  It’s as if she has a built-in sense of decorum.  The whole time I worked on that computer, she hung out in that office quietly, chewing on a big pretzel the lawyer gave her and waiting patiently for me.  Periodically one of her admiring public would come to the door to say hi to her.

Then we went over to the server room, which is more of a closet.  She sits in there with me and touches nothing she shouldn’t.  This in a place where she could easily reach out and rip the spaghetti of little phone wires from their contacts.  There’s a toolbox she uses as a chair, and someone left a doorknob kit on the floor next to the door, so she plays with the pieces of that.

Then she got a big purple lollipop from the receptionist on our way down to my office, and for the little while we were there she ate the lollipop and played with her computer and a couple of small toys that live there.

She was sooooo good!  I know she is generally, but it still amazes me.  I still couldn’t take her for a whole day of intense work in the client’s offices, but it’s nice that I can take her for a couple hours or more and not have to worry much.

And one of the two of them in their room.  Sadie is wearing her cutely garish dress that is her Favorite Outfit Ever.  She had caught sight of it in the clean laundry, insisted on wearing it and using the white part as a food catcher per usual, and then insisted on sleeping in it too.

To the degree that Sadie is… a bit odd… Valerie has been possibly the best thing ever to happen to her.

Speaking of being younger, seeing the abbreviation MMF reminds me of the days when we’d all go to Applebee’s periodically after work, or have going away parties there for departing colleagues.  In the early days, the usual bartender was a young woman named Jody.  I was introduced to a drink that was a specialty of hers, best ordered when she was there because nobody else could make it half as well.  It was called a Mongolian Motherfucker, or MMF for short.  It amused the waitresses sometimes to make me ask for it by its full name, rather than its initials.  It was delicious, but very strong, based on Midori, with whatever the blue stuff is called, a couple other alcohols, and I think a bit of sour mix as the only thing that wasn’t alcohol in it.  My alternate drink of choice at the time was their amazing frozen mudslides, better than I have had anywhere else, and probably about 1500 calories each.  Somewhere among my non-digital pictures I have one of our bartender buddy sitting on the lap of one of my colleagues.  Those were the days.

If you are entering anyway, you might keep that in mind.  If you weren’t planning to enter but have something that fits, send it on in.  Even if you don’t blog yourself, but see an entry that lends itself to inclusion, go ahead and submit it.

How to enter a post.

Alternatively or additionally, you might consider purchasing a copy of the newly released novel by Dean Esmay and John Eddy, Methuselah’s Daughter, which I am assured remains available as a signed, limited edition hardcover first printing.  I was lucky enough to be one of those getting advance installments to review as they were completed.  It’s been edited and modified since, but I liked what I saw and look forward to reading it all in one not-on-screen pass.  If the special hardcover is too costly for you, despite its special nature, the paperback should be available Real Soon Now through typical bookseller channels.

The blog of Methuselah’s Daughter.
An excerpt
Another excerpt
Testemonials