The Windows 7 Black Screen Debacle

You might have seen the deluge of stories about the so-called “black screen of death” affecting Windows 7 computers recently. 

First off: there really isn’t any “death” involved.  The cursor works, the keyboard works, the Task Manager works, just the desktop and shortcuts don’t display.  That’s it. 

Secondly: it’s not due to a bad patch, as has been touted to death (the only “death” involved here after all, is the press going berzerk and reprinting lies to death).

The actual “attack vector” is by way of a web popup ad that says “your computer may be infected with malware!  click here to remove it now!”, which my daughter fell for.

The malware installs itself as a “anti malware” application, with a peculiar name (randomly defined it seems), but which appears in the Add/Remove Programs list (dumb move on their part).  It reconfigures the firewall settings and turns off the Microsoft Security Essentials service, so real-time scanning was disabled.  I was able to clean it out and get the machine back to normal state.  No rootkits or leftovers appear to be on it and it doesn’t appear to have propagated to other computers or shares.

I know, because it affected one of my home computers.  The actual cause was malware.  That’s right: malware.  But actually, that’s not the “root cause”.  The root cause was an oversight on my part.  I added my daughter’s user account into the local Administrators group so she could install some games while I was away.  Bad decision.  Normally, I would not have done that and would have made her ask me to install them when I was at home.  I got lazy. 

Other people I’ve talked to who have run into this have either encountered it the same way, or by tuning UAC down until it’s useless.  Leave UAC alone!  It works fine!  UAC is the lock on the front door of your house/apartment.  Sure, it sucks at times to whip your keys out and unlock with a load of groceries, but does it make sense to remove the lock for that reason?!  Hell no!  People that whine about UAC are just whiners.  Get over it.  It’s for YOUR own good so, whatever…

Book Review: Rootkits

"Rootkits / Subverting the Windows Kernel" 

by Greg Hoglund and James Butler. Addison-Wesley, ISBN 978-0-321-29431-9

I just finished reading this book and I have to say it was worth the time.  This is one of the best technical books I've read mainly because it strikes a good balance of leading you into the topic and then gradually immersing you neck deep in C coding examples, Assembler and excellent diagrams of all of the conceptual models.  

Aside from mundane exercises in college, this was the first time I've seen double-linked lists explained in a way that makes them seem useful and practical.  This is of course talking about Windows kernel process, and thread constructs.  It dives into kernel hooking, driver and process issues, circumventing NIDS and HIDS detection methods, and strategies for a wide range of alternative insertion vectors and stealth techniques.  It is written well enough to allow even a non-programmer to grasp the conceptual aspects, yet provides enough examples to entertain the inner geek.