Watch as a modern PC gets Windows 1.0 installed, and upgraded through every major version up to Windows 7. Not sure what's more amazing; that this screencast is possible today in a VMware virtual machine, or that applications installed in Windows 3.1 still worked through every upgrade to Windows 7, representing nearly 20 years of compatibility. (via kottke)

So, armed with a thumbdrive loaded with Firefox and AdAware installation files, I headed over there to take a look. Here's what I found:

• The Norton AV trial subscription that came with Windows XP had expired and stopped protecting the machine, which was connected directly to my friend's broadband ISP with Windows Firewall turned off.
• Windows XP hadn't been updated since before SP2 had come out, because a friend of my friend told him not to trust any automatic updates. Because they might be spyware.
• Rogue software called XP AntiSpyware had taken over the machine.

AntiSpyware XP was the problem that prompted my friend to call, and it was the most hostile, insidious, and difficult-to-kill malware I've ever seen. It looked completely authentic and felt impossible to stop. Masquerading as a spyware killer itself, in the system tray, its icon was an almost perfect replica of the Windows Security Center icon. When you tried to visit a web site in Internet Explorer or do much of anything, XP AntiSpyware launched, and its window looked just like Windows Security Center. Once launched, it would start scanning your PC automatically, and tell you, in alarming red pop-ups, that dozens of files were infected and that you should delete them. There was no quit, there was no uninstallation available in Add/Remove Programs, and all the program's options in its Settings area were grayed out/disabled. If you tried to run the real Windows Security Center or a program like AdAware, AntiSpyware would show up instead and start scanning again. If you tried to launch the Windows Task Manager (with Ctrl+Alt+Del), a message came up saying your computer administrator had disabled it--even though I was logged on as an administrator. There was no way to tell what startup entry the program was in msconfig, and when I restarted Windows in Safe Mode (F8 during boot) and tried to launch AdAware, this software started instead.

What a mess.

To fix it, I installed Chrome (which came bundled with AdAware). While AdAware itself wouldn't launch, Chrome thankfully would, and after some Googling, I found this lifesaving article, which describes what "XP AntiSpyware" really is:

During installation, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will configure itself to run automatically every time when you run any program that have “exe” extension (99% of Windows applications). The rogue also uses this method of running to block the ability to run any programs, including antivirus and antispyware applications.

When XP AntiSpyware 2010 (XP Antivirus Pro 2010) is started, it will perform a system scan and detect a large amount of infections. All of these infections are fake, so you can safely ignore them. What is more, while the rogue is running, it will display various fake security warning and notifications from Windows task bar that have “Spyware infection has been found” or “Tracking software found” header. However, all of these alerts are fake and like false scan results should be ignored.

Last but not least, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will hijack Internet Explorer and Firefox and display fake warnings when you opening a web site.

The solution was two-fold: first, you had to do a manual registry edit that stopped the program from starting in place of AdAware or any other spyware scanner. The lifesaving article had the registry fix-it entries, which I will reprint here for posterity.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

Here's what I did: I backed up the Windows registry, copied this text into Notepad, saved the file as fixme.reg, double-clicked it to apply the changes, and restarted Windows. Only then did I get the first sign of progress: once the registry was fixed, Internet Explorer was actually able to load web pages. Sweet.

Second, you had install a real spyware killer to kill XP AntiSpyware. (Imagine me trying to explain this to my computer illiterate friend. By now his eyes were glazed over.) Microsoft Security Essentials didn't detect it. At the article's suggestion, I installed Malwarebytes Anti-Malware and scanned away, cleaning off everything it found, including AntiSpyware.

From there the machine was usable, but still not ready for primetime. I ran Windows Update and got the machine Service Pack 3 and all the updates beyond that. (That alone was an hour and a half of progress bars and restarts. Did I mention this was a slow, year-and-a-half old HP PC from Costco?) I turned on Windows Firewall, and set up Microsoft Security Essentials. I uninstalled Norton AV to get rid of its nagging pop-ups, and because my friend said that Windows was slow to start up, I ran msconfig and unchecked the stuff he didn't need to start up automatically (Java, Quicktime, and some other annoying "helper" apps). When I was done, the machine was speedier, usable, and not littered with both legit and malicious system tray pop-ups about infected files and software updates.

If I had more time, I would have formatted the hard drive and reinstalled Windows from scratch, and then installed a hardware router with a firewall on it between the computer and his cable modem. At any rate, I advised my friend to change all of his passwords before he did anything else on the machine.

Then, I tried to explain to him that some notifications and updates (like Windows Updates) are good and needed and he should get them, and others are malware trying to get his money (like Antispyware XP). But how does someone like him know the difference?

If you're dealing with a malware situation and simply installing a spyware cleaner like AdAware ain't working, you may have to Google the specific problem you're having, like I did. Otherwise, check out my published-in-2006-but-still-holds-up article on cleaning your computer illiterate relatives' and friends' PCs, How to fix Mom and Dad's computer.

UPDATE: I should point out that the screenshot included in this post is NOT from the machine I cleaned, and it looks slightly different. My guy's PC must have had a different version of AntiSpyware, which seems to exist in many incarnations. However, if you click on the screenshot above you'll see a pretty funny typo--"Protect your Widows PC."

I admit: since my desktop is behind my router's firewall and I'm super-careful about what I do on it, I haven't run AV or spyware blocking utilities on my PC in years--without a single problem. Happily MSE gave it a clean bill of health. It didn't try to upsell me for a paid subscription, and it didn't report that it quarantined harmless browser cookies (a common red herring that malware cleaners use to make you think they're saving you). While security experts who make their living selling you this kind of software will tell you not to depend entirely on it, I'll replace AVG Free on Grandpa's computer with this this weekend. Kudos to Microsoft for finally offering malware protection at the right price.

Microsoft Security Essentials [Microsoft]

I've got to be conversant with many operating systems, so right now I'm triple-booting XP, Vista, and Windows 7 on my PC (not to mention using OS X on my MacBook Pro). This is definitely overkill for non-tech writers, but I do think it's a good idea for power users to separate their data onto a standalone partition.

This morning at Lifehacker I ran down exactly how to do that, and what the benefits and drawbacks are. Here's the full article: How to separate your data from Windows on a standalone partition.

Install MinTTY either in Cygwin's setup (find it under Shells) or get the standalone download from MinTTY's homepage. The downside to MinTTY? It doesn't include a tabbed interface and the developer doesn't plan to add tabs, either. Still, MinTTY's a big upgrade for anyone who spends time with Cygwin. After MinTTY's installed, choose its shortcut instead of Cygwin's from your Start menu. MinTTY is a free download that works with Cygwin for Windows only.

If beginners are interested in learning a bit about Unix through Cygwin, check out my three-part series of tutorials published over at Lifehacker:

• Introduction to Cygwin, part I
• Introduction to Cygwin, part II - More useful commands
• Introduction to Cygwin, Part III - Scripts, packages and more